diff --git a/tests/unit/admin/test_routes.py b/tests/unit/admin/test_routes.py index ab481bf4cd75..1b1fa30ebcbd 100644 --- a/tests/unit/admin/test_routes.py +++ b/tests/unit/admin/test_routes.py @@ -248,6 +248,20 @@ def test_includeme(): traverse="/{project_name}", domain=warehouse, ), + pretend.call( + "admin.project.archive", + "/admin/projects/{project_name}/archive/", + factory="warehouse.packaging.models:ProjectFactory", + traverse="/{project_name}", + domain=warehouse, + ), + pretend.call( + "admin.project.unarchive", + "/admin/projects/{project_name}/unarchive/", + factory="warehouse.packaging.models:ProjectFactory", + traverse="/{project_name}", + domain=warehouse, + ), pretend.call("admin.journals.list", "/admin/journals/", domain=warehouse), pretend.call( "admin.prohibited_project_names.list", diff --git a/tests/unit/admin/views/test_projects.py b/tests/unit/admin/views/test_projects.py index 47c17b064b50..918fe09ef33e 100644 --- a/tests/unit/admin/views/test_projects.py +++ b/tests/unit/admin/views/test_projects.py @@ -26,7 +26,7 @@ from tests.common.db.oidc import GitHubPublisherFactory from warehouse.admin.views import projects as views from warehouse.observations.models import ObservationKind -from warehouse.packaging.models import Project, Role +from warehouse.packaging.models import LifecycleStatus, Project, Role from warehouse.packaging.tasks import update_release_description from warehouse.search.tasks import reindex_project from warehouse.utils.paginate import paginate_url_factory @@ -952,3 +952,96 @@ def test_reindexes_project(self, db_request): assert db_request.session.flash.calls == [ pretend.call("Task sent to reindex the project 'foo'", queue="success") ] + + +class TestProjectArchival: + def test_archive(self, db_request): + project = ProjectFactory.create(name="foo") + user = UserFactory.create(username="testuser") + + db_request.route_path = pretend.call_recorder(lambda *a, **kw: "/the-redirect") + db_request.method = "POST" + db_request.user = user + db_request.session = pretend.stub( + flash=pretend.call_recorder(lambda *a, **kw: None) + ) + + result = views.archive_project_view(project, db_request) + + assert isinstance(result, HTTPSeeOther) + assert result.headers["Location"] == "/the-redirect" + assert project.lifecycle_status == LifecycleStatus.Archived + assert db_request.route_path.calls == [ + pretend.call("admin.project.detail", project_name=project.name) + ] + + def test_unarchive_project(self, db_request): + project = ProjectFactory.create( + name="foo", lifecycle_status=LifecycleStatus.Archived + ) + user = UserFactory.create(username="testuser") + + db_request.route_path = pretend.call_recorder(lambda *a, **kw: "/the-redirect") + db_request.method = "POST" + db_request.user = user + db_request.session = pretend.stub( + flash=pretend.call_recorder(lambda *a, **kw: None) + ) + + result = views.unarchive_project_view(project, db_request) + + assert isinstance(result, HTTPSeeOther) + assert result.headers["Location"] == "/the-redirect" + assert db_request.route_path.calls == [ + pretend.call("admin.project.detail", project_name=project.name) + ] + assert project.lifecycle_status is None + + def test_disallowed_archive(self, db_request): + project = ProjectFactory.create(name="foo", lifecycle_status="quarantine-enter") + user = UserFactory.create(username="testuser") + + db_request.route_path = pretend.call_recorder(lambda *a, **kw: "/the-redirect") + db_request.method = "POST" + db_request.user = user + db_request.session = pretend.stub( + flash=pretend.call_recorder(lambda *a, **kw: None) + ) + + result = views.archive_project_view(project, db_request) + + assert isinstance(result, HTTPSeeOther) + assert result.headers["Location"] == "/the-redirect" + assert db_request.session.flash.calls == [ + pretend.call( + f"Cannot archive project with status {project.lifecycle_status}", + queue="error", + ) + ] + assert db_request.route_path.calls == [ + pretend.call("admin.project.detail", project_name="foo") + ] + assert project.lifecycle_status == "quarantine-enter" + + def test_disallowed_unarchive(self, db_request): + project = ProjectFactory.create(name="foo", lifecycle_status="quarantine-enter") + user = UserFactory.create(username="testuser") + + db_request.route_path = pretend.call_recorder(lambda *a, **kw: "/the-redirect") + db_request.method = "POST" + db_request.user = user + db_request.session = pretend.stub( + flash=pretend.call_recorder(lambda *a, **kw: None) + ) + + result = views.unarchive_project_view(project, db_request) + + assert isinstance(result, HTTPSeeOther) + assert result.headers["Location"] == "/the-redirect" + assert db_request.session.flash.calls == [ + pretend.call("Can only unarchive an archived project", queue="error") + ] + assert db_request.route_path.calls == [ + pretend.call("admin.project.detail", project_name="foo") + ] + assert project.lifecycle_status == "quarantine-enter" diff --git a/tests/unit/manage/test_views.py b/tests/unit/manage/test_views.py index 07b6c9f0d969..b7ebeaa3a40f 