Refactor: Migrate to 2.0-style security policies #11218

woodruffw · 2022-04-20T16:34:17Z

~~Very WIP; pushing up for visibility.~~

WIP.

…y-policies

woodruffw · 2022-04-20T16:36:27Z

This currently partially works (I can log in and navigate around), but permissions are currently broken for reasons I haven't fully debugged (trying to manage projects returns a 403).

Also fixes the weirdness with ACLs.

woodruffw · 2022-04-20T19:53:42Z

This needs a lot of testing, but the basic structure is here:

Each of session, basic, and macaroon-based authentication uses a "security policy" rather than 1.0-style AuthN APIs.
We provide a new MultiSecurityPolicy that wraps multiple security policies in a manner similar to the now-removed pyramid-multiauth. One significant deviation: MultiSecurityPolicy also handles AuthZ, but it doesn't use each policy's separate AuthZ -- instead it keeps a singular AuthZ policy internal to itself, since Warehouse only has one.
Our "identity" structure is now a dictionary with the following format:
```
{ "entity": entity, "principals": principals }
```

...where entity can be User model or any other DB model suitable for a particular AuthN/AuthZ flow, and principals is the list of relevant security principles (previously a dedicated part of Pyramid's AuthZ APIs).

warehouse/utils/security_policy.py

Again.

warehouse/utils/security_policy.py

warehouse/accounts/__init__.py

warehouse/utils/security_policy.py

Punt principal handling further down, remove the generic identity implementation, etc. etc.

warehouse/accounts/security_policy.py

warehouse/macaroons/security_policy.py

…ity-policies

di

This looks great. Leaving this open for a little while to give @ewdurbin and @dstufft a chance to review if they are able.

woodruffw · 2022-04-27T22:01:21Z

This is the main blocker for #11272, which will "finish" the core functionality here (allowing a user to go from a JWT to an ephemeral API token).

…ity-policies

di

This is ready to merge once this last comment is addressed.

warehouse/utils/security_policy.py

…ities

This reverts commit 975a485.

…11313) This reverts commit 975a485.

…i#11218)" (pypi#11313)" This reverts commit 3b9a831.

)" (#11313)" (#11315) This reverts commit 3b9a831.

* warehouse: begin using security policies WIP. * Remove pyramid-multiauth, begin switching to security policies * migrations: remove incorrectly checked in migrations * warehouse: fix principals a little bit * warehouse: begin using real security policies Also fixes the weirdness with ACLs. * warehouse: port basic auth * warehouse: port macaroon policy, remove transition shim * utils/security_policy: fix principals Again. * warehouse: fix lint * tests/unit: rename-o-rama * Improve the readabililty of the overall diff * warehouse: refactor security policies Punt principal handling further down, remove the generic identity implementation, etc. etc. * macaroons/security_policy: remove redundant route check * accounts/security_policy: lint * Update warehouse/utils/security_policy.py Co-authored-by: Joachim Jablon <ewjoachim@gmail.com> * macaroons/security_policy: avoid a DB roundtrip * utils/security_policy: simplify principals, add comment * utils/security_policy: re-add id principal * warehouse: disambiguate user IDs inside the principal set * packaging/models: blacken * tests, warehouse: the long and winding road * tests/packaging: fix ACL tests * tests, warehouse: rewrite account security policy tests * macaroons: make the tests pass * tests: finish tests * warehouse: move session invalidation to session authn * tests, warehouse: update tests * utils/security_policy: authenticated_userid only works for user identities * tests: update utils/security_policy tests Co-authored-by: Dustin Ingram <di@users.noreply.github.com> Co-authored-by: Joachim Jablon <ewjoachim@gmail.com>

pypi#11313) This reverts commit 975a485.

…i#11218)" (pypi#11313)" (pypi#11315) This reverts commit 3b9a831.

woodruffw added 3 commits April 20, 2022 09:44

warehouse: begin using security policies

bba2796

WIP.

Merge remote-tracking branch 'origin/main' into tob-pyramid-2-securit…

7bc9904

…y-policies

Remove pyramid-multiauth, begin switching to security policies

03ffbc3

woodruffw self-assigned this Apr 20, 2022

woodruffw added 5 commits April 20, 2022 12:39

migrations: remove incorrectly checked in migrations

6beb4dd

warehouse: fix principals a little bit

4efbccf

warehouse: begin using real security policies

9da307d

Also fixes the weirdness with ACLs.

warehouse: port basic auth

00afa6e

warehouse: port macaroon policy, remove transition shim

a211e35

woodruffw commented Apr 20, 2022

View reviewed changes

warehouse/utils/security_policy.py Outdated Show resolved Hide resolved

woodruffw added 2 commits April 20, 2022 16:24

utils/security_policy: fix principals

1be99d8

Again.

warehouse: fix lint

936b633

woodruffw commented Apr 20, 2022

View reviewed changes

warehouse/utils/security_policy.py Outdated Show resolved Hide resolved

tests/unit: rename-o-rama

8f95b0e

woodruffw requested a review from di April 20, 2022 20:34

woodruffw commented Apr 20, 2022

View reviewed changes

warehouse/utils/security_policy.py Show resolved Hide resolved

woodruffw commented Apr 20, 2022

View reviewed changes

warehouse/utils/security_policy.py Outdated Show resolved Hide resolved

woodruffw mentioned this pull request Apr 20, 2022

Routes and endpoints for JWT consumption #10970

Closed

Improve the readabililty of the overall diff

090ef01

di reviewed Apr 21, 2022

View reviewed changes

warehouse: refactor security policies

0b788d9

Punt principal handling further down, remove the generic identity implementation, etc. etc.

