From 2006917e03750ff2834de3ce064f30331e53e0aa Mon Sep 17 00:00:00 2001 From: Joseph Schorr Date: Thu, 27 Mar 2014 18:33:13 -0400 Subject: [PATCH 01/58] Add support for pull credentials on builds and build triggers --- data/database.py | 1 + data/model/legacy.py | 29 ++++++- endpoints/api/build.py | 37 +++++++- endpoints/api/trigger.py | 44 +++++++++- endpoints/common.py | 4 +- endpoints/webhooks.py | 4 +- initdb.py | 8 +- static/css/quay.css | 34 ++++++++ static/directives/trigger-description.html | 2 +- static/js/app.js | 16 +++- static/js/controllers.js | 20 ++++- static/partials/repo-admin.html | 46 +++++++++- test/data/test.db | Bin 194560 -> 540672 bytes test/test_api_security.py | 4 +- test/test_api_usage.py | 94 ++++++++++++++++++++- util/names.py | 3 + workers/dockerfilebuild.py | 46 ++++++---- 17 files changed, 355 insertions(+), 37 deletions(-) diff --git a/data/database.py b/data/database.py index d99f56c77..b0cb60bb6 100644 --- a/data/database.py +++ b/data/database.py @@ -176,6 +176,7 @@ class RepositoryBuildTrigger(BaseModel): auth_token = CharField() config = TextField(default='{}') write_token = ForeignKeyField(AccessToken, null=True) + pull_user = ForeignKeyField(User, null=True, related_name='pulluser') class EmailConfirmation(BaseModel): diff --git a/data/model/legacy.py b/data/model/legacy.py index 00d9c9b26..116a39a96 100644 --- a/data/model/legacy.py +++ b/data/model/legacy.py @@ -154,6 +154,16 @@ def create_robot(robot_shortname, parent): raise DataModelException(ex.message) +def lookup_robot(robot_username): + joined = User.select().join(FederatedLogin).join(LoginService) + found = list(joined.where(LoginService.name == 'quayrobot', + User.username == robot_username)) + if not found or len(found) < 1 or not found[0].robot: + return None + + return found[0] + + def verify_robot(robot_username, password): joined = User.select().join(FederatedLogin).join(LoginService) found = list(joined.where(FederatedLogin.service_ident == password, @@ -1449,6 +1459,20 @@ def create_repository_build(repo, access_token, job_config_obj, dockerfile_id, display_name=display_name, trigger=trigger, resource_key=dockerfile_id) +def get_pull_credentials(trigger): + if not trigger.pull_user: + return None + + try: + login_info = FederatedLogin.get(user=trigger.pull_user) + except FederatedLogin.DoesNotExist: + return None + + return { + 'username': trigger.pull_user.username, + 'password': login_info.service_ident, + 'registry': 'quay.io' # TODO: Is there a better way to do this? + } def create_webhook(repo, params_obj): return Webhook.create(repository=repo, parameters=json.dumps(params_obj)) @@ -1506,11 +1530,12 @@ def log_action(kind_name, user_or_organization_name, performer=None, metadata_json=json.dumps(metadata), datetime=timestamp) -def create_build_trigger(repo, service_name, auth_token, user): +def create_build_trigger(repo, service_name, auth_token, user, pull_user=None): service = BuildTriggerService.get(name=service_name) trigger = RepositoryBuildTrigger.create(repository=repo, service=service, auth_token=auth_token, - connected_user=user) + connected_user=user, + pull_user=None) return trigger diff --git a/endpoints/api/build.py b/endpoints/api/build.py index f14d097bb..c08ee37ec 100644 --- a/endpoints/api/build.py +++ b/endpoints/api/build.py @@ -33,6 +33,13 @@ def get_job_config(build_obj): def trigger_view(trigger): + def user_view(user): + return { + 'name': user.username, + 'kind': 'user', + 'is_robot': user.robot, + } + if trigger and trigger.uuid: config_dict = get_trigger_config(trigger) build_trigger = BuildTrigger.get_trigger_for_service(trigger.service.name) @@ -41,7 +48,8 @@ def trigger_view(trigger): 'config': config_dict, 'id': trigger.uuid, 'connected_user': trigger.connected_user.username, - 'is_active': build_trigger.is_active(config_dict) + 'is_active': build_trigger.is_active(config_dict), + 'pull_user': user_view(trigger.pull_user) if trigger.pull_user else None } return None @@ -88,6 +96,29 @@ class RepositoryBuildList(RepositoryParamResource): 'type': 'string', 'description': 'Subdirectory in which the Dockerfile can be found', }, + 'pull_credentials': { + 'type': 'object', + 'description': 'Credentials used by the builder when pulling images', + 'required': [ + 'username', + 'password', + 'registry' + ], + 'properties': { + 'username': { + 'type': 'string', + 'description': 'The username for the pull' + }, + 'password': { + 'type': 'string', + 'description': 'The password for the pull' + }, + 'registry': { + 'type': 'string', + 'description': 'The registry hostname for the pull' + }, + } + } }, }, } @@ -116,6 +147,7 @@ class RepositoryBuildList(RepositoryParamResource): dockerfile_id = request_json['file_id'] subdir = request_json['subdirectory'] if 'subdirectory' in request_json else '' + pull_credentials = request_json.get('pull_credentials', None) # Check if the dockerfile resource has already been used. If so, then it # can only be reused if the user has access to the repository for which it @@ -130,7 +162,8 @@ class RepositoryBuildList(RepositoryParamResource): repo = model.get_repository(namespace, repository) display_name = user_files.get_file_checksum(dockerfile_id) - build_request = start_build(repo, dockerfile_id, ['latest'], display_name, subdir, True) + build_request = start_build(repo, dockerfile_id, ['latest'], display_name, subdir, True, + pull_credentials=pull_credentials) resp = build_status_view(build_request, True) repo_string = '%s/%s' % (namespace, repository) diff --git a/endpoints/api/trigger.py b/endpoints/api/trigger.py index 1eb7cd169..0d846d889 100644 --- a/endpoints/api/trigger.py +++ b/endpoints/api/trigger.py @@ -15,7 +15,8 @@ from endpoints.common import start_build from endpoints.trigger import (BuildTrigger as BuildTriggerBase, TriggerDeactivationException, TriggerActivationException, EmptyRepositoryException) from data import model -from auth.permissions import UserAdminPermission +from auth.permissions import UserAdminPermission, AdministerOrganizationPermission +from util.names import parse_robot_username logger = logging.getLogger(__name__) @@ -133,7 +134,19 @@ class BuildTriggerActivate(RepositoryParamResource): 'BuildTriggerActivateRequest': { 'id': 'BuildTriggerActivateRequest', 'type': 'object', - 'description': 'Arbitrary json.', + 'required': [ + 'config' + ], + 'properties': { + 'config': { + 'type': 'object', + 'description': 'Arbitrary json.', + }, + 'pull_robot': { + 'type': 'string', + 'description': 'The name of the robot that will be used to pull images.' + } + } }, } @@ -154,7 +167,27 @@ class BuildTriggerActivate(RepositoryParamResource): user_permission = UserAdminPermission(trigger.connected_user.username) if user_permission.can(): - new_config_dict = request.get_json() + # Update the pull robot (if any). + pull_robot_name = request.get_json().get('pull_robot', None) + if pull_robot_name: + pull_robot = model.lookup_robot(pull_robot_name) + if not pull_robot: + raise NotFound() + + # Make sure the user has administer permissions for the robot's namespace. + (robot_namespace, shortname) = parse_robot_username(pull_robot_name) + if not AdministerOrganizationPermission(robot_namespace).can(): + raise Unauthorized() + + # Make sure the namespace matches that of the trigger. + if robot_namespace != namespace: + raise Unauthorized() + + # Set the pull robot. + trigger.pull_user = pull_robot + + # Update the config. + new_config_dict = request.get_json()['config'] token_name = 'Build Trigger: %s' % trigger.service.name token = model.create_delegate_token(namespace, repository, token_name, @@ -185,6 +218,7 @@ class BuildTriggerActivate(RepositoryParamResource): log_action('setup_repo_trigger', namespace, {'repo': repository, 'namespace': namespace, 'trigger_id': trigger.uuid, 'service': trigger.service.name, + 'pull_user': trigger.pull_user.username if trigger.pull_user else None, 'config': final_config}, repo=repo) return trigger_view(trigger) @@ -214,8 +248,10 @@ class ActivateBuildTrigger(RepositoryParamResource): dockerfile_id, tags, name, subdir = specs repo = model.get_repository(namespace, repository) + pull_credentials = model.get_pull_credentials(trigger) - build_request = start_build(repo, dockerfile_id, tags, name, subdir, True) + build_request = start_build(repo, dockerfile_id, tags, name, subdir, True, + pull_credentials=pull_credentials) resp = build_status_view(build_request, True) repo_string = '%s/%s' % (namespace, repository) diff --git a/endpoints/common.py b/endpoints/common.py index 4832aaaf0..99ca4ef1a 100644 --- a/endpoints/common.py +++ b/endpoints/common.py @@ -100,7 +100,7 @@ def check_repository_usage(user_or_org, plan_found): def start_build(repository, dockerfile_id, tags, build_name, subdir, manual, - trigger=None): + trigger=None, pull_credentials=None): host = urlparse.urlparse(request.url).netloc repo_path = '%s/%s/%s' % (host, repository.namespace, repository.name) @@ -112,7 +112,9 @@ def start_build(repository, dockerfile_id, tags, build_name, subdir, manual, 'docker_tags': tags, 'repository': repo_path, 'build_subdir': subdir, + 'pull_credentials': pull_credentials, } + build_request = model.create_repository_build(repository, token, job_config, dockerfile_id, build_name, trigger) diff --git a/endpoints/webhooks.py b/endpoints/webhooks.py index d92e7095e..69ba97b58 100644 --- a/endpoints/webhooks.py +++ b/endpoints/webhooks.py @@ -73,8 +73,10 @@ def build_trigger_webhook(namespace, repository, trigger_uuid): # This was just a validation request, we don't need to build anything return make_response('Okay') + pull_credentials = model.get_pull_credentials(trigger) repo = model.get_repository(namespace, repository) - start_build(repo, dockerfile_id, tags, name, subdir, False, trigger) + start_build(repo, dockerfile_id, tags, name, subdir, False, trigger, + pull_credentials=pull_credentials) return make_response('Okay') diff --git a/initdb.py b/initdb.py index a4b1709f0..fb55ca8fd 100644 --- a/initdb.py +++ b/initdb.py @@ -257,7 +257,7 @@ def populate_database(): new_user_1.stripe_id = TEST_STRIPE_ID new_user_1.save() - model.create_robot('dtrobot', new_user_1) + dtrobot = model.create_robot('dtrobot', new_user_1) new_user_2 = model.create_user('public', 'password', 'jacob.moshenko@gmail.com') @@ -268,6 +268,8 @@ def populate_database(): new_user_3.verified = True new_user_3.save() + model.create_robot('anotherrobot', new_user_3) + new_user_4 = model.create_user('randomuser', 'password', 'no4@thanks.com') new_user_4.verified = True new_user_4.save() @@ -330,7 +332,7 @@ def populate_database(): token = model.create_access_token(building, 'write') trigger = model.create_build_trigger(building, 'github', '123authtoken', - new_user_1) + new_user_1, pull_user = dtrobot) trigger.config = json.dumps({ 'build_source': 'jakedt/testconnect', 'subdir': '', @@ -354,6 +356,8 @@ def populate_database(): org.stripe_id = TEST_STRIPE_ID org.save() + model.create_robot('coolrobot', org) + oauth.create_application(org, 'Some Test App', 'http://localhost:8000', 'http://localhost:8000/o2c.html', client_id='deadbeef') diff --git a/static/css/quay.css b/static/css/quay.css index ac7c01e66..919c0ddc9 100644 --- a/static/css/quay.css +++ b/static/css/quay.css @@ -3589,4 +3589,38 @@ pre.command:before { .auth-info .scope { cursor: pointer; margin-right: 4px; +} + +.trigger-pull-credentials { + margin-top: 4px; + padding-left: 26px; + font-size: 12px; +} + +.trigger-pull-credentials .context-tooltip { + color: gray; + margin-right: 4px; +} + +.trigger-description .trigger-description-subtitle { + display: inline-block; + margin-right: 34px; +} + +.trigger-option-section:not(:last-child) { + border-bottom: 1px solid #eee; + padding-bottom: 16px; + margin-bottom: 16px; +} + +.trigger-option-section .entity-search-element .twitter-typeahead { + width: 370px; +} + +.trigger-option-section .entity-search-element input { + width: 100%; +} + +.trigger-option-section table td { + padding: 6px; } \ No newline at end of file diff --git a/static/directives/trigger-description.html b/static/directives/trigger-description.html index 2a081aa69..1ce32ec32 100644 --- a/static/directives/trigger-description.html +++ b/static/directives/trigger-description.html @@ -10,7 +10,7 @@
- Dockerfile: + Dockerfile: //Dockerfile diff --git a/static/js/app.js b/static/js/app.js index 87f73c724..00dc325ac 100644 --- a/static/js/app.js +++ b/static/js/app.js @@ -2504,7 +2504,8 @@ quayApp.directive('entitySearch', function () { 'isOrganization': '=isOrganization', 'isPersistent': '=isPersistent', 'currentEntity': '=currentEntity', - 'clearNow': '=clearNow' + 'clearNow': '=clearNow', + 'filter': '=filter', }, controller: function($scope, $element, Restangular, UserService, ApiService) { $scope.lazyLoading = true; @@ -2628,6 +2629,19 @@ quayApp.directive('entitySearch', function () { var datums = []; for (var i = 0; i < data.results.length; ++i) { var entity = data.results[i]; + if ($scope.filter) { + var allowed = $scope.filter; + var found = 'user'; + if (entity.kind == 'user') { + found = entity.is_robot ? 'robot' : 'user'; + } else if (entity.kind == 'team') { + found = 'team'; + } + if (allowed.indexOf(found)) { + continue; + } + } + datums.push({ 'value': entity.name, 'tokens': [entity.name], diff --git a/static/js/controllers.js b/static/js/controllers.js index b74071928..2daf27c30 100644 --- a/static/js/controllers.js +++ b/static/js/controllers.js @@ -1158,7 +1158,7 @@ function RepoBuildCtrl($scope, Restangular, ApiService, $routeParams, $rootScope fetchRepository(); } -function RepoAdminCtrl($scope, Restangular, ApiService, KeyService, $routeParams, $rootScope, $location) { +function RepoAdminCtrl($scope, Restangular, ApiService, KeyService, $routeParams, $rootScope, $location, UserService) { var namespace = $routeParams.namespace; var name = $routeParams.name; @@ -1462,6 +1462,10 @@ function RepoAdminCtrl($scope, Restangular, ApiService, KeyService, $routeParams $scope.setupTrigger = function(trigger) { $scope.triggerSetupReady = false; $scope.currentSetupTrigger = trigger; + + trigger['_pullEntity'] = null; + trigger['_publicPull'] = true; + $('#setupTriggerModal').modal({}); $('#setupTriggerModal').on('hidden.bs.modal', function () { $scope.$apply(function() { @@ -1470,6 +1474,10 @@ function RepoAdminCtrl($scope, Restangular, ApiService, KeyService, $routeParams }); }; + $scope.isNamespaceAdmin = function(namespace) { + return UserService.isNamespaceAdmin(namespace); + }; + $scope.finishSetupTrigger = function(trigger) { $('#setupTriggerModal').modal('hide'); $scope.currentSetupTrigger = null; @@ -1479,7 +1487,15 @@ function RepoAdminCtrl($scope, Restangular, ApiService, KeyService, $routeParams 'trigger_uuid': trigger.id }; - ApiService.activateBuildTrigger(trigger['config'], params).then(function(resp) { + var data = { + 'config': trigger['config'] + }; + + if (trigger['_pullEntity']) { + data['pull_robot'] = trigger['_pullEntity']['name']; + } + + ApiService.activateBuildTrigger(data, params).then(function(resp) { trigger['is_active'] = true; }, function(resp) { $scope.triggers.splice($scope.triggers.indexOf(trigger), 1); diff --git a/static/partials/repo-admin.html b/static/partials/repo-admin.html index 6d2fe9665..80d45768e 100644 --- a/static/partials/repo-admin.html +++ b/static/partials/repo-admin.html @@ -270,6 +270,12 @@ Setting up trigger
+
+ + Pull Credentials: + + +
@@ -387,7 +393,45 @@

Setup new build trigger

-
+
+ + + + + + + + + +
+
+ Pull Credentials: +
+ 		+
+ In order to set pull credentials for a build trigger, you must be an Administrator of the namespace {{ repo.namespace }} +
+
+ + +
+
+ +
+
+
+ +