100644 --- a/tests/unit/manage/test_views.py +++ b/tests/unit/manage/test_views.py @@ -63,6 +63,7 @@ from warehouse.packaging.models import ( File, JournalEntry, + LifecycleStatus, Project, Release, Role, @@ -2602,7 +2603,7 @@ class TestManageProjectSettings: @pytest.mark.parametrize("enabled", [False, True]) def test_manage_project_settings(self, enabled, monkeypatch): request = pretend.stub(organization_access=enabled) - project = pretend.stub(organization=None) + project = pretend.stub(organization=None, lifecycle_status=None) view = views.ManageProjectSettingsViews(project, request) form = pretend.stub() view.transfer_organization_project_form_class = lambda *a, **kw: form @@ -2629,7 +2630,7 @@ def test_manage_project_settings_in_organization_managed(self, monkeypatch): request = pretend.stub(organization_access=True) organization_managed = pretend.stub(name="managed-org", is_active=True) organization_owned = pretend.stub(name="owned-org", is_active=True) - project = pretend.stub(organization=organization_managed) + project = pretend.stub(organization=organization_managed, lifecycle_status=None) view = views.ManageProjectSettingsViews(project, request) form = pretend.stub() view.transfer_organization_project_form_class = pretend.call_recorder( @@ -2661,7 +2662,7 @@ def test_manage_project_settings_in_organization_owned(self, monkeypatch): request = pretend.stub(organization_access=True) organization_managed = pretend.stub(name="managed-org", is_active=True) organization_owned = pretend.stub(name="owned-org", is_active=True) - project = pretend.stub(organization=organization_owned) + project = pretend.stub(organization=organization_owned, lifecycle_status=None) view = views.ManageProjectSettingsViews(project, request) form = pretend.stub() view.transfer_organization_project_form_class = pretend.call_recorder( @@ -7955,3 +7956,96 @@ def test_delete_oidc_publisher_admin_disabled(self, monkeypatch): queue="error", ) ] + + +class TestArchiveProject: + def test_archive(self, db_request): + project = ProjectFactory.create(name="foo") + user = UserFactory.create(username="testuser") + + db_request.route_path = pretend.call_recorder(lambda *a, **kw: "/the-redirect") + db_request.method = "POST" + db_request.user = user + db_request.session = pretend.stub( + flash=pretend.call_recorder(lambda *a, **kw: None) + ) + + result = views.archive_project_view(project, db_request) + + assert isinstance(result, HTTPSeeOther) + assert result.headers["Location"] == "/the-redirect" + assert project.lifecycle_status == LifecycleStatus.Archived + assert db_request.route_path.calls == [ + pretend.call("manage.project.settings", project_name=project.name) + ] + + def test_unarchive_project(self, db_request): + project = ProjectFactory.create( + name="foo", lifecycle_status=LifecycleStatus.Archived + ) + user = UserFactory.create(username="testuser") + + db_request.route_path = pretend.call_recorder(lambda *a, **kw: "/the-redirect") + db_request.method = "POST" + db_request.user = user + db_request.session = pretend.stub( + flash=pretend.call_recorder(lambda *a, **kw: None) + ) + + result = views.unarchive_project_view(project, db_request) + + assert isinstance(result, HTTPSeeOther) + assert result.headers["Location"] == "/the-redirect" + assert db_request.route_path.calls == [ + pretend.call("manage.project.settings", project_name=project.name) + ] + assert project.lifecycle_status is None + + def test_disallowed_archive(self, db_request): + project = ProjectFactory.create(name="foo", lifecycle_status="quarantine-enter") + user = UserFactory.create(username="testuser") + + db_request.route_path = pretend.call_recorder(lambda *a, **kw: "/the-redirect") + db_request.method = "POST" + db_request.user = user + db_request.session = pretend.stub( + flash=pretend.call_recorder(lambda *a, **kw: None) + ) + + result = views.archive_project_view(project, db_request) + + assert isinstance(result, HTTPSeeOther) + assert result.headers["Location"] == "/the-redirect" + assert db_request.session.flash.calls == [ + pretend.call( + f"Cannot archive project with status {project.lifecycle_status}", + queue="error", + ) + ] + assert db_request.route_path.calls == [ + pretend.call("manage.project.settings", project_name="foo") + ] + assert project.lifecycle_status == "quarantine-enter" + + def test_disallowed_unarchive(self, db_request): + project = ProjectFactory.create(name="foo", lifecycle_status="quarantine-enter") + user = UserFactory.create(username="testuser") + + db_request.route_path = pretend.call_recorder(lambda *a, **kw: "/the-redirect") + db_request.method = "POST" + db_request.user = user + db_request.session = pretend.stub( + flash=pretend.call_recorder(lambda *a, **kw: None) + ) + + result = views.unarchive_project_view(project, db_request) + + assert isinstance(result, HTTPSeeOther) + assert result.headers["Location"] == "/the-redirect" + assert db_request.session.flash.calls == [ + pretend.call("Can only unarchive an archived project", queue="error") + ] + assert