Skip to content

Commit 4841c5b

Browse files
woodruffwwoodruffw
authored
OIDC macaroon minting for GitHub (#11272)
* warehouse: make `Macaroon <-> User` optional Macaroons were previously strongly associated with individual users. This was the correct association for user-minted tokens, but not generally. In particular, ODIC-minted tokens are associated with projects themselves and not the user who registered the OIDC provider. * migrations: rebase * warehouse: oidc minting boilerplate * oidc/views: more boilerplate * dev, tests, warehouse: NullOIDCProvider * warehouse: end-to-end OIDC minting functionality * macaroons/services: docs * warehouse/locale: `make translations` * oidc/views: remove import * warehouse: more DB macaroon modeling * warehouse, tests: add missing relationship * warehouse/macaroons: lint fixes * tests, warehouse: update macaroon handling, OIDC minting view * warehouse/forklift: begin supporting non-user identities * warehouse: fill in project ACLs for project identities * warehouse: fix link in project history * utils/security_policy: handle unknown identities * oidc/services: NullOIDCProviderService.verify_for_project actually checks the project * warehouse/locale: `make translations` * services, test_services: fix options, add some null OIDC tests * warehouse: make `JournalEvent.submitted_by` optional * warehouse: create JournalEvent events for nonusers, update template * oidc/views: tweak error message * forklift, oidc: remove "ephemeral" language Also make the error response more structured when minting. Signed-off-by: William Woodruff <[email protected]> * warehouse/migrations: rebase migration Signed-off-by: William Woodruff <[email protected]> * warehouse: refactor OIDCProvider retrieval Still needs more work. Signed-off-by: William Woodruff <[email protected]> * warehouse/migrations: remove project_id migration Unneeded Signed-off-by: William Woodruff <[email protected]> * warehouse/macaroons: update security policy to handle multiple projects in macaroon Signed-off-by: William Woodruff <[email protected]> * warehouse: more migration cleanup Signed-off-by: William Woodruff <[email protected]> * oidc/services: add find_provider to NullOIDCProviderService Signed-off-by: William Woodruff <[email protected]> * macaroons/interfaces: update docstring, iface Signed-off-by: William Woodruff <[email protected]> * warehouse/{macaroons,oidc}: bugfixes, fix query Almost there. Signed-off-by: William Woodruff <[email protected]> * Use OIDCProvider as an identity Signed-off-by: William Woodruff <[email protected]> * manage/history: render OIDC events more reasonably Signed-off-by: William Woodruff <[email protected]> * manage/views: remove the OIDC provider if it's fully orphaned This, in turn, cascades and ensures that we delete any lingering Macaroons associated with the provider (whether expired or not). Signed-off-by: William Woodruff <[email protected]> * macaroons/models: fix constraint name Signed-off-by: William Woodruff <[email protected]> * Avoid DB queries, fail DB lookup gracefully Signed-off-by: William Woodruff <[email protected]> * migrations: rebase Signed-off-by: William Woodruff <[email protected]> * migrations: rebase Signed-off-by: William Woodruff <[email protected]> * Re-remove template Git merge hell. Signed-off-by: William Woodruff <[email protected]> * migrations: rebase Signed-off-by: William Woodruff <[email protected]> * oidc/services: fix the find_provider API Signed-off-by: William Woodruff <[email protected]> * tests/oidc: begin fixing tests Signed-off-by: William Woodruff <[email protected]> * warehouse/migrations: rebase Signed-off-by: William Woodruff <[email protected]> * tests/unit: fix forklift (legacy) tests This involves setting the security policy correctly, since we now check `request.identity` in addition to `request.user`. Signed-off-by: William Woodruff <[email protected]> * tests/unit: fix, fill in macaroon and manage/views tests Signed-off-by: William Woodruff <[email protected]> * warehouse: lint fixes Signed-off-by: William Woodruff <[email protected]> * tests: add GitHubProviderFactory, chip away at coverage Signed-off-by: William Woodruff <[email protected]> * tests: fill in OIDCProviderCaveat tests Signed-off-by: William Woodruff <[email protected]> * macaroons/security_policy: reduce control flow Each macaroon has a relationship of user XOR OIDC provider, so we can simply fall back here. Signed-off-by: William Woodruff <[email protected]> * tests/unit: fill in Macaroon service coverage, fix tests for API changes Signed-off-by: William Woodruff <[email protected]> * tests/unit: more forklift/legacy coverage Signed-off-by: William Woodruff <[email protected]> * tests/unit: coverage for management views, OIDC services Signed-off-by: William Woodruff <[email protected]> * warehouse, tests: OIDC utils coverage Signed-off-by: William Woodruff <[email protected]> * tests, warehouse: add OIDC view coverage Signed-off-by: William Woodruff <[email protected]> * warehouse, tests: feature flags for OIDC token minting This makes the API route respect the same `warehouse.oidc.enabled` and admin flag as the other OIDC functionality. Signed-off-by: William Woodruff <[email protected]> * warehouse: `make translations` Signed-off-by: William Woodruff <[email protected]> * migrations: rebase Signed-off-by: William Woodruff <[email protected]> * oidc: use EventTag, update API route Signed-off-by: William Woodruff <[email protected]> * templates: put provider spec in <code> Signed-off-by: William Woodruff <[email protected]> * warehouse, tests: display token expiration information, if present Signed-off-by: William Woodruff <[email protected]> * warehouse: `make translations` Signed-off-by: William Woodruff <[email protected]> * oidc/views: remove old TODO Signed-off-by: William Woodruff <[email protected]> * macaroons/services: avoid deprecated API use Signed-off-by: William Woodruff <[email protected]> * warehouse, tests: restrict JSON body to dictionaries Signed-off-by: William Woodruff <[email protected]> * tests, warehouse: distinguish between invalid and missing tokens Signed-off-by: William Woodruff <[email protected]> * caveats: clarify comment Signed-off-by: William Woodruff <[email protected]> * tests, warehouse: distinguish short-lived tokens, render them differently Signed-off-by: William Woodruff <[email protected]> * warehouse: `make translations` Signed-off-by: William Woodruff <[email protected]> * tests: fix, bringup coverage Signed-off-by: William Woodruff <[email protected]> * tests, warehouse: avoid rendering the OIDC provider spec Signed-off-by: William Woodruff <[email protected]> * tests: lint Signed-off-by: William Woodruff <[email protected]> * tests, warehouse: expose verified claims with the provider We can eventually use this to put more information in the token creation event, for nicer renderings. Signed-off-by: William Woodruff <[email protected]> * publishing: put each publisher's URL in the table Signed-off-by: William Woodruff <[email protected]> * warehouse: `make translations` Signed-off-by: William Woodruff <[email protected]> * oidc: refactor claim handling Tests not updated, yet. Signed-off-by: William Woodruff <[email protected]> * tests, warehouse: update tests, bring coverage back up Signed-off-by: William Woodruff <[email protected]> * warehouse/migrations: rebase Signed-off-by: William Woodruff <[email protected]> * warehouse, tests: use provider URL in macaroon comment Signed-off-by: William Woodruff <[email protected]> * warehouse/migrations: rebase Signed-off-by: William Woodruff <[email protected]> Signed-off-by: William Woodruff <[email protected]>
1 parent 66dde44 commit 4841c5b

