diff --git a/tests/unit/admin/test_routes.py b/tests/unit/admin/test_routes.py
index ab481bf4cd75..1b1fa30ebcbd 100644
--- a/tests/unit/admin/test_routes.py
+++ b/tests/unit/admin/test_routes.py
@@ -248,6 +248,20 @@ def test_includeme():
traverse="/{project_name}",
domain=warehouse,
),
+ pretend.call(
+ "admin.project.archive",
+ "/admin/projects/{project_name}/archive/",
+ factory="warehouse.packaging.models:ProjectFactory",
+ traverse="/{project_name}",
+ domain=warehouse,
+ ),
+ pretend.call(
+ "admin.project.unarchive",
+ "/admin/projects/{project_name}/unarchive/",
+ factory="warehouse.packaging.models:ProjectFactory",
+ traverse="/{project_name}",
+ domain=warehouse,
+ ),
pretend.call("admin.journals.list", "/admin/journals/", domain=warehouse),
pretend.call(
"admin.prohibited_project_names.list",
diff --git a/tests/unit/admin/views/test_projects.py b/tests/unit/admin/views/test_projects.py
index 47c17b064b50..918fe09ef33e 100644
--- a/tests/unit/admin/views/test_projects.py
+++ b/tests/unit/admin/views/test_projects.py
@@ -26,7 +26,7 @@
from tests.common.db.oidc import GitHubPublisherFactory
from warehouse.admin.views import projects as views
from warehouse.observations.models import ObservationKind
-from warehouse.packaging.models import Project, Role
+from warehouse.packaging.models import LifecycleStatus, Project, Role
from warehouse.packaging.tasks import update_release_description
from warehouse.search.tasks import reindex_project
from warehouse.utils.paginate import paginate_url_factory
@@ -952,3 +952,96 @@ def test_reindexes_project(self, db_request):
assert db_request.session.flash.calls == [
pretend.call("Task sent to reindex the project 'foo'", queue="success")
]
+
+
+class TestProjectArchival:
+ def test_archive(self, db_request):
+ project = ProjectFactory.create(name="foo")
+ user = UserFactory.create(username="testuser")
+
+ db_request.route_path = pretend.call_recorder(lambda *a, **kw: "/the-redirect")
+ db_request.method = "POST"
+ db_request.user = user
+ db_request.session = pretend.stub(
+ flash=pretend.call_recorder(lambda *a, **kw: None)
+ )
+
+ result = views.archive_project_view(project, db_request)
+
+ assert isinstance(result, HTTPSeeOther)
+ assert result.headers["Location"] == "/the-redirect"
+ assert project.lifecycle_status == LifecycleStatus.Archived
+ assert db_request.route_path.calls == [
+ pretend.call("admin.project.detail", project_name=project.name)
+ ]
+
+ def test_unarchive_project(self, db_request):
+ project = ProjectFactory.create(
+ name="foo", lifecycle_status=LifecycleStatus.Archived
+ )
+ user = UserFactory.create(username="testuser")
+
+ db_request.route_path = pretend.call_recorder(lambda *a, **kw: "/the-redirect")
+ db_request.method = "POST"
+ db_request.user = user
+ db_request.session = pretend.stub(
+ flash=pretend.call_recorder(lambda *a, **kw: None)
+ )
+
+ result = views.unarchive_project_view(project, db_request)
+
+ assert isinstance(result, HTTPSeeOther)
+ assert result.headers["Location"] == "/the-redirect"
+ assert db_request.route_path.calls == [
+ pretend.call("admin.project.detail", project_name=project.name)
+ ]
+ assert project.lifecycle_status is None
+
+ def test_disallowed_archive(self, db_request):
+ project = ProjectFactory.create(name="foo", lifecycle_status="quarantine-enter")
+ user = UserFactory.create(username="testuser")
+
+ db_request.route_path = pretend.call_recorder(lambda *a, **kw: "/the-redirect")
+ db_request.method = "POST"
+ db_request.user = user
+ db_request.session = pretend.stub(
+ flash=pretend.call_recorder(lambda *a, **kw: None)
+ )
+
+ result = views.archive_project_view(project, db_request)
+
+ assert isinstance(result, HTTPSeeOther)
+ assert result.headers["Location"] == "/the-redirect"
+ assert db_request.session.flash.calls == [
+ pretend.call(
+ f"Cannot archive project with status {project.lifecycle_status}",
+ queue="error",
+ )
+ ]
+ assert db_request.route_path.calls == [
+ pretend.call("admin.project.detail", project_name="foo")
+ ]
+ assert project.lifecycle_status == "quarantine-enter"
+
+ def test_disallowed_unarchive(self, db_request):
+ project = ProjectFactory.create(name="foo", lifecycle_status="quarantine-enter")
+ user = UserFactory.create(username="testuser")
+
+ db_request.route_path = pretend.call_recorder(lambda *a, **kw: "/the-redirect")
+ db_request.method = "POST"
+ db_request.user = user
+ db_request.session = pretend.stub(
+ flash=pretend.call_recorder(lambda *a, **kw: None)
+ )
+
+ result = views.unarchive_project_view(project, db_request)
+
+ assert isinstance(result, HTTPSeeOther)
+ assert result.headers["Location"] == "/the-redirect"
+ assert db_request.session.flash.calls == [
+ pretend.call("Can only unarchive an archived project", queue="error")
+ ]
+ assert db_request.route_path.calls == [
+ pretend.call("admin.project.detail", project_name="foo")
+ ]
+ assert project.lifecycle_status == "quarantine-enter"
diff --git a/tests/unit/manage/test_views.py b/tests/unit/manage/test_views.py
index 07b6c9f0d969..b7ebeaa3a40f 100644
--- a/tests/unit/manage/test_views.py
+++ b/tests/unit/manage/test_views.py
@@ -63,6 +63,7 @@
from warehouse.packaging.models import (
File,
JournalEntry,
+ LifecycleStatus,
Project,
Release,
Role,
@@ -2602,7 +2603,7 @@ class TestManageProjectSettings:
@pytest.mark.parametrize("enabled", [False, True])
