pulpcore 3.115.2__tar.gz → 3.115.3__tar.gz

{pulpcore-3.115.2 → pulpcore-3.115.3}/CHANGES.md

@@ -8,6 +8,29 @@
 
 [//]: # (towncrier release notes start)
 
+## 3.115.3 (2026-07-28) {: #3.115.3 }
+
+### REST API {: #3.115.3-rest-api }
+
+#### Bugfixes {: #3.115.3-rest-api-bugfix }
+
+- Fixed domain list returning all domains to authenticated users instead of only domains they can view.
+  [#7898](https://github.com/pulp/pulpcore/issues/7898)
+
+### Plugin API {: #3.115.3-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.115.3-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.115.3-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.115.2 (2026-07-22) {: #3.115.2 }
 
 ### REST API {: #3.115.2-rest-api }

{pulpcore-3.115.2 → pulpcore-3.115.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulpcore
-Version: 3.115.2
+Version: 3.115.3
 Summary: Pulp Django Application and Related Modules
 Author-email: Pulp Team <pulp-list@redhat.com>
 License-Expression: GPL-2.0-or-later

{pulpcore-3.115.2 → pulpcore-3.115.3}/pulp_certguard/app/__init__.py

@@ -6,6 +6,6 @@ class PulpCertGuardPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_certguard.app"
     label = "certguard"
-    version = "3.115.2"
+    version = "3.115.3"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.115.2 → pulpcore-3.115.3}/pulp_file/app/__init__.py

@@ -8,6 +8,6 @@ class PulpFilePluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_file.app"
     label = "file"
-    version = "3.115.2"
+    version = "3.115.3"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.115.2 → pulpcore-3.115.3}/pulpcore/app/apps.py

@@ -237,7 +237,7 @@ class PulpAppConfig(PulpPluginAppConfig):
     label = "core"
 
     # The version of this app
-    version = "3.115.2"
+    version = "3.115.3"
 
     # The python package name providing this app
     python_package_name = "pulpcore"

{pulpcore-3.115.2 → pulpcore-3.115.3}/pulpcore/app/viewsets/domain.py

@@ -49,6 +49,7 @@ class DomainViewSet(
     serializer_class = DomainSerializer
     endpoint_name = "domains"
     filterset_class = DomainFilter
+    queryset_filtering_required_permission = "core.view_domain"
     DEFAULT_ACCESS_POLICY = {
         "statements": [
             {

{pulpcore-3.115.2 → pulpcore-3.115.3}/pulpcore/tests/functional/api/test_crud_domains.py

@@ -360,3 +360,41 @@ def test_set_label_on_domain(pulpcore_bindings, domain_factory, gen_user):
         response = pulpcore_bindings.DomainsApi.unset_label(domain.pulp_href, {"key": "abc"})
         assert response.key == "abc"
         assert response.value == "def"
+
+
+@pytest.mark.parallel
+def test_domain_list_queryset_scoping(pulpcore_bindings, gen_user, gen_object_with_cleanup):
+    """Test that domain list is scoped to domains the user can view."""
+    body = {
+        "name": str(uuid.uuid4()),
+        "storage_class": "pulpcore.app.models.storage.FileSystem",
+        "storage_settings": {"MEDIA_ROOT": ""},
+    }
+    domain = gen_object_with_cleanup(pulpcore_bindings.DomainsApi, body)
+    gen_object_with_cleanup(pulpcore_bindings.DomainsApi, {**body, "name": str(uuid.uuid4())})
+
+    # Authenticated users without view_domain see no domains
+    with gen_user():
+        assert pulpcore_bindings.DomainsApi.list().count == 0
+
+    # Object-level domain_viewer can see only that domain
+    with gen_user(object_roles=[("core.domain_viewer", domain.pulp_href)]):
+        domains = pulpcore_bindings.DomainsApi.list()
+        assert domains.count == 1
+        assert domains.results[0].pulp_href == domain.pulp_href
+
+    # Object-level domain_owner can see only that domain
+    with gen_user(object_roles=[("core.domain_owner", domain.pulp_href)]):
+        domains = pulpcore_bindings.DomainsApi.list()
+        assert domains.count == 1
+        assert domains.results[0].pulp_href == domain.pulp_href
+
+    # Domain creator sees domains they create (via creation_hooks), not others
+    creator = gen_user(model_roles=["core.domain_creator"])
+    with creator:
+        created = gen_object_with_cleanup(
+            pulpcore_bindings.DomainsApi, {**body, "name": str(uuid.uuid4())}
+        )
+        domains = pulpcore_bindings.DomainsApi.list()
+        assert domains.count == 1
+        assert domains.results[0].pulp_href == created.pulp_href

{pulpcore-3.115.2 → pulpcore-3.115.3}/pulpcore.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulpcore
-Version: 3.115.2
+Version: 3.115.3
 Summary: Pulp Django Application and Related Modules
 Author-email: Pulp Team <pulp-list@redhat.com>
 License-Expression: GPL-2.0-or-later

{pulpcore-3.115.2 → pulpcore-3.115.3}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = 'setuptools.build_meta'
 
 [project]
 name = "pulpcore"
-version = "3.115.2"
+version = "3.115.3"
 description = "Pulp Django Application and Related Modules"
 readme = "README.md"
 authors = [
@@ -207,7 +207,7 @@ ignore = [
 [tool.bumpversion]
 # This section is managed by the plugin template. Do not edit manually.
 
-current_version = "3.115.2"
+current_version = "3.115.3"
 commit = false
 tag = false
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<alpha>0a)?(?P<patch>\\d+)(\\.(?P<release>[a-z]+))?"
@@ -278,6 +278,7 @@ extend-exclude = [
 
 [tool.ruff.lint]
 # This section is managed by the plugin template. Do not edit manually.
+select = ["E4", "E7", "E9", "F"]
 extend-select = [
   "I",
   "INT",