pulpcore 3.121.0__tar.gz → 3.121.2__tar.gz

{pulpcore-3.121.0 → pulpcore-3.121.2}/CHANGES.md

@@ -8,6 +8,54 @@
 
 [//]: # (towncrier release notes start)
 
+## 3.121.2 (2026-10-08) {: #3.121.2 }
+
+### REST API {: #3.121.2-rest-api }
+
+#### Bugfixes {: #3.121.2-rest-api-bugfix }
+
+- Optimized `scope_queryset` SQL queries when using a domain scoped endpoint.
+
+### Plugin API {: #3.121.2-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.121.2-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.121.2-pulp-cert-guard }
+
+No significant changes.
+
+---
+
+## 3.121.1 (2026-10-08) {: #3.121.1 }
+
+### REST API {: #3.121.1-rest-api }
+
+#### Bugfixes {: #3.121.1-rest-api-bugfix }
+
+- Fixed an issue where users were able to list (but not modify) uploads they didn't have permissions to view.
+- Removed parent directory sizes and fixed wrong last modified timestamp in content app listings.
+- Repeated object lookups in a single API request now reuse the retrieved object.
+- Reverted support for returning 304 responses to content requests with conditional headers
+  because of a breaking change in the internal plugin's API.
+
+### Plugin API {: #3.121.1-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.121.1-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.121.1-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.121.0 (2026-10-06) {: #3.121.0 }
 
 ### REST API {: #3.121.0-rest-api }

{pulpcore-3.121.0 → pulpcore-3.121.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulpcore
-Version: 3.121.0
+Version: 3.121.2
 Summary: Pulp Django Application and Related Modules
 Author-email: Pulp Team <pulp-list@redhat.com>
 License-Expression: GPL-2.0-or-later
@@ -37,7 +37,7 @@ Requires-Dist: drf-access-policy<1.5.1,>=1.1.2
 Requires-Dist: drf-nested-routers<=0.95.3,>=0.93.4
 Requires-Dist: drf-spectacular<0.30,>=0.27.2
 Requires-Dist: dynaconf<3.4,>=3.3.0
-Requires-Dist: GitPython<3.2,>=3.1.24
+Requires-Dist: GitPython<3.3,>=3.1.24
 Requires-Dist: gunicorn<26.3.0,>=22.0
 Requires-Dist: jinja2<=3.1.6,>=3.1
 Requires-Dist: json_stream<2.6,>=2.3.2

{pulpcore-3.121.0 → pulpcore-3.121.2}/pulp_certguard/app/__init__.py

@@ -6,6 +6,6 @@ class PulpCertGuardPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_certguard.app"
     label = "certguard"
-    version = "3.121.0"
+    version = "3.121.2"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.121.0 → pulpcore-3.121.2}/pulp_file/app/__init__.py

@@ -8,6 +8,6 @@ class PulpFilePluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_file.app"
     label = "file"
-    version = "3.121.0"
+    version = "3.121.2"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.121.0 → pulpcore-3.121.2}/pulp_file/app/viewsets.py