diff --git a/test/data/test.db b/test/data/test.db index a69b3b9fbd4e166d21996bd23e461ea3433d1c61..96fd13c574015ddb8dd12b2cd23fc77ca838388c 100644 GIT binary patch delta 19047 zcmeHvcYIXE_V~`+?Ys95J-tCf2w}6mfj~B$^g;@ugiW%Wgp`FeK!mW0T|~I*fP&}) z!HOViY=Gq_xt1b`Q`J;?36PzXJ*bhbLPyP zyY#GP>C%{SB}KUn?Vf0_ueI6T9&MHkk{~2Wj*gZ{m|G+g$uju=?QibNapv?}B)X%q zGRTsVV?x0^@)P-voFo4t$27NUhN-?$-K+{%-mMH(Y*Ez9&&uzSO_lyA-6kz&eqkQR zK6C+fN?uy&3g^?7rJ)G^v)bYOeamL3y22DelM|4C6u+`=82|V(HJ?<+p>Td;T`mgc zZ>ck&Fo;L+`|HN=Z+H?>==SrTAt*dQSRNEJ9Cb9b)Or?lw0T;qJk9QgCLtCAZCj#C zg5*I7!_oYU0B!B94RbwJ4YdMLFn_1Vif4}CgFG=Ph@YmFap%MJ*S{=VBGYSod zRzmqBnbG|0j36{@`+|%l#H%w#qM^Jl!_2Qrk3>WGZRyka-1Ja1n6FDuiBCxk;m?j$@gF6QW&8}w&rCD&`^JXwo70?pP+}rt`4wrw{Pe^G{_(M6 zkycEd9UITzmJow9{Fa1Y`QZs>q^3s(!Bo^FB=F0|=#h$lYK)s7F~-MVGin(>Y*Yik za^!XVLovtsxR_=9tV93S}WgWTdh1oVouJUajrB){sU)QmbBtd{ zw?^Yc>YRw{i0OuJKlMk1_LL;jm=#cRa3c1~hm8IrwK9Z0ydN9s{7E=Ysv2I+(EBIh z9O>Yt8&1(Plki>gK~Eh@>>NQ)9{`{iCS#Xkd~or3f8=oLJqUPF3vS^4X}#c&7 zFgs3`T83^%w91axDF%;oZ1P8NH0m8FTOEt*30=3+q(V)1^>r(P(IK!i05S(_N$SI_V%!+E6+>9EQWe^i&LPAC#0ZxYQrP z{5IVT-8L1ErE5k4ipIAh{1KQ&VQ*(!*nHN`MzKomIqgC1GnddS5OeqTX9g88IofUs`G9nj6J!JT6p7@n<0cY@ z+smrh6=WV+r9H$JkaTV}cbtvp8i}9SSReZfm%t5YkFvYjCrBx&(ROpitV8>C|304G z-aRazQGi4w=gF~4%0>PHL~{9KVUY@Q9Jq=c9{?tgKOPmXX2=c+ISJ_Q7yvAq-w~h6 zsbTIIvQt9-NluZS1AxZxJN21p&;X^4t1Pnr`-N#z7~kodwy3lrmdxr7_c(VR4nY%IxK-CE2!8hdm|JSynnrqmh^;epV?_s+83o z3tO7pt#zKn8lSJJ)mQCn&r2yNG*?)P^Gb`X4r`&asIbUxo|09VQ%)cn>8JM0+8DMvYJAPp zl^RKiUzVVfD3!`qkGs~>8f$XL8cne|t=`h&dPiQp!CYRDTi)tycFeUGbhH)BYqFF! zwl&RdHFq_Xx1@F&3tJ0P-4!jZ^V_F3wD^pDTCY-QBr(uB%!X3g(bDN@ZSXdDYI}NU z&&{?tvb{ywm6p0GInDNkE%V&=j^^C-hR({lCWF1W+*7!~XG&{taF$KYZp-neSsb<& zpS8DxE?;w%JkUb`e|Jl*uUSw9dU~+Tch0jK=ViI)lzA+U>U3wmyU>?3C&w|ZxxBG+ zZh2vYJ}IdntFa|3-%^>=QBh~KmU&uymfjwG&2E`S;{0tvy{(?MdZGP9cZ;vRzRS}p zE~>*+XelY4l9}ZwwdEN~)174%Q(zHGrxi}M9SfY%;_03r5Z_;UluP8qPLHpF=V8cw#_S=Q=DqewKbL(=QX;TI_f)$-1gM; zP>-!Ozp>q!VlSW9Sk{?dI<4MW)8MG6cQo_QR>oUv>{DF&r1YYs0%x78Ak|_jzPhNU zpmBb=&t~m#7T60t^Xv2tuAFLp`GP{1r^98`Cl&C+rdyM(E?1?i#86~*Sc<3QJJW1M zB^8E@vh4D7>y%7aN@cmF$eul=!daeLnC~=HS}peU>@q`MMowyRhNU>QjK6t$xOH0A zLW6HkM@fFmyterZ8Vwod+7?%V&p1D?t=-b8cV%Wbr<6NN7hY|4HhBz1)oso!Lo&f-xIQK3083`o{(#E}YXSs~PUlhJtv6Vj(v6qvuY+n(p;RiPk z?@|w864393r7DosSHdX+Sr=uJuUQeu>MKO#B4YoMm>7B)Il;F!S{wc`xDB2ZvWDLEm5^VE5AhMc%`I(yhZn?L)F zbd**qV-V6XLMX#h2C49WP+vy>CkKttO1aM@Z0Kc0U^}@OLobMC0=3I3QRdn;tya0IYB3gWhkO;r0w;x{3lekzuVjWZKTG}6t3FXr zQLoS_G&8juw7;+!?1Su&TsFChdxK>6SX87Dsm19K-+oK99YN5^fQew8Xe_w%q6Hxv zX|``kNI<=|hT@Ahh)XRLmoZ}WS~z^7#bb(S0a+wkM6yK_NgnEBH|e#f^fj|w74;|V zGJj~@>0=4PotIdN(u5fuf;uFq1AT`dV+y5@$aJzN6`hJ-ly|GQYT`BB+G*M|?6ur0 zWG?p_c^+{R3RQ%^fsIi)YQH&L5i}hvRlXieRWN_`GOpK>RdoeR)*n{B2StLpX*i#M zy&uJFfA9KP2#pjo(r%n99|bGxn#xbOF^vE4#za1RogT$*&t10{p*a45Cx-D!>ldKW zJuwY`<9fosb3o1?S|7(xd`yqxw>Li)fzcQMh~gjFG8^{Y2cC%L&ur1~wkPJGv5>0b zr@b_ZZ+cA0KlDThfAvc&pZuzp|MUsMA9*PkjT38+zLJpZxUVi{vSe){!+&+p@G-XBsg9J4va*cSVzb#b z&0blVR#aY|HpOB}&oUb-iYhG@YjH-olizi3oN``=dtp+8Pt6zJn>nTe&RB-hto*WR z`PpT~mFX3BV`lMGQ(VwsyBv%WQh{)eSA-Wv&%0gBB45X2is#Gz{J z{`+oLMt%k@cmRkR{^u7|e;s0v>c3*@0J>CN;-hF0m zfL#8V6o&SYLI56Yu|E%Jjh!x#4*%ol8U;BiT0;6GBAy!x_>;%N6a<*)Thfn-dKNZk z1}hCiJ?EP?HP%Q&kjgi|#naj*Qsr>8MS`~A<4hs5p7~PhmDR}JlAGl_m5IuGRfAQ2 z)p2c{b}ze#Q*v9$coGXloFWlyeZrrVdR%BU%A~iskewb&Mp20i(iK4yV~{^eDDE=C zEr9o0yG{`_d^lQGBr2Ni9(S|wZ{Tb8|2=r1!tFKtvk)@!j~$qWOuXh`4l?uQ2g{H} z6risjtU)$D{?GyJHS;fiI|kYL#ovbT|Nb@>doBD_$Z$Z$M1JIXGjfVG8qYVN@!LN< z--gfx!SWu)*Ipo8@wsSnchO*!hfy+} zJsORq_r)O)K3%LThXJgS2njMEsSUrhu9gW7Llt96IqmhCRi%0P|ZZcgG zhf+~$Z##qN?sybI|7R$)7&;nhpo`I?krSl}5czaMJjzGuLVOIZiAO_)_9N)gcofMA zQiTynIZY;muG;CT^;CNto|;-avuI=+Nb!;5qephSn>sur7x$5dM#p%wX}rmrWr2eyUtQ;Hs~B4t5@fCn2a8~-B#_c@i17Al@e5{ z0-{lS-43JCZMEsDtGx!D#c6lz946R~YCI0N(P?rRytPKm=#f|fNs!v@HQOu(qethg zt%0?&+bue`vD%=sI^C9Fv&CRHdyNi;5tcx>ZUQNIZa_IWm7a@2K(iv)1#+(6zyjuz zsRGT0Fu$2Zek0j45;$`WygwI1Ej9hYjI?40!kyt3Eyhf&Rr@6jCBp&w_fS(B3X8QF-PJa;-K(>?-Jpwj>^7al zZmiXrEC#2|Q)91jSgPr~G?X^V=5d>9fKqhE8iNxcEkIXRr&H(lnv8b0)$Xiy(*0@3 z7V9=&Y%&wO4!G z^mGQAGRo|&uJr=P)mUI6p#g`kx~A5kbJrLQ7OTbPt#%mcv`jQM)@|`ZuXel6V6-`a zhYZy^U_7g?w%TlS)>=KaRUq>ZsOPtVXjAWMVDg;x?My2Dj5< z_X@10Aumbb+NH-10cOela6R`nSXE!TWbwtzEjs8l3Zj3{L9P%Ym5?yvAo-vVZ6dXB zhb1Ko$Q}JP<7BO!>6RA2p*V_k3Kui~1BS$dU_{(Qc95sY!yuUMBDat((%G-a;0+Az zEJ5MJRVqfIkxL{hqyoDpM4&Y#-CTkqVQYM?1UaqZX=E_kEkV0+Dt>_ZSXw6iRDPFY zw4z&CsXV3Hs_xMIs%_97V@pV}<-d#`)h#PUa7TK!427Y*K;6hWNF!t@sI46K@x5he6z!^q^8DWNA#`^=6wN9} zX{ew#S3_SbN8=ekmqXtzLoswv1GM2SL&H#E9~d$B!7`|Rx*p}CqTi5IQ?X+x9!@9C zL6MX;pgL6iyW+*DqZ9AC(C|VRXr26sx{|Y_TH9 z=|ngC=wpkK5tRpq{|S!%Ps<^*-c{B5Ne%e%NyU z1ylMOd4j9~ygvjM{t+g3?`1Tu;MW+srVR~^SE;mesR|}U6VTEWYVns*sKjiAQcSAo z2W@DaM&w2$^tGlxDzH#%<|D1A(2;wbYp6MS^=E(^9_~?gCQ*^#XhC9MA=V)G8>cZHnY)Y744&lydb$eoxnae zvLFpE6;!srh=V``h+J7;yiU*;uMBdd0J1_tR`j2&j~Igwslfn%RB;^=iLKgNB;EsZ<)MkAzj8Zqj;x{CUFWHCx72_k#n;*!(MptorUyjy)|Dt52X>!qG^00I{BQhh#A5}tsUI}N&iau>c zt%4oMw+iXFxT%Vu5-0NKh-0JM7NZetRj=rUhjL;Tns%|WR4Ao8>S06dT7~+^X?pi6 zRDdckLQ)NnCgcC+_$UI*8aKhdTNUWmuvu8MO(+iVIJ^lt(Cps)i7>-0o8gr0?#+_Z zTQ(y?eS4u&6c4f48?X67W?jIm3jU0=8o79?Mh*I$1W8;HxN`4*E;jcz>OPAnM5vi7fqZ%n zkD-QhSW3S3|ze%sY0|}+sU*pKW zV5WXx;$R;88b|#O!TxZ^zs6Jgwq)$r63pCiTKx@<3sd)QoBg5w_6;`VUjbmzNWnZO zSW*J7BHBhS7Ir|bpvgSndxrQNREvF}k-P;YG=LVP@e2BsR?w%^8Zi{rEVW9Ei+Yw? zA;#rmC=)~R9<<*nT1#G*KyR;sR(Mfg{1^Ec9xC*EPS8W@L+HzIp~-j8M(`Lx&=Q1t zFMz^$3Qi`6;bF!HpbG6FFZUsJp`v&KT3M(SHMm_Lpp3A z?#B(X%M^E+#`ktE{atxKCSa~yjDKgk>sPzad--LsnmzC3)iGbH(^L;Ae^M4JHYp_X za@nJBk?&@9Fe7ji+J%B8EufUxXjv+Lq4plOWZxo*^K7doe3G#_@p|U|aO*uvBR3<1xlq$s!iW7JV)zpL(6uT?Km&s68DQ`Ba4jCzP#uDYQ5QuUGQP1Osk z$5i*LR;sR5b*k!ArK)7r7!|8LqkM;iJPPNQPO=JK?ADVhq+Gd6xmCGQxmwxtSTkAs zF{WcYIJ8T~5TswAVuFy~Xmsf3i|Njuv`yb3rrUec7JZwTZtY2%^z+2@+@7>S?-SE4 zfwaM)Zx+){J!zZ1QB2S2Nn7;31~H?)C&Q$#6Vu+Fv_bC?)3w4AGQHEPciQw$hrUL` zg#DJR?h|(_nc-soY_V2VAZgam5|cBdnRFVn2Zu_XM*R#Lxd%rw@D@$T3X)dBn>Qgg ztZUjZMu+qcv)*CRJFI$#P4BSlD+V+1zt1ceQR)RN6VV7HOT~U6K2_|uM1-_E^$vsH zVbm9kkbz{82nq2*5wZXvyO7>))!S`)yIr3j02PyY0Z^+xR|L%w5waWfcB9^I(%a4Y z>_9iak9bVqGyOTF6QhD+eG_#mW#*5i7gs zmSZS}iC`wvZO2fkbh0po5DS7Uo+lb{aF;lJR;%7>(_8I&t3z*f>aP-e?3+13?6Egz zyx3tN=@dJJxI^sFEEJmSTnCs%NGwoVO!`Cz(;=p;QY+&V zV@6qmiD?j{NwP6|rbdh=%Hqc{GsWl_+2{nOT#Uw{IQm2#j+c&Na>R@%*(e}WF&Zu# z39~FlL*Ue9tixeaafE=>(A20tLp0g-CWqeS)JOIiVjwf3&k!Leyw4EB=qp~VBW8VY zpUfcofEPzb8uY{aWDXNo1ZHlixFSR7Lwj&ki11ib@6;O&dZR^8gy)}u6i08~gTuRw zdhNwLje;2}6ocjh@y;v_3vq=AW7UHe12D2c|9X?&td|DF0mK;*#;Aw) z07Ru1g*iLwqGjk9`3xRieh5rcYtTZHhA*-Aeed95S}b2H-bc5L^_C%G>{rH zla!Mpl0(wTWa5M;vN{q^V!%*4oDiY{KZswr3*0&G6!#@}m^;9I!0qMsa4&N&a8Gkj za1V1ExOL!vv68!$yPoUf7IJM|GgrsC;S5m96>v3ExKwT;XXlJuA{WO+aUtALj^z{_ zVt-=KvuD^7?C0z!>^}B=_APLw*u_4_Zf757H?t40_p*1fE7+Ua>)6HYe0Cn&$a>f+ zb{bp4=CPTqi=Dt)Sv{M;j=DtW0#i+=p!#&jpGKeJE;jm#_BQemyenNx?glgTEo2#4 z0tV?;c(3Rsvq>fRndFl!l0vQ`Hew)S;letS1d|~|OXNht{Rpp6|A#xy9pygeKH}cv z-sJwy?c|>2o&>#W6L&v%4|gYbdlz>TIHz30b#imTMWvRT#Z_>{TrQWvC3E9B3zq~g zD-Sosb{O%8EhF_$Y!%?>?GE~n%HsdXc)Kfw|#`=A!2RY#!56*AeEvUQ5Pq>B}wNUg{tV^zzU2jx1+a-qB4 zzm@rF@c|*dZwbz#Ntt*h)mK66%nS%Nr$MkM9p6Fs7$Men0l5@`*L_mzcjIKb%ZQb< zsv0Mwanz8G3+S;~09P&qyE3th&aHyHc&J8SnhCM4nNYC#8k|YXGH?z(k%2R)UC29T zf`ACs){6}Y$z5il0W(x1Lb5Ae$g6_9<7tq$S-@|7h7g$W6lyR-Q(q-PY<&{s*^SW0 z&I@o=KSqx!-E4ror4fLpnjSace98%sdvuWN3KoW;gJF~>LE9U~;p?O@IZLSW5u7E& z7E=RYSSB2<X=8z1<-n*XxkKDLK!#hm z`?%#mcTJ#m<$`0>I4+D+gYI=4cVEnMl!M0!9S)IoN|Z-cIjZN? z*Gn2T;1n}0=lLRsfeD;F+lim=9f=H6l@L$o1A`%kV$od_v z;kf-Y+&(-^Hjs6Mf-m5$aGLER3&EA685qG$rh^||0qFUuWFoN>BS|E2a0&_O-`}vn zjYk z9om0tjhfrkfAs+Q0W)zpn65|(?DCkc&_1g9Nt2~sr8=OBP|i}UmG6@iS(>zyc@V#k zene3K`uo4`xo&(1?tY~LPhz@lh4@XT+nmf_#vDj$eAec@`YKJa<#DKmHh8G z3Bw_{<^OvH|3B;%9GjhxewQ>rEItXD4J4ik&b?JEqpi`rqRCcoQ&)pEz^mM?%u_t2 z@WAC_gY0!#p|o3CFV!+l_$^$5o=1&{NPIvn35-8tQoslK;Pv2xocN~MUO6$~gS_Ad z@Wh_0p=@;dd^vn(5H?42^HN0~?U49ifD!+ImPA2h7w{reS=Wkxl0jKiS z?ch{C><0f&{s_lKpYIid&vys-d`lMxrr@1$4!5vGeR7l6C^nkE0tYzrtMP?&R}1)lqgkm@bhZzCzsD6O zOsh-`c#$8RisR&puU5RDHFF4u(>y>`UlI2{U6co?PSpHdK*RI#+VRS|o2Ls@5hR%* zAyM1{(3E4e^E5j(LF#7JtE!R8C5n9toqVb6Jz0dbj@g30#zp9H@W+_}R4|&B@nAPw ze-m~y-FGa-bD8dt1^5`#y?!p_&=s@sXI;Y1Fji`nNUhRE(pO|ES)pvT?1+4fe6IXi zg+!61xI?jD8Lg}bo6`4Sbh=6Po;p}PTm6vwtj3{Ps(D>INL!)3UwfQ2unX9i;K^$t zc#t0f+v{BN?7$_xB9tbM!(8{wad-nG6II_poIZO2Wp#t+&1{A?iP1D68Vyl;{|tOb z584Kabb<6GnezV}(o(~pMq4E+_OPM9w*V)1?^=vqnBMdqAXsrH{**3x7-w}anTfB( zy()b`k?+3$8eu2`WH&%Q#L%mRO7}m6kI>g2#>qW92JCZH;P;=;{>p9uAy5s*!y*k< zZvr9UQJz*#Rmv0(gAk~fot2f#l+wpQ2sGkva3$8DCqM`YX45gWdMkWIA$rl>8~hP7 z0@A>_4ajrISNqQ{ZEq`z(h@(l6a{tL~2638<$>sxncML-&aZ3prk z9kL*tR&56!#ph;O{1Igrc~tnM#F~vl%P*%cuPhC4zwJTbexu~z1zPnWv^-+}KNWP# zgU~X&`qvGe#R2ZWdJ}N}xI6z%>8?#c`1a55-%Mw3#%rb0irf~uc{O|o!@0>|%gd+8 zCh*A`V9uc(udDqd@@SDwV9qu0VTNI+(l~l*4RGgGwmJ9sBXj7Iy#T%X9$c>&v2%~i zACVpSh=lWA_(DVUHSzsA2D32%Khir%^mP}aU{IOdOpH_mx59Ow18?kdTK#(xKx{#`*Y zd6MJUI_(baAdOG`mO55-weo<{s<>VLg*;WZUi!T>pLqbE!;{cWl6NIbVBM#vi~K@$ zxHu%#_%wDQP4~x7<5=9i1vr`~$Bfa`4kf1Jm-yL+< zQCLs4e+Z?sKZo@sjz#O}=KZjqng@<<&ugWqQ)u%54pta$u+Q_4m`95`q1zh|;Mvl! z2d0|osROuOn)KltT3T}u_$2(Z2-qcCF7inMd?dtq2#`$t$DO{)W??Tg(tU@31Z^$; zWqC~kksE3L+t9-Vvj0~9h(>|PO?3U+c(z=X5wf6jj5_`go-~u(>VR3DRRsnt3<9 ze&0A!