38 files changed

+1728
-364
lines changed

‎dev/environment

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@ BREACHED_PASSWORDS=warehouse.accounts.NullPasswordBreachedService
3939

4040
MALWARE_CHECK_BACKEND=warehouse.malware.services.PrinterMalwareCheckService
4141

42+
OIDC_BACKEND=warehouse.oidc.services.NullOIDCProviderService
43+
4244
METRICS_BACKEND=warehouse.metrics.DataDogMetrics host=notdatadog
4345

4446
STATUSPAGE_URL=https://2p66nmmycsj3.statuspage.io

‎tests/common/db/oidc.py

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Licensed under the Apache License, Version 2.0 (the "License");
2+
# you may not use this file except in compliance with the License.
3+
# You may obtain a copy of the License at
4+
#
5+
# http://www.apache.org/licenses/LICENSE-2.0
6+
#
7+
# Unless required by applicable law or agreed to in writing, software
8+
# distributed under the License is distributed on an "AS IS" BASIS,
9+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
10+
# See the License for the specific language governing permissions and
11+
# limitations under the License.
12+
13+
import factory
14+
15+
from warehouse.oidc.models import GitHubProvider
16+
17+
from .base import WarehouseFactory
18+
19+
20+
class GitHubProviderFactory(WarehouseFactory):
21+
class Meta:
22+
model = GitHubProvider
23+
24+
id = factory.Faker("uuid4", cast_to=None)
25+
repository_name = "foo"
26+
repository_owner = "bar"
27+
repository_owner_id = 123
28+
workflow_filename = "example.yml"

‎tests/functional/test_templates.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
"format_package_type": "warehouse.filters:format_package_type",
3333
"parse_version": "warehouse.filters:parse_version",
3434
"localize_datetime": "warehouse.filters:localize_datetime",
35+
"ctime": "warehouse.filters:ctime",
3536
"canonicalize_name": "packaging.utils:canonicalize_name",
3637
}
3738

0 commit comments

Comments
 (0)