Repository navigation
Conversation
closes pulp#48 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
| actions:='["publish"]' | ||
| ``` | ||
|
|
||
| The available actions are `publish` and `yank`, where `yank` covers both yanking and |
There was a problem hiding this comment.
Cargo has publish-new and publish-update rather than a single catchall scope. Can you explain why we're changing the scopings - is it because we don't currently track crate ownership? If we could keep it as close as possible to the upstream model (without trying to introduce crate ownership right now) that would be ideal.
There was a problem hiding this comment.
Yeah I did it that way because of the pet crate ownership, wasn't sure if we needed that separation without it.
| silently widen to everything its owner can reach. Revoking it keeps the deletion from | ||
| granting the bearer reach the owner never delegated. | ||
| """ | ||
| token_pks = getattr(instance, "_scoped_cargo_token_pks", None) |
There was a problem hiding this comment.
Hold up, do these objects only exist in memory? Would restarting pulp impact / prevent revocation from working properly?
There was a problem hiding this comment.
No, restarting the instance wouldn't break the revocation, as this method is called within the same transaction as distro delete, but I'll refactor it to make it more clear.
Split the catchall publish scope into publish-new and publish-update to match Cargo; the distinction needs no crate ownership, only whether the repository already has the crate name. Revocation on distribution deletion now happens entirely in pre_delete, with no pks stashed on the instance.
This branch has not been deployed
2 participants
Two scope axes: distributions (M2M to RustDistribution) and actions (publish, yank; yank covers unyank).
The scope check runs in addition to the existing RBAC check on every publish and yank, so a token can never exceed its owner's permissions.
The scope check runs in addition to the existing RBAC check on every publish and yank, so a token can never exceed its owner's permissions.
Deleting the last scoped distribution revokes the token. The M2M cascades, so an emptied scope would otherwise read as "unrestricted" and silently widen the token. Partial loss leaves it valid for the distributions that remain.
Scopes are immutable. No update endpoint; revoke and re-create to change them.