@@ -163,7 +163,7 @@ class FileRepositoryViewSet(RepositoryViewSet, ModifyRepositoryActionMixin, Role
     DEFAULT_ACCESS_POLICY = {
         "statements": [
             {
-                "action": ["list", "my_permissions"],
+                "action": ["list", "retrieve", "my_permissions"],
                 "principal": "authenticated",
                 "effect": "allow",
             },
@@ -176,12 +176,6 @@ class FileRepositoryViewSet(RepositoryViewSet, ModifyRepositoryActionMixin, Role
                     "has_remote_param_model_or_domain_or_obj_perms:file.view_fileremote",
                 ],
             },
-            {
-                "action": ["retrieve"],
-                "principal": "authenticated",
-                "effect": "allow",
-                "condition": "has_model_or_domain_or_obj_perms:file.view_filerepository",
-            },
             {
                 "action": ["destroy"],
                 "principal": "authenticated",
@@ -347,7 +341,7 @@ class FileRemoteViewSet(RemoteViewSet, RolesMixin):
     DEFAULT_ACCESS_POLICY = {
         "statements": [
             {
-                "action": ["list", "my_permissions"],
+                "action": ["list", "retrieve", "my_permissions"],
                 "principal": "authenticated",
                 "effect": "allow",
             },
@@ -357,12 +351,6 @@ class FileRemoteViewSet(RemoteViewSet, RolesMixin):
                 "effect": "allow",
                 "condition": "has_model_or_domain_perms:file.add_fileremote",
             },
-            {
-                "action": ["retrieve"],
-                "principal": "authenticated",
-                "effect": "allow",
-                "condition": "has_model_or_domain_or_obj_perms:file.view_fileremote",
-            },
             {
                 "action": ["update", "partial_update", "set_label", "unset_label"],
                 "principal": "authenticated",
@@ -425,7 +413,7 @@ class FileGitRemoteViewSet(RemoteViewSet, RolesMixin):
     DEFAULT_ACCESS_POLICY = {
         "statements": [
             {
-                "action": ["list", "my_permissions"],
+                "action": ["list", "retrieve", "my_permissions"],
                 "principal": "authenticated",
                 "effect": "allow",
             },
@@ -435,12 +423,6 @@ class FileGitRemoteViewSet(RemoteViewSet, RolesMixin):
                 "effect": "allow",
                 "condition": "has_model_or_domain_perms:file.add_filegitremote",
             },
-            {
-                "action": ["retrieve"],
-                "principal": "authenticated",
-                "effect": "allow",
-                "condition": "has_model_or_domain_or_obj_perms:file.view_filegitremote",
-            },
             {
                 "action": ["update", "partial_update", "set_label", "unset_label"],
                 "principal": "authenticated",
@@ -504,7 +486,7 @@ class FilePublicationViewSet(PublicationViewSet, RolesMixin):
     DEFAULT_ACCESS_POLICY = {
         "statements": [
             {
-                "action": ["list", "my_permissions"],
+                "action": ["list", "retrieve", "my_permissions"],
                 "principal": "authenticated",
                 "effect": "allow",
             },
@@ -518,12 +500,6 @@ class FilePublicationViewSet(PublicationViewSet, RolesMixin):
                     "file.view_filerepository",
                 ],
             },
-            {
-                "action": ["retrieve"],
-                "principal": "authenticated",
-                "effect": "allow",
-                "condition": "has_model_or_domain_or_obj_perms:file.view_filepublication",
-            },
             {
                 "action": ["destroy"],
                 "principal": "authenticated",
@@ -607,7 +583,7 @@ class FileDistributionViewSet(DistributionViewSet, RolesMixin):
     DEFAULT_ACCESS_POLICY = {
         "statements": [
             {
-                "action": ["list", "my_permissions"],
+                "action": ["list", "retrieve", "my_permissions"],
                 "principal": "authenticated",
                 "effect": "allow",
             },
@@ -622,12 +598,6 @@ class FileDistributionViewSet(DistributionViewSet, RolesMixin):
                     "has_publication_param_model_or_domain_or_obj_perms:file.view_filepublication",
                 ],
             },
-            {
-                "action": ["retrieve"],
-                "principal": "authenticated",
-                "effect": "allow",
-                "condition": "has_model_or_domain_or_obj_perms:file.view_filedistribution",
-            },
             {
                 "action": ["update", "partial_update", "set_label", "unset_label"],
                 "principal": "authenticated",
@@ -691,7 +661,7 @@ class FileAlternateContentSourceViewSet(AlternateContentSourceViewSet, RolesMixi
     DEFAULT_ACCESS_POLICY = {
         "statements": [
             {
-                "action": ["list", "my_permissions"],
+                "action": ["list", "retrieve", "my_permissions"],
                 "principal": "authenticated",
                 "effect": "allow",
             },
@@ -704,13 +674,6 @@ class FileAlternateContentSourceViewSet(AlternateContentSourceViewSet, RolesMixi
                     "has_remote_param_model_or_domain_or_obj_perms:file.view_fileremote",
                 ],
             },
-            {
-                "action": ["retrieve"],
-                "principal": "authenticated",
-                "effect": "allow",
-                "condition": "has_model_or_domain_or_obj_perms:"
-                "file.view_filealternatecontentsource",
-            },
             {
                 "action": ["update", "partial_update"],
                 "principal": "authenticated",