db_request.route_path.calls == [ + pretend.call("manage.project.settings", project_name="foo") + ] + assert project.lifecycle_status == "quarantine-enter" diff --git a/tests/unit/packaging/test_models.py b/tests/unit/packaging/test_models.py index aac3cc37433b..8a80d58129e2 100644 --- a/tests/unit/packaging/test_models.py +++ b/tests/unit/packaging/test_models.py @@ -365,6 +365,99 @@ def test_acl_for_quarantined_project(self, db_session): key=lambda x: x[1], ) + def test_acl_for_archived_project(self, db_session): + """ + If a Project is archived, the Project ACL should disallow uploads. + """ + project = DBProjectFactory.create(lifecycle_status="archived") + owner1 = DBRoleFactory.create(project=project) + owner2 = DBRoleFactory.create(project=project) + + # Maintainers should not appear in the ACLs, since they only have + # upload permissions, and archived projects don't allow upload + DBRoleFactory.create_batch(2, project=project, role_name="Maintainer") + + organization = DBOrganizationFactory.create() + owner3 = DBOrganizationRoleFactory.create(organization=organization) + DBOrganizationProjectFactory.create(organization=organization, project=project) + + team = DBTeamFactory.create() + owner4 = DBTeamRoleFactory.create(team=team) + DBTeamProjectRoleFactory.create( + team=team, project=project, role_name=TeamProjectRoleType.Owner + ) + + # Publishers should not appear in the ACLs, since they only have upload + # permissions, and archived projects don't allow upload + GitHubPublisherFactory.create(projects=[project]) + + acls = [] + for location in lineage(project): + try: + acl = location.__acl__ + except AttributeError: + continue + + if acl and callable(acl): + acl = acl() + + acls.extend(acl) + + _perms_read_and_write = [ + Permissions.ProjectsRead, + Permissions.ProjectsWrite, + ] + assert acls == [ + ( + Allow, + "group:admins", + ( + Permissions.AdminDashboardSidebarRead, + Permissions.AdminObservationsRead, + Permissions.AdminObservationsWrite, + Permissions.AdminProhibitedProjectsWrite, + Permissions.AdminProhibitedUsernameWrite, + Permissions.AdminProjectsDelete, + Permissions.AdminProjectsRead, + Permissions.AdminProjectsSetLimit, + Permissions.AdminProjectsWrite, + Permissions.AdminRoleAdd, + Permissions.AdminRoleDelete, + ), + ), + ( + Allow, + "group:moderators", + ( + Permissions.AdminDashboardSidebarRead, + Permissions.AdminObservationsRead, + Permissions.AdminObservationsWrite, + Permissions.AdminProjectsRead, + Permissions.AdminProjectsSetLimit, + Permissions.AdminRoleAdd, + Permissions.AdminRoleDelete, + ), + ), + ( + Allow, + "group:observers", + Permissions.APIObservationsAdd, + ), + ( + Allow, + Authenticated, + Permissions.SubmitMalwareObservation, + ), + ] + sorted( + [ + (Allow, f"user:{owner1.user.id}", _perms_read_and_write), + (Allow, f"user:{owner2.user.id}", _perms_read_and_write), + (Allow, f"user:{owner3.user.id}", _perms_read_and_write), + (Allow, f"user:{owner4.user.id}", _perms_read_and_write), + ], + key=lambda x: x[1], + ) + def test_repr(self, db_request): project = DBProjectFactory() assert isinstance(repr(project), str) diff --git a/tests/unit/test_routes.py b/tests/unit/test_routes.py index 0de9e3f61694..5377dc445eed 100644 --- a/tests/unit/test_routes.py +++ b/tests/unit/test_routes.py @@ -493,6 +493,20 @@ def add_redirect_rule(*args, **kwargs): traverse="/{project_name}", domain=warehouse, ), + pretend.call( + "manage.project.archive", + "/manage/project/{project_name}/archive/", + factory="warehouse.packaging.models:ProjectFactory", + traverse="/{project_name}", + domain=warehouse, + ), + pretend.call( + "manage.project.unarchive", + "/manage/project/{project_name}/unarchive/", + factory="warehouse.packaging.models:ProjectFactory", + traverse="/{project_name}", + domain=warehouse, + ), pretend.call( "manage.project.history", "/manage/project/{project_name}/history/", diff --git a/warehouse/admin/routes.py b/warehouse/admin/routes.py index 0f8b941d7599..fe7bdae93635 100644 --- a/warehouse/admin/routes.py +++ b/warehouse/admin/routes.py @@ -252,6 +252,20 @@ def includeme(config): traverse="/{project_name}", domain=warehouse, ) + config.add_route( + "admin.project.archive", + "/admin/projects/{project_name}/archive/", + factory="warehouse.packaging.models:ProjectFactory", + traverse="/{project_name}", + domain=warehouse, + ) + config.add_route( + "admin.project.unarchive", + "/admin/projects/{project_name}/unarchive/", + factory="warehouse.packaging.models:ProjectFactory", + traverse="/{project_name}", + domain=warehouse, + ) # Journal related Admin pages config.add_route("admin.journals.list", "/admin/journals/", domain=warehouse) diff --git a/warehouse/admin/templates/admin/projects/detail.html b/warehouse/admin/templates/admin/projects/detail.html index 77e6d2b035a8..89778d0004ad 100644 --- a/warehouse/admin/templates/admin/projects/detail.html +++ b/warehouse/admin/templates/admin/projects/detail.html @@ -96,6 +96,27 @@ + {% elif project.lifecycle_status == 'archived' %} +
+
+

