devpi-server 6.11.0__tar.gz → 6.12.0__tar.gz

{devpi_server-6.11.0 → devpi_server-6.12.0}/CHANGELOG

@@ -2,6 +2,25 @@
 
 .. towncrier release notes start
 
+6.12.0 (2024-06-25)
+===================
+
+Features
+--------
+
+- Added ``devpiserver_on_toxresult_store`` hook to allow blocking or skipping a toxresult upload on more specific conditions as ``acl_toxresult_upload`` would allow.
+
+- Added ``devpiserver_on_toxresult_upload_forbidden`` hook to allow returning a custom message and result (403 or 200).
+
+
+
+Bug Fixes
+---------
+
+- Return json data if toxresult upload is forbidden.
+
+
+
 6.11.0 (2024-04-20)
 ===================
 

{devpi_server-6.11.0 → devpi_server-6.12.0}/CHANGELOG.short.rst

@@ -9,6 +9,27 @@ Changelog
 
 .. towncrier release notes start
 
+6.11.0 (2024-04-20)
+===================
+
+Features
+--------
+
+- The ``devpi-fsck`` script now returns an error code when there have been missing files or checksum errors.
+
+- Fix #983: Add plugin hook for mirror authentication header.
+
+
+
+Bug Fixes
+---------
+
+- Preserve last modified of docs and toxresults during export/import.
+
+- Fix #1033: Use ``int`` for ``--mirror-cache-expiry`` to fix value of ``proxy_cache_valid`` in nginx caching config.
+
+
+
 6.10.0 (2023-12-19)
 ===================
 
@@ -74,22 +95,3 @@ Bug Fixes
 
 - Fix wrong hash metadata introduced in 6.5.0 for toxresults which prevents replication. The metadata can be fixed by an export/import cycle.
 
-
-6.8.0 (2022-12-05)
-==================
-
-Features
---------
-
-- Fix #929: Cache normalized project names per transaction on mirror index instances.
-
-
-Bug Fixes
----------
-
-- Fix #914: add locking to list_projects_perstage of mirror indexes to prevent multiple slow concurrent updates of the full project name list.
-
-- Catch exceptions in async_httpget analog to httpget.
-
-- Add locking to mirror name cache to prevent race condition on updates.
-

{devpi_server-6.11.0 → devpi_server-6.12.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devpi-server
-Version: 6.11.0
+Version: 6.12.0
 Summary: devpi-server: reliable private and pypi.org caching server
 Home-page: https://devpi.net
 Maintainer: Florian Schulze
@@ -119,6 +119,25 @@ Changelog
 
 .. towncrier release notes start
 
+6.12.0 (2024-06-25)
+===================
+
+Features
+--------
+
+- Added ``devpiserver_on_toxresult_store`` hook to allow blocking or skipping a toxresult upload on more specific conditions as ``acl_toxresult_upload`` would allow.
+
+- Added ``devpiserver_on_toxresult_upload_forbidden`` hook to allow returning a custom message and result (403 or 200).
+
+
+
+Bug Fixes
+---------
+
+- Return json data if toxresult upload is forbidden.
+
+
+
 6.11.0 (2024-04-20)
 ===================
 
@@ -180,28 +199,3 @@ Bug Fixes
 
 - Fix #980: Remove long deprecated backward compatibility for old pluggy versions to fix error with pluggy 1.1.0.
 
-
-6.9.0 (2023-05-23)
-==================
-
-Features
---------
-
-- Support export directory layout for ``--replica-file-search-path`` option.
-
-- Fix #931: Add ``mirror_no_project_list`` setting for mirror indexes that have no full project list like google cloud artifacts or if you want to prevent downloading the full list for huge indexes like PyPI.
-
-
-Bug Fixes
----------
-
-- Keep a reference to async tasks to avoid their removal mid execution.
-
-- Support changed default of ``enforce_content_length`` in urllib3 >= 2.
-
-- Fix #934: Properly set PATH_INFO when outside URL is used with sub-path.
-
-- Fix #945: Adapt FatalError to be usable as an async HTTP response when updating a project on a mirror.
-
-- Fix wrong hash metadata introduced in 6.5.0 for toxresults which prevents replication. The metadata can be fixed by an export/import cycle.
-

devpi_server-6.12.0/devpi_server/__init__.py

@@ -0,0 +1 @@
+__version__ = '6.12.0'

