pulpcore 3.42.0__tar.gz → 3.43.0__tar.gz

{pulpcore-3.42.0 → pulpcore-3.43.0}/CHANGES.rst

@@ -13,6 +13,47 @@ Changelog
 
 .. towncrier release notes start
 
+3.43.0 (2023-12-05)
+===================
+REST API
+--------
+
+Features
+~~~~~~~~
+
+- Added a CompositeContentGuard, that manages a list-of ContentGuards and permits
+  access to content if *ANY* guard permits.
+  :github:`4583`
+
+
+Bugfixes
+~~~~~~~~
+
+- Removed a race condition leading to 500 error in distribution filtering.
+  :github:`4766`
+- Added missing database indices to the ``RemoteArtifact`` model.
+  :github:`4835`
+
+
+Plugin API
+----------
+
+Features
+~~~~~~~~
+
+- Added the async safe `detail_model` property to master detail models.
+  :github:`4766`
+
+
+Pulp File
+---------
+
+No significant changes.
+
+
+----
+
+
 3.42.0 (2023-11-28)
 ===================
 REST API
@@ -1796,6 +1837,25 @@ Features
   :github:`3661`
 
 
+3.23.23 (2023-11-29)
+====================
+REST API
+--------
+
+Bugfixes
+~~~~~~~~
+
+- Removed a workaround to force close all tcp connections in sync leading to an exhaustion of port
+  numbers and their reuse while in time_wait state.
+  :github:`4452`
+
+
+Plugin API
+----------
+
+No significant changes.
+
+
 3.23.22 (2023-11-23)
 ====================
 REST API
@@ -2389,6 +2449,25 @@ Deprecations
   :github:`3604`
 
 
+3.22.20 (2023-11-30)
+====================
+REST API
+--------
+
+Bugfixes
+~~~~~~~~
+
+- Removed a workaround to force close all tcp connections in sync leading to an exhaustion of port
+  numbers and their reuse while in time_wait state.
+  :github:`4452`
+
+
+Plugin API
+----------
+
+No significant changes.
+
+
 3.22.19 (2023-11-15)
 ====================
 REST API
@@ -2920,6 +2999,25 @@ Removals
   :github:`3400`
 
 
+3.21.24 (2023-11-30)
+====================
+REST API
+--------
+
+Bugfixes
+~~~~~~~~
+
+- Removed a workaround to force close all tcp connections in sync leading to an exhaustion of port
+  numbers and their reuse while in time_wait state.
+  :github:`4452`
+
+
+Plugin API
+----------
+
+No significant changes.
+
+
 3.21.23 (2023-11-23)
 ====================
 REST API
@@ -3928,6 +4026,28 @@ Bugfixes
   :github:`2069`
 
 
+3.18.33 (2023-12-01)
+====================
+REST API
+--------
+
+Bugfixes
+~~~~~~~~
+
+- Removed a workaround to force close all tcp connections in sync leading to an exhaustion of port
+  numbers and their reuse while in time_wait state.
+  :github:`4452`
+
+
+Plugin API
+----------
+
+No significant changes.
+
+
+----
+
+
 3.18.32 (2023-11-14)
 ====================
 REST API

{pulpcore-3.42.0 → pulpcore-3.43.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pulpcore
-Version: 3.42.0
+Version: 3.43.0
 Summary: Pulp Django Application and Related Modules
 Home-page: https://pulpproject.org
 Author: Pulp Team

{pulpcore-3.42.0 → pulpcore-3.43.0}/pulp_file/app/__init__.py

@@ -8,6 +8,6 @@ class PulpFilePluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_file.app"
     label = "file"
-    version = "3.42.0"
+    version = "3.43.0"
     python_package_name = "pulp-file"  # TODO Add python_module_name
     domain_compatible = True

{pulpcore-3.42.0 → pulpcore-3.43.0}/pulpcore/app/apps.py

@@ -239,7 +239,7 @@ class PulpAppConfig(PulpPluginAppConfig):
     label = "core"
 
     # The version of this app
-    version = "3.42.0"
+    version = "3.43.0"
 
     # The python package name providing this app
     python_package_name = "pulpcore"

pulpcore-3.43.0/pulpcore/app/migrations/0115_compositecontentguard.py

@@ -0,0 +1,27 @@
+# Generated by Django 4.2.6 on 2023-10-19 14:20
+
+from django.db import migrations, models
+import django.db.models.deletion
+import pulpcore.app.models.access_policy
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0114_remove_task_args_remove_task_kwargs'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='CompositeContentGuard',
+            fields=[
+                ('contentguard_ptr', models.OneToOneField(auto_created=True, on_delete=django.db.models.deletion.CASCADE, parent_link=True, primary_key=True, serialize=False, to='core.contentguard')),
+                ('guards', models.ManyToManyField(related_name='+', to='core.contentguard')),
+            ],
+            options={
+                'permissions': (('manage_roles_compositecontentguard', 'Can manage role assignments on Composite content guard'),),
+                'default_related_name': '%(app_label)s_%(model_name)s',
+            },
+            bases=('core.contentguard', pulpcore.app.models.access_policy.AutoAddObjPermsMixin),
+        ),
+    ]

pulpcore-3.43.0/pulpcore/app/migrations/0116_alter_remoteartifact_md5_alter_remoteartifact_sha1_and_more.py