{pulpcore-3.121.0 → pulpcore-3.121.2}/pulpcore/app/apps.py

@@ -238,7 +238,7 @@ class PulpAppConfig(PulpPluginAppConfig):
     label = "core"
 
     # The version of this app
-    version = "3.121.0"
+    version = "3.121.2"
 
     # The python package name providing this app
     python_package_name = "pulpcore"

{pulpcore-3.121.0 → pulpcore-3.121.2}/pulpcore/app/models/publication.py

@@ -868,7 +868,7 @@ class Distribution(MasterModel):
 
     def get_fallback_ca(self, path):
         """
-        Return the ContentArtifact and RepositoryVersion for path from publication history, or None.
+        Return a ContentArtifact for path from the grace-period publication history, or None.
 
         Iterates DistributedPublication records for this distribution from newest to oldest,
         trying each publication until the path is found.  Handles both pass-through and
@@ -894,7 +894,7 @@ class Distribution(MasterModel):
                     .first()
                 )
                 if ca is not None:
-                    return ca, pub.repository_version
+                    return ca
             else:
                 pa = (
                     pub.published_artifact.select_related(
@@ -905,7 +905,7 @@ class Distribution(MasterModel):
                     .first()
                 )
                 if pa is not None:
-                    return pa.content_artifact, pub.repository_version
+                    return pa.content_artifact
         return None
 
     @hook(BEFORE_CREATE)

{pulpcore-3.121.0 → pulpcore-3.121.2}/pulpcore/app/role_util.py

@@ -137,22 +137,33 @@ def get_objects_for_user_roles(
     ).values_list("object_id", flat=True)
     final_q = Q(pk_str__in=user_role_pks)
     if accept_domain_perms and hasattr(qs.model, "pulp_domain"):
-        domains = list(
-            user.object_roles.filter(
+        # Optimization used by get_queryset in NamedModelViewSet
+        if filtered_domain := getattr(qs, "filtered_domain", None):
+            if user.object_roles.filter(
+                domain=filtered_domain, role__permissions=permission
+            ).exists():
+                return qs
+            if (
+                use_groups
+                and GroupRole.objects.filter(
+                    group__in=user.groups.all(),
+                    domain=filtered_domain,
+                    role__permissions=permission,
+                ).exists()
+            ):
+                return qs
+        else:
+            user_domains = user.object_roles.filter(
                 domain__isnull=False, role__permissions=permission
             ).values_list("domain_id", flat=True)
-        )
-        if use_groups:
-            domains.extend(
-                GroupRole.objects.filter(
+            final_q |= Q(pulp_domain_id__in=user_domains)
+            if use_groups:
+                group_domains = GroupRole.objects.filter(
                     group__in=user.groups.all(),
                     domain__isnull=False,
                     role__permissions=permission,
                 ).values_list("domain_id", flat=True)
-            )
-        final_q |= Q(
-            pk_str__in=list(qs.filter(pulp_domain_id__in=domains).values_list("pk", flat=True))
-        )
+                final_q |= Q(pulp_domain_id__in=group_domains)
 
     if use_groups:
         group_role_pks = GroupRole.objects.filter(

{pulpcore-3.121.0 → pulpcore-3.121.2}/pulpcore/app/util.py

@@ -17,7 +17,6 @@ from django.apps import apps
 from django.conf import settings
 from django.db import connection
 from django.db.models import Model, UUIDField
-from django.utils.http import parse_http_date
 from rest_framework.reverse import reverse as drf_reverse
 from rest_framework.serializers import ValidationError
 
@@ -715,25 +714,6 @@ def normalize_http_status(status):
         return ""
 
 
-def check_request_was_modified(request, last_modified, etag=None):
-    if_none_match = request.headers.get("If-None-Match")
-    if_modified_since = request.headers.get("If-Modified-Since")
-
-    if not if_none_match and not (last_modified and if_modified_since):
-        return True
-
-    if if_none_match:
-        client_etags = [etag == client_etag.strip() for client_etag in if_none_match.split(",")]
-        return not any(client_etags)
-
-    try:
-        last_modified_ts = parse_http_date(last_modified)
-        if_modified_ts = parse_http_date(if_modified_since)
-        return last_modified_ts > if_modified_ts
-    except (TypeError, ValueError):
-        return True
-
-
 class HashingFileWriter(RawIOBase):
     """
     A file-like object that handles writing data to disk with simultaneous