{devpi_server-6.11.0 → devpi_server-6.12.0}/devpi_server/hookspecs.py

@@ -1,5 +1,13 @@
-
+from __future__ import annotations
 from pluggy import HookspecMarker
+from typing import Optional
+from typing import TYPE_CHECKING
+
+
+if TYPE_CHECKING:
+    from devpi_server.views import ToxResultHandling
+    from pyramid.request import Request
+
 
 hookspec = HookspecMarker("devpiserver")
 
@@ -255,6 +263,28 @@ def devpiserver_on_replicated_file(stage, project, version, link, serial, back_s
     """Called when a file was downloaded from master on replica."""
 
 
+@hookspec(firstresult=True)
+def devpiserver_on_toxresult_store(request: Request, tox_result_handling: ToxResultHandling) -> Optional[ToxResultHandling]:
+    """Called when a toxresult is about to be stored.
+
+    Stops at first non-None result.
+
+    :returns: A ToxResultHandling object which determines how the upload is processed.
+    """
+
+
+@hookspec(firstresult=True)
+def devpiserver_on_toxresult_upload_forbidden(request: Request, tox_result_handling: ToxResultHandling) -> Optional[str]:
+    """Called when the permission check for toxresult upload failed.
+
+    Stops at first non-None result.
+
+    :returns: A ToxResultHandling object which determines whether an error
+    with message (default using ``block``) or a success with a message
+    (using ``skip``) is returned.
+    """
+
+
 @hookspec
 def devpiserver_metrics(request):
     """ called for status view.

{devpi_server-6.11.0 → devpi_server-6.12.0}/devpi_server/views.py

@@ -1,3 +1,4 @@
+from __future__ import annotations
 import contextlib
 import os
 import re
@@ -50,6 +51,7 @@ from .readonly import get_mutable_deepcopy
 from .log import thread_push_log, thread_pop_log, threadlog
 
 from .auth import Auth
+import attrs
 
 devpiweb_hookimpl = HookimplMarker("devpiweb")
 server_version = devpi_server.__version__
@@ -412,6 +414,34 @@ def devpiserver_authcheck_forbidden(request):
         return True
 
 
+TOXRESULT_UPLOAD_FORBIDDEN = (
+    "No permission to upload tox results. "
+    "You can use the devpi test --no-upload option to skip the upload.")
+
+
+@attrs.define(frozen=True)
+class ToxResultHandling:
+    _block: bool = attrs.field(default=False, alias="_block")
+    _skip: bool = attrs.field(default=False, alias="_skip")
+    msg: None | str = None
+
+    def block(self, msg=TOXRESULT_UPLOAD_FORBIDDEN):
+        return ToxResultHandling(_block=True, msg=msg)
+
+    def skip(self, msg=None):
+        return ToxResultHandling(_skip=True, msg=msg)
+
+
+@hookimpl(trylast=True)
+def devpiserver_on_toxresult_store(request, tox_result_handling):
+    return tox_result_handling
+
+
+@hookimpl(trylast=True)
+def devpiserver_on_toxresult_upload_forbidden(request, tox_result_handling):
+    return tox_result_handling
+
+
 def version_in_filename(version, filename):
     if version is None:
         # no version set, so skip check
@@ -530,14 +560,25 @@ class PyPIView:
 
     @view_config(
         route_name="/{user}/{index}/+f/{relpath:.*}",
-        request_method="POST",
-        permission="toxresult_upload")
+        request_method="POST")
     def post_toxresult(self):
-        stage = self.context.stage
-        relpath = self.request.path_info.strip("/")
-        link = stage.get_link_from_entrypath(relpath)
-        if link is None or link.rel != "releasefile":
-            apireturn(404, message="no release file found at %s" % relpath)
+        if not self.request.has_permission("toxresult_upload"):
+            default_tox_result_handling = ToxResultHandling().block(TOXRESULT_UPLOAD_FORBIDDEN)
+            tox_result_handling = self.xom.config.hook.devpiserver_on_toxresult_upload_forbidden(
+                request=self.request, tox_result_handling=default_tox_result_handling)
+        else:
+            stage = self.context.stage
+            relpath = self.request.path_info.strip("/")
+            link = stage.get_link_from_entrypath(relpath)
+            if link is None or link.rel != "releasefile":
+                apireturn(404, message="no release file found at %s" % relpath)
+            default_tox_result_handling = ToxResultHandling()
+            tox_result_handling = self.xom.config.hook.devpiserver_on_toxresult_store(
+                request=self.request, tox_result_handling=default_tox_result_handling)
+        if tox_result_handling._block:
+            apireturn(403, tox_result_handling.msg)
+        if tox_result_handling._skip:
+            apireturn(200, tox_result_handling.msg)
         # the getjson call validates that we got valid json
         getjson(self.request)
         # but we store the original body