def test_manage_project_settings(self, enabled, monkeypatch):
request = pretend.stub(organization_access=enabled)
- project = pretend.stub(organization=None)
+ project = pretend.stub(organization=None, lifecycle_status=None)
view = views.ManageProjectSettingsViews(project, request)
form = pretend.stub()
view.transfer_organization_project_form_class = lambda *a, **kw: form
@@ -2629,7 +2630,7 @@ def test_manage_project_settings_in_organization_managed(self, monkeypatch):
request = pretend.stub(organization_access=True)
organization_managed = pretend.stub(name="managed-org", is_active=True)
organization_owned = pretend.stub(name="owned-org", is_active=True)
- project = pretend.stub(organization=organization_managed)
+ project = pretend.stub(organization=organization_managed, lifecycle_status=None)
view = views.ManageProjectSettingsViews(project, request)
form = pretend.stub()
view.transfer_organization_project_form_class = pretend.call_recorder(
@@ -2661,7 +2662,7 @@ def test_manage_project_settings_in_organization_owned(self, monkeypatch):
request = pretend.stub(organization_access=True)
organization_managed = pretend.stub(name="managed-org", is_active=True)
organization_owned = pretend.stub(name="owned-org", is_active=True)
- project = pretend.stub(organization=organization_owned)
+ project = pretend.stub(organization=organization_owned, lifecycle_status=None)
view = views.ManageProjectSettingsViews(project, request)
form = pretend.stub()
view.transfer_organization_project_form_class = pretend.call_recorder(
@@ -7955,3 +7956,96 @@ def test_delete_oidc_publisher_admin_disabled(self, monkeypatch):
queue="error",
)
]
+
+
+class TestArchiveProject:
+ def test_archive(self, db_request):
+ project = ProjectFactory.create(name="foo")
+ user = UserFactory.create(username="testuser")
+
+ db_request.route_path = pretend.call_recorder(lambda *a, **kw: "/the-redirect")
+ db_request.method = "POST"
+ db_request.user = user
+ db_request.session = pretend.stub(
+ flash=pretend.call_recorder(lambda *a, **kw: None)
+ )
+
+ result = views.archive_project_view(project, db_request)
+
+ assert isinstance(result, HTTPSeeOther)
+ assert result.headers["Location"] == "/the-redirect"
+ assert project.lifecycle_status == LifecycleStatus.Archived
+ assert db_request.route_path.calls == [
+ pretend.call("manage.project.settings", project_name=project.name)
+ ]
+
+ def test_unarchive_project(self, db_request):
+ project = ProjectFactory.create(
+ name="foo", lifecycle_status=LifecycleStatus.Archived
+ )
+ user = UserFactory.create(username="testuser")
+
+ db_request.route_path = pretend.call_recorder(lambda *a, **kw: "/the-redirect")
+ db_request.method = "POST"
+ db_request.user = user
+ db_request.session = pretend.stub(
+ flash=pretend.call_recorder(lambda *a, **kw: None)
+ )
+
+ result = views.unarchive_project_view(project, db_request)
+
+ assert isinstance(result, HTTPSeeOther)
+ assert result.headers["Location"] == "/the-redirect"
+ assert db_request.route_path.calls == [
+ pretend.call("manage.project.settings", project_name=project.name)
+ ]
+ assert project.lifecycle_status is None
+
+ def test_disallowed_archive(self, db_request):
+ project = ProjectFactory.create(name="foo", lifecycle_status="quarantine-enter")
+ user = UserFactory.create(username="testuser")
+
+ db_request.route_path = pretend.call_recorder(lambda *a, **kw: "/the-redirect")
+ db_request.method = "POST"
+ db_request.user = user
+ db_request.session = pretend.stub(
+ flash=pretend.call_recorder(lambda *a, **kw: None)
+ )
+
+ result = views.archive_project_view(project, db_request)
+
+ assert isinstance(result, HTTPSeeOther)
+ assert result.headers["Location"] == "/the-redirect"
+ assert db_request.session.flash.calls == [
+ pretend.call(
+ f"Cannot archive project with status {project.lifecycle_status}",
+ queue="error",
+ )
+ ]
+ assert db_request.route_path.calls == [
+ pretend.call("manage.project.settings", project_name="foo")
+ ]
+ assert project.lifecycle_status == "quarantine-enter"
+
+ def test_disallowed_unarchive(self, db_request):
+ project = ProjectFactory.create(name="foo", lifecycle_status="quarantine-enter")
+ user = UserFactory.create(username="testuser")
+
+ db_request.route_path = pretend.call_recorder(lambda *a, **kw: "/the-redirect")
+ db_request.method = "POST"
+ db_request.user = user
+ db_request.session = pretend.stub(
+ flash=pretend.call_recorder(lambda *a, **kw: None)
+ )
+
+ result = views.unarchive_project_view(project, db_request)
+
+ assert isinstance(result, HTTPSeeOther)
+ assert result.headers["Location"] == "/the-redirect"
+ assert db_request.session.flash.calls == [
+ pretend.call("Can only unarchive an archived project", queue="error")
+ ]
+ assert db_request.route_path.calls == [
+ pretend.call("manage.project.settings", project_name="foo")
+ ]
+ assert project.lifecycle_status == "quarantine-enter"
diff --git a/tests/unit/packaging/test_models.py b/tests/unit/packaging/test_models.py
index aac3cc37433b..8a80d58129e2 100644
--- a/tests/unit/packaging/test_models.py
+++ b/tests/unit/packaging/test_models.py
@@ -365,6 +365,99 @@ def test_acl_for_quarantined_project(self, db_session):
key=lambda x: x[1],
)
+ def test_acl_for_archived_project(self, db_session):
+ """
+ If a Project is archived, the Project ACL should disallow uploads.