{pulpcore-3.121.0 → pulpcore-3.121.2}/pulpcore/app/viewsets/base.py

@@ -312,6 +312,12 @@ class NamedModelViewSet(viewsets.GenericViewSet):
             self.get_parent_field_and_object()
         super().initial(request, *args, **kwargs)
 
+    def get_object(self):
+        """Return the object cached for the lifetime of this view instance."""
+        if not hasattr(self, "_pulp_cached_object"):
+            self._pulp_cached_object = super().get_object()
+        return self._pulp_cached_object
+
     def get_queryset(self):
         """
         Gets a QuerySet based on the current request.
@@ -341,6 +347,8 @@ class NamedModelViewSet(viewsets.GenericViewSet):
             if settings.DOMAIN_ENABLED:
                 if hasattr(qs.model, "pulp_domain"):
                     qs = qs.filter(pulp_domain=request.pulp_domain)
+                    # Inform get_objects_for_user that the queryset has already been filtered by domain.
+                    setattr(qs, "filtered_domain", request.pulp_domain)
 
             for permission_class in self.get_permissions():
                 if hasattr(permission_class, "scope_queryset"):

{pulpcore-3.121.0 → pulpcore-3.121.2}/pulpcore/app/viewsets/domain.py

@@ -53,7 +53,7 @@ class DomainViewSet(
     DEFAULT_ACCESS_POLICY = {
         "statements": [
             {
-                "action": ["list"],
+                "action": ["list", "retrieve", "my_permissions"],
                 "principal": "authenticated",
                 "effect": "allow",
             },
@@ -63,12 +63,6 @@ class DomainViewSet(
                 "effect": "allow",
                 "condition": "has_model_perms:core.add_domain",
             },
-            {
-                "action": ["retrieve", "my_permissions"],
-                "principal": "authenticated",
-                "effect": "allow",
-                "condition": "has_model_or_obj_perms:core.view_domain",
-            },
             {
                 "action": ["update", "partial_update", "migrate", "set_label", "unset_label"],
                 "principal": "authenticated",

{pulpcore-3.121.0 → pulpcore-3.121.2}/pulpcore/app/viewsets/openpgp.py

@@ -104,7 +104,7 @@ class OpenPGPKeyringViewSet(RepositoryViewSet, ModifyRepositoryActionMixin, Role
     DEFAULT_ACCESS_POLICY = {
         "statements": [
             {
-                "action": ["list", "my_permissions"],
+                "action": ["list", "retrieve", "my_permissions"],
                 "principal": "authenticated",
                 "effect": "allow",
             },
@@ -116,12 +116,6 @@ class OpenPGPKeyringViewSet(RepositoryViewSet, ModifyRepositoryActionMixin, Role
                     "has_model_or_domain_perms:core.add_openpgpkeyring",
                 ],
             },
-            {
-                "action": ["retrieve"],
-                "principal": "authenticated",
-                "effect": "allow",
-                "condition": "has_model_or_domain_or_obj_perms:core.view_openpgpkeyring",
-            },
             {
                 "action": ["destroy"],
                 "principal": "authenticated",