{devpi_server-6.11.0 → devpi_server-6.12.0}/devpi_server.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devpi-server
-Version: 6.11.0
+Version: 6.12.0
 Summary: devpi-server: reliable private and pypi.org caching server
 Home-page: https://devpi.net
 Maintainer: Florian Schulze
@@ -119,6 +119,25 @@ Changelog
 
 .. towncrier release notes start
 
+6.12.0 (2024-06-25)
+===================
+
+Features
+--------
+
+- Added ``devpiserver_on_toxresult_store`` hook to allow blocking or skipping a toxresult upload on more specific conditions as ``acl_toxresult_upload`` would allow.
+
+- Added ``devpiserver_on_toxresult_upload_forbidden`` hook to allow returning a custom message and result (403 or 200).
+
+
+
+Bug Fixes
+---------
+
+- Return json data if toxresult upload is forbidden.
+
+
+
 6.11.0 (2024-04-20)
 ===================
 
@@ -180,28 +199,3 @@ Bug Fixes
 
 - Fix #980: Remove long deprecated backward compatibility for old pluggy versions to fix error with pluggy 1.1.0.
 
-
-6.9.0 (2023-05-23)
-==================
-
-Features
---------
-
-- Support export directory layout for ``--replica-file-search-path`` option.
-
-- Fix #931: Add ``mirror_no_project_list`` setting for mirror indexes that have no full project list like google cloud artifacts or if you want to prevent downloading the full list for huge indexes like PyPI.
-
-
-Bug Fixes
----------
-
-- Keep a reference to async tasks to avoid their removal mid execution.
-
-- Support changed default of ``enforce_content_length`` in urllib3 >= 2.
-
-- Fix #934: Properly set PATH_INFO when outside URL is used with sub-path.
-
-- Fix #945: Adapt FatalError to be usable as an async HTTP response when updating a project on a mirror.
-
-- Fix wrong hash metadata introduced in 6.5.0 for toxresults which prevents replication. The metadata can be fixed by an export/import cycle.
-

{devpi_server-6.11.0 → devpi_server-6.12.0}/setup.py

@@ -57,7 +57,7 @@ if __name__ == "__main__":
         'Documentation': 'https://doc.devpi.net',
         'Source Code': 'https://github.com/devpi/devpi'
       },
-      version='6.11.0',
+      version='6.12.0',
       maintainer="Florian Schulze",
       maintainer_email="mail@pyfidelity.com",
       packages=[

{devpi_server-6.11.0 → devpi_server-6.12.0}/test_devpi_server/functional.py

@@ -367,6 +367,29 @@ class TestProjectThings:
         r = mapp.downloadrelease(200, toxresult_url)
         assert json.loads(r.decode('utf-8')) == tox_result_data
 
+    def test_toxresult_forbidden(self, mapp, server_version):
+        import json
+        mapp.create_and_use('pruser2/dev')
+        mapp.modify_index("pruser2/dev", ['acl_toxresult_upload='])
+        info = mapp.getjson(f"/{mapp.api.stagename}")
+        assert info['result']['acl_toxresult_upload'] == []
+        content = mapp.makepkg("hello-1.0.tar.gz", b"content", "hello", "1.0")
+        mapp.upload_file_pypi("hello-1.0.tar.gz", content, "hello", "1.0")
+        (pkg_url,) = mapp.getreleaseslist("hello")
+        tox_result_data = dict(foo="bar")
+        result = mapp.upload_toxresult(pkg_url, json.dumps(tox_result_data), code=403)
+        if server_version >= parse_version("6.11dev"):
+            # in devpi-client tests we don't have the result.content_type helper
+            assert result.headers.get('content-type', '').lower().startswith('application/json')
+            data = result.json
+            if callable(data):
+                # in devpi-client .json is a method
+                data = data()
+            assert 'no permission to upload tox results' in data['message'].lower()
+        info = mapp.getjson(f"/{mapp.api.stagename}/hello")
+        (href,) = (x['href'] for x in info["result"]["1.0"]["+links"])
+        assert 'toxresult' not in href
+
 
