pulpcore 3.85.26__tar.gz → 3.85.27__tar.gz

{pulpcore-3.85.26 → pulpcore-3.85.27}/CHANGES.md

@@ -8,6 +8,30 @@
 
 [//]: # (towncrier release notes start)
 
+## 3.85.27 (2026-07-28) {: #3.85.27 }
+
+### REST API {: #3.85.27-rest-api }
+
+#### Bugfixes {: #3.85.27-rest-api-bugfix }
+
+- Fixed domain list returning all domains to authenticated users instead of only domains they can view.
+  [#7898](https://github.com/pulp/pulpcore/issues/7898)
+- Stopped shipping an insecure default as DJANGO_SECRET.
+
+### Plugin API {: #3.85.27-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.85.27-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.85.27-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.85.26 (2026-07-20) {: #3.85.26 }
 
 ### REST API {: #3.85.26-rest-api }

{pulpcore-3.85.26 → pulpcore-3.85.27}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulpcore
-Version: 3.85.26
+Version: 3.85.27
 Summary: Pulp Django Application and Related Modules
 Author-email: Pulp Team <pulp-list@redhat.com>
 Project-URL: Homepage, https://pulpproject.org

{pulpcore-3.85.26 → pulpcore-3.85.27}/pulp_certguard/app/__init__.py

@@ -6,6 +6,6 @@ class PulpCertGuardPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_certguard.app"
     label = "certguard"
-    version = "3.85.26"
+    version = "3.85.27"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.85.26 → pulpcore-3.85.27}/pulp_file/app/__init__.py

@@ -8,6 +8,6 @@ class PulpFilePluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_file.app"
     label = "file"
-    version = "3.85.26"
+    version = "3.85.27"
     python_package_name = "pulpcore"
     domain_compatible = True

{pulpcore-3.85.26 → pulpcore-3.85.27}/pulp_file/tests/functional/api/test_domains.py

@@ -2,8 +2,8 @@ import json
 import uuid
 
 import pytest
+from django.conf import settings
 
-from pulpcore.app import settings
 from pulpcore.tests.functional.utils import download_file, generate_iso
 
 pytestmark = pytest.mark.skipif(not settings.DOMAIN_ENABLED, reason="Domains not enabled.")

{pulpcore-3.85.26 → pulpcore-3.85.27}/pulp_file/tests/functional/api/test_pulp_export.py

@@ -1,8 +1,8 @@
 import uuid
 
 import pytest
+from django.conf import settings
 
-from pulpcore.app import settings
 from pulpcore.client.pulpcore.exceptions import ApiException
 from pulpcore.constants import TASK_STATES
 

{pulpcore-3.85.26 → pulpcore-3.85.27}/pulpcore/app/access_policy.py

@@ -1,9 +1,9 @@
 from copy import deepcopy
 
+from django.conf import settings
 from rest_access_policy import AccessPolicy
 from rest_framework.exceptions import APIException
 
-from pulpcore.app import settings
 from pulpcore.app.models import AccessPolicy as AccessPolicyModel
 from pulpcore.app.util import get_view_urlpattern, get_viewset_for_model
 

{pulpcore-3.85.26 → pulpcore-3.85.27}/pulpcore/app/apps.py

@@ -237,7 +237,7 @@ class PulpAppConfig(PulpPluginAppConfig):
     label = "core"
 
     # The version of this app
-    version = "3.85.26"
+    version = "3.85.27"
 
     # The python package name providing this app
     python_package_name = "pulpcore"

{pulpcore-3.85.26 → pulpcore-3.85.27}/pulpcore/app/authentication.py

@@ -5,6 +5,7 @@ from binascii import Error as Base64DecodeError
 from gettext import gettext as _
 
 import jq
+from django.conf import settings
 from django.contrib.auth import authenticate
 from django.contrib.auth.backends import RemoteUserBackend
 from rest_framework.authentication import (
@@ -16,8 +17,6 @@ from rest_framework.authentication import (
 )
 from rest_framework.exceptions import AuthenticationFailed
 
-from pulpcore.app import settings
-
 _logger = logging.getLogger(__name__)
 
 

{pulpcore-3.85.26 → pulpcore-3.85.27}/pulpcore/app/redis_connection.py

@@ -1,8 +1,7 @@
+from django.conf import settings
 from redis import Redis
 from redis.asyncio import Redis as aRedis
 
-from pulpcore.app.settings import settings
-
 _conn = None
 _a_conn = None
 

{pulpcore-3.85.26 → pulpcore-3.85.27}/pulpcore/app/serializers/exporter.py

@@ -2,10 +2,11 @@ import os
 import re
 from gettext import gettext as _
 
+from django.conf import settings
 from rest_framework import serializers
 from rest_framework.validators import UniqueValidator
 