_&#D=0Y$#)p^of!$&CNx>-c zA($b`Ux8rPqhNtJ@(ARu7m{|d;1RIC=pTjP!g=KCKK>GXpQ-!UD>wwvjptF;=9fOi zn9e>AZx;)pvF>9haReHsRKpics<`L55Vl?Wfi_9AT;2C;Cdpa^g#U#|{vYEE^uGW< C%kZH9 delta 15511 zcmbt52Y6If*6-f)X5LIffCN%VNF@;31z}dN zA_#~I>e3cu5T)1)y7m~bPRd5`1&z+8gI-Cfary!V7i@;Td zU}`yn>q-z*jYm+Hi(q^vf^n$`(ya(AdIY-B2u3F%7(N6+LL7p~Caff~Ta-tS&|HSU!SBGY~vtL$FlB{((^l{*j2_zQG6}YkOL-&21<|8x9BFy=q+@}3|dB0>2Nxb{6sz{FOzj-0cj#7 z#6n_;iaW>c<+gZ(4Df^lhRh3!xPjbDxq@7)KwZ z$4DHV2_7($X7V!~K|{$Q@(NiG6T!jxXgRTRU*n_=n|#-ofB;94yl@oB@hNzZHpd8X z3@Hl7umVYZtb1^OC3iROjwF&bbRi6cxj44Vx9cF{=u19K#?rphmI1bNa01cWjsw?& zcl*NZ#Vhy_feYjC_cjtr{!Z6IINZh>za-1p@*_mWLXMDoNguZ22yv1ipW-MPLA-CO z26^97C$XkuWR!P2eoR%5pf?722dk1vf7bsviNI#Hca~~o-vD{p9UOcJCt(LJy8*mA zmgf;3i$B8R4T`^3IxAs`{9DT%Bt>K~4WLuu3EX22Qm`-k>=@CJU}@np?>Zrj4Dh}p zOk@QoNF*7^oF_;D3HA09YP?I72_($BU1?yGPm*vFzG;>snXpx-@Eju;IfuPO#n2u~ z9hL}u3JxQlAA$Gq#RN5c!NK?N1)RpJ{{Z`rrf8ph{WPS97H z)vP#`Sh`h#T)amyLd~gEs^-p)_UTSnb6Z2A-kzw_CstMDSG2a~%&IlbXlvDGRXePC zR%5BX+3c>Y*Nf%`y=_|O%);r;mii{`_?%pAc2#p@V^gy}qhp%AX=Zz}qq*@qA&?t% zX@NGE-RWxUncP&8)s@*jyJb#sdr?hSY4P}3x#OC2uF}#9C8i8*URHTlQEhc` zL4hf|sHmtsue7{UJE>?w`9zyFU#rzs7v^Qz3^}&4vdpsT9Bp=1QQ7$N0-deAU_xny zwv^p9mJBu-GRvwuCl%yZ%$YSixyI3$oLn#3JDbhp+%v_>V!Pd#m0R5`w&gcFOYF`` z6SOzhc2pL!y<^G9hyZYNsAS#nEgXPXVF4-xA1s44C?w;78A{2Z+<+j6CH0**G|jTN zHMrD$A)frozp4NjMEu+)NG-pzhEn?c^&HtNrDQBF_YMa?!Pjsab^KxY3_igHzlV2l zxlO>{X(l71)r115)RJNpxSKfqeFZgO2YCba?VTu?Ztq4uiVX6;&1+~$n0Gy{A9YDf zD46yu5=keAv;5N}o(yI)PLotrdlw;^M0=xoled|UA~BmDrXhrON3yiD#6V(M>seAr zyQ0|LXNZ=>NuSYd&lxg&u%spf=xz=krMuyFL^%bLU@8nR(%fGE5FM-34W z3Lu0$nc~*zO2y&%}tNc~H%**>Mn#R9yk&Z20G&CY_HRIG&W5$Oqf|+R$(p4V|y<0iR?r- z3F{-V3WZr5x(u^$+*Ih!r%H6wi3(eBz&p(*FnX;(u3GB_dJDBf9|KA)3d5 zo$Uri2<3sO>F+c)13w_3cWWyL&q6B>bwPKY0=Gy0=k3v4X&&|eXLIu260TN6(iteY z91eefB#+SZva6$Cv@3_iOTyW~)_+aLkRei8WRc&HhM>gk@^P7!&C{@;;s z_P|$Ui0}1pNCY86+2`Mq+m*xQPVDrzDB~sH5rHlEjwJT+6YCrYKfpO8$CnT)@PrU_ zKa}`aO{s(p_s71>16ryO=n)QXrAKi5UdoQ7)6n6?ITc20X<1QW^@Q4NUD>4Etb*Fw zTwQTqPDxRPr7X{?oit&bxmL?|j-^9YlE5ZUZ&tGjV`<*-!kWtbOq0o2l$TpsU@R!l z*JhT~Sj#JGvU3Y+^DM=sh1Iq^+r(;VtYNUaqPfu(SLtf+h|6qgk+20am?MMfL1;jP z`V#i9?}!+bbOni;&yz4eiIV0&+oC`u=hs)mB=xVHYwT+e9 z)0iO_3?xG$!5}t27hELM`&?k;mOQ8-B#UJfKoslDM=E9e%SZF!QUG=pQb>nL0Te(8 zpbw;0OQZrgDOrqf;3Q(cAC$7D!%bm0sesiStj6kP;Fv@NZX!{OnHHDJVKZs98k@tV z(-`eWr^e=Vx-@Qw!EAPGT~>op4|5aRQ2`~S#3gjuXLY&~=Jl3RbBflKVzMRcOj?v| zzkFOk9B`p?z%HzZfGgxdmXAXm9K!ZJkQ@z}>OY>%FY~gQ*i53J+8Z2aWWfcHOmZaR z%p$pd8ogcs6G@&gW;_&AlFv#@U=(9TV7^++&61e^l`YFU78*Ht2Ofb&M70iB;~5C( zR=adMeSJM@GpEJo(iq)(B%RG|*Vv2(gVW%)S>09}P?4%QGEt2Tr8c=uM!m~v(72oy zr^aY>S~XU)-KnWJJ9HMC-C{G>Ybknk@&Ll&0GHWP4OghIcWSJbdSiss zsI%EzZXJOCw9%^lgvlf+FLM~!xr-9-%5~q%whrqgaft>%7fSM!)iUoZxVJg(Z8Db* z!AwC4QuR6Zb`j*00*Q19>}(N)u<^y9r$f_OUC3BR*0BMV^RJLoDA%ElI?Wmn9-z zmIyTf+I}?}e+B;W6NSQYDL-=@SJ@BjcpX1jRxl@I;z|mpnU6$Oew5>m5*K-i{sME5 zav!l384$})@3^6q9oxuz$OJayUwkboXXp9~5x)KZ;zdF#SjIj@1RJ`UcaTcv5rkN_ zW;1V&k=QJd)1z2I4LwcQ(tPp*@e)1v3D?T$7iA7)`kVNuM5o@Vb6K7B8swvTjZtf{ zXzXs2L!)=P>uq|Sv0m?Rv(}sVoFQ%}GKtZE%%Zg*?--FW>n%pT#^JWRw065)XLqnY zH}U2~i^XVgTOCG?#p-fsjC!3`W3?I08oN$w*Xd04F00nX^z-<%M6<eET8tW_PV3UxtwyV+9#PkuoNk-V zZeu^p<3}YLEINbRWHV_DHtcRRyQQ8ky~gRZ=n;FH)>N-$`8V^Ki6*zfiW|~vYgVBH! z8B7|h)kfH zB(Q<7i^Jp-y7b7a$1$MYgQ?56Fp}PdT=yujT?_efgU}E`6j-4IP4W}q#7rL#bKpMN zDLX=a{BrbKW1&mRPkn{K&|VCLUW4th8J8l>_Tq&kqh&snH54G098R zDs=!B(DxPC>h*jKCI(+!&)b3(em#2|$K6K9(6?YR@^uIMY%^~m6a8$Q{0x5&Vf~)v z1$O&Zeju6TXXu-KJbETl?aN#F;Vj9=4`I)4L9<)ktNr{IUSwN+d=9DURU5aJPf3(W z(igT#I_%0o@IzF*Z^A2>5Z{SAc>vh9i+o`$V6NBS^HS>kH4Nh3#{}P7@B%!CJr@Jp z@(y1b3+sC9HwK4a^d>XTxEa=A&%6DKg#GIbUl9wNrC3SQJ4fIn%*1b&5`T!o1byl&lI4{d=t~KhaiYu$LZ25U5 z#wuNAaY_D!s?ze@;_9sIiPfsB90T+;bjc{67QI#ufC)Uu$)~;%Cg$)Mmzw{_1^r@x zH!3CER$?ZP;(4XBi_h^RNS&NAV(HKGlZl-zeV(69>ZLzXOx(^V2HbXCxe#u%kvq%S zA7rUv|NL0d$G2%aiYt3-2mcehctD|4KriR0RDrD1>$^_+zK?_ZkcfAH*hJJA zP!aXePR^irTb(9jy~bjf+zy9Uhx*v8)40)DGuZ3xCZk!$b~Y<=d(9Urr3zH?rbr2g zA;S;!VJN_<(+PNnSFqxb6}iMIF<~@Yv4K~ymX8%d63_K#=^rTivxnbT^jF7L3gM+T z;>l(!_bCRlmX8#}iQ7L0%OULbj}#iV>_3VE($H(BJ|8Q_Qezcc`@Uj4ndWbpx<^s; z+u-Etcxj>H>i7x2BRPmfy!!)-d`Gd{fUzO+g3Jy&t<7k&)pt&x<-Q)|lIi|)nYT}&_HFn;@hD--_9~pJY9ZV-ig@}-TMT6rK2`Aj zrO>o}dPj5H4f5PGr7grrO+!^RLUtRA_n~9J?ShMz0X=YARt=*@x$nIsDyBGJvtN6+$e9>)4Wg z3KMB!@9tBSqB@D&udt97KVGT(6@Az(`xPTlm;7_TVlZj-J`xn>JFs67Pieyx_JvAF zB5kaXS{U1d-#!lZA=TdpwogcS{R9u{!z7%i;|igAdDtm(xxI= zXMmtZseK|q7(!;VHv@zelv72ZFqF(;qXLDr2&WJp9!~Di$vM^OjrInY3~unv4-^)Y zIR8#j^q=%z zoUoCydmm8-bzc?^eX`MP#n7%#3}lkus?tl%f!A&hxOTJp>gI00WL}zGb#?od&B7JU zx=V6>X|(c+X6@C@ir;CL*1t5I@7=DmT|FGG-AsGOroSC6i9;A(1>=vz`j@Wsh@PAe#c(MY)nqmZxOLyX{vJtFIN3dMF7++>U z@DNHr$3`N!e;5L9Jc32i75Tz&1os3ZxU&y}zbPp~3Qr;A{)JABT-X#E_Ym+8$H6$} z*`|yPG#kVWY+o`OCNtgh$`J#GNt#qaLO2paW|H@)hQ5Z+5eS{+V!Pi}#F87?$#)eN z>U6WlAR&?5#Fo9Mh-Xi~tB4s=+n@~Bgp=;+O-|PwS%m7^QIn!P)lGNG-}BhFLBbd` z4BEbek=!het%qC8)7hJSg<+)IhoRE|(mj_9`Bj3B!snRu{|NDa14UpvUOR2X)c@n? z-aG_exEKD0cgS<06PjTGdl9{d-cGye4YZv$(gtd$*U^czlorrznno>D zM@P}2G?osc185KxC?OZfcjOE?P7ag(gqY^zKV~TlpF7CUMvFX<-e%fLIC- zV4!d}+y*ye$j}C}P*F^UT6_^v0{M^ysbB^zjD$qw{RjwwKA;4S{z$*2U(sXq5Zy=r zL*J!u(wFHDx|RM5Rm&4}1zke_K^Jt>JMkICO|*-)&>7T8r_gFzPK#(R&7djNNR#nx zMFJg6!)SlZtn=g-a-MumPLU(zAlXYkB>yI_lNZVJWDD6qp2EBHN63Sy$Nx_5AoIzM zcwyH>rjdGbJ*grS$as>2=}{}ulhI@t?pylthQ&qu;`S@Qppj})Db+lOe)=>Rj0oRG zt+>((Qi-xy^q7Rp78Q-dCR}kfz7cvD!@Y(0BH>n;2ea{E%1m%U9n?St;*bZKFb1E&h%f?% z;A5C@T;Tc!B#4SY++iH5H4cnNdU@Zu!OiUh$(xm%@Z$su&jK(8Dt+f>3x%FUPjpa`}?5P0^iN*JN? zC}s-b+1P$c5Jbv(F1H8!o#0mmA#~CR`7kJkCqTS(m_Zzx*~#20?gYL!nnQL`6`g=jxelT~ z)dH+6PL=ArcbBjVVx`V~xD_1!9>bgd-|On}#l0>}g$O^9>p7^yCub$(B3XsItLKck zbZpP=8cmNt;}`X)~-djd)Jw(d6hk7qc^}($R|e}FY(q`?pKbooL}A5pDh}s z(s_qkGx^A-UGI8lSeHd=_n3>MWt8~H3zvBgAF|Ehwo8w`d=V>^CobV|4+nSBGpMw4 zP{#sy4<{va@_TSNuj}9=2RH(}E&65r@R#UFZ?Iu0pZ-GpFz-e~H9zLN871BzVedQ{e0a#axoq89;eKW6;`1}Q61-of>DkLsvxCn=A~n}THd%Du#3}w477HXcdbp&Ql1hLmFD=cqT-QWb&8%n z@RShFr+qT=PPXwW;Q__6WpQ1@z2~su=BI@W!8qgGDNjt2cg7eK`|)YPC5UHlsq{n- z^9H6G*hBvm+{ytvtghOj-ltOa%(7NU9Fe*!T|OqBdyxYZZ6FU|;YuBWWJ1RhQCsGF z?-n8bukk!}gV075 z!3?xx>w)|S(OSda@F^p^dFZDW70{1}3K?Ri0m~sWw8$`1hL}{r`a&6&%CJI)lVw;Z zL#GVgGMpyE88VzD!zLNF$goX@9SZ2iNxS5aIRajyh&qv~@irCz>O}~ID1XTy^8Q+_ zR&@20^kPF#$tX_mDVfEYJteEy=r8HCVslSPFShoSjADCF$!-=qdx}8M;U|EPwA^GV`3QNW3_aJq^fG=^>=#)w(e&iUKE0wHd6w^Gf%;2+lk04cyQ5lV* zW*nv=<*#o1GMdEXUIZ~(L~XC_L@ zB9o|;&NN>%iDprd&qgX)M3sENCX;COSDHkVS+vPhU?rAK7BNM}@A9X~Dvn|AZ0k85 zj1vd)Y0~jvDV(IUo3|-rdMw|y>^gX&_1<8!fh~UmmDJ!*zEjoeyc^7VmbM!8U*eW0 zzbMvv`&jhsq18gTK%ZOpv?omTUT-n56RU+fCGGge+LbIDL^gkokSPR@SbfqHqwzLc z4eY`ip+N|#NE_sd9_{UGGq9yk3hs!sH}*d5w@;WCufdRxl5%c2SAqwf)?=S`JSW&M z>FR5lZScg{SpR`4{R69nX+p@TCEt3Yt!yJ!u$8NX24%wW6t337CWNYVZ0uvgP-Wlq zj?=|vZ$G>gTlyI8C+XsXDo>cnTW2(|(~k*tyzt7n2ib(jg$^MlVgG(ljKSMtGO%AB z7aF3|eEotYypmd3oV!Ea4pw?c4f$xGwKXlPR+p56jpZzE$5J($xB%C3SlWe3K~?x`mGeI zl`-#zH5R9`^&v=-M^*|Eg8GB3C{NfJb}JMnvkC z*L;@`ERWtpP9UOJ9++|?9$2*0=?~0(alULs%_q@_j(#ld5Gy;0Mn7Qr=Z|*f%2qVy zl#r>+e*t~iacD#h?7>sWJ5knC22XU3Y(#CRkw3@IRJ>K2EgR8~PYa2B;19K7?BZ$k zBu4HY?`9=m3HK+)=TG^EA6kh zUj0jZPW(~GhFGbql8cqd^9&6}Pjwf5{QBd|{;%-)rG5U1@~HBQTjm!iZu}$PUtc@X zFK!3EKyfp?@bvuRN?F`ezr?M_cj>*JunJk+?)?(QEiClQvFz-ZC~l*+KCJV^l*!`u z$PwJLs_eYd6FouJO=FJ=?ja#ZBjk&vKXdxo!Ow()%=)2_%XSDLc-D2d*jNZeKA0F z`Dm}LQk=3}?i#Gh5cDtp@`NYGAq!?ow5mZc7CqVFiLRFgb8ocDtxWx}YGtim7R)&@ zszl!AP1Lg$F{(no{|iM+*_jyC{mS&Ht-)PWWJUFStSTcu;e|QBNPa;ecZ~bP7;d-k z&Jn6+!gdbBvtxLGzVAn>29XKUz(jJ2!_3lmlwejX0rPzp%y(5|Ca@7RIk(eA7-v0+ zNBc6S%}xSf_@9c&02juQb1^}%1XFTb(7|{Y?+Ct>pW`eg-Le%no5U>H3S+@+7PDn5 z>@S-wVvcNuFMpb?;y8JfMJwjXqp)DniTUy4I=r_PU56UUb-+?MUVNX~s*GX(-l~irEjukXF+lo{0isPrmo@O$VqfY1 z68LL%I{Jd0qu7rX>{P}U%UIbA;uL?uBuupxi;a5({ zQW(9B4k8`g2VC-^%t+r^r3#ZOQtKbtm|3V~b!