+ """
+ project = DBProjectFactory.create(lifecycle_status="archived")
+ owner1 = DBRoleFactory.create(project=project)
+ owner2 = DBRoleFactory.create(project=project)
+
+ # Maintainers should not appear in the ACLs, since they only have
+ # upload permissions, and archived projects don't allow upload
+ DBRoleFactory.create_batch(2, project=project, role_name="Maintainer")
+
+ organization = DBOrganizationFactory.create()
+ owner3 = DBOrganizationRoleFactory.create(organization=organization)
+ DBOrganizationProjectFactory.create(organization=organization, project=project)
+
+ team = DBTeamFactory.create()
+ owner4 = DBTeamRoleFactory.create(team=team)
+ DBTeamProjectRoleFactory.create(
+ team=team, project=project, role_name=TeamProjectRoleType.Owner
+ )
+
+ # Publishers should not appear in the ACLs, since they only have upload
+ # permissions, and archived projects don't allow upload
+ GitHubPublisherFactory.create(projects=[project])
+
+ acls = []
+ for location in lineage(project):
+ try:
+ acl = location.__acl__
+ except AttributeError:
+ continue
+
+ if acl and callable(acl):
+ acl = acl()
+
+ acls.extend(acl)
+
+ _perms_read_and_write = [
+ Permissions.ProjectsRead,
+ Permissions.ProjectsWrite,
+ ]
+ assert acls == [
+ (
+ Allow,
+ "group:admins",
+ (
+ Permissions.AdminDashboardSidebarRead,
+ Permissions.AdminObservationsRead,
+ Permissions.AdminObservationsWrite,
+ Permissions.AdminProhibitedProjectsWrite,
+ Permissions.AdminProhibitedUsernameWrite,
+ Permissions.AdminProjectsDelete,
+ Permissions.AdminProjectsRead,
+ Permissions.AdminProjectsSetLimit,
+ Permissions.AdminProjectsWrite,
+ Permissions.AdminRoleAdd,
+ Permissions.AdminRoleDelete,
+ ),
+ ),
+ (
+ Allow,
+ "group:moderators",
+ (
+ Permissions.AdminDashboardSidebarRead,
+ Permissions.AdminObservationsRead,
+ Permissions.AdminObservationsWrite,
+ Permissions.AdminProjectsRead,
+ Permissions.AdminProjectsSetLimit,
+ Permissions.AdminRoleAdd,
+ Permissions.AdminRoleDelete,
+ ),
+ ),
+ (
+ Allow,
+ "group:observers",
+ Permissions.APIObservationsAdd,
+ ),
+ (
+ Allow,
+ Authenticated,
+ Permissions.SubmitMalwareObservation,
+ ),
+ ] + sorted(
+ [
+ (Allow, f"user:{owner1.user.id}", _perms_read_and_write),
+ (Allow, f"user:{owner2.user.id}", _perms_read_and_write),
+ (Allow, f"user:{owner3.user.id}", _perms_read_and_write),
+ (Allow, f"user:{owner4.user.id}", _perms_read_and_write),
+ ],
+ key=lambda x: x[1],
+ )
+
def test_repr(self, db_request):
project = DBProjectFactory()
assert isinstance(repr(project), str)
diff --git a/tests/unit/test_routes.py b/tests/unit/test_routes.py
index 0de9e3f61694..5377dc445eed 100644
--- a/tests/unit/test_routes.py
+++ b/tests/unit/test_routes.py
@@ -493,6 +493,20 @@ def add_redirect_rule(*args, **kwargs):
traverse="/{project_name}",
domain=warehouse,
),
+ pretend.call(
+ "manage.project.archive",
+ "/manage/project/{project_name}/archive/",
+ factory="warehouse.packaging.models:ProjectFactory",
+ traverse="/{project_name}",
+ domain=warehouse,
+ ),
+ pretend.call(
+ "manage.project.unarchive",
+ "/manage/project/{project_name}/unarchive/",
+ factory="warehouse.packaging.models:ProjectFactory",
+ traverse="/{project_name}",
+ domain=warehouse,
+ ),
pretend.call(
"manage.project.history",
"/manage/project/{project_name}/history/",
diff --git a/warehouse/admin/routes.py b/warehouse/admin/routes.py
index 0f8b941d7599..fe7bdae93635 100644
--- a/warehouse/admin/routes.py
+++ b/warehouse/admin/routes.py
@@ -252,6 +252,20 @@ def includeme(config):
traverse="/{project_name}",
domain=warehouse,
)
+ config.add_route(
+ "admin.project.archive",
+ "/admin/projects/{project_name}/archive/",
+ factory="warehouse.packaging.models:ProjectFactory",
+ traverse="/{project_name}",
+ domain=warehouse,
+ )
+ config.add_route(
+ "admin.project.unarchive",
+ "/admin/projects/{project_name}/unarchive/",
+ factory="warehouse.packaging.models:ProjectFactory",
+ traverse="/{project_name}",
+ domain=warehouse,
+ )
# Journal related Admin pages
config.add_route("admin.journals.list", "/admin/journals/", domain=warehouse)
diff --git a/warehouse/admin/templates/admin/projects/detail.html b/warehouse/admin/templates/admin/projects/detail.html
index 77e6d2b035a8..89778d0004ad 100644
--- a/warehouse/admin/templates/admin/projects/detail.html
+++ b/warehouse/admin/templates/admin/projects/detail.html
@@ -96,6 +96,27 @@
Remove Project from Quarantine
+ {% elif project.lifecycle_status == 'archived' %}
+
+
+
+
+ This project is archived.
+ It should not allow any new uploads unless it's unarchived.
+
+
+
+
+
{% endif %}
@@ -582,6 +603,33 @@
Prohibit Project Name
+
+
+
+
+
+
{% include 'delete.html' %}
diff --git a/warehouse/admin/views/projects.py b/warehouse/admin/views/projects.py
index 07f5ada3ede2..dfa1f797df38 100644
--- a/warehouse/admin/views/projects.py
+++ b/warehouse/admin/views/projects.py
@@ -30,9 +30,11 @@
from warehouse.search.tasks import reindex_project as _reindex_project
from warehouse.utils.paginate import paginate_url_factory
from warehouse.utils.project import (
+ archive_project,
clear_project_quarantine,
confirm_project,
remove_project,
+ unarchive_project,
)
UPLOAD_LIMIT_CAP = ONE_GIB
@@ -737,3 +739,37 @@ def reindex_project(project, request):
return HTTPSeeOther(
request.route_path("admin.project.detail", project_name=project.normalized_name)
)
+
+
+@view_config(
+ route_name="admin.project.archive",
+ permission=Permissions.AdminProjectsWrite,
+ context=Project,
+ uses_session=True,
+ require_methods=["POST"],
+)
+def archive_project_view(project, request) -> HTTPSeeOther:
+ """
+ Archive a Project. Reversible action.
