Fixes #1193: deprecated JWT decode. #1194

jensens · 2021-08-12T21:20:41Z

verify as kwarg of decode was already deprecated in PyJWT and was removed in 2.0. Uses now options style to pass this on.
encode returns a str (Py3!) which can not be decoded again.
Update to use and require PyJWT 2.1.0.

Note:
After merge, buildout.coredev needs to be updated.
I prepared an separate PR for this: plone/buildout.coredev#735
This is difficult to test with our current Jenkins setup.

mister-roboto · 2021-08-12T21:31:51Z

@jensens thanks for creating this Pull Request and help improve Plone!

To ensure that these changes do not break other parts of Plone, the Plone test suite matrix needs to pass.

Whenever you feel that the pull request is ready to be tested, either start all jenkins jobs pull requests by yourself, or simply add a comment in this pull request stating:

@jenkins-plone-org please run jobs

With this simple comment all the jobs will be started automatically.

Happy hacking!

wesleybl · 2021-08-12T22:19:07Z

versions.cfg

+
+# recent pyjwt 
+pyjwt = 2.1.0


I would put a comment here to remove this pin after release Plone version with coredev PR.

It is needed for Plone 5.2 - which is still supported with Py3 here at master.

You won't update the version in the 5.2 branch of coredev? At least for Python 3?

Well, with conditional version sections this would be technically possible.

Since the 8.x series is not part of the release of Plone 5.2 (see https://github.com/plone/buildout.coredev/blob/5.2/versions.cfg#L197 and https://github.com/plone/buildout.coredev/blob/5.2/sources.cfg#L118, it uses the 7.x) I do not think this is possible.

We could add a note to the README which versions/ preconditions are needed for use of the 8 series in Plone 5.2.

Anyway, it's weird to say that version 8.x is compatible with Plone 5.2 and it will not be tested on coredev. If any unreleased changes in any package, break the version 8.x, we won't know about it until the Plone version is released.

@jensens @mauritsvanrees I am wondering if we should defer this to the next major release of plone.restapi (9.x). Once plone.volto has seen a first release, we will need to move some things around (e.g. the block behavior needs to move from restapi to plone.volto). The plan is to have stuff ready for the conference, so it won't take so long. What do you think?

It looks like the new code from this PR also works with the old PyJWT. At least the tests pass.
So I think we can include this code even in 7.x.x. Just don't touch setup.py.
On PY3, token.decode("utf-8") should still be done, but only if the token is bytes, which PyJWT 1.7.1 gives us.

So that is one option: be a bit smarter in the code so we can support both versions of PyJWT.

Other option is to only merge the current PR when plone.restapi master only targets PY 3, which seems to be what Timo is saying.

I don't really mind either way.

@jensens is there a way we can support both PyJWT versions as @mauritsvanrees suggests?

This would still be good to have, fixing a minor pain point and getting rid of an old dependency version.
But this seems like the kind of change we could do in a Plone 6.0 beta.

I rebased the branch.

tisto · 2021-08-18T21:11:55Z

@jenkins-plone-org please run jobs

jensens · 2021-08-20T10:02:39Z

@jenkins-plone-org please run jobs

jensens · 2021-08-30T08:19:58Z

@jenkins-plone-org please run jobs

jensens · 2021-08-30T19:02:59Z

@jenkins-plone-org please run jobs

jensens · 2021-08-30T19:10:57Z

Jenkins will always fail here. There no easy way to test a branch on buildout.coredev together with branch on a package. Except on an own branch of the branch of buildout.coredev - I did this here plone/buildout.coredev#737

jensens · 2021-11-14T22:51:45Z

Except on an own branch of the branch of buildout.coredev

Nope, won't work as well.

- Document usage of version 8 with Plone 5.2. - Bumb version on feature level.

…ork in P 5.2

jensens · 2022-03-23T08:52:01Z

Summary:

all done
this works only with newer PyJWT
- without Python 2 support
- but then also in Plone 5.2
tests are failing as unless buildout.coredev PyJWT pin is upgraded, it pins the old version.

mauritsvanrees · 2022-03-23T14:45:30Z

For me, it would be fine to let plone.restapi master use latest pyjwt, as the branch is already for Python 3 only. New minor version. Maybe new major version, but for me it would not be needed.