+ Archived +

+
+ + + +
+
+
+

+ This project is archived. + It should not allow any new uploads unless it's unarchived. +

+
+
+ + {% endif %}
@@ -582,6 +603,33 @@

Prohibit Project Name

+
+
+

Archive project

+
+ +
+
+ + +
+ {% include 'delete.html' %} diff --git a/warehouse/admin/views/projects.py b/warehouse/admin/views/projects.py index 07f5ada3ede2..dfa1f797df38 100644 --- a/warehouse/admin/views/projects.py +++ b/warehouse/admin/views/projects.py @@ -30,9 +30,11 @@ from warehouse.search.tasks import reindex_project as _reindex_project from warehouse.utils.paginate import paginate_url_factory from warehouse.utils.project import ( + archive_project, clear_project_quarantine, confirm_project, remove_project, + unarchive_project, ) UPLOAD_LIMIT_CAP = ONE_GIB @@ -737,3 +739,37 @@ def reindex_project(project, request): return HTTPSeeOther( request.route_path("admin.project.detail", project_name=project.normalized_name) ) + + +@view_config( + route_name="admin.project.archive", + permission=Permissions.AdminProjectsWrite, + context=Project, + uses_session=True, + require_methods=["POST"], +) +def archive_project_view(project, request) -> HTTPSeeOther: + """ + Archive a Project. Reversible action. + """ + archive_project(project, request) + return HTTPSeeOther( + request.route_path("admin.project.detail", project_name=project.name) + ) + + +@view_config( + route_name="admin.project.unarchive", + permission=Permissions.AdminProjectsWrite, + context=Project, + uses_session=True, + require_methods=["POST"], +) +def unarchive_project_view(project, request) -> HTTPSeeOther: + """ + Unarchive a Project. Reversible action. + """ + unarchive_project(project, request) + return HTTPSeeOther( + request.route_path("admin.project.detail", project_name=project.name) + ) diff --git a/warehouse/events/tags.py b/warehouse/events/tags.py index 61e3161c8e37..22eaaaec92f9 100644 --- a/warehouse/events/tags.py +++ b/warehouse/events/tags.py @@ -124,6 +124,8 @@ class Project(EventTagEnum): OrganizationProjectRemove = "project:organization_project:remove" OwnersRequire2FADisabled = "project:owners_require_2fa:disabled" OwnersRequire2FAEnabled = "project:owners_require_2fa:enabled" + ProjectArchiveEnter = "project:archive:enter" + ProjectArchiveExit = "project:archive:exit" ProjectCreate = "project:create" ProjectQuarantineEnter = "project:quarantine:enter" ProjectQuarantineExit = "project:quarantine:exit" diff --git a/warehouse/locale/messages.pot b/warehouse/locale/messages.pot index f8f88a3c4257..1a6081502f95 100644 --- a/warehouse/locale/messages.pot +++ b/warehouse/locale/messages.pot @@ -152,7 +152,7 @@ msgstr "" msgid "Successful WebAuthn assertion" msgstr "" -#: warehouse/accounts/views.py:609 warehouse/manage/views/__init__.py:871 +#: warehouse/accounts/views.py:609 warehouse/manage/views/__init__.py:877 msgid "Recovery code accepted. The supplied code cannot be used again." msgstr "" @@ -286,7 +286,7 @@ msgid "You are now ${role} of the '${project_name}' project." msgstr "" #: warehouse/accounts/views.py:1588 warehouse/accounts/views.py:1831 -#: warehouse/manage/views/__init__.py:1407 +#: warehouse/manage/views/__init__.py:1413 msgid "" "Trusted publishing is temporarily disabled. See https://pypi.org/help" "#admin-intervention for details." @@ -306,19 +306,19 @@ msgstr "" msgid "You can't register more than 3 pending trusted publishers at once." msgstr "" -#: warehouse/accounts/views.py:1654 warehouse/manage/views/__init__.py:1576 -#: warehouse/manage/views/__init__.py:1689 -#: warehouse/manage/views/__init__.py:1801 -#: warehouse/manage/views/__init__.py:1911 +#: warehouse/accounts/views.py:1654 warehouse/manage/views/__init__.py:1582 +#: warehouse/manage/views/__init__.py:1695 +#: warehouse/manage/views/__init__.py:1807 +#: warehouse/manage/views/__init__.py:1917 msgid "" "There have been too many attempted trusted publisher registrations. Try " "again later." msgstr "" -#: warehouse/accounts/views.py:1665 warehouse/manage/views/__init__.py:1590 -#: warehouse/manage/views/__init__.py:1703 -#: warehouse/manage/views/__init__.py:1815 -#: warehouse/manage/views/__init__.py:1925 +#: warehouse/accounts/views.py:1665 warehouse/manage/views/__init__.py:1596 +#: warehouse/manage/views/__init__.py:1709 +#: warehouse/manage/views/__init__.py:1821 +#: warehouse/manage/views/__init__.py:1931 msgid "The trusted publisher could not be registered" msgstr "" @@ -446,161 +446,161 @@ msgid "" "less." msgstr "" -#: warehouse/manage/views/__init__.py:283 +#: warehouse/manage/views/__init__.py:289 msgid "Account details updated" msgstr "" -#: warehouse/manage/views/__init__.py:313 +#: warehouse/manage/views/__init__.py:319 msgid "Email ${email_address} added - check your email for a verification link" msgstr "" -#: warehouse/manage/views/__init__.py:819 +#: warehouse/manage/views/__init__.py:825 msgid "Recovery codes already generated" msgstr "" -#: warehouse/manage/views/__init__.py:820 +#: warehouse/manage/views/__init__.py:826 msgid "Generating new recovery codes will invalidate your existing codes." msgstr "" -#: warehouse/manage/views/__init__.py:929 +#: warehouse/manage/views/__init__.py:935 msgid "Verify your email to create an API token." msgstr "" -#: warehouse/manage/views/__init__.py:1029 +#: warehouse/manage/views/__init__.py:1035 msgid "API Token does not exist." msgstr "" -#: warehouse/manage/views/__init__.py:1061 +#: warehouse/manage/views/__init__.py:1067 msgid "Invalid credentials. Try again" msgstr "" -#: warehouse/manage/views/__init__.py:1180 +#: warehouse/manage/views/__init__.py:1186 msgid "Invalid alternate repository location details" msgstr "" -#: warehouse/manage/views/__init__.py:1217 +#: warehouse/manage/views/__init__.py:1223 msgid "Added alternate repository '${name}'" msgstr "" -#: warehouse/manage/views/__init__.py:1251 -#: warehouse/manage/views/__init__.py:2258 -#: warehouse/manage/views/__init__.py:2343 -#: warehouse/manage/views/__init__.py:2444 -#: warehouse/manage/views/__init__.py:2544 +#: warehouse/manage/views/__init__.py:1257 +#: warehouse/manage/views/__init__.py:2264 +#: warehouse/manage/views/__init__.py:2349 +#: warehouse/manage/views/__init__.py:2450 +#: warehouse/manage/views/__init__.py:2550 msgid "Confirm the request" msgstr "" -#: warehouse/manage/views/__init__.py:1263 +#: warehouse/manage/views/__init__.py:1269 msgid "Invalid alternate repository id" msgstr "" -#: warehouse/manage/views/__init__.py:1274 +#: warehouse/manage/views/__init__.py:1280 msgid "Invalid alternate repository for project" msgstr "" -#: warehouse/manage/views/__init__.py:1282 +#: warehouse/manage/views/__init__.py:1288 msgid "" "Could not delete alternate repository - ${confirm} is not the same as " "${alt_repo_name}" msgstr "" -#: warehouse/manage/views/__init__.py:1312 +#: warehouse/manage/views/__init__.py:1318 msgid "Deleted alternate repository '${name}'" msgstr "" -#: warehouse/manage/views/__init__.py:1457 +#: warehouse/manage/views/__init__.py:1463 msgid "The trusted publisher could not be constrained" msgstr "" -#: warehouse/manage/views/__init__.py:1557 +#: warehouse/manage/views/__init__.py:1563 msgid "" "GitHub-based trusted publishing is temporarily disabled. See " "https://pypi.org/help#admin-intervention for details." msgstr "" -#: warehouse/manage/views/__init__.py:1670 +#: warehouse/manage/views/__init__.py:1676 msgid "" "GitLab-based trusted publishing is temporarily disabled. See " "https://pypi.org/help#admin-intervention for details." msgstr "" -#: warehouse/manage/views/__init__.py:1782 +#: warehouse/manage/views/__init__.py:1788 msgid "" "Google-based trusted publishing is temporarily disabled. See " "https://pypi.org/help#admin-intervention for details." msgstr "" -#: warehouse/manage/views/__init__.py:1891 +#: warehouse/manage/views/__init__.py:1897 msgid "" "ActiveState-based trusted publishing is temporarily disabled. See " "https://pypi.org/help#admin-intervention for details." msgstr "" -#: warehouse/manage/views/__init__.py:2126 -#: warehouse/manage/views/__init__.py:2427 -#: warehouse/manage/views/__init__.py:2535 +#: warehouse/manage/views/__init__.py:2132 +#: warehouse/manage/views/__init__.py:2433 +#: warehouse/manage/views/__init__.py:2541 msgid "" "Project deletion temporarily disabled. See https://pypi.org/help#admin-" "intervention for details." msgstr "" -#: warehouse/manage/views/__init__.py:2270 +#: warehouse/manage/views/__init__.py:2276 msgid "Could not yank release - " msgstr "" -#: warehouse/manage/views/__init__.py:2355 +#: warehouse/manage/views/__init__.py:2361 msgid "Could not un-yank release - " msgstr "" -#: warehouse/manage/views/__init__.py:2456 +#: warehouse/manage/views/__init__.py:2462 msgid "Could not delete release - " msgstr "" -#: warehouse/manage/views/__init__.py:2556 +#: warehouse/manage/views/__init__.py:2562 msgid "Could not find file" msgstr "" -#: warehouse/manage/views/__init__.py:2560 +#: warehouse/manage/views/__init__.py:2566 msgid "Could not delete file - " msgstr "" -#: warehouse/manage/views/__init__.py:2710 +#: warehouse/manage/views/__init__.py:2716 msgid "Team '${team_name}' already has ${role_name} role for project" msgstr "" -#: warehouse/manage/views/__init__.py:2817 +#: warehouse/manage/views/__init__.py:2823 msgid "User '${username}' already has ${role_name} role for project" msgstr "" -#: warehouse/manage/views/__init__.py:2884 +#: warehouse/manage/views/__init__.py:2890 msgid "${username} is now ${role} of the '${project_name}' project." msgstr "" -#: warehouse/manage/views/__init__.py:2916 +#: warehouse/manage/views/__init__.py:2922 msgid "" "User '${username}' does not have a verified primary email address and " "cannot be added as a ${role_name} for project" msgstr "" -#: warehouse/manage/views/__init__.py:2929 +#: warehouse/manage/views/__init__.py:2935 #: warehouse/manage/views/organizations.py:889 msgid "User '${username}' already has an active invite. Please try again later." msgstr "" -#: warehouse/manage/views/__init__.py:2994 +#: warehouse/manage/views/__init__.py:3000 #: warehouse/manage/views/organizations.py:954 msgid "Invitation sent to '${username}'" msgstr "" -#: warehouse/manage/views/__init__.py:3027 +#: warehouse/manage/views/__init__.py:3033 msgid "Could not find role invitation." msgstr "" -#: warehouse/manage/views/__init__.py:3038 +#: warehouse/manage/views/__init__.py:3044 msgid "Invitation already expired." msgstr "" -#: warehouse/manage/views/__init__.py:3070 +#: warehouse/manage/views/__init__.py:3076 #: warehouse/manage/views/organizations.py:1141 msgid "Invitation revoked from '${username}'." msgstr "" @@ -914,8 +914,8 @@ msgstr "" #: warehouse/templates/manage/project/release.html:194 #: warehouse/templates/manage/project/releases.html:140 #: warehouse/templates/manage/project/releases.html:179 -#: warehouse/templates/packaging/detail.html:407 -#: warehouse/templates/packaging/detail.html:427 +#: warehouse/templates/packaging/detail.html:417 +#: warehouse/templates/packaging/detail.html:437 #: warehouse/templates/pages/classifiers.html:25 #: warehouse/templates/pages/help.html:20 #: warehouse/templates/pages/help.html:228 @@ -1150,7 +1150,7 @@ msgstr "" #: warehouse/templates/manage/project/release.html:182 #: warehouse/templates/manage/project/settings.html:87 #: warehouse/templates/manage/project/settings.html:136 -#: warehouse/templates/manage/project/settings.html:357 +#: warehouse/templates/manage/project/settings.html:394 #: warehouse/templates/manage/team/settings.html:84 msgid "Warning" msgstr "" @@ -6690,7 +6690,7 @@ msgstr "" #: warehouse/templates/manage/project/settings.html:108 #: warehouse/templates/manage/project/settings.html:179 -#: warehouse/templates/manage/project/settings.html:395 +#: warehouse/templates/manage/project/settings.html:432 msgid "Project Name" msgstr "" @@ -6835,16 +6835,47 @@ msgstr "" msgid "Description of the purpose or content of the alternate repository." msgstr "" -#: warehouse/templates/manage/project/settings.html:355 -#: warehouse/templates/manage/project/settings.html:395 +#: warehouse/templates/manage/project/settings.html:354 +#: warehouse/templates/manage/project/settings.html:371 +#: warehouse/templates/manage/project/settings.html:379 +msgid "Archive project" +msgstr "" + +#: warehouse/templates/manage/project/settings.html:359 +#, python-format +msgid "" +"Archiving a project will prevent any new uploads. Before doing so, we " +"recommend publishing a final release with an update to the project's " +"description to warn the users that the project won't receive further " +"updates, and to mention any alternative projects they may consider as a " +"replacement. If your project is configured to do so, you can " +"update the project's description by editing the README file." +msgstr "" + +#: warehouse/templates/manage/project/settings.html:374 +#: warehouse/templates/manage/project/settings.html:385 +msgid "Unarchive project" +msgstr "" + +#: warehouse/templates/manage/project/settings.html:380 +msgid "Archiving a project will block any new file uploads" +msgstr "" + +#: warehouse/templates/manage/project/settings.html:386 +msgid "Unarchiving a project will allow new file uploads" +msgstr "" + +#: warehouse/templates/manage/project/settings.html:392 +#: warehouse/templates/manage/project/settings.html:432 msgid "Delete project" msgstr "" -#: warehouse/templates/manage/project/settings.html:358 +#: warehouse/templates/manage/project/settings.html:395 msgid "Deleting this project will:" msgstr "" -#: warehouse/templates/manage/project/settings.html:363 +#: warehouse/templates/manage/project/settings.html:400 #, python-format msgid "" "Irreversibly delete the project along with %(count)s" @@ -6855,15 +6886,15 @@ msgid_plural "" msgstr[0] "" msgstr[1] "" -#: warehouse/templates/manage/project/settings.html:369 +#: warehouse/templates/manage/project/settings.html:406 msgid "Irreversibly delete the project" msgstr "" -#: warehouse/templates/manage/project/settings.html:373 +#: warehouse/templates/manage/project/settings.html:410 msgid "Make the project name available to any other PyPI user" msgstr "" -#: warehouse/templates/manage/project/settings.html:375 +#: warehouse/templates/manage/project/settings.html:412 msgid "" "This user will be able to make new releases under this project name, so " "long as the distribution filenames do not match filenames from a " @@ -7053,7 +7084,7 @@ msgstr "" #: warehouse/templates/packaging/detail.html:238 #: warehouse/templates/packaging/detail.html:272 -#: warehouse/templates/packaging/detail.html:322 +#: warehouse/templates/packaging/detail.html:332 msgid "Project description" msgstr "" @@ -7064,7 +7095,7 @@ msgstr "" #: warehouse/templates/packaging/detail.html:244 #: warehouse/templates/packaging/detail.html:284 -#: warehouse/templates/packaging/detail.html:344 +#: warehouse/templates/packaging/detail.html:354 msgid "Release history" msgstr "" @@ -7075,7 +7106,7 @@ msgstr "" #: warehouse/templates/packaging/detail.html:251 #: warehouse/templates/packaging/detail.html:291 -#: warehouse/templates/packaging/detail.html:406 +#: warehouse/templates/packaging/detail.html:416 msgid "Download files" msgstr "" @@ -7084,40 +7115,50 @@ msgid "Project details. Focus will be moved to the project details." msgstr "" #: warehouse/templates/packaging/detail.html:278 -#: warehouse/templates/packaging/detail.html:336 +#: warehouse/templates/packaging/detail.html:346 msgid "Project details" msgstr "" #: warehouse/templates/packaging/detail.html:318 -#: warehouse/templates/packaging/detail.html:393 +msgid "This project has been archived." +msgstr "" + +#: warehouse/templates/packaging/detail.html:320 +msgid "" +"The maintainers of this project have marked this project as archived. No " +"new releases are expected." +msgstr "" + +#: warehouse/templates/packaging/detail.html:328 +#: warehouse/templates/packaging/detail.html:403 msgid "Reason this release was yanked:" msgstr "" -#: warehouse/templates/packaging/detail.html:329 +#: warehouse/templates/packaging/detail.html:339 msgid "The author of this package has not provided a project description" msgstr "" -#: warehouse/templates/packaging/detail.html:346 +#: warehouse/templates/packaging/detail.html:356 msgid "Release notifications" msgstr "" -#: warehouse/templates/packaging/detail.html:347 +#: warehouse/templates/packaging/detail.html:357 msgid "RSS feed" msgstr "" -#: warehouse/templates/packaging/detail.html:359 +#: warehouse/templates/packaging/detail.html:369 msgid "This version" msgstr "" -#: warehouse/templates/packaging/detail.html:379 +#: warehouse/templates/packaging/detail.html:389 msgid "pre-release" msgstr "" -#: warehouse/templates/packaging/detail.html:384 +#: warehouse/templates/packaging/detail.html:394 msgid "yanked" msgstr "" -#: warehouse/templates/packaging/detail.html:407 +#: warehouse/templates/packaging/detail.html:417 #, python-format msgid "" "Download the file for your platform. If you're not sure which to choose, " @@ -7125,24 +7166,24 @@ msgid "" "target=\"_blank\" rel=\"noopener\">installing packages." msgstr "" -#: warehouse/templates/packaging/detail.html:410 +#: warehouse/templates/packaging/detail.html:420 msgid "Source Distribution" msgid_plural "Source Distributions" msgstr[0] "" msgstr[1] "" -#: warehouse/templates/packaging/detail.html:426 +#: warehouse/templates/packaging/detail.html:436 msgid "No source distribution files available for this release." msgstr "" -#: warehouse/templates/packaging/detail.html:427 +#: warehouse/templates/packaging/detail.html:437 #, python-format msgid "" "See tutorial on generating distribution archives." msgstr "" -#: warehouse/templates/packaging/detail.html:434 +#: warehouse/templates/packaging/detail.html:444 msgid "Built Distribution" msgid_plural "Built Distributions" msgstr[0] "" diff --git a/warehouse/manage/views/__init__.py b/warehouse/manage/views/__init__.py index 0023fc0d785f..a619bc1e6ab5 100644 --- a/warehouse/manage/views/__init__.py +++ b/warehouse/manage/views/__init__.py @@ -141,7 +141,13 @@ from warehouse.rate_limiting import IRateLimiter from warehouse.utils.http import is_safe_url from warehouse.utils.paginate import paginate_url_factory -from warehouse.utils.project import confirm_project, destroy_docs, remove_project +from warehouse.utils.project import ( + archive_project, + confirm_project, + destroy_docs, + remove_project, + unarchive_project, +) class ManageAccountMixin: @@ -3292,3 +3298,37 @@ def manage_project_history(project, request): ) def manage_project_documentation(project, request): return {"project": project} + + +@view_config( + route_name="manage.project.archive", + context=Project, + uses_session=True, + require_methods=["POST"], + permission=Permissions.ProjectsWrite, +) +def archive_project_view(project, request) -> HTTPSeeOther: + """ + Archive a Project. Reversible action. + """ + archive_project(project, request) + return HTTPSeeOther( + request.route_path("manage.project.settings", project_name=project.name) + ) + + +@view_config( + route_name="manage.project.unarchive", + context=Project, + uses_session=True, + require_methods=["POST"], + permission=Permissions.ProjectsWrite, +) +def unarchive_project_view(project, request) -> HTTPSeeOther: + """ + Unarchive a Project. Reversible action. + """ + unarchive_project(project, request) + return HTTPSeeOther( + request.route_path("manage.project.settings", project_name=project.name) + ) diff --git a/warehouse/migrations/versions/12a43f12cc18_add_new_lifecycle_statuses.py b/warehouse/migrations/versions/12a43f12cc18_add_new_lifecycle_statuses.py new file mode 100644 index 000000000000..b1601a763c2d --- /dev/null +++ b/warehouse/migrations/versions/12a43f12cc18_add_new_lifecycle_statuses.py @@ -0,0 +1,55 @@ +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +""" +Add new lifecycle statuses + +Revision ID: 12a43f12cc18 +Revises: 24aa37164e72 +""" + +from alembic import op +from alembic_postgresql_enum import TableReference + +revision = "12a43f12cc18" +down_revision = "24aa37164e72" + + +def upgrade(): + op.sync_enum_values( + "public", + "lifecyclestatus", + ["quarantine-enter", "quarantine-exit", "archived"], + [ + TableReference( + table_schema="public", + table_name="projects", + column_name="lifecycle_status", + ) + ], + enum_values_to_rename=[], + ) + + +def downgrade(): + op.sync_enum_values( + "public", + "lifecyclestatus", + ["quarantine-enter", "quarantine-exit"], + [ + TableReference( + table_schema="public", + table_name="projects", + column_name="lifecycle_status", + ) + ], + enum_values_to_rename=[], + ) diff --git a/warehouse/packaging/models.py b/warehouse/packaging/models.py index 0b7782741efe..476638de019b 100644 --- a/warehouse/packaging/models.py +++ b/warehouse/packaging/models.py @@ -166,6 +166,7 @@ def __contains__(self, project): class LifecycleStatus(enum.StrEnum): QuarantineEnter = "quarantine-enter" QuarantineExit = "quarantine-exit" + Archived = "archived" class Project(SitemapMixin, HasEvents, HasObservations, db.Model): @@ -327,10 +328,14 @@ def __acl__(self): (Allow, Authenticated, Permissions.SubmitMalwareObservation), ] - # The project has zero or more OIDC publishers registered to it, - # each of which serves as an identity with the ability to upload releases. - for publisher in self.oidc_publishers: - acls.append((Allow, f"oidc:{publisher.id}", [Permissions.ProjectsUpload])) + if self.lifecycle_status != LifecycleStatus.Archived: + # The project has zero or more OIDC publishers registered to it, + # each of which serves as an identity with the ability to upload releases + # (only if the project is not archived) + for publisher in self.oidc_publishers: + acls.append( + (Allow, f"oidc:{publisher.id}", [Permissions.ProjectsUpload]) + ) # Get all of the users for this project. user_query = ( @@ -376,27 +381,25 @@ def __acl__(self): for user_id, permission_name in sorted(permissions, key=lambda x: (x[1], x[0])): # Disallow Write permissions for Projects in quarantine, allow Upload if self.lifecycle_status == LifecycleStatus.QuarantineEnter: - acls.append( - ( - Allow, - f"user:{user_id}", - [Permissions.ProjectsRead, Permissions.ProjectsUpload], - ) - ) + current_permissions = [ + Permissions.ProjectsRead, + Permissions.ProjectsUpload, + ] elif permission_name == "Administer": - acls.append( - ( - Allow, - f"user:{user_id}", - [ - Permissions.ProjectsRead, - Permissions.ProjectsUpload, - Permissions.ProjectsWrite, - ], - ) - ) + current_permissions = [ + Permissions.ProjectsRead, + Permissions.ProjectsUpload, + Permissions.ProjectsWrite, + ] else: - acls.append((Allow, f"user:{user_id}", [Permissions.ProjectsUpload])) + current_permissions = [Permissions.ProjectsUpload] + + if self.lifecycle_status == LifecycleStatus.Archived: + # Disallow upload permissions for archived projects + current_permissions.remove(Permissions.ProjectsUpload) + + if current_permissions: + acls.append((Allow, f"user:{user_id}", current_permissions)) return acls @property diff --git a/warehouse/routes.py b/warehouse/routes.py index c31158dbab82..e8566619705c 100644 --- a/warehouse/routes.py +++ b/warehouse/routes.py @@ -493,6 +493,20 @@ def includeme(config): traverse="/{project_name}", domain=warehouse, ) + config.add_route( + "manage.project.archive", + "/manage/project/{project_name}/archive/", + factory="warehouse.packaging.models:ProjectFactory", + traverse="/{project_name}", + domain=warehouse, + ) + config.add_route( + "manage.project.unarchive", + "/manage/project/{project_name}/unarchive/", + factory="warehouse.packaging.models:ProjectFactory", + traverse="/{project_name}", + domain=warehouse, + ) config.add_route( "manage.project.history", "/manage/project/{project_name}/history/", diff --git a/warehouse/templates/manage/project/settings.html b/warehouse/templates/manage/project/settings.html index 609b684067f6..40d6201a500b 100644 --- a/warehouse/templates/manage/project/settings.html +++ b/warehouse/templates/manage/project/settings.html @@ -351,6 +351,43 @@