+ """
+ archive_project(project, request)
+ return HTTPSeeOther(
+ request.route_path("admin.project.detail", project_name=project.name)
+ )
+
+
+@view_config(
+ route_name="admin.project.unarchive",
+ permission=Permissions.AdminProjectsWrite,
+ context=Project,
+ uses_session=True,
+ require_methods=["POST"],
+)
+def unarchive_project_view(project, request) -> HTTPSeeOther:
+ """
+ Unarchive a Project. Reversible action.
+ """
+ unarchive_project(project, request)
+ return HTTPSeeOther(
+ request.route_path("admin.project.detail", project_name=project.name)
+ )
diff --git a/warehouse/events/tags.py b/warehouse/events/tags.py
index 61e3161c8e37..22eaaaec92f9 100644
--- a/warehouse/events/tags.py
+++ b/warehouse/events/tags.py
@@ -124,6 +124,8 @@ class Project(EventTagEnum):
OrganizationProjectRemove = "project:organization_project:remove"
OwnersRequire2FADisabled = "project:owners_require_2fa:disabled"
OwnersRequire2FAEnabled = "project:owners_require_2fa:enabled"
+ ProjectArchiveEnter = "project:archive:enter"
+ ProjectArchiveExit = "project:archive:exit"
ProjectCreate = "project:create"
ProjectQuarantineEnter = "project:quarantine:enter"
ProjectQuarantineExit = "project:quarantine:exit"
diff --git a/warehouse/locale/messages.pot b/warehouse/locale/messages.pot
index f8f88a3c4257..1a6081502f95 100644
--- a/warehouse/locale/messages.pot
+++ b/warehouse/locale/messages.pot
@@ -152,7 +152,7 @@ msgstr ""
msgid "Successful WebAuthn assertion"
msgstr ""
-#: warehouse/accounts/views.py:609 warehouse/manage/views/__init__.py:871
+#: warehouse/accounts/views.py:609 warehouse/manage/views/__init__.py:877
msgid "Recovery code accepted. The supplied code cannot be used again."
msgstr ""
@@ -286,7 +286,7 @@ msgid "You are now ${role} of the '${project_name}' project."
msgstr ""
#: warehouse/accounts/views.py:1588 warehouse/accounts/views.py:1831
-#: warehouse/manage/views/__init__.py:1407
+#: warehouse/manage/views/__init__.py:1413
msgid ""
"Trusted publishing is temporarily disabled. See https://pypi.org/help"
"#admin-intervention for details."
@@ -306,19 +306,19 @@ msgstr ""
msgid "You can't register more than 3 pending trusted publishers at once."
msgstr ""
-#: warehouse/accounts/views.py:1654 warehouse/manage/views/__init__.py:1576
-#: warehouse/manage/views/__init__.py:1689
-#: warehouse/manage/views/__init__.py:1801
-#: warehouse/manage/views/__init__.py:1911
+#: warehouse/accounts/views.py:1654 warehouse/manage/views/__init__.py:1582
+#: warehouse/manage/views/__init__.py:1695
+#: warehouse/manage/views/__init__.py:1807
+#: warehouse/manage/views/__init__.py:1917
msgid ""
"There have been too many attempted trusted publisher registrations. Try "
"again later."
msgstr ""
-#: warehouse/accounts/views.py:1665 warehouse/manage/views/__init__.py:1590
-#: warehouse/manage/views/__init__.py:1703
-#: warehouse/manage/views/__init__.py:1815
-#: warehouse/manage/views/__init__.py:1925
+#: warehouse/accounts/views.py:1665 warehouse/manage/views/__init__.py:1596
+#: warehouse/manage/views/__init__.py:1709
+#: warehouse/manage/views/__init__.py:1821
+#: warehouse/manage/views/__init__.py:1931
msgid "The trusted publisher could not be registered"
msgstr ""
@@ -446,161 +446,161 @@ msgid ""
"less."
msgstr ""
-#: warehouse/manage/views/__init__.py:283
+#: warehouse/manage/views/__init__.py:289
msgid "Account details updated"
msgstr ""
-#: warehouse/manage/views/__init__.py:313
+#: warehouse/manage/views/__init__.py:319
msgid "Email ${email_address} added - check your email for a verification link"
msgstr ""
-#: warehouse/manage/views/__init__.py:819
+#: warehouse/manage/views/__init__.py:825
msgid "Recovery codes already generated"
msgstr ""
-#: warehouse/manage/views/__init__.py:820
+#: warehouse/manage/views/__init__.py:826
msgid "Generating new recovery codes will invalidate your existing codes."
msgstr ""
-#: warehouse/manage/views/__init__.py:929
+#: warehouse/manage/views/__init__.py:935
msgid "Verify your email to create an API token."
msgstr ""
-#: warehouse/manage/views/__init__.py:1029
+#: warehouse/manage/views/__init__.py:1035
msgid "API Token does not exist."