-from pulpcore.app import models, settings
+from pulpcore.app import models
 from pulpcore.app.serializers import (
     DetailIdentityField,
     DetailRelatedField,

{pulpcore-3.85.26 → pulpcore-3.85.27}/pulpcore/app/serializers/importer.py

@@ -1,11 +1,12 @@
 import os
 from gettext import gettext as _
 
+from django.conf import settings
 from django.core.exceptions import ObjectDoesNotExist
 from rest_framework import serializers
 from rest_framework.validators import UniqueValidator
 
-from pulpcore.app import models, settings
+from pulpcore.app import models
 from pulpcore.app.serializers import (
     DetailIdentityField,
     ImportIdentityField,

{pulpcore-3.85.26 → pulpcore-3.85.27}/pulpcore/app/serializers/repository.py

@@ -3,10 +3,11 @@ from gettext import gettext as _
 from urllib.parse import urlparse
 
 from cryptography.x509 import load_pem_x509_certificate
+from django.conf import settings
 from rest_framework import fields, serializers
 from rest_framework_nested.serializers import NestedHyperlinkedModelSerializer
 
-from pulpcore.app import models, settings
+from pulpcore.app import models
 from pulpcore.app.serializers import (
     DetailIdentityField,
     DetailRelatedField,

{pulpcore-3.85.26 → pulpcore-3.85.27}/pulpcore/app/settings.py

@@ -12,7 +12,6 @@ import sys
 from contextlib import suppress
 from importlib import import_module
 from importlib.metadata import entry_points
-from logging import getLogger
 from pathlib import Path
 
 from cryptography.fernet import Fernet
@@ -88,9 +87,6 @@ CHUNKED_UPLOAD_DIR = "upload"
 # List of upload handler classes to be applied in order.
 FILE_UPLOAD_HANDLERS = ("pulpcore.app.files.HashingFileUploadHandler",)
 
-# SECURITY WARNING: this should be set to a unique, unpredictable value
-SECRET_KEY = "SECRET"
-
 # Key used to encrypt fields in the database
 DB_ENCRYPTION_KEY = "/etc/pulp/certs/database_fields.symmetric.key"
 
@@ -514,6 +510,49 @@ def otel_middleware_hook(settings):
     return data
 
 
+def api_root_hook(settings):
+    # protocol://host:port/{API_ROOT}{domain}/api/{version}/
+    # All of the below are DEPRECATED, and should be replaced by calling
+    # pulpcore.plugin.find_url.find_api_root() (q.v.)
+    if settings.API_ROOT_REWRITE_HEADER:
+        api_root = "/<path:api_root>/"
+    else:
+        api_root = settings.API_ROOT
+    return {
+        "V3_API_ROOT": api_root + "api/v3/",
+        "V3_DOMAIN_API_ROOT": api_root + "<slug:pulp_domain>/api/v3/",
+        "V3_API_ROOT_NO_FRONT_SLASH": (api_root + "api/v3/").lstrip("/"),
+        "V3_DOMAIN_API_ROOT_NO_FRONT_SLASH": (api_root + "<slug:pulp_domain>/api/v3/").lstrip("/"),
+    }
+
+
+def forbidden_checksums_hook(settings):
+    return {
+        "FORBIDDEN_CHECKSUMS": sorted(
+            set(constants.ALL_KNOWN_CONTENT_CHECKSUMS).difference(
+                settings.ALLOWED_CONTENT_CHECKSUMS
+            )
+        ),
+    }
+
+
+def validate_db_encryption_key_hook(settings):
+    if Path(sys.argv[0]).name in ["pytest", "sphinx-build"] or (
+        len(sys.argv) >= 2 and sys.argv[1] in ["collectstatic", "openapi"]
+    ):
+        return {}
+    try:
+        with open(settings.DB_ENCRYPTION_KEY, "rb") as key_file:
+            Fernet(key_file.read())
+    except Exception as ex:
+        raise ImproperlyConfigured(
+            "Could not load DB_ENCRYPTION_KEY file '{file}': {err}".format(
+                file=settings.DB_ENCRYPTION_KEY, err=ex
+            )
+        )
+    return {}
+
+
 del preload_settings
 