+

{% trans %}Archive project{% endtrans %}

+ {% set can_be_archived = not project.lifecycle_status or project.lifecycle_status == "quarantine-exit" %} + {% set can_be_unarchived = project.lifecycle_status == "archived" %} +
+

+ {% trans readme_description_href='https://packaging.python.org/guides/making-a-pypi-friendly-readme/'%} + Archiving a project will prevent any new uploads. Before doing so, we + recommend publishing a final release with an update to the project's + description to warn the users that the project won't receive further updates, + and to mention any alternative projects they may consider as a replacement. + If your project is + configured + to do so, you can update the project's description by editing the README file. + {% endtrans %} +

+
+ + {% trans %}Archive project{% endtrans %} + + + {% trans %}Unarchive project{% endtrans %} + + + {% set action = request.route_path('manage.project.archive', project_name=project.name) %} + {% set slug = "archive-project" %} + {% set title = gettext("Archive project") %} + {% set extra_description = gettext("Archiving a project will block any new file uploads") %} + {{ confirm_modal(title=title, label=project.name, slug=slug, extra_description=extra_description, action=action, warning=False) }} + + {% set action = request.route_path('manage.project.unarchive', project_name=project.name) %} + {% set slug = "unarchive-project" %} + {% set title = gettext("Unarchive project") %} + {% set extra_description = gettext("Unarchiving a project will allow new file uploads") %} + {{ confirm_modal(title=title, label=project.name, slug=slug, extra_description=extra_description, action=action, warning=False) }} + +
+

{% trans %}Delete project{% endtrans %}

diff --git a/warehouse/templates/packaging/detail.html b/warehouse/templates/packaging/detail.html index fef56c293cda..a789e0897261 100644 --- a/warehouse/templates/packaging/detail.html +++ b/warehouse/templates/packaging/detail.html @@ -313,6 +313,16 @@

{% endtrans %}

+ {% elif project.lifecycle_status == "archived" %} +
+

{% trans %}This project has been archived.{% endtrans %}

+

+ {% trans %} + The maintainers of this project have marked this project as archived. + No new releases are expected. + {% endtrans %} +

+
{% elif release.yanked and release.yanked_reason %}

{% trans %}Reason this release was yanked:{% endtrans %}

diff --git a/warehouse/utils/project.py b/warehouse/utils/project.py index e6ff187e770e..4ddefc027f09 100644 --- a/warehouse/utils/project.py +++ b/warehouse/utils/project.py @@ -196,3 +196,44 @@ def destroy_docs(project, request, flash=True): request.session.flash( f"Deleted docs for project {project.name!r}", queue="success" ) + + +def archive_project(project: Project, request) -> None: + if ( + project.lifecycle_status is not None + and project.lifecycle_status != LifecycleStatus.QuarantineExit + ): + request.session.flash( + f"Cannot archive project with status {project.lifecycle_status}", + queue="error", + ) + return + + project.lifecycle_status = LifecycleStatus.Archived + project.record_event( + tag=EventTag.Project.ProjectArchiveEnter, + request=request, + additional={ + "submitted_by": request.user.username, + }, + ) + request.session.flash("Project archived", queue="success") + + +def unarchive_project(project: Project, request) -> None: + if project.lifecycle_status != LifecycleStatus.Archived: + request.session.flash( + "Can only unarchive an archived project", + queue="error", + ) + return + + project.lifecycle_status = None + project.record_event( + tag=EventTag.Project.ProjectArchiveExit, + request=request, + additional={ + "submitted_by": request.user.username, + }, + ) + request.session.flash("Project unarchived", queue="success")