msgstr ""
-#: warehouse/manage/views/__init__.py:1061
+#: warehouse/manage/views/__init__.py:1067
msgid "Invalid credentials. Try again"
msgstr ""
-#: warehouse/manage/views/__init__.py:1180
+#: warehouse/manage/views/__init__.py:1186
msgid "Invalid alternate repository location details"
msgstr ""
-#: warehouse/manage/views/__init__.py:1217
+#: warehouse/manage/views/__init__.py:1223
msgid "Added alternate repository '${name}'"
msgstr ""
-#: warehouse/manage/views/__init__.py:1251
-#: warehouse/manage/views/__init__.py:2258
-#: warehouse/manage/views/__init__.py:2343
-#: warehouse/manage/views/__init__.py:2444
-#: warehouse/manage/views/__init__.py:2544
+#: warehouse/manage/views/__init__.py:1257
+#: warehouse/manage/views/__init__.py:2264
+#: warehouse/manage/views/__init__.py:2349
+#: warehouse/manage/views/__init__.py:2450
+#: warehouse/manage/views/__init__.py:2550
msgid "Confirm the request"
msgstr ""
-#: warehouse/manage/views/__init__.py:1263
+#: warehouse/manage/views/__init__.py:1269
msgid "Invalid alternate repository id"
msgstr ""
-#: warehouse/manage/views/__init__.py:1274
+#: warehouse/manage/views/__init__.py:1280
msgid "Invalid alternate repository for project"
msgstr ""
-#: warehouse/manage/views/__init__.py:1282
+#: warehouse/manage/views/__init__.py:1288
msgid ""
"Could not delete alternate repository - ${confirm} is not the same as "
"${alt_repo_name}"
msgstr ""
-#: warehouse/manage/views/__init__.py:1312
+#: warehouse/manage/views/__init__.py:1318
msgid "Deleted alternate repository '${name}'"
msgstr ""
-#: warehouse/manage/views/__init__.py:1457
+#: warehouse/manage/views/__init__.py:1463
msgid "The trusted publisher could not be constrained"
msgstr ""
-#: warehouse/manage/views/__init__.py:1557
+#: warehouse/manage/views/__init__.py:1563
msgid ""
"GitHub-based trusted publishing is temporarily disabled. See "
"https://pypi.org/help#admin-intervention for details."
msgstr ""
-#: warehouse/manage/views/__init__.py:1670
+#: warehouse/manage/views/__init__.py:1676
msgid ""
"GitLab-based trusted publishing is temporarily disabled. See "
"https://pypi.org/help#admin-intervention for details."
msgstr ""
-#: warehouse/manage/views/__init__.py:1782
+#: warehouse/manage/views/__init__.py:1788
msgid ""
"Google-based trusted publishing is temporarily disabled. See "
"https://pypi.org/help#admin-intervention for details."
msgstr ""
-#: warehouse/manage/views/__init__.py:1891
+#: warehouse/manage/views/__init__.py:1897
msgid ""
"ActiveState-based trusted publishing is temporarily disabled. See "
"https://pypi.org/help#admin-intervention for details."
msgstr ""
-#: warehouse/manage/views/__init__.py:2126
-#: warehouse/manage/views/__init__.py:2427
-#: warehouse/manage/views/__init__.py:2535
+#: warehouse/manage/views/__init__.py:2132
+#: warehouse/manage/views/__init__.py:2433
+#: warehouse/manage/views/__init__.py:2541
msgid ""
"Project deletion temporarily disabled. See https://pypi.org/help#admin-"
"intervention for details."
msgstr ""
-#: warehouse/manage/views/__init__.py:2270
+#: warehouse/manage/views/__init__.py:2276
msgid "Could not yank release - "
msgstr ""
-#: warehouse/manage/views/__init__.py:2355
+#: warehouse/manage/views/__init__.py:2361
msgid "Could not un-yank release - "
msgstr ""
-#: warehouse/manage/views/__init__.py:2456
+#: warehouse/manage/views/__init__.py:2462
msgid "Could not delete release - "
msgstr ""
-#: warehouse/manage/views/__init__.py:2556
+#: warehouse/manage/views/__init__.py:2562
msgid "Could not find file"
msgstr ""
-#: warehouse/manage/views/__init__.py:2560
+#: warehouse/manage/views/__init__.py:2566
msgid "Could not delete file - "
msgstr ""
-#: warehouse/manage/views/__init__.py:2710
+#: warehouse/manage/views/__init__.py:2716
msgid "Team '${team_name}' already has ${role_name} role for project"
msgstr ""
-#: warehouse/manage/views/__init__.py:2817
+#: warehouse/manage/views/__init__.py:2823
msgid "User '${username}' already has ${role_name} role for project"
msgstr ""
-#: warehouse/manage/views/__init__.py:2884
+#: warehouse/manage/views/__init__.py:2890
msgid "${username} is now ${role} of the '${project_name}' project."
msgstr ""
-#: warehouse/manage/views/__init__.py:2916
+#: warehouse/manage/views/__init__.py:2922
msgid ""
"User '${username}' does not have a verified primary email address and "
"cannot be added as a ${role_name} for project"
msgstr ""
-#: warehouse/manage/views/__init__.py:2929
+#: warehouse/manage/views/__init__.py:2935
#: warehouse/manage/views/organizations.py:889
msgid "User '${username}' already has an active invite. Please try again later."
msgstr ""
-#: warehouse/manage/views/__init__.py:2994
+#: warehouse/manage/views/__init__.py:3000
#: warehouse/manage/views/organizations.py:954
msgid "Invitation sent to '${username}'"
msgstr ""
-#: warehouse/manage/views/__init__.py:3027
+#: warehouse/manage/views/__init__.py:3033
msgid "Could not find role invitation."
msgstr ""
-#: warehouse/manage/views/__init__.py:3038
+#: warehouse/manage/views/__init__.py:3044
msgid "Invitation already expired."
msgstr ""
-#: warehouse/manage/views/__init__.py:3070
+#: warehouse/manage/views/__init__.py:3076
#: warehouse/manage/views/organizations.py:1141
msgid "Invitation revoked from '${username}'."