@@ -0,0 +1,43 @@
+# Generated by Django 4.2.7 on 2023-12-04 15:58
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0115_compositecontentguard'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='remoteartifact',
+            name='md5',
+            field=models.CharField(db_index=True, max_length=32, null=True),
+        ),
+        migrations.AlterField(
+            model_name='remoteartifact',
+            name='sha1',
+            field=models.CharField(db_index=True, max_length=40, null=True),
+        ),
+        migrations.AlterField(
+            model_name='remoteartifact',
+            name='sha224',
+            field=models.CharField(db_index=True, max_length=56, null=True),
+        ),
+        migrations.AlterField(
+            model_name='remoteartifact',
+            name='sha256',
+            field=models.CharField(db_index=True, max_length=64, null=True),
+        ),
+        migrations.AlterField(
+            model_name='remoteartifact',
+            name='sha384',
+            field=models.CharField(db_index=True, max_length=96, null=True),
+        ),
+        migrations.AlterField(
+            model_name='remoteartifact',
+            name='sha512',
+            field=models.CharField(db_index=True, max_length=128, null=True),
+        ),
+    ]

{pulpcore-3.42.0 → pulpcore-3.43.0}/pulpcore/app/models/__init__.py

@@ -55,6 +55,7 @@ from .publication import (
     PublishedArtifact,
     PublishedMetadata,
     RBACContentGuard,
+    CompositeContentGuard,
     ContentRedirectContentGuard,
     HeaderContentGuard,
     ArtifactDistribution,

{pulpcore-3.42.0 → pulpcore-3.43.0}/pulpcore/app/models/base.py

@@ -148,16 +148,20 @@ class MasterModel(BaseModel, metaclass=MasterModelMeta):
     def get_model_for_pulp_type(cls, pulp_type):
         return cls._pulp_model_map[pulp_type]
 
-    def save(self, *args, **kwargs):
+    @property
+    def detail_model(self):
+        return self._pulp_model_map[self.pulp_type]
+
+    def __init__(self, *args, **kwargs):
         # instances of "detail" models that subclass MasterModel are exposed
         # on instances of MasterModel by the string stored in that model's TYPE attr.
         # Storing this pulp_type in a column on the MasterModel next to makes it trivial
         # to filter for specific detail model types across master's relations.
         # Prepend the TYPE defined on a detail model with a django app label.
         # If a plugin sets the type field themselves, it's used as-is.
+        super().__init__(*args, **kwargs)
         if not self.pulp_type:
             self.pulp_type = self.get_pulp_type()
-        return super().save(*args, **kwargs)
 
     def cast(self):
         """Return the "Detail" model instance of this master-detail object.

{pulpcore-3.42.0 → pulpcore-3.43.0}/pulpcore/app/models/content.py

@@ -713,12 +713,12 @@ class RemoteArtifact(BaseModel, QueryMixin):
 
     url = models.TextField(validators=[validators.URLValidator])
     size = models.BigIntegerField(null=True)
-    md5 = models.CharField(max_length=32, null=True)
-    sha1 = models.CharField(max_length=40, null=True)
-    sha224 = models.CharField(max_length=56, null=True)
-    sha256 = models.CharField(max_length=64, null=True)
-    sha384 = models.CharField(max_length=96, null=True)
-    sha512 = models.CharField(max_length=128, null=True)
+    md5 = models.CharField(max_length=32, null=True, db_index=True)
+    sha1 = models.CharField(max_length=40, null=True, db_index=True)
+    sha224 = models.CharField(max_length=56, null=True, db_index=True)
+    sha256 = models.CharField(max_length=64, null=True, db_index=True)
+    sha384 = models.CharField(max_length=96, null=True, db_index=True)
+    sha512 = models.CharField(max_length=128, null=True, db_index=True)
 
     content_artifact = models.ForeignKey(ContentArtifact, on_delete=models.CASCADE)
     remote = models.ForeignKey("Remote", on_delete=models.CASCADE)