You changed the versions.cfg here to pin pyjwt = 2.1.0, but this file is currently not used. Maybe base.cfg should extend it. @tisto may know how this is intended.

tisto · 2022-03-25T04:57:29Z

setup.py

        "Framework :: Plone :: Core",
        "Intended Audience :: Developers",
        "Operating System :: OS Independent",
        "Programming Language :: Python",
        "Programming Language :: Python :: 3.6",
        "Programming Language :: Python :: 3.7",
        "Programming Language :: Python :: 3.8",
+        "Programming Language :: Python :: 3.9",


@jensens Python 3.9 is not officially supported or tested with plone.restapi yet: https://github.com/plone/plone.restapi/blob/master/.github/workflows/tests.yml#L9

It is tested in coredev.

Yes, Python 3.9 must work for Plone 6, so running tests with it here is important. I added issue #1345 to not forget about it.

Otherwise the buildout fails since the ES6 merges yesterday. See [this GHA run](https://github.com/plone/plone.restapi/runs/5687219593?check_suite_focus=true#step:11:203).

mauritsvanrees · 2022-03-25T12:05:18Z

Green now.
(Except plone-coredev 6, which can only pass when we update the PyJWT pin there, which we can only do after we merge this PR. Chicken versus egg.)

Takes code from #1194 Fixes #1193

mauritsvanrees · 2022-04-19T18:11:08Z

I am tired of waiting on someone to either approve and merge this, or say what needs to change.
So I have made a new PR #1377. It takes the main change of the current PR, but makes it conditional: the code works on both PyJWT version 1 and 2. That change should be easier to make a decision on and merge soon, instead of being in limbo since August.
The cost is an extra dependency (importlib-metadata) on Python 3.7 and lower, but this is likely already pulled in by other packages, and it is already pinned by Plone 5.2 and 6.0. (I could have used pkg_resources, but that is apparently deprecated for this use case.)

Branch: refs/heads/master Date: 2022-04-19T17:46:53+02:00 Author: Maurits van Rees (mauritsvanrees) <maurits@vanrees.org> Commit: plone/plone.restapi@8a3c019 Make the PAS plugin compatible with PyJWT 1 and 2. Takes code from plone/plone.restapi#1194 Fixes plone/plone.restapi#1193 Files changed: A news/1193.bugfix M setup.py M src/plone/restapi/pas/plugin.py Repository: plone.restapi Branch: refs/heads/master Date: 2022-04-22T11:34:51+02:00 Author: Jens W. Klein (jensens) <jk@kleinundpartner.at> Commit: plone/plone.restapi@30ec4d8 Merge pull request #1377 from plone/maurits-support-pyjwt-1-and-2 Make the PAS plugin compatible with PyJWT 1 and 2. Files changed: A news/1193.bugfix M setup.py M src/plone/restapi/pas/plugin.py

jensens · 2022-04-22T09:35:33Z

solved with bbb #1377

jensens closed this Aug 12, 2021

jensens force-pushed the fix-and-update-deprecated-jwt branch from 376db45 to 34dc327 Compare August 12, 2021 21:30

jensens reopened this Aug 12, 2021

jensens force-pushed the fix-and-update-deprecated-jwt branch from 5e1a135 to 4d044a4 Compare August 12, 2021 21:34

plone deleted a comment from mister-roboto Aug 12, 2021

jensens force-pushed the fix-and-update-deprecated-jwt branch from 4d044a4 to 9a2ccf0 Compare August 12, 2021 21:43

jensens mentioned this pull request Aug 12, 2021

[6.0] Update PyJWT to 2.3.0 plone/buildout.coredev#735

Closed

jensens marked this pull request as ready for review August 12, 2021 22:17

jensens requested review from ericof and tisto August 12, 2021 22:18

wesleybl reviewed Aug 12, 2021

View reviewed changes

jensens force-pushed the fix-and-update-deprecated-jwt branch 2 times, most recently from 1855487 to 094db97 Compare August 30, 2021 19:01

jensens mentioned this pull request Aug 30, 2021

NOT FOR MERGE: Test restapi change with coredev update. plone/buildout.coredev#737