msgstr ""
@@ -914,8 +914,8 @@ msgstr ""
#: warehouse/templates/manage/project/release.html:194
#: warehouse/templates/manage/project/releases.html:140
#: warehouse/templates/manage/project/releases.html:179
-#: warehouse/templates/packaging/detail.html:407
-#: warehouse/templates/packaging/detail.html:427
+#: warehouse/templates/packaging/detail.html:417
+#: warehouse/templates/packaging/detail.html:437
#: warehouse/templates/pages/classifiers.html:25
#: warehouse/templates/pages/help.html:20
#: warehouse/templates/pages/help.html:228
@@ -1150,7 +1150,7 @@ msgstr ""
#: warehouse/templates/manage/project/release.html:182
#: warehouse/templates/manage/project/settings.html:87
#: warehouse/templates/manage/project/settings.html:136
-#: warehouse/templates/manage/project/settings.html:357
+#: warehouse/templates/manage/project/settings.html:394
#: warehouse/templates/manage/team/settings.html:84
msgid "Warning"
msgstr ""
@@ -6690,7 +6690,7 @@ msgstr ""
#: warehouse/templates/manage/project/settings.html:108
#: warehouse/templates/manage/project/settings.html:179
-#: warehouse/templates/manage/project/settings.html:395
+#: warehouse/templates/manage/project/settings.html:432
msgid "Project Name"
msgstr ""
@@ -6835,16 +6835,47 @@ msgstr ""
msgid "Description of the purpose or content of the alternate repository."
msgstr ""
-#: warehouse/templates/manage/project/settings.html:355
-#: warehouse/templates/manage/project/settings.html:395
+#: warehouse/templates/manage/project/settings.html:354
+#: warehouse/templates/manage/project/settings.html:371
+#: warehouse/templates/manage/project/settings.html:379
+msgid "Archive project"
+msgstr ""
+
+#: warehouse/templates/manage/project/settings.html:359
+#, python-format
+msgid ""
+"Archiving a project will prevent any new uploads. Before doing so, we "
+"recommend publishing a final release with an update to the project's "
+"description to warn the users that the project won't receive further "
+"updates, and to mention any alternative projects they may consider as a "
+"replacement. If your project is configured to do so, you can "
+"update the project's description by editing the README file."
+msgstr ""
+
+#: warehouse/templates/manage/project/settings.html:374
+#: warehouse/templates/manage/project/settings.html:385
+msgid "Unarchive project"
+msgstr ""
+
+#: warehouse/templates/manage/project/settings.html:380
+msgid "Archiving a project will block any new file uploads"
+msgstr ""
+
+#: warehouse/templates/manage/project/settings.html:386
+msgid "Unarchiving a project will allow new file uploads"
+msgstr ""
+
+#: warehouse/templates/manage/project/settings.html:392
+#: warehouse/templates/manage/project/settings.html:432
msgid "Delete project"
msgstr ""
-#: warehouse/templates/manage/project/settings.html:358
+#: warehouse/templates/manage/project/settings.html:395
msgid "Deleting this project will:"
msgstr ""
-#: warehouse/templates/manage/project/settings.html:363
+#: warehouse/templates/manage/project/settings.html:400
#, python-format
msgid ""
"Irreversibly delete the project along with %(count)s"
@@ -6855,15 +6886,15 @@ msgid_plural ""
msgstr[0] ""
msgstr[1] ""
-#: warehouse/templates/manage/project/settings.html:369
+#: warehouse/templates/manage/project/settings.html:406
msgid "Irreversibly delete the project"
msgstr ""
-#: warehouse/templates/manage/project/settings.html:373
+#: warehouse/templates/manage/project/settings.html:410
msgid "Make the project name available to any other PyPI user"
msgstr ""
-#: warehouse/templates/manage/project/settings.html:375
+#: warehouse/templates/manage/project/settings.html:412
msgid ""
"This user will be able to make new releases under this project name, so "
"long as the distribution filenames do not match filenames from a "
@@ -7053,7 +7084,7 @@ msgstr ""
#: warehouse/templates/packaging/detail.html:238
#: warehouse/templates/packaging/detail.html:272
-#: warehouse/templates/packaging/detail.html:322
+#: warehouse/templates/packaging/detail.html:332
msgid "Project description"
msgstr ""
@@ -7064,7 +7095,7 @@ msgstr ""
#: warehouse/templates/packaging/detail.html:244
#: warehouse/templates/packaging/detail.html:284
-#: warehouse/templates/packaging/detail.html:344
+#: warehouse/templates/packaging/detail.html:354
msgid "Release history"
msgstr ""
@@ -7075,7 +7106,7 @@ msgstr ""
#: warehouse/templates/packaging/detail.html:251
#: warehouse/templates/packaging/detail.html:291
-#: warehouse/templates/packaging/detail.html:406
+#: warehouse/templates/packaging/detail.html:416
msgid "Download files"
msgstr ""
@@ -7084,40 +7115,50 @@ msgid "Project details. Focus will be moved to the project details."
msgstr ""
#: warehouse/templates/packaging/detail.html:278
-#: warehouse/templates/packaging/detail.html:336
+#: warehouse/templates/packaging/detail.html:346
msgid "Project details"
msgstr ""
#: warehouse/templates/packaging/detail.html:318
-#: warehouse/templates/packaging/detail.html:393
+msgid "This project has been archived."
+msgstr ""
+
+#: warehouse/templates/packaging/detail.html:320
+msgid ""
+"The maintainers of this project have marked this project as archived. No "
+"new releases are expected."
+msgstr ""
+
+#: warehouse/templates/packaging/detail.html:328
+#: warehouse/templates/packaging/detail.html:403
msgid "Reason this release was yanked:"
msgstr ""
-#: warehouse/templates/packaging/detail.html:329
+#: warehouse/templates/packaging/detail.html:339
msgid "The author of this package has not provided a project description"
msgstr ""
-#: warehouse/templates/packaging/detail.html:346
+#: warehouse/templates/packaging/detail.html:356
msgid "Release notifications"
msgstr ""
-#: warehouse/templates/packaging/detail.html:347
+#: warehouse/templates/packaging/detail.html:357
msgid "RSS feed"
msgstr ""
-#: warehouse/templates/packaging/detail.html:359
+#: warehouse/templates/packaging/detail.html:369
msgid "This version"
msgstr ""
-#: warehouse/templates/packaging/detail.html:379
+#: warehouse/templates/packaging/detail.html:389
msgid "pre-release"
msgstr ""
-#: warehouse/templates/packaging/detail.html:384
+#: warehouse/templates/packaging/detail.html:394
msgid "yanked"
msgstr ""
-#: warehouse/templates/packaging/detail.html:407
+#: warehouse/templates/packaging/detail.html:417
#, python-format
msgid ""
"Download the file for your platform. If you're not sure which to choose, "
@@ -7125,24 +7166,24 @@ msgid ""
"target=\"_blank\" rel=\"noopener\">installing packages."