 @pytest.mark.nomocking
 class TestMirrorIndexThings:

{devpi_server-6.11.0 → devpi_server-6.12.0}/test_devpi_server/test_views.py

@@ -2178,6 +2178,64 @@ def test_delete_removed_toxresult(mapp, testapp, tox_result_data):
     testapp.delete(toxlink2.href, status=410)
 
 
+def test_plugin_toxresult_upload_block(makemapp, maketestapp, makexom, tox_result_data):
+    class Plugin:
+        @hookimpl
+        def devpiserver_on_toxresult_store(self, tox_result_handling):
+            return tox_result_handling.block("custom block")
+    xom = makexom(plugins=[Plugin()])
+    testapp = maketestapp(xom)
+    mapp = makemapp(testapp)
+    api = mapp.create_and_use()
+    mapp.upload_file_pypi("pkg6-2.6.tgz", b"123", "pkg6", "2.6")
+    vv = get_view_version_links(testapp, api.index, "pkg6", "2.6")
+    (link1,) = vv.get_links()
+    r = mapp.upload_toxresult(link1.href, json.dumps(tox_result_data), code=403)
+    assert r.json['message'] == 'custom block'
+    # make sure the upload was blocked
+    (link2,) = vv.get_links()
+    assert link1.href == link2.href
+
+
+def test_plugin_toxresult_upload_forbidden_skip(makemapp, maketestapp, makexom, tox_result_data):
+    class Plugin:
+        @hookimpl
+        def devpiserver_on_toxresult_upload_forbidden(self, tox_result_handling):
+            return tox_result_handling.skip("custom message")
+    xom = makexom(plugins=[Plugin()])
+    testapp = maketestapp(xom)
+    mapp = makemapp(testapp)
+    api = mapp.create_and_use(indexconfig=dict(acl_toxresult_upload=''))
+    mapp.upload_file_pypi("pkg6-2.6.tgz", b"123", "pkg6", "2.6")
+    vv = get_view_version_links(testapp, api.index, "pkg6", "2.6")
+    (link1,) = vv.get_links()
+    r = mapp.upload_toxresult(link1.href, json.dumps(tox_result_data), code=200)
+    assert r.json['message'] == 'custom message'
+    # make sure the upload was blocked
+    (link2,) = vv.get_links()
+    assert link1.href == link2.href
+
+
+def test_plugin_toxresult_upload_skip(makemapp, maketestapp, makexom, tox_result_data):
+    class Plugin:
+        @hookimpl
+        def devpiserver_on_toxresult_store(self, tox_result_handling):
+            return tox_result_handling.skip("custom skip")
+    xom = makexom(plugins=[Plugin()])
+    testapp = maketestapp(xom)
+    mapp = makemapp(testapp)
+    api = mapp.create_and_use()
+    mapp.upload_file_pypi("pkg6-2.6.tgz", b"123", "pkg6", "2.6")
+    vv = get_view_version_links(testapp, api.index, "pkg6", "2.6")
+    (link1,) = vv.get_links()
+    r = mapp.upload_toxresult(link1.href, json.dumps(tox_result_data), code=200)
+    assert r.json['message'] == 'custom skip'
+    vv = get_view_version_links(testapp, api.index, "pkg6", "2.6")
+    # make sure the upload was skipped
+    (link2,) = vv.get_links()
+    assert link1.href == link2.href
+
+
 @proj
 def test_upload_docs_no_version(mapp, testapp, proj):
     api = mapp.create_and_use()

devpi_server-6.11.0/devpi_server/__init__.py

@@ -1 +0,0 @@
-__version__ = '6.11.0'