 settings = DjangoDynaconf(
@@ -533,36 +572,12 @@ settings = DjangoDynaconf(
         json_header_auth_validator,
         authentication_json_header_openapi_security_scheme_validator,
     ],
-    post_hooks=(otel_middleware_hook,),
-)
-
-_logger = getLogger(__name__)
-
-
-if not (
-    Path(sys.argv[0]).name in ["pytest", "sphinx-build"]
-    or (len(sys.argv) >= 2 and sys.argv[1] in ["collectstatic", "openapi"])
-):
-    try:
-        with open(DB_ENCRYPTION_KEY, "rb") as key_file:
-            Fernet(key_file.read())
-    except Exception as ex:
-        raise ImproperlyConfigured(
-            ("Could not load DB_ENCRYPTION_KEY file '{file}': {err}").format(
-                file=DB_ENCRYPTION_KEY, err=ex
-            )
-        )
-
-
-FORBIDDEN_CHECKSUMS = set(constants.ALL_KNOWN_CONTENT_CHECKSUMS).difference(
-    ALLOWED_CONTENT_CHECKSUMS
+    post_hooks=(
+        otel_middleware_hook,
+        api_root_hook,
+        forbidden_checksums_hook,
+        validate_db_encryption_key_hook,
+    ),
 )
 
-if settings.API_ROOT_REWRITE_HEADER:
-    api_root = "/<path:api_root>/"
-else:
-    api_root = settings.API_ROOT
-settings.set("V3_API_ROOT", api_root + "api/v3/")  # Not user configurable
-settings.set("V3_DOMAIN_API_ROOT", api_root + "<slug:pulp_domain>/api/v3/")
-settings.set("V3_API_ROOT_NO_FRONT_SLASH", settings.V3_API_ROOT.lstrip("/"))
-settings.set("V3_DOMAIN_API_ROOT_NO_FRONT_SLASH", settings.V3_DOMAIN_API_ROOT.lstrip("/"))
+# HERE ENDS DYNACONF EXTENSION LOAD (No more code below this line)

{pulpcore-3.85.26 → pulpcore-3.85.27}/pulpcore/app/views/importer.py

@@ -2,11 +2,11 @@ import json
 import os
 from gettext import gettext as _
 
+from django.conf import settings
 from drf_spectacular.utils import extend_schema
 from rest_framework.response import Response
 from rest_framework.views import APIView
 
-from pulpcore.app import settings
 from pulpcore.app.serializers import PulpImportCheckResponseSerializer, PulpImportCheckSerializer
 
 

{pulpcore-3.85.26 → pulpcore-3.85.27}/pulpcore/app/viewsets/domain.py

@@ -49,6 +49,7 @@ class DomainViewSet(
     serializer_class = DomainSerializer
     endpoint_name = "domains"
     filterset_class = DomainFilter
+    queryset_filtering_required_permission = "core.view_domain"
     DEFAULT_ACCESS_POLICY = {
         "statements": [
             {

{pulpcore-3.85.26 → pulpcore-3.85.27}/pulpcore/cache/cache.py

@@ -5,6 +5,7 @@ from functools import wraps
 
 from aiohttp.web import FileResponse, HTTPSuccessful, Request, Response, StreamResponse
 from aiohttp.web_exceptions import HTTPFound
+from django.conf import settings
 from django.http import FileResponse as ApiFileResponse
 from django.http import HttpResponse, HttpResponseRedirect
 from redis import ConnectionError
@@ -16,7 +17,6 @@ from pulpcore.app.redis_connection import (
     get_async_redis_connection,
     get_redis_connection,
 )
-from pulpcore.app.settings import settings
 from pulpcore.metrics import artifacts_size_counter
 from pulpcore.responses import ArtifactResponse
 

{pulpcore-3.85.26 → pulpcore-3.85.27}/pulpcore/tasking/kafka.py

@@ -6,7 +6,7 @@ from typing import Optional
 
 from django.conf import settings
 
-_bootstrap_servers = settings.get("KAFKA_BOOTSTRAP_SERVERS")
+_bootstrap_servers = getattr(settings, "KAFKA_BOOTSTRAP_SERVERS")
 
 
 if _bootstrap_servers is None:

{pulpcore-3.85.26 → pulpcore-3.85.27}/pulpcore/tests/functional/api/test_auth.py

@@ -8,8 +8,7 @@ import json
 from base64 import b64encode
 
 import pytest
-
-from pulpcore.app import settings
+from django.conf import settings
 
 
 @pytest.mark.parallel

{pulpcore-3.85.26 → pulpcore-3.85.27}/pulpcore/tests/functional/api/test_crud_domains.py