=~hDnf{wa(KNbY$hsMJsUMhHI*N< zAtaV99Hinv+tO9JHko%vJh1@Z#npIEL$6bY9ruqM-cld1l300h|s-VU8o{;?DYYvOunCE{f{hYplTUE z%-~Y6bpusPBeYdsB`tE5d3YwW9iC*UNimn zZckb;l+}+_4vo5u`0w<3bgWWqy+((*3DVD{dVzdW@k%#)6nKnw>lc%LdGnDl@BaYX3Jx~_ diff --git a/test/test_api_security.py b/test/test_api_security.py index 5fa026700..8c46e9b11 100644 --- a/test/test_api_security.py +++ b/test/test_api_security.py @@ -962,7 +962,7 @@ class TestBuildTriggerActivateSwo1DevtableShared(ApiTestCase): self._run_test('POST', 403, 'reader', {}) def test_post_devtable(self): - self._run_test('POST', 404, 'devtable', {}) + self._run_test('POST', 404, 'devtable', {'config': {}}) class TestBuildTriggerActivateSwo1BuynlargeOrgrepo(ApiTestCase): @@ -980,7 +980,7 @@ class TestBuildTriggerActivateSwo1BuynlargeOrgrepo(ApiTestCase): self._run_test('POST', 403, 'reader', {}) def test_post_devtable(self): - self._run_test('POST', 404, 'devtable', {}) + self._run_test('POST', 404, 'devtable', {'config': {}}) class TestBuildTriggerSources831cPublicPublicrepo(ApiTestCase): diff --git a/test/test_api_usage.py b/test/test_api_usage.py index 977c20f2c..20d216df2 100644 --- a/test/test_api_usage.py +++ b/test/test_api_usage.py @@ -982,6 +982,33 @@ class TestRequestRepoBuild(ApiTestCase): assert len(json['builds']) > 0 + def test_requestrepobuild_with_credentials(self): + self.login(ADMIN_ACCESS_USER) + + # Ensure where not yet building. + json = self.getJsonResponse(RepositoryBuildList, + params=dict(repository=ADMIN_ACCESS_USER + '/simple')) + + assert len(json['builds']) == 0 + + # Request a (fake) build. + pull_creds = { + 'username': 'foo', + 'password': 'bar', + 'registry': 'baz' + } + self.postResponse(RepositoryBuildList, + params=dict(repository=ADMIN_ACCESS_USER + '/simple'), + data=dict(file_id='foobarbaz', pull_credentials=pull_creds), + expected_code=201) + + # Check for the build. + json = self.getJsonResponse(RepositoryBuildList, + params=dict(repository=ADMIN_ACCESS_USER + '/building')) + + assert len(json['builds']) > 0 + + class TestWebhooks(ApiTestCase): def test_webhooks(self): @@ -1642,7 +1669,7 @@ class TestBuildTriggers(ApiTestCase): trigger_config = {} activate_json = self.postJsonResponse(BuildTriggerActivate, params=dict(repository=ADMIN_ACCESS_USER + '/simple', trigger_uuid=trigger.uuid), - data=trigger_config) + data={'config': trigger_config}) self.assertEquals(True, activate_json['is_active']) @@ -1654,7 +1681,7 @@ class TestBuildTriggers(ApiTestCase): # Make sure we cannot activate again. self.postResponse(BuildTriggerActivate, params=dict(repository=ADMIN_ACCESS_USER + '/simple', trigger_uuid=trigger.uuid), - data=trigger_config, + data={'config': trigger_config}, expected_code=400) # Start a manual build. @@ -1667,6 +1694,69 @@ class TestBuildTriggers(ApiTestCase): self.assertEquals(['bar'], start_json['job_config']['docker_tags']) + def test_invalid_robot_account(self): + self.login(ADMIN_ACCESS_USER) + + database.BuildTriggerService.create(name='fakeservice') + + # Add a new fake trigger. + repo = model.get_repository(ADMIN_ACCESS_USER, 'simple') + user = model.get_user(ADMIN_ACCESS_USER) + trigger = model.create_build_trigger(repo, 'fakeservice', 'sometoken', user) + + # Try to activate it with an invalid robot account. + trigger_config = {} + activate_json = self.postJsonResponse(BuildTriggerActivate, + params=dict(repository=ADMIN_ACCESS_USER + '/simple', trigger_uuid=trigger.uuid), + data={'config': trigger_config, 'pull_robot': 'someinvalidrobot'}, + expected_code=404) + + def test_unauthorized_robot_account(self): + self.login(ADMIN_ACCESS_USER) + + database.BuildTriggerService.create(name='fakeservice') + + # Add a new fake trigger. + repo = model.get_repository(ADMIN_ACCESS_USER, 'simple') + user = model.get_user(ADMIN_ACCESS_USER) + trigger = model.create_build_trigger(repo, 'fakeservice', 'sometoken', user) + + # Try to activate it with a robot account in the wrong namespace. + trigger_config = {} + activate_json = self.postJsonResponse(BuildTriggerActivate, + params=dict(repository=ADMIN_ACCESS_USER + '/simple', trigger_uuid=trigger.uuid), + data={'config': trigger_config, 'pull_robot': 'freshuser+anotherrobot'}, + expected_code=403) + + def test_robot_account(self): + self.login(ADMIN_ACCESS_USER) + + database.BuildTriggerService.create(name='fakeservice') + + # Add a new fake trigger. + repo = model.get_repository(ADMIN_ACCESS_USER, 'simple') + user = model.get_user(ADMIN_ACCESS_USER) + trigger = model.create_build_trigger(repo, 'fakeservice', 'sometoken', user) + + # Try to activate it with a robot account. + trigger_config = {} + activate_json = self.postJsonResponse(BuildTriggerActivate, + params=dict(repository=ADMIN_ACCESS_USER + '/simple', trigger_uuid=trigger.uuid), + data={'config': trigger_config, 'pull_robot': ADMIN_ACCESS_USER + '+dtrobot'}) + + # Verify that the robot was saved. + self.assertEquals(True, activate_json['is_active']) + self.assertEquals(ADMIN_ACCESS_USER + '+dtrobot', activate_json['pull_user']['name']) + + # Start a manual build. + start_json = self.postJsonResponse(ActivateBuildTrigger, + params=dict(repository=ADMIN_ACCESS_USER + '/simple', trigger_uuid=trigger.uuid), + expected_code=201) + + assert 'id' in start_json + self.assertEquals("build-name", start_json['display_name']) + self.assertEquals(['bar'], start_json['job_config']['docker_tags']) + class TestUserAuthorizations(ApiTestCase): def test_list_get_delete_user_authorizations(self): diff --git a/util/names.py b/util/names.py index 7e48468bb..b705bec36 100644 --- a/util/names.py +++ b/util/names.py @@ -24,3 +24,6 @@ def parse_repository_name(f): def format_robot_username(parent_username, robot_shortname): return '%s+%s' % (parent_username, robot_shortname) + +def parse_robot_username(robot_username): + return robot_username.split('+', 2) diff --git a/workers/dockerfilebuild.py b/workers/dockerfilebuild.py index 398b33842..31cd6bfde 100644 --- a/workers/dockerfilebuild.py +++ b/workers/dockerfilebuild.py @@ -56,15 +56,21 @@ def unwrap_stream(json_stream): class DockerfileBuildContext(object): def __init__(self, build_context_dir, dockerfile_subdir, repo, tag_names, - push_token, build_uuid): + push_token, build_uuid, pull_credentials=None): self._build_dir = build_context_dir self._dockerfile_subdir = dockerfile_subdir self._repo = repo self._tag_names = tag_names self._push_token = push_token - self._cl = Client(timeout=1200) self._status = StatusWrapper(build_uuid) self._build_logger = partial(build_logs.append_log_message, build_uuid) + self._pull_credentials = pull_credentials + + # Note: We have two different clients here because we (potentially) login + # with both, but with different credentials that we do not want shared between + # the build and push operations. + self._push_cl = Client(timeout=1200) + self._build_cl = Client(timeout=1200) dockerfile_path = os.path.join(self._build_dir, dockerfile_subdir, "Dockerfile") @@ -99,6 +105,13 @@ class DockerfileBuildContext(object): return float(sent_bytes)/total_bytes*percentage_with_sizes def build(self): + # Login with the specified credentials (if any). + if self._pull_credentials: + logger.debug('Logging in with pull credentials.') + self.build_cl_.login(self._pull_credentials['username'], self._pull_credentials['password'], + registry=self._pull_credentials['registry'], reauth=True) + + # Start the build itself. logger.debug('Starting build.') with self._status as status: @@ -110,7 +123,7 @@ class DockerfileBuildContext(object): logger.debug('Final context path: %s exists: %s' % (context_path, os.path.exists(context_path))) - build_status = self._cl.build(path=context_path, stream=True) + build_status = self._build_cl.build(path=context_path, stream=True) current_step = 0 built_image = None @@ -158,7 +171,7 @@ class DockerfileBuildContext(object): logger.debug('Attempting login to registry: %s' % registry_endpoint) try: - self._cl.login('$token', self._push_token, registry=registry_endpoint) + self._push_cl.login('$token', self._push_token, registry=registry_endpoint) break except APIError: pass # Probably the wrong protocol @@ -166,15 +179,15 @@ class DockerfileBuildContext(object): for tag in self._tag_names: logger.debug('Tagging image %s as %s:%s' % (built_image, self._repo, tag)) - self._cl.tag(built_image, self._repo, tag) + self._push_cl.tag(built_image, self._repo, tag) - history = json.loads(self._cl.history(built_image)) + history = json.loads(self._push_cl.history(built_image)) num_images = len(history) with self._status as status: status['total_images'] = num_images logger.debug('Pushing to repo %s' % self._repo) - resp = self._cl.push(self._repo, stream=True) + resp = self._push_cl.push(self._repo, stream=True) for status_str in resp: status = json.loads(status_str) @@ -204,20 +217,20 @@ class DockerfileBuildContext(object): def __cleanup(self): # First clean up any containers that might be holding the images - for running in self._cl.containers(quiet=True): + for running in self._build_cl.containers(quiet=True): logger.debug('Killing container: %s' % running['Id']) - self._cl.kill(running['Id']) + self._build_cl.kill(running['Id']) # Next, remove all of the containers (which should all now be killed) - for container in self._cl.containers(all=True, quiet=True): + for container in self._build_cl.containers(all=True, quiet=True): logger.debug('Removing container: %s' % container['Id']) - self._cl.remove_container(container['Id']) + self._build_cl.remove_container(container['Id']) # Iterate all of the images and remove the ones that the public registry # doesn't know about, this should preserve base images. images_to_remove = set() repos = set() - for image in self._cl.images(): + for image in self._build_cl.images(): images_to_remove.add(image['Id']) for tag in image['RepoTags']: @@ -237,13 +250,13 @@ class DockerfileBuildContext(object): for to_remove in images_to_remove: logger.debug('Removing private image: %s' % to_remove) try: - self._cl.remove_image(to_remove) + self._build_cl.remove_image(to_remove) except APIError: # Sometimes an upstream image removed this one pass # Verify that our images were actually removed - for image in self._cl.images(): + for image in self._build_cl.images(): if image['Id'] in images_to_remove: raise RuntimeError('Image was not removed: %s' % image['Id']) @@ -291,6 +304,7 @@ class DockerfileBuildWorker(Worker): tag_names = job_config['docker_tags'] build_subdir = job_config['build_subdir'] repo = job_config['repository'] + pull_credentials = job_config.get('pull_credentials', None) access_token = repository_build.access_token.code @@ -325,7 +339,7 @@ class DockerfileBuildWorker(Worker): with DockerfileBuildContext(build_dir, build_subdir, repo, tag_names, access_token, - repository_build.uuid) as build_ctxt: + repository_build.uuid, pull_credentials) as build_ctxt: try: built_image = build_ctxt.build() @@ -379,4 +393,4 @@ else: handler = logging.StreamHandler() handler.setFormatter(formatter) root_logger.addHandler(handler) - worker.start() \ No newline at end of file + worker.start() From 126363dce9c2037a3843816416a7ef042daa9a8b Mon Sep 17 00:00:00 2001 From: jakedt Date: Tue, 1 Apr 2014 11:38:17 -0400 Subject: [PATCH 02/58] Use our patched version of docker-py with build credentials patched in. Fix the hostname in the build credentials block to be variable. --- data/model/legacy.py | 2 +- requirements-nover.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/data/model/legacy.py b/data/model/legacy.py index e398d8b97..9ddda72e1 100644 --- a/data/model/legacy.py +++ b/data/model/legacy.py @@ -1471,7 +1471,7 @@ def get_pull_credentials(trigger): return { 'username': trigger.pull_user.username, 'password': login_info.service_ident, - 'registry': 'quay.io' # TODO: Is there a better way to do this? + 'registry': app.config['URL_HOST'], } def create_webhook(repo, params_obj): diff --git a/requirements-nover.txt b/requirements-nover.txt index bac4ba690..8bd0d7946 100644 --- a/requirements-nover.txt +++ b/requirements-nover.txt @@ -21,7 +21,7 @@ xhtml2pdf logstash_formatter redis hiredis -docker-py +git+https://github.com/DevTable/docker-py.git loremipsum pygithub flask-restful From ca1970a2f496592d500e0a09a8b0801113b63d8e Mon Sep 17 00:00:00 2001 From: jakedt Date: Tue, 1 Apr 2014 19:00:11 -0400 Subject: [PATCH 03/58] Use the real registry endpoint in the login command. --- data/model/legacy.py | 2 +- workers/dockerfilebuild.py | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/data/model/legacy.py b/data/model/legacy.py index 9ddda72e1..a2cac1d26 100644 --- a/data/model/legacy.py +++ b/data/model/legacy.py @@ -1471,7 +1471,7 @@ def get_pull_credentials(trigger): return { 'username': trigger.pull_user.username, 'password': login_info.service_ident, - 'registry': app.config['URL_HOST'], + 'registry': '%s://%s/v1/' % (app.config['URL_SCHEME'], app.config['URL_HOST']), } def create_webhook(repo, params_obj): diff --git a/workers/dockerfilebuild.py b/workers/dockerfilebuild.py index ea165060e..6e8be1f4d 100644 --- a/workers/dockerfilebuild.py +++ b/workers/dockerfilebuild.py @@ -143,7 +143,8 @@ class DockerfileBuildContext(object): def build(self): # Login with the specified credentials (if any). if self._pull_credentials: - logger.debug('Logging in with pull credentials.') + logger.debug('Logging in with pull credentials: %s@%s', + self._pull_credentials['username'], self._pull_credentials['registry']) self._build_cl.login(self._pull_credentials['username'], self._pull_credentials['password'], registry=self._pull_credentials['registry'], reauth=True) From 93fd48d6b03e8c1f06b19d63a1cee281d66ecaa3 Mon Sep 17 00:00:00 2001 From: Joseph Schorr Date: Tue, 1 Apr 2014 19:30:29 -0400 Subject: [PATCH 04/58] Disable the finish trigger setup button if a robot account permission is selected but no robot account is given --- static/partials/repo-admin.html | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/static/partials/repo-admin.html b/static/partials/repo-admin.html index 80d45768e..172b6d9f8 100644 --- a/static/partials/repo-admin.html +++ b/static/partials/repo-admin.html @@ -438,7 +438,9 @@
- +
From 2a72e91bdb166564b7c644f61fd861e2f1e9a95e Mon Sep 17 00:00:00 2001 From: Joseph Schorr Date: Tue, 1 Apr 2014 19:33:11 -0400 Subject: [PATCH 05/58] Prevent the entity search typeahead "no users found" message from being displayed when the entity is set from code --- static/js/app.js | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/static/js/app.js b/static/js/app.js index 7ac0219f2..311b531fb 100644 --- a/static/js/app.js +++ b/static/js/app.js @@ -2728,7 +2728,7 @@ quayApp.directive('entitySearch', function () { entity['is_org_member'] = true; } - $scope.setEntityInternal(entity); + $scope.setEntityInternal(entity, false); }; $scope.clearEntityInternal = function() { @@ -2738,8 +2738,12 @@ quayApp.directive('entitySearch', function () { } }; - $scope.setEntityInternal = function(entity) { - $(input).typeahead('val', $scope.isPersistent ? entity.name : ''); + $scope.setEntityInternal = function(entity, updateTypeahead) { + if (updateTypeahead) { + $(input).typeahead('val', $scope.isPersistent ? entity.name : ''); + } else { + $(input).val($scope.isPersistent ? entity.name : ''); + } if ($scope.isPersistent) { $scope.currentEntity = entity; @@ -2854,7 +2858,7 @@ quayApp.directive('entitySearch', function () { $(input).on('typeahead:selected', function(e, datum) { $scope.$apply(function() { - $scope.setEntityInternal(datum.entity); + $scope.setEntityInternal(datum.entity, true); }); }); From 38cb12b7c6706b4ad2afe26d48e2816a8f60aa1d Mon Sep 17 00:00:00 2001 From: Joseph Schorr Date: Tue, 1 Apr 2014 19:44:31 -0400 Subject: [PATCH 06/58] Make sure the sign in form redirects to the landing page --- static/partials/signin.