Add ExpiryCaveat

[woodruffw]

Closes #10792.

Closes #6255.

[woodruffw]

This needs more testing, but the basic idea:

• All current macaroons continue to function as expected, and nothing about the construction of normal macaroons (i.e., ones minted by users manually through the PyPI website) is changed.

• In the future, macaroons minted via the OIDC JWT consumption route will include an additional expiry caveat, with two fields: nbf to indicate that the macaroon must not be used before the given timestamp, and exp to indicate when the macaroon ceases to be valid.

[woodruffw]

Marking as ready for review since this is in a stable state, but see comments above about the current approach.

[di]

This looks good, but I didn't give it a super deep review. I had one high level question: how will this be backwards-compatible for macaroons created before this change? The migration is just dropping one column and adding a new one without doing a data migration.

[woodruffw]

I had one high level question: how will this be backwards-compatible for macaroons created before this change?

Yeah, this was an oversight on my part. This will break the UI for pre-existing macaroons, at least in the form they're recorded in the DB.

The migration should probably just rename the column rather than dropping it and inserting a new one, since interior data is the same. I'll fix that now.

[woodruffw]

Blocked on: #11157.

[di]

#11157 has been merged!

[woodruffw]

Excellent! I'll de-conflict here.

[woodruffw]

N.B.: 1f65cff is a naive pick of the original changeset, so it isn't ready for review yet. I'll do another pass over it later today.

Edit: Done.

[woodruffw]

I also confirmed locally that this does not break verification of current tokens (i.e., ones missing an expiry caveat).

[fschulze]

What is the deployment policy of pypi.org? Is everything on main automatically deployed? If not, where can I see what version is deployed? In other words, how can I see that changes like this are available on pypi.org?

[di]

@fschulze Everything is automatically deployed within 5-10 minutes after merge.

[woodruffw]

But also, note that these changes aren't user-facing yet! We don't currently allow users to create API tokens with expiry restrictions.

[fschulze]

@woodruffw doesn't matter for my use case. I want to derive unique upload tokens for pushing releases with devpi. The upload is done on the server side and the server currently sees the token/password. With the expiration and the project caveat I can create unique tokens on the client for use by the server.