Require a distribution for registry-pushed content RBAC checks.

Distribution consumers may only filter content by repository_version on
container repositories that have no remote and are tied to a distribution.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: gerrod3

pulp_container/app/viewsets.py

@@ -173,18 +173,22 @@ def _repo_query_params(self, request, view, push_perm, mirror_perm):
                         mirror_perm, repo
                     ):
                         repo_pks.append(repo.pk)
-                    elif not repo.remote and (
-                        request.user.has_perm(push_perm)
-                        or any(
-                            request.user.has_perm(push_perm, dist.cast())
-                            or (
-                                dist.cast().namespace
-                                and request.user.has_perm(
-                                    "container.namespace_view_containerdistribution",
-                                    dist.cast().namespace,
+                    elif (
+                        repo.remote_id is None
+                        and repo.distributions.exists()
+                        and (
+                            request.user.has_perm(push_perm)
+                            or any(
+                                request.user.has_perm(push_perm, dist.cast())
+                                or (
+                                    dist.cast().namespace
+                                    and request.user.has_perm(
+                                        "container.namespace_view_containerdistribution",
+                                        dist.cast().namespace,
+                                    )
                                 )
+                                for dist in repo.distributions.all()
                             )
-                            for dist in repo.distributions.all()
                         )
                     ):
                         repo_pks.append(repo.pk)