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/static/partials/signin.html b/static/partials/signin.html index 434d835d3..4aac6cb7e 100644 --- a/static/partials/signin.html +++ b/static/partials/signin.html @@ -1,7 +1,7 @@ From 9a79d1562ad2aaf8452910cec82a5db33e19b940 Mon Sep 17 00:00:00 2001 From: Joseph Schorr Date: Tue, 1 Apr 2014 21:49:06 -0400 Subject: [PATCH 07/58] Change to store the pull robot on the repository build and only add the credentials to the queue item. This prevents the credentials from being exposed to the end user. Also fixes the restart build option --- data/database.py | 3 +- data/model/legacy.py | 31 ++++++++++++---- endpoints/api/build.py | 64 ++++++++++++++++---------------- endpoints/api/trigger.py | 8 ++-- endpoints/common.py | 8 ++-- endpoints/webhooks.py | 4 +- initdb.py | 2 +- static/js/controllers.js | 9 ++++- static/partials/repo-admin.html | 4 +- test/data/test.db | Bin 198656 -> 544768 bytes test/test_api_usage.py | 39 +++++++++++++------ util/names.py | 3 ++ workers/dockerfilebuild.py | 3 +- 13 files changed, 110 insertions(+), 68 deletions(-) diff --git a/data/database.py b/data/database.py index b0cb60bb6..d6a67bd80 100644 --- a/data/database.py +++ b/data/database.py @@ -176,7 +176,7 @@ class RepositoryBuildTrigger(BaseModel): auth_token = CharField() config = TextField(default='{}') write_token = ForeignKeyField(AccessToken, null=True) - pull_user = ForeignKeyField(User, null=True, related_name='pulluser') + pull_robot = ForeignKeyField(User, null=True, related_name='triggerpullrobot') class EmailConfirmation(BaseModel): @@ -245,6 +245,7 @@ class RepositoryBuild(BaseModel): started = DateTimeField(default=datetime.now) display_name = CharField() trigger = ForeignKeyField(RepositoryBuildTrigger, null=True, index=True) + pull_robot = ForeignKeyField(User, null=True, related_name='buildpullrobot') class QueueItem(BaseModel): diff --git a/data/model/legacy.py b/data/model/legacy.py index a2cac1d26..3cfa6c27f 100644 --- a/data/model/legacy.py +++ b/data/model/legacy.py @@ -1453,27 +1453,42 @@ def get_recent_repository_build(namespace_name, repository_name): def create_repository_build(repo, access_token, job_config_obj, dockerfile_id, - display_name, trigger=None): + display_name, trigger=None, pull_robot_name=None): + pull_robot = None + if pull_robot_name: + pull_robot = lookup_robot(pull_robot_name) + return RepositoryBuild.create(repository=repo, access_token=access_token, job_config=json.dumps(job_config_obj), display_name=display_name, trigger=trigger, - resource_key=dockerfile_id) + resource_key=dockerfile_id, + pull_robot=pull_robot) -def get_pull_credentials(trigger): - if not trigger.pull_user: + +def get_pull_robot_name(trigger): + if not trigger.pull_robot: return None + return trigger.pull_robot.username + + +def get_pull_credentials(robotname): + robot = lookup_robot(robotname) + if not robot: + return None + try: - login_info = FederatedLogin.get(user=trigger.pull_user) + login_info = FederatedLogin.get(user=robot) except FederatedLogin.DoesNotExist: return None return { - 'username': trigger.pull_user.username, + 'username': robot.username, 'password': login_info.service_ident, 'registry': '%s://%s/v1/' % (app.config['URL_SCHEME'], app.config['URL_HOST']), } + def create_webhook(repo, params_obj): return Webhook.create(repository=repo, parameters=json.dumps(params_obj)) @@ -1530,12 +1545,12 @@ def log_action(kind_name, user_or_organization_name, performer=None, metadata_json=json.dumps(metadata), datetime=timestamp) -def create_build_trigger(repo, service_name, auth_token, user, pull_user=None): +def create_build_trigger(repo, service_name, auth_token, user, pull_robot=None): service = BuildTriggerService.get(name=service_name) trigger = RepositoryBuildTrigger.create(repository=repo, service=service, auth_token=auth_token, connected_user=user, - pull_user=None) + pull_robot=pull_robot) return trigger diff --git a/endpoints/api/build.py b/endpoints/api/build.py index 3ff6dfd9d..9fa130054 100644 --- a/endpoints/api/build.py +++ b/endpoints/api/build.py @@ -10,8 +10,10 @@ from endpoints.api import (RepositoryParamResource, parse_args, query_param, nic from endpoints.common import start_build from endpoints.trigger import BuildTrigger from data import model -from auth.permissions import ModifyRepositoryPermission +from auth.auth_context import get_authenticated_user +from auth.permissions import ModifyRepositoryPermission, AdministerOrganizationPermission from data.buildlogs import BuildStatusRetrievalError +from util.names import parse_robot_username logger = logging.getLogger(__name__) @@ -33,13 +35,14 @@ def get_job_config(build_obj): return None +def user_view(user): + return { + 'name': user.username, + 'kind': 'user', + 'is_robot': user.robot, + } + def trigger_view(trigger): - def user_view(user): - return { - 'name': user.username, - 'kind': 'user', - 'is_robot': user.robot, - } if trigger and trigger.uuid: config_dict = get_trigger_config(trigger) @@ -50,7 +53,7 @@ def trigger_view(trigger): 'id': trigger.uuid, 'connected_user': trigger.connected_user.username, 'is_active': build_trigger.is_active(config_dict), - 'pull_user': user_view(trigger.pull_user) if trigger.pull_user else None + 'pull_robot': user_view(trigger.pull_robot) if trigger.pull_robot else None } return None @@ -75,6 +78,7 @@ def build_status_view(build_obj, can_write=False): 'is_writer': can_write, 'trigger': trigger_view(build_obj.trigger), 'resource_key': build_obj.resource_key, + 'pull_robot': user_view(build_obj.pull_robot) if build_obj.pull_robot else None, } if can_write: @@ -103,28 +107,9 @@ class RepositoryBuildList(RepositoryParamResource): 'type': 'string', 'description': 'Subdirectory in which the Dockerfile can be found', }, - 'pull_credentials': { - 'type': 'object', - 'description': 'Credentials used by the builder when pulling images', - 'required': [ - 'username', - 'password', - 'registry' - ], - 'properties': { - 'username': { - 'type': 'string', - 'description': 'The username for the pull' - }, - 'password': { - 'type': 'string', - 'description': 'The password for the pull' - }, - 'registry': { - 'type': 'string', - 'description': 'The registry hostname for the pull' - }, - } + 'pull_robot': { + 'type': 'string', + 'description': 'Username of a Quay robot account to use as pull credentials', } }, }, @@ -154,7 +139,22 @@ class RepositoryBuildList(RepositoryParamResource): dockerfile_id = request_json['file_id'] subdir = request_json['subdirectory'] if 'subdirectory' in request_json else '' - pull_credentials = request_json.get('pull_credentials', None) + pull_robot_name = request_json.get('pull_robot', None) + + # Verify the security behind the pull robot. + if pull_robot_name: + result = parse_robot_username(pull_robot_name) + if result: + pull_robot = model.lookup_robot(pull_robot_name) + if not pull_robot: + raise NotFound() + + # Make sure the user has administer permissions for the robot's namespace. + (robot_namespace, shortname) = result + if not AdministerOrganizationPermission(robot_namespace).can(): + raise Unauthorized() + else: + raise Unauthorized() # Check if the dockerfile resource has already been used. If so, then it # can only be reused if the user has access to the repository for which it @@ -170,7 +170,7 @@ class RepositoryBuildList(RepositoryParamResource): display_name = user_files.get_file_checksum(dockerfile_id) build_request = start_build(repo, dockerfile_id, ['latest'], display_name, subdir, True, - pull_credentials=pull_credentials) + pull_robot_name=pull_robot_name) resp = build_status_view(build_request, True) repo_string = '%s/%s' % (namespace, repository) diff --git a/endpoints/api/trigger.py b/endpoints/api/trigger.py index fc734d3db..c62367f52 100644 --- a/endpoints/api/trigger.py +++ b/endpoints/api/trigger.py @@ -190,7 +190,7 @@ class BuildTriggerActivate(RepositoryParamResource): raise Unauthorized() # Set the pull robot. - trigger.pull_user = pull_robot + trigger.pull_robot = pull_robot # Update the config. new_config_dict = request.get_json()['config'] @@ -224,7 +224,7 @@ class BuildTriggerActivate(RepositoryParamResource): log_action('setup_repo_trigger', namespace, {'repo': repository, 'namespace': namespace, 'trigger_id': trigger.uuid, 'service': trigger.service.name, - 'pull_user': trigger.pull_user.username if trigger.pull_user else None, + 'pull_robot': trigger.pull_robot.username if trigger.pull_robot else None, 'config': final_config}, repo=repo) return trigger_view(trigger) @@ -254,10 +254,10 @@ class ActivateBuildTrigger(RepositoryParamResource): dockerfile_id, tags, name, subdir = specs repo = model.get_repository(namespace, repository) - pull_credentials = model.get_pull_credentials(trigger) + pull_robot_name = model.get_pull_robot_name(trigger) build_request = start_build(repo, dockerfile_id, tags, name, subdir, True, - pull_credentials=pull_credentials) + pull_robot_name=pull_robot_name) resp = build_status_view(build_request, True) repo_string = '%s/%s' % (namespace, repository) diff --git a/endpoints/common.py b/endpoints/common.py index