msgstr ""
-#: warehouse/templates/packaging/detail.html:410
+#: warehouse/templates/packaging/detail.html:420
msgid "Source Distribution"
msgid_plural "Source Distributions"
msgstr[0] ""
msgstr[1] ""
-#: warehouse/templates/packaging/detail.html:426
+#: warehouse/templates/packaging/detail.html:436
msgid "No source distribution files available for this release."
msgstr ""
-#: warehouse/templates/packaging/detail.html:427
+#: warehouse/templates/packaging/detail.html:437
#, python-format
msgid ""
"See tutorial on generating distribution archives."
msgstr ""
-#: warehouse/templates/packaging/detail.html:434
+#: warehouse/templates/packaging/detail.html:444
msgid "Built Distribution"
msgid_plural "Built Distributions"
msgstr[0] ""
diff --git a/warehouse/manage/views/__init__.py b/warehouse/manage/views/__init__.py
index 0023fc0d785f..a619bc1e6ab5 100644
--- a/warehouse/manage/views/__init__.py
+++ b/warehouse/manage/views/__init__.py
@@ -141,7 +141,13 @@
from warehouse.rate_limiting import IRateLimiter
from warehouse.utils.http import is_safe_url
from warehouse.utils.paginate import paginate_url_factory
-from warehouse.utils.project import confirm_project, destroy_docs, remove_project
+from warehouse.utils.project import (
+ archive_project,
+ confirm_project,
+ destroy_docs,
+ remove_project,
+ unarchive_project,
+)
class ManageAccountMixin:
@@ -3292,3 +3298,37 @@ def manage_project_history(project, request):
)
def manage_project_documentation(project, request):
return {"project": project}
+
+
+@view_config(
+ route_name="manage.project.archive",
+ context=Project,
+ uses_session=True,
+ require_methods=["POST"],
+ permission=Permissions.ProjectsWrite,
+)
+def archive_project_view(project, request) -> HTTPSeeOther:
+ """
+ Archive a Project. Reversible action.
+ """
+ archive_project(project, request)
+ return HTTPSeeOther(
+ request.route_path("manage.project.settings", project_name=project.name)
+ )
+
+
+@view_config(
+ route_name="manage.project.unarchive",
+ context=Project,
+ uses_session=True,
+ require_methods=["POST"],
+ permission=Permissions.ProjectsWrite,
+)
+def unarchive_project_view(project, request) -> HTTPSeeOther:
+ """
+ Unarchive a Project. Reversible action.
+ """
+ unarchive_project(project, request)
+ return HTTPSeeOther(
+ request.route_path("manage.project.settings", project_name=project.name)
+ )
diff --git a/warehouse/migrations/versions/12a43f12cc18_add_new_lifecycle_statuses.py b/warehouse/migrations/versions/12a43f12cc18_add_new_lifecycle_statuses.py
new file mode 100644
index 000000000000..b1601a763c2d
--- /dev/null
+++ b/warehouse/migrations/versions/12a43f12cc18_add_new_lifecycle_statuses.py
@@ -0,0 +1,55 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""
+Add new lifecycle statuses
+
+Revision ID: 12a43f12cc18
+Revises: 24aa37164e72
+"""
+
+from alembic import op
+from alembic_postgresql_enum import TableReference
+
+revision = "12a43f12cc18"
+down_revision = "24aa37164e72"
+
+
+def upgrade():
+ op.sync_enum_values(
+ "public",
+ "lifecyclestatus",
+ ["quarantine-enter", "quarantine-exit", "archived"],
+ [
+ TableReference(
+ table_schema="public",
+ table_name="projects",
+ column_name="lifecycle_status",
+ )
+ ],
+ enum_values_to_rename=[],
+ )
+
+
+def downgrade():
+ op.sync_enum_values(
+ "public",
+ "lifecyclestatus",
+ ["quarantine-enter", "quarantine-exit"],
+ [
+ TableReference(
+ table_schema="public",
+ table_name="projects",
+ column_name="lifecycle_status",
+ )
+ ],
+ enum_values_to_rename=[],
+ )
diff --git a/warehouse/packaging/models.py b/warehouse/packaging/models.py
index 0b7782741efe..476638de019b 100644
--- a/warehouse/packaging/models.py
+++ b/warehouse/packaging/models.py
@@ -166,6 +166,7 @@ def __contains__(self, project):
class LifecycleStatus(enum.StrEnum):
QuarantineEnter = "quarantine-enter"
QuarantineExit = "quarantine-exit"
+ Archived = "archived"
class Project(SitemapMixin, HasEvents, HasObservations, db.Model):
@@ -327,10 +328,14 @@ def __acl__(self):
(Allow, Authenticated, Permissions.SubmitMalwareObservation),
]
- # The project has zero or more OIDC publishers registered to it,
- # each of which serves as an identity with the ability to upload releases.
- for publisher in self.oidc_publishers:
- acls.append((Allow, f"oidc:{publisher.id}", [Permissions.ProjectsUpload]))
+ if self.lifecycle_status != LifecycleStatus.Archived:
+ # The project has zero or more OIDC publishers registered to it,
+ # each of which serves as an identity with the ability to upload releases
+ # (only if the project is not archived)
+ for publisher in self.oidc_publishers:
+ acls.append(
+ (Allow, f"oidc:{publisher.id}", [Permissions.ProjectsUpload])
+ )