{pulpcore-3.121.0 → pulpcore-3.121.2}/pulpcore/app/viewsets/publication.py

@@ -205,7 +205,7 @@ class RBACContentGuardViewSet(ContentGuardViewSet, RolesMixin):
     DEFAULT_ACCESS_POLICY = {
         "statements": [
             {
-                "action": ["list"],
+                "action": ["list", "retrieve", "my_permissions"],
                 "principal": "authenticated",
                 "effect": "allow",
             },
@@ -215,12 +215,6 @@ class RBACContentGuardViewSet(ContentGuardViewSet, RolesMixin):
                 "effect": "allow",
                 "condition": "has_model_or_domain_perms:core.add_rbaccontentguard",
             },
-            {
-                "action": ["retrieve", "my_permissions"],
-                "principal": "authenticated",
-                "effect": "allow",
-                "condition": "has_model_or_domain_or_obj_perms:core.view_rbaccontentguard",
-            },
             {
                 "action": ["update", "partial_update"],
                 "principal": "authenticated",
@@ -282,7 +276,7 @@ class ContentRedirectContentGuardViewSet(ContentGuardViewSet, RolesMixin):
     DEFAULT_ACCESS_POLICY = {
         "statements": [
             {
-                "action": ["list"],
+                "action": ["list", "retrieve", "my_permissions"],
                 "principal": "authenticated",
                 "effect": "allow",
             },
@@ -292,13 +286,6 @@ class ContentRedirectContentGuardViewSet(ContentGuardViewSet, RolesMixin):
                 "effect": "allow",
                 "condition": "has_model_or_domain_perms:core.add_contentredirectcontentguard",
             },
-            {
-                "action": ["retrieve", "my_permissions"],
-                "principal": "authenticated",
-                "effect": "allow",
-                "condition": "has_model_or_domain_or_obj_perms:core."
-                "view_contentredirectcontentguard",
-            },
             {
                 "action": ["update", "partial_update"],
                 "principal": "authenticated",
@@ -357,7 +344,7 @@ class HeaderContentGuardViewSet(ContentGuardViewSet, RolesMixin):
     DEFAULT_ACCESS_POLICY = {
         "statements": [
             {
-                "action": ["list"],
+                "action": ["list", "retrieve", "my_permissions"],
                 "principal": "authenticated",
                 "effect": "allow",
             },
@@ -367,12 +354,6 @@ class HeaderContentGuardViewSet(ContentGuardViewSet, RolesMixin):
                 "effect": "allow",
                 "condition": "has_model_or_domain_perms:core.add_headercontentguard",
             },
-            {
-                "action": ["retrieve", "my_permissions"],
-                "principal": "authenticated",
-                "effect": "allow",
-                "condition": "has_model_or_domain_or_obj_perms:core.view_headercontentguard",
-            },
             {
                 "action": ["update", "partial_update"],
                 "principal": "authenticated",
@@ -427,7 +408,7 @@ class EnvVarHeaderContentGuardViewSet(ContentGuardViewSet, RolesMixin):
     DEFAULT_ACCESS_POLICY = {
         "statements": [
             {
-                "action": ["list"],
+                "action": ["list", "retrieve", "my_permissions"],
                 "principal": "authenticated",
                 "effect": "allow",
             },
@@ -437,14 +418,6 @@ class EnvVarHeaderContentGuardViewSet(ContentGuardViewSet, RolesMixin):
                 "effect": "allow",
                 "condition": "has_model_or_domain_perms:core.add_envvarheadercontentguard",
             },
-            {
-                "action": ["retrieve", "my_permissions"],
-                "principal": "authenticated",
-                "effect": "allow",
-                "condition": (
-                    "has_model_or_domain_or_obj_perms:core.view_envvarheadercontentguard"
-                ),
-            },
             {
                 "action": ["update", "partial_update"],
                 "principal": "authenticated",
@@ -503,7 +476,7 @@ class CompositeContentGuardViewSet(ContentGuardViewSet, RolesMixin):
     DEFAULT_ACCESS_POLICY = {
         "statements": [
             {
-                "action": ["list"],
+                "action": ["list", "retrieve", "my_permissions"],
                 "principal": "authenticated",
                 "effect": "allow",
             },
@@ -513,12 +486,6 @@ class CompositeContentGuardViewSet(ContentGuardViewSet, RolesMixin):
                 "effect": "allow",
                 "condition": "has_model_or_domain_perms:core.add_compositecontentguard",
             },
-            {
-                "action": ["retrieve", "my_permissions"],
-                "principal": "authenticated",
-                "effect": "allow",
-                "condition": "has_model_or_domain_or_obj_perms:core.view_compositecontentguard",
-            },
             {
                 "action": ["update", "partial_update"],
                 "principal": "authenticated",