{pulpcore-3.42.0 → pulpcore-3.43.0}/pulpcore/app/models/publication.py

@@ -29,7 +29,7 @@ from pulpcore.cache import Cache
 from rest_framework.exceptions import APIException
 from pulpcore.app.models import AutoAddObjPermsMixin
 from pulpcore.responses import ArtifactResponse
-from pulpcore.app.util import get_domain_pk, cache_key
+from pulpcore.app.util import get_domain_pk, cache_key, get_url
 
 
 _logger = logging.getLogger(__name__)
@@ -522,6 +522,55 @@ class HeaderContentGuard(ContentGuard, AutoAddObjPermsMixin):
         )
 
 
+class CompositeContentGuard(ContentGuard, AutoAddObjPermsMixin):
+    """
+    Content guard to allow a list of contentguards to be evaluated on access.
+
+    Content-guards in the `guards` list have their permit() calls issued in order. At the
+    first "pass" result, access is permitted. Only if ALL guards in the list forbid access,
+    is access forbidden.
+
+    guards (django.db.models.ManyToManyField): ContentGuards to invoke.
+    """
+
+    TYPE = "composite"
+
+    guards = models.ManyToManyField(ContentGuard, related_name="+", symmetrical=False)
+
+    def permit(self, request):
+        """
+        Permit if ANY content-guard allows (OR permissions).
+        """
+        errors = []
+        if not self.guards.all():
+            # No guards specified? PASS
+            return
+
+        for guard in self.guards.all():
+            detail_guard = guard.cast()
+            try:
+                detail_guard.permit(request)
+                return  # success on first-pass
+            except PermissionError as pe:
+                guard_error = _("Guard: '{}', HREF: '{}', class: '{}', denial: [{}].").format(
+                    detail_guard.name, get_url(detail_guard), type(detail_guard), str(pe)
+                )
+                errors.append(guard_error)
+
+        # If we get here - FAIL
+        msg = _("Access forbidden. Refusals: {}").format(errors)
+        raise PermissionError(msg)
+
+    class Meta:
+        default_related_name = "%(app_label)s_%(model_name)s"
+        permissions = (
+            (
+                "manage_roles_compositecontentguard",
+                "Can manage role assignments on Composite content guard",
+            ),
+        )
+
+
 class BaseDistribution(MasterModel):
     """
     A distribution defines how a publication is distributed by the Content App.

{pulpcore-3.42.0 → pulpcore-3.43.0}/pulpcore/app/serializers/__init__.py

@@ -77,6 +77,7 @@ from .publication import (
     PublicationSerializer,
     RBACContentGuardSerializer,
     RBACContentGuardPermissionSerializer,
+    CompositeContentGuardSerializer,
     ContentRedirectContentGuardSerializer,
     HeaderContentGuardSerializer,
     ArtifactDistributionSerializer,

{pulpcore-3.42.0 → pulpcore-3.43.0}/pulpcore/app/serializers/publication.py

@@ -108,6 +108,21 @@ class RBACContentGuardSerializer(ContentGuardSerializer):
         fields = ContentGuardSerializer.Meta.fields + ("users", "groups")
 
 
+class CompositeContentGuardSerializer(ContentGuardSerializer, GetOrCreateSerializerMixin):
+    guards = DetailRelatedField(
+        many=True,
+        required=False,
+        help_text=_("List of ContentGuards to ask for access-permission."),
+        view_name_pattern=r"contentguards(-.*/.*)?-detail",
+        queryset=models.ContentGuard.objects.all(),
+        allow_null=True,
+    )
+
+    class Meta:
+        model = models.CompositeContentGuard
+        fields = ContentGuardSerializer.Meta.fields + ("guards",)
+
+
 class RBACContentGuardPermissionSerializer(serializers.Serializer):
     usernames = serializers.ListField(default=[])
     groupnames = serializers.ListField(default=[])

{pulpcore-3.42.0 → pulpcore-3.43.0}/pulpcore/app/viewsets/__init__.py

@@ -53,6 +53,7 @@ from .publication import (
     PublicationFilter,
     PublicationViewSet,
     RBACContentGuardViewSet,
+    CompositeContentGuardViewSet,
     ContentRedirectContentGuardViewSet,
     HeaderContentGuardViewSet,
     ArtifactDistributionViewSet,

{pulpcore-3.42.0 → pulpcore-3.43.0}/pulpcore/app/viewsets/custom_filters.py

@@ -355,12 +355,12 @@ class DistributionWithContentFilter(Filter):
         for dist in qs.exclude(publication=None).values("publication__repository_version", "pk"):
             versions_distributions[dist["publication__repository_version"]].append(dist["pk"])
 