# Get all of the users for this project.
user_query = (
@@ -376,27 +381,25 @@ def __acl__(self):
for user_id, permission_name in sorted(permissions, key=lambda x: (x[1], x[0])):
# Disallow Write permissions for Projects in quarantine, allow Upload
if self.lifecycle_status == LifecycleStatus.QuarantineEnter:
- acls.append(
- (
- Allow,
- f"user:{user_id}",
- [Permissions.ProjectsRead, Permissions.ProjectsUpload],
- )
- )
+ current_permissions = [
+ Permissions.ProjectsRead,
+ Permissions.ProjectsUpload,
+ ]
elif permission_name == "Administer":
- acls.append(
- (
- Allow,
- f"user:{user_id}",
- [
- Permissions.ProjectsRead,
- Permissions.ProjectsUpload,
- Permissions.ProjectsWrite,
- ],
- )
- )
+ current_permissions = [
+ Permissions.ProjectsRead,
+ Permissions.ProjectsUpload,
+ Permissions.ProjectsWrite,
+ ]
else:
- acls.append((Allow, f"user:{user_id}", [Permissions.ProjectsUpload]))
+ current_permissions = [Permissions.ProjectsUpload]
+
+ if self.lifecycle_status == LifecycleStatus.Archived:
+ # Disallow upload permissions for archived projects
+ current_permissions.remove(Permissions.ProjectsUpload)
+
+ if current_permissions:
+ acls.append((Allow, f"user:{user_id}", current_permissions))
return acls
@property
diff --git a/warehouse/routes.py b/warehouse/routes.py
index c31158dbab82..e8566619705c 100644
--- a/warehouse/routes.py
+++ b/warehouse/routes.py
@@ -493,6 +493,20 @@ def includeme(config):
traverse="/{project_name}",
domain=warehouse,
)
+ config.add_route(
+ "manage.project.archive",
+ "/manage/project/{project_name}/archive/",
+ factory="warehouse.packaging.models:ProjectFactory",
+ traverse="/{project_name}",
+ domain=warehouse,
+ )
+ config.add_route(
+ "manage.project.unarchive",
+ "/manage/project/{project_name}/unarchive/",
+ factory="warehouse.packaging.models:ProjectFactory",
+ traverse="/{project_name}",
+ domain=warehouse,
+ )
config.add_route(
"manage.project.history",
"/manage/project/{project_name}/history/",
diff --git a/warehouse/templates/manage/project/settings.html b/warehouse/templates/manage/project/settings.html
index 609b684067f6..40d6201a500b 100644
--- a/warehouse/templates/manage/project/settings.html
+++ b/warehouse/templates/manage/project/settings.html
@@ -351,6 +351,43 @@
+ {% trans %}Archive project{% endtrans %}
+ {% set can_be_archived = not project.lifecycle_status or project.lifecycle_status == "quarantine-exit" %}
+ {% set can_be_unarchived = project.lifecycle_status == "archived" %}
+
+
+ {% trans readme_description_href='https://packaging.python.org/guides/making-a-pypi-friendly-readme/'%}
+ Archiving a project will prevent any new uploads. Before doing so, we
+ recommend publishing a final release with an update to the project's
+ description to warn the users that the project won't receive further updates,
+ and to mention any alternative projects they may consider as a replacement.
+ If your project is
+ configured
+ to do so, you can update the project's description by editing the README file.
+ {% endtrans %}
+
+
+
+ {% trans %}Archive project{% endtrans %}
+
+
+ {% trans %}Unarchive project{% endtrans %}
+
+
+ {% set action = request.route_path('manage.project.archive', project_name=project.name) %}
+ {% set slug = "archive-project" %}
+ {% set title = gettext("Archive project") %}
+ {% set extra_description = gettext("Archiving a project will block any new file uploads") %}
+ {{ confirm_modal(title=title, label=project.name, slug=slug, extra_description=extra_description, action=action, warning=False) }}
+
+ {% set action = request.route_path('manage.project.unarchive', project_name=project.name) %}
+ {% set slug = "unarchive-project" %}
+ {% set title = gettext("Unarchive project") %}
+ {% set extra_description = gettext("Unarchiving a project will allow new file uploads") %}
+ {{ confirm_modal(title=title, label=project.name, slug=slug, extra_description=extra_description, action=action, warning=False) }}
+
+
+
{% trans %}Delete project{% endtrans %}
diff --git a/warehouse/templates/packaging/detail.html b/warehouse/templates/packaging/detail.html
index fef56c293cda..a789e0897261 100644
--- a/warehouse/templates/packaging/detail.html
+++ b/warehouse/templates/packaging/detail.html
@@ -313,6 +313,16 @@
{% endtrans %}
+ {% elif project.lifecycle_status == "archived" %}
+
+
{% trans %}This project has been archived.{% endtrans %}
+
+ {% trans %}
+ The maintainers of this project have marked this project as archived.
+ No new releases are expected.
+ {% endtrans %}
+
+
{% elif release.yanked and release.yanked_reason %}
{% trans %}Reason this release was yanked:{% endtrans %}
diff --git a/warehouse/utils/project.py b/warehouse/utils/project.py
index e6ff187e770e..4ddefc027f09 100644
--- a/warehouse/utils/project.py
+++ b/warehouse/utils/project.py
@@ -196,3 +196,44 @@ def destroy_docs(project, request, flash=True):
request.session.flash(
f"Deleted docs for project {project.name!r}", queue="success"
)
+
+
+def archive_project(project: Project, request) -> None:
+ if (
+ project.lifecycle_status is not None
+ and project.lifecycle_status != LifecycleStatus.QuarantineExit
+ ):
+ request.session.flash(
+ f"Cannot archive project with status {project.lifecycle_status}",
+ queue="error",
+ )
+ return
+
+ project.lifecycle_status = LifecycleStatus.Archived
+ project.record_event(
+ tag=EventTag.Project.ProjectArchiveEnter,
+ request=request,
+ additional={
+ "submitted_by": request.user.username,
+ },
+ )
+ request.session.flash("Project archived", queue="success")
+
+
+def unarchive_project(project: Project, request) -> None:
+ if project.lifecycle_status != LifecycleStatus.Archived:
+ request.session.flash(
+ "Can only unarchive an archived project",
+ queue="error",
+ )
+ return
+
+ project.lifecycle_status = None
+ project.record_event(
+ tag=EventTag.Project.ProjectArchiveExit,
+ request=request,
+ additional={
+ "submitted_by": request.user.username,
+ },
+ )
+ request.session.flash("Project unarchived", queue="success")