{pulpcore-3.121.0 → pulpcore-3.121.2}/pulpcore/app/viewsets/replica.py

@@ -44,7 +44,7 @@ class UpstreamPulpViewSet(
     DEFAULT_ACCESS_POLICY = {
         "statements": [
             {
-                "action": ["list", "my_permissions"],
+                "action": ["list", "retrieve", "my_permissions"],
                 "principal": "authenticated",
                 "effect": "allow",
             },
@@ -56,12 +56,6 @@ class UpstreamPulpViewSet(
                     "has_model_or_domain_perms:core.add_upstreampulp",
                 ],
             },
-            {
-                "action": ["retrieve"],
-                "principal": "authenticated",
-                "effect": "allow",
-                "condition": "has_model_or_domain_or_obj_perms:core.view_upstreampulp",
-            },
             {
                 "action": ["destroy"],
                 "principal": "authenticated",

{pulpcore-3.121.0 → pulpcore-3.121.2}/pulpcore/app/viewsets/task.py

@@ -98,12 +98,10 @@ class TaskViewSet(
 
     DEFAULT_ACCESS_POLICY = {
         "statements": [
-            {"action": ["list"], "principal": "authenticated", "effect": "allow"},
             {
-                "action": ["retrieve", "my_permissions"],
+                "action": ["list", "retrieve", "my_permissions"],
                 "principal": "authenticated",
                 "effect": "allow",
-                "condition": "has_model_or_domain_or_obj_perms:core.view_task",
             },
             {
                 "action": ["profile_artifacts"],
@@ -419,12 +417,10 @@ class TaskScheduleViewSet(
 
     DEFAULT_ACCESS_POLICY = {
         "statements": [
-            {"action": ["list"], "principal": "authenticated", "effect": "allow"},
             {
-                "action": ["retrieve", "my_permissions"],
+                "action": ["list", "retrieve", "my_permissions"],
                 "principal": "authenticated",
                 "effect": "allow",
-                "condition": "has_model_or_domain_or_obj_perms:core.view_taskschedule",
             },
             {
                 "action": ["list_roles", "add_role", "remove_role"],

{pulpcore-3.121.0 → pulpcore-3.121.2}/pulpcore/app/viewsets/upload.py

@@ -30,6 +30,7 @@ class UploadViewSet(
 
     endpoint_name = "uploads"
     queryset = Upload.objects.all()
+    queryset_filtering_required_permission = "core.view_upload"
     http_method_names = ["get", "post", "head", "put", "delete"]
     filterset_fields = {"size": ["exact", "gt", "lt", "range"]}
 
@@ -45,7 +46,7 @@ class UploadViewSet(
     DEFAULT_ACCESS_POLICY = {
         "statements": [
             {
-                "action": ["list"],
+                "action": ["list", "retrieve", "my_permissions"],
                 "principal": "authenticated",
                 "effect": "allow",
             },
@@ -55,12 +56,6 @@ class UploadViewSet(
                 "effect": "allow",
                 "condition": "has_model_or_domain_perms:core.add_upload",
             },
-            {
-                "action": ["retrieve", "my_permissions"],
-                "principal": "authenticated",
-                "effect": "allow",
-                "condition": "has_model_or_domain_or_obj_perms:core.view_upload",
-            },
             {
                 "action": ["update", "partial_update", "commit"],
                 "principal": "authenticated",

{pulpcore-3.121.0 → pulpcore-3.121.2}/pulpcore/app/viewsets/user.py

@@ -87,7 +87,7 @@ class GroupViewSet(
     DEFAULT_ACCESS_POLICY = {
         "statements": [
             {
-                "action": ["list"],
+                "action": ["list", "retrieve", "my_permissions"],
                 "principal": "authenticated",
                 "effect": "allow",
             },
@@ -97,12 +97,6 @@ class GroupViewSet(
                 "effect": "allow",
                 "condition": "has_model_perms:core.add_group",
             },
-            {
-                "action": ["retrieve", "my_permissions"],
-                "principal": "authenticated",
-                "effect": "allow",
-                "condition": "has_model_or_obj_perms:core.view_group",
-            },
             {
                 "action": ["update", "partial_update"],
                 "principal": "authenticated",