Closed

tisto modified the milestones: 9.x.x, Plone 6 Sep 25, 2021

jensens force-pushed the fix-and-update-deprecated-jwt branch from 094db97 to 968d314 Compare November 14, 2021 22:50

mauritsvanrees mentioned this pull request Nov 15, 2021

Latest alpha release is not working with Plone 5.2.6 - plone.restapi 7.5.0 plone/plone.volto#22

Closed

jensens added 2 commits March 23, 2022 09:44

Fix #1193 - deprecated JWT decode. Update to usePyJWT 2.1.0

ce08572

- Document usage of version 8 with Plone 5.2. - Bumb version on feature level.

PR now on MS targeting 9.x with Plone 6 only support, remove how to w…

4b0d5ac

…ork in P 5.2

jensens force-pushed the fix-and-update-deprecated-jwt branch from cc0c76e to 4b0d5ac Compare March 23, 2022 08:44

tisto reviewed Mar 25, 2022

View reviewed changes

tisto and others added 2 commits March 25, 2022 05:59

Pin pyjwt in Plone 5.2/6.0 buildouts

d41ba41

Temporarily include mockup egg on Plone 6.

3fa8f82

Otherwise the buildout fails since the ES6 merges yesterday. See [this GHA run](https://github.com/plone/plone.restapi/runs/5687219593?check_suite_focus=true#step:11:203).

stevepiercy mentioned this pull request Apr 5, 2022

Revert "Import docs into plone/documentation" #1350

Closed

mauritsvanrees added a commit that referenced this pull request Apr 19, 2022

Make the PAS plugin compatible with PyJWT 1 and 2.

cb88aef

Takes code from #1194 Fixes #1193

mauritsvanrees mentioned this pull request Apr 19, 2022

Make the PAS plugin compatible with PyJWT 1 and 2. #1377

Merged

mauritsvanrees added a commit that referenced this pull request Apr 19, 2022

Make the PAS plugin compatible with PyJWT 1 and 2.

8a3c019

Takes code from #1194 Fixes #1193

jensens closed this Apr 22, 2022

jensens deleted the fix-and-update-deprecated-jwt branch April 22, 2022 09:35

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fixes #1193: deprecated JWT decode. #1194

Fixes #1193: deprecated JWT decode. #1194

jensens commented Aug 12, 2021 •

edited

Loading

mister-roboto commented Aug 12, 2021

wesleybl Aug 12, 2021

jensens Aug 12, 2021

wesleybl Aug 12, 2021

jensens Aug 12, 2021 •

edited

Loading

wesleybl Aug 12, 2021

tisto Sep 25, 2021

mauritsvanrees Sep 27, 2021

tisto Feb 8, 2022

mauritsvanrees Mar 22, 2022

jensens Mar 23, 2022

tisto commented Aug 18, 2021

jensens commented Aug 20, 2021

jensens commented Aug 30, 2021

jensens commented Aug 30, 2021

jensens commented Aug 30, 2021

jensens commented Nov 14, 2021

jensens commented Mar 23, 2022

mauritsvanrees commented Mar 23, 2022

tisto Mar 25, 2022

mauritsvanrees Mar 25, 2022

jensens Mar 25, 2022

mauritsvanrees commented Mar 25, 2022

mauritsvanrees commented Apr 19, 2022

jensens commented Apr 22, 2022

Fixes #1193: deprecated JWT decode. #1194

Fixes #1193: deprecated JWT decode. #1194

Conversation

jensens commented Aug 12, 2021 • edited Loading

mister-roboto commented Aug 12, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jensens Aug 12, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tisto commented Aug 18, 2021

jensens commented Aug 20, 2021

jensens commented Aug 30, 2021

jensens commented Aug 30, 2021

jensens commented Aug 30, 2021

jensens commented Nov 14, 2021

jensens commented Mar 23, 2022

mauritsvanrees commented Mar 23, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mauritsvanrees commented Mar 25, 2022

mauritsvanrees commented Apr 19, 2022

jensens commented Apr 22, 2022

jensens commented Aug 12, 2021 •

edited

Loading

jensens Aug 12, 2021 •

edited

Loading