@@ -353,3 +353,41 @@ def test_set_label_on_domain(pulpcore_bindings, domain_factory, gen_user):
         response = pulpcore_bindings.DomainsApi.unset_label(domain.pulp_href, {"key": "abc"})
         assert response.key == "abc"
         assert response.value == "def"
+
+
+@pytest.mark.parallel
+def test_domain_list_queryset_scoping(pulpcore_bindings, gen_user, gen_object_with_cleanup):
+    """Test that domain list is scoped to domains the user can view."""
+    body = {
+        "name": str(uuid.uuid4()),
+        "storage_class": "pulpcore.app.models.storage.FileSystem",
+        "storage_settings": {"MEDIA_ROOT": ""},
+    }
+    domain = gen_object_with_cleanup(pulpcore_bindings.DomainsApi, body)
+    gen_object_with_cleanup(pulpcore_bindings.DomainsApi, {**body, "name": str(uuid.uuid4())})
+
+    # Authenticated users without view_domain see no domains
+    with gen_user():
+        assert pulpcore_bindings.DomainsApi.list().count == 0
+
+    # Object-level domain_viewer can see only that domain
+    with gen_user(object_roles=[("core.domain_viewer", domain.pulp_href)]):
+        domains = pulpcore_bindings.DomainsApi.list()
+        assert domains.count == 1
+        assert domains.results[0].pulp_href == domain.pulp_href
+
+    # Object-level domain_owner can see only that domain
+    with gen_user(object_roles=[("core.domain_owner", domain.pulp_href)]):
+        domains = pulpcore_bindings.DomainsApi.list()
+        assert domains.count == 1
+        assert domains.results[0].pulp_href == domain.pulp_href
+
+    # Domain creator sees domains they create (via creation_hooks), not others
+    creator = gen_user(model_roles=["core.domain_creator"])
+    with creator:
+        created = gen_object_with_cleanup(
+            pulpcore_bindings.DomainsApi, {**body, "name": str(uuid.uuid4())}
+        )
+        domains = pulpcore_bindings.DomainsApi.list()
+        assert domains.count == 1
+        assert domains.results[0].pulp_href == created.pulp_href

{pulpcore-3.85.26 → pulpcore-3.85.27}/pulpcore/tests/functional/api/using_plugin/test_filesystemexport.py

@@ -8,8 +8,8 @@ the case.
 import uuid
 
 import pytest
+from django.conf import settings
 
-from pulpcore.app import settings
 from pulpcore.client.pulp_file import RepositorySyncURL
 from pulpcore.client.pulpcore.exceptions import ApiException
 

{pulpcore-3.85.26 → pulpcore-3.85.27}/pulpcore/tests/functional/api/using_plugin/test_pulpimport.py

@@ -11,8 +11,8 @@ import uuid
 from pathlib import Path
 
 import pytest
+from django.conf import settings
 
-from pulpcore.app import settings
 from pulpcore.client.pulp_file import RepositorySyncURL
 from pulpcore.client.pulpcore.exceptions import ApiException
 

{pulpcore-3.85.26 → pulpcore-3.85.27}/pulpcore.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulpcore
-Version: 3.85.26
+Version: 3.85.27
 Summary: Pulp Django Application and Related Modules
 Author-email: Pulp Team <pulp-list@redhat.com>
 Project-URL: Homepage, https://pulpproject.org

{pulpcore-3.85.26 → pulpcore-3.85.27}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = 'setuptools.build_meta'
 
 [project]
 name = "pulpcore"
-version = "3.85.26"
+version = "3.85.27"
 description = "Pulp Django Application and Related Modules"
 readme = "README.md"
 authors = [
@@ -206,7 +206,7 @@ ignore = [
 [tool.bumpversion]
 # This section is managed by the plugin template. Do not edit manually.
 
-current_version = "3.85.26"
+current_version = "3.85.27"
 commit = false
 tag = false
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<alpha>0a)?(?P<patch>\\d+)(\\.(?P<release>[a-z]+))?"
@@ -266,7 +266,6 @@ filename = "./pyproject.toml"
 search = "version = \"{current_version}\""
 replace = "version = \"{new_version}\""
 
-
 [tool.ruff]
 # This section is managed by the plugin template. Do not edit manually.
 line-length = 100
@@ -278,6 +277,7 @@ extend-exclude = [
 
 [tool.ruff.lint]
 # This section is managed by the plugin template. Do not edit manually.
+select = ["E4", "E7", "E9", "F"]
 extend-select = [
   "I",
   "INT",
@@ -288,6 +288,7 @@ extend-select = [
 [tool.ruff.lint.flake8-tidy-imports.banned-api]
 # This section is managed by the plugin template. Do not edit manually.
 "distutils".msg = "The 'distutils' module has been deprecated since Python 3.9."
+"pulpcore.app.settings".msg = "Always import 'settings' from 'django.conf' instead."
 
 [tool.ruff.lint.isort]
 # This section is managed by the plugin template. Do not edit manually.