woodruffw commented Apr 21, 2022

View reviewed changes

warehouse/accounts/security_policy.py Outdated Show resolved Hide resolved

woodruffw commented Apr 21, 2022

View reviewed changes

warehouse/macaroons/security_policy.py Outdated Show resolved Hide resolved

woodruffw requested a review from di April 21, 2022 19:32

woodruffw added 3 commits April 21, 2022 15:41

macaroons/security_policy: remove redundant route check

0bc2083

Merge remote-tracking branch 'upstream/main' into tob-pyramid-2-secur…

8f858e3

…ity-policies

accounts/security_policy: lint

231a46d

woodruffw requested a review from ewjoachim April 26, 2022 16:51

ewjoachim approved these changes Apr 26, 2022

View reviewed changes

Merge remote-tracking branch 'upstream/main' into tob-pyramid-2-secur…

250a2a7

…ity-policies

di approved these changes Apr 26, 2022

View reviewed changes

woodruffw mentioned this pull request Apr 27, 2022

OIDC macaroon minting for GitHub #11272

Merged

4 tasks

woodruffw added 2 commits April 28, 2022 11:02

Merge remote-tracking branch 'upstream/main' into tob-pyramid-2-secur…

42f7beb

…ity-policies

Merge remote-tracking branch 'upstream/main' into tob-pyramid-2-secur…

222b293

…ity-policies

di approved these changes Apr 28, 2022

View reviewed changes

warehouse/utils/security_policy.py Outdated Show resolved Hide resolved

woodruffw added 2 commits April 28, 2022 15:41

utils/security_policy: authenticated_userid only works for user ident…

ec2c563

…ities

tests: update utils/security_policy tests

8cb31c8

woodruffw requested a review from di April 29, 2022 00:02

Merge branch 'main' into tob-pyramid-2-security-policies

6e6d039

di approved these changes May 2, 2022

View reviewed changes

di merged commit 975a485 into pypi:main May 2, 2022

di deleted the tob-pyramid-2-security-policies branch May 2, 2022 16:49

di added a commit that referenced this pull request May 2, 2022

Revert "Refactor: Migrate to 2.0-style security policies (#11218)"

1c52223

This reverts commit 975a485.

woodruffw restored the tob-pyramid-2-security-policies branch May 2, 2022 21:31

di added a commit that referenced this pull request May 2, 2022

Revert "Refactor: Migrate to 2.0-style security policies (#11218)" (#…

3b9a831

…11313) This reverts commit 975a485.

woodruffw mentioned this pull request May 2, 2022

Pyramid 2.0 security policies: take two #11314

Closed

woodruffw added a commit to trail-of-forks/warehouse that referenced this pull request May 2, 2022

Revert "Revert "Refactor: Migrate to 2.0-style security policies (pyp…

174028d

…i#11218)" (pypi#11313)" This reverts commit 3b9a831.

woodruffw mentioned this pull request May 2, 2022

Revert #11313 #11315

Merged

di pushed a commit that referenced this pull request May 2, 2022

Revert "Revert "Refactor: Migrate to 2.0-style security policies (#11218

8b77dd7

)" (#11313)" (#11315) This reverts commit 3b9a831.

woodruffw mentioned this pull request May 3, 2022

macaroons/security_policy: avoid exceptions during user lookup #11322

Merged

domdfcoding pushed a commit to domdfcoding/warehouse that referenced this pull request Jun 7, 2022

Revert "Refactor: Migrate to 2.0-style security policies (pypi#11218)" (

5aa7595

pypi#11313) This reverts commit 975a485.

domdfcoding pushed a commit to domdfcoding/warehouse that referenced this pull request Jun 7, 2022

Revert "Revert "Refactor: Migrate to 2.0-style security policies (pyp…

ff614bf

…i#11218)" (pypi#11313)" (pypi#11315) This reverts commit 3b9a831.

woodruffw mentioned this pull request Oct 31, 2022

[META] OIDC federation roadmap for Warehouse #12465

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Refactor: Migrate to 2.0-style security policies #11218

Refactor: Migrate to 2.0-style security policies #11218

woodruffw commented Apr 20, 2022 •

edited

Loading

woodruffw commented Apr 20, 2022

woodruffw commented Apr 20, 2022

di left a comment

woodruffw commented Apr 27, 2022

di left a comment

Refactor: Migrate to 2.0-style security policies #11218

Refactor: Migrate to 2.0-style security policies #11218

Conversation

woodruffw commented Apr 20, 2022 • edited Loading

woodruffw commented Apr 20, 2022

woodruffw commented Apr 20, 2022

di left a comment

Choose a reason for hiding this comment

woodruffw commented Apr 27, 2022

di left a comment

Choose a reason for hiding this comment

woodruffw commented Apr 20, 2022 •

edited

Loading