-        for dist in qs.exclude(repository_version=None).values("repository_version", "pk"):
-            if not dist.cast().SERVE_FROM_PUBLICATION:
+        for dist in qs.exclude(repository_version=None).values("repository_version", "pulp_type"):
+            if not dist.detail_model.SERVE_FROM_PUBLICATION:
                 versions_distributions[dist["repository_version"]].append(dist["pk"])
 
         for dist in qs.exclude(repository=None).prefetch_related("repository__versions"):
-            if dist.cast().SERVE_FROM_PUBLICATION:
+            if dist.detail_model.SERVE_FROM_PUBLICATION:
                 versions = dist.repository.versions.values_list("pk", flat=True)
                 publications = Publication.objects.filter(
                     repository_version__in=versions, complete=True

{pulpcore-3.42.0 → pulpcore-3.43.0}/pulpcore/app/viewsets/publication.py

@@ -4,6 +4,8 @@ from django.db.models import Prefetch
 from django_filters import Filter
 from rest_framework import mixins, serializers
 
+from pulpcore.app.models.publication import CompositeContentGuard
+from pulpcore.app.serializers.publication import CompositeContentGuardSerializer
 from pulpcore.filters import BaseFilterSet
 from pulpcore.app.models import (
     ContentGuard,
@@ -427,6 +429,76 @@ class HeaderContentGuardViewSet(ContentGuardViewSet, RolesMixin):
     }
 
 
+class CompositeContentGuardViewSet(ContentGuardViewSet, RolesMixin):
+    """
+    Content guard that queries a list-of content-guards for access permissions.
+    """
+
+    endpoint_name = "composite"
+    queryset = CompositeContentGuard.objects.all()
+    serializer_class = CompositeContentGuardSerializer
+    queryset_filtering_required_permission = "core.view_compositecontentguard"
+
+    DEFAULT_ACCESS_POLICY = {
+        "statements": [
+            {
+                "action": ["list"],
+                "principal": "authenticated",
+                "effect": "allow",
+            },
+            {
+                "action": ["create"],
+                "principal": "authenticated",
+                "effect": "allow",
+                "condition": "has_model_or_domain_perms:core.add_compositecontentguard",
+            },
+            {
+                "action": ["retrieve", "my_permissions"],
+                "principal": "authenticated",
+                "effect": "allow",
+                "condition": "has_model_or_domain_or_obj_perms:core." "view_compositecontentguard",
+            },
+            {
+                "action": ["update", "partial_update"],
+                "principal": "authenticated",
+                "effect": "allow",
+                "condition": ("has_model_or_domain_or_obj_perms:core.change_compositecontentguard"),
+            },
+            {
+                "action": ["destroy"],
+                "principal": "authenticated",
+                "effect": "allow",
+                "condition": ("has_model_or_domain_or_obj_perms:core.delete_compositecontentguard"),
+            },
+            {
+                "action": ["list_roles", "add_role", "remove_role"],
+                "principal": "authenticated",
+                "effect": "allow",
+                "condition": (
+                    "has_model_or_domain_or_obj_perms:core.manage_roles_compositecontentguard"
+                ),
+            },
+        ],
+        "creation_hooks": [
+            {
+                "function": "add_roles_for_object_creator",
+                "parameters": {"roles": ["core.compositecontentguard_owner"]},
+            },
+        ],
+        "queryset_scoping": {"function": "scope_queryset"},
+    }
+    LOCKED_ROLES = {
+        "core.compositecontentguard_creator": ["core.add_compositecontentguard"],
+        "core.compositecontentguard_owner": [
+            "core.view_compositecontentguard",
+            "core.change_compositecontentguard",
+            "core.delete_compositecontentguard",
+            "core.manage_roles_compositecontentguard",
+        ],
+        "core.compositecontentguard_viewer": ["core.view_compositecontentguard"],
+    }
+
+
 class DistributionFilter(BaseFilterSet):
     # e.g.
     # /?name=foo

{pulpcore-3.42.0 → pulpcore-3.43.0}/pulpcore/tests/functional/__init__.py

@@ -39,6 +39,7 @@ from pulpcore.client.pulpcore import (
     ContentApi,
     ContentguardsApi,
     ContentguardsRbacApi,
+    ContentguardsCompositeApi,
     ContentguardsContentRedirectApi,
     ContentguardsHeaderApi,
     DomainsApi,
@@ -341,6 +342,11 @@ def header_contentguard_api_client(pulpcore_client):
     return ContentguardsHeaderApi(pulpcore_client)
 
 
+@pytest.fixture(scope="session")
+def composite_contentguard_api_client(pulpcore_client):
+    return ContentguardsCompositeApi(pulpcore_client)
+
+
 @pytest.fixture(scope="session")
 def orphans_cleanup_api_client(pulpcore_client):
     return OrphansCleanupApi(pulpcore_client)