e22df6226..e25d7c797 100644 --- a/endpoints/common.py +++ b/endpoints/common.py @@ -107,7 +107,7 @@ def check_repository_usage(user_or_org, plan_found): def start_build(repository, dockerfile_id, tags, build_name, subdir, manual, - trigger=None, pull_credentials=None): + trigger=None, pull_robot_name=None): host = urlparse.urlparse(request.url).netloc repo_path = '%s/%s/%s' % (host, repository.namespace, repository.name) @@ -118,18 +118,18 @@ def start_build(repository, dockerfile_id, tags, build_name, subdir, manual, job_config = { 'docker_tags': tags, 'repository': repo_path, - 'build_subdir': subdir, - 'pull_credentials': pull_credentials, + 'build_subdir': subdir } build_request = model.create_repository_build(repository, token, job_config, dockerfile_id, build_name, - trigger) + trigger, pull_robot_name = pull_robot_name) dockerfile_build_queue.put(json.dumps({ 'build_uuid': build_request.uuid, 'namespace': repository.namespace, 'repository': repository.name, + 'pull_credentials': model.get_pull_credentials(pull_robot_name) if pull_robot_name else None }), retries_remaining=1) metadata = { diff --git a/endpoints/webhooks.py b/endpoints/webhooks.py index 69ba97b58..93d5e413c 100644 --- a/endpoints/webhooks.py +++ b/endpoints/webhooks.py @@ -73,10 +73,10 @@ def build_trigger_webhook(namespace, repository, trigger_uuid): # This was just a validation request, we don't need to build anything return make_response('Okay') - pull_credentials = model.get_pull_credentials(trigger) + pull_robot_name = model.get_pull_robot_name(trigger) repo = model.get_repository(namespace, repository) start_build(repo, dockerfile_id, tags, name, subdir, False, trigger, - pull_credentials=pull_credentials) + pull_robot_name=pull_robot_name) return make_response('Okay') diff --git a/initdb.py b/initdb.py index edad2f2b1..854f83f8a 100644 --- a/initdb.py +++ b/initdb.py @@ -332,7 +332,7 @@ def populate_database(): token = model.create_access_token(building, 'write') trigger = model.create_build_trigger(building, 'github', '123authtoken', - new_user_1, pull_user = dtrobot) + new_user_1, pull_robot=dtrobot[0]) trigger.config = json.dumps({ 'build_source': 'jakedt/testconnect', 'subdir': '', diff --git a/static/js/controllers.js b/static/js/controllers.js index e907398eb..08bcca561 100644 --- a/static/js/controllers.js +++ b/static/js/controllers.js @@ -962,9 +962,13 @@ function RepoBuildCtrl($scope, Restangular, ApiService, $routeParams, $rootScope var data = { 'file_id': build['resource_key'], - 'subdirectory': subdirectory + 'subdirectory': subdirectory, }; + if (build['pull_robot']) { + data['pull_robot'] = build['pull_robot']['name']; + } + var params = { 'repository': namespace + '/' + name }; @@ -1486,7 +1490,8 @@ function RepoAdminCtrl($scope, Restangular, ApiService, KeyService, $routeParams } ApiService.activateBuildTrigger(data, params).then(function(resp) { - trigger['is_active'] = true; + trigger['is_active'] = true; + trigger['pull_robot'] = resp['pull_robot']; }, function(resp) { $scope.triggers.splice($scope.triggers.indexOf(trigger), 1); bootbox.dialog({ diff --git a/static/partials/repo-admin.html b/static/partials/repo-admin.html index 172b6d9f8..f1ee224f5 100644 --- a/static/partials/repo-admin.html +++ b/static/partials/repo-admin.html @@ -270,11 +270,11 @@ Setting up trigger
-
+
Pull Credentials: - +
diff --git a/test/data/test.db b/test/data/test.db index b52ec7fe126611a7256b4d1fc9673b523ab1a3d5..a2d06594804813bac40b14a63510edfab6653493 100644 GIT binary patch delta 18485 zcmeHv2Y6IP*YM8V?Ys95JwPfUkc6<=-l*C1LOLl#Fzjx2lR!d35<(N=+7$uuiUU|c zQLzE~qDE1vV#kgY6;Py$6vgi6f9~A?F(JNwpa1(m|MUF+KIAgx%$aj%&YU^t%$$4u zUE1r{3>jHmIH9)17v*ngs&}_UnI*j>2uYHnq9hV#sYD{V8U8N)W-c3PPFpI`eH9~v zA{jX@R5X!a$q(c_`Gy?VEYkE-eW$uz6{fsbIasklQ6oPmUnQF;{YCn$w21kgS&tjg zkEm6$ZJ8^KPrWG>h4Wul_2(bFX|k#h9tDQ-%c}eF>u*x?iPanmNx%_UjiDu>7uU>3ddWiW&HUYI5vULUY}zD#LfT-|o3Bnw;18z`K)v`M zQ%mqXj=v=#kxxz-#Gf0X;y+Co!2}qVpOR|i_l_9EuS<3EAqfeH<(H-oEUK5j?CectnkaN914@o`_tOkc*poTh20@qAZ6y zJ@_Q;Wd5R}myG-%AwTp0F@^s@!=*ChJfM=?7-RvK(XP`fG=BBB>JqhF^`uIzoTj*- zn50n4H^@0zz4W4VvXo_>WqRXA^b@K?y(G^`ZsCnumm;x5z$2mO7vdQDN+~Xv8w0(@ z=0;Go1DoiCG902XKBsy)Fd&>3?!adHKpC!-DvwX?PZy=)7BVs<=U5;jR3#~qn1=*( z^qDxEK%Hs0nuMU+hX%q2chn@%Arxv3q+!3@y7J*Q6@%y#C$N#uPRGNf{W2eEq-)Y~ zj?|cS>r8q!9WR$h_f7k(bpSnc5`bRLz%IqGKfb*o5YeCdPXS$Y46Y%gFT8pn5Z>=f z4`oec)3hXsLfa_LMdg>LoH4Layy%v1MdwW{fvDbQ+uB2JQOUWjwht%>*nDVmQSr&IO# ze!1kyyL1%_y5(K~`YaB|$j$RTMY(bsJ`oD+@i6|fIF~jsKt}5)!ua17592@n7yaAx zbUbcR*thlD6o_Ex!V;)kIRaNJh9@b02!vxASqdei5@5UynI|_^AiAX#5bjIBg9OgJ zehNIU8wZd1kpff3XkU40OV}A~9&2YKS*7;8_JH<AjbS7TE+HH;lYwn)e)Y;Y}-4@yZ`N~u&yy6jI9KIn(dY~+w zKavxzB410$kK}7|rU$4D{_Ff9Dso7`b&4G70V*klV>fZWrh081`Y-rTtoaqc%r#T625n#sgO|blgT9o#f0jR%B4DsosSr6gC_3kqG9^ekstT4s7lS#oY# zxod){(3+KM%S@#?kK=j z$=4g))4X+dzco3tu{F)$w>u_f8bg)TtlH_ic}+s z49H?t5~Wh&!Q)Ya!_r9uvX{PdI=neLkE;@O2Z+V3fBO)_O9r<h>vP(jKBNxaS za)cZt`vLxaSa2uE+hkYQHiGT}B5?q}%R9QGL$UFXV)GN15kOP&e$R~?l0wNt5^|Ir zCZCZ{$%o`!@&?&K9wQHdG&3rbz=V`X4WJMaN3#-=0>J^iP?eZ<=nc{ioc9Ll~=S zTC=yNp{XgU%GcWB_SE?jy$$t(9F=nWB(SO1k!WsT_aPm`v}H==V0Q#qE&itio5=(* zY4CqzaNDjbMl*2`l??yW5za(GOc-B%m`DBnRV^$^DLE+to%D z%AaW)sQG)aGXC57AsX&W33&;)Kc39&iZ@9c&CoRtEN}bAQzXrh!BnIF&IEOupSCOe z9Mgg5pH2@>7YI`IFgac3CgCqcZg6s75Pt@X_$2wV>mYVaPBQ=HqM>63qaP*cN4$*b z&-^A0NKeS>WuM9G2SnTOo+}1pHqva`5Fd{&o0dgaOwO(b=~Zmj%LZ+OXy9gv z2Jd{)0L~UI;#}0pOulSBcebj>ME(sk{NEb$oeY26+Qli5Du|grXqE)cLO4TfEMJQSS@G~t2W2o2*O+SrdzTs;R3??`F*TUQhQz5R0jv(>}+u}|w!?56ss!!e2j zfJpwy4O3A(q@wt<8#KIa<1{n^a+Um~ZR7a5rcaLf;%Q5H*&|iuA(Gu z0>d9$)jzJ-V#-L*%gxPA&aQA}nX__BQ!-o?#p%V)wCq%Sku^JeQf5U#S}wo!zF~ak zefe?arktW2rz^`*o}CTq^`uOTCAqLH*O2TgNVTVBSc{U4lXC4DPH5oL3X2&FmfZJ$ zWy!4tOAcHqAdS0{*|FFwL`nSfI<1U640^`Zpq3S=Y9=F%q(r3}(m%w-vSypbVe{F& zI={nd(pl_2o6h01San8^xyn*iRpquitxdkhhEeXS`q~*SzUG#ehUvZ;CWFzUGr&Jn zl)*5{Y#L>7a+Ul~?W~Oa z20CC55MKVbmsS59;tkb*#9{@;Bda823t82j{6h@CYOlY8HU7@DAJQrWKiY3SdeW{D z+2fZZ8U;Be8n4|u6*c61{?zeM1%VauJ?XY0IwmoPKXy7|Tz|Adf;Qk2OaZf+IV$zb zys~%XX89Ing7Q99Z&g5bLOV>mo1M=oxo5~I5(8|RED@YA!cR(lE;Jlv&^ukoPLC&{ z$b>m*ijc8GP#{vMZZm?P)_;RtrwHlaAKg?as(CFwcfIgu;Jy1^8`x9jChxvXgpB;t z`>#bNUUMJ^nfbB5^Wk z5RDVkjc9y(VQ-X+Q4*ax97WRyhanYxyDzfQ-7zQ=xq_wVVo)ENJq($!dK`UbI2whL zgB2ePM+(|67RBOWrf-2=ir{`4P%Wn`U%th*Y-vI5Rqh7^(#q|&?m4!a%XmqX_;m_dMf>`tB2 zVFm%_a60{No6+d;x|#XW%?xUrESUJs`=73uj!ae@De%Nl}|1MgPvr2Pe8-0+#WEq`n(H z1D|1NeJIkj87*d;*J7~is*E$MyG4Ax_%1eK`3gi;%; zs%$>1(V+9XjY0#5UFY^Y-8vs^9VV;K#gc%V0{UFND_bALJ(({q1pDGCUBRSvgy@J;ML_y{aVi+l- zLYQGxsvz>S5-@0b-bjm}m74x+Mq050;n1lkZU8zG1UdktXeRYQhk#K^ztf{WDgw;^ z%U>}+J#9yW6@oE!u}7mTkDeTj!bCxSs>dDlF!Gkqg6D%Y$i95rs=Q7!!S)Mg% z_iJZrODK`z>~z#cKBGJWi)m=kWSH4v*7qsdD=0%v6*b z2^6m~SWDpNgz8&MK?L3O}8}=dtQ6kk)z3 zpmW&Wevb)$Ua!+kO=)OsjLq%vgB#MJ14Krh#cXxz+y;+B=K*X+P)qzqhnw(g1he!tG`_4svmhudH=S>0}r*G7L%LkTe!yVp?V@jHM!4K@%HPM^-> zt}^SYyjFwFVRPH8RaG=I9l2s`R;$A=^yxQLIe|{U5nkKm&;d5Lv&!goJMDJ5J{^U{ zn7wAF#csFhJXQ

F|1WPLt3(fEX-Bv)$u%(lhBOGsaw1W$-u+UY*@&g;BEDVU%pJ zUVKik+vD(AoOY9$PRc+dzzJw{8|)6N&SZzRXR%rBIv7WT4i=in?{}CSZnKB3%Ru0Q ztMZ!t9~p1*(w(m!12h@eYEqjaiv zp+Hc*sOYF}hiW}SS@cv{x(2a5HUp*&-Mjsa5vB3Jyr?*mY`#SE8E_k4aUu&| z;LT)f_r`~rWd#bl`5KfHNmdI&|9fyg9|MQ=KH&Jb$xiYLd7f+_tI1>C+rG=t)eXoW zNmfe88rTB9fkAqmY$Pjz?me)~eu3fIeHEQ&;Oh)s*^KIBLc^8a@xnN+oQ*VoOG$Bd zs--BkqM|U{Whl!oDXTE%n9C>GN(;+VjCm=>?0j=xsi~mE?kYAJ(+e|7QYYAK<;ifM zQJkNaSEB5$kXRE94yVyz!@^J_^0MUW^9WlOm#x^)q9 zX*$N>pP8HVx77$N(!Zwu-@YJ`GD!6|=%K%@Ln;-UA|ZpgL^h@CU?gd8LA?Ss3@hl; zC4p-~T|-n7ddDUdL+3t$9*pnMjls4zS9M@?^lF`grHlDqGYSBcUSwwN1f>IN{fQS zy9sGgbpEF(R11xyfskp6km3+T%@<&kXryhK)!@53dBd zzhxzocK{@9gxw1Ydv)Yf??Xjsa@Phk?gJZf_kGB$zB#&FA>8P>eLjtR8uq^_L2AjT=h!i(z-DTMTYK=Xx#u_-QnQ2}BmtCs%>_Sl$)wyQ^R~3%?KPaKc3T+e(yy zCUpggScM3ky$TssaV39x$@xp6_lmCI^Ohn`*r9sS)!Tw^tD!fyA@YCs7=5UTZk$zD zS9y7-tDxuBqdD|cAJj{AxklXbXw3#>LY0@_TTWlvfUZSTFBi-~?#pR8y<;N`U&9_G zrwfFEocc5P-dFlaxj-Hup#Xd5D^>N2#FlI_SG zQK<+C4@bAn7Z*=mL$z;4OViv-|NGjfZbx?9Va(qGzCLmb+1ORML|NWq=q;O2+uyN{ zeg%80U9h(zC%Jbk2f!d)vcq0h>4>H7>(senGs!Up~Yb8 zKul`a3JT5Q>2v5RltWEQS8x$eHf9pKRtR|F=+l_db*njnnbNL>fTut8FpRNl1$~%d z#w2$c#QD*JH&AfwH2K_BzNY5r1%d*h71X-Tmu;RSpl9s`_3Ry(uO3u74c+`c$_XXg zB>?w2sH;~L*>8XsJ|*vTnp43EddXVqL$`m7#@{;?NyD^)dL*=a85{k|%GSFRz5Zp$1NpNNaUvDeC;7QP8zW{Z* z2lvLZ0=209zIp^@hH{I+MFl$RBXAqRPcldxQE{iZcetmyt6aI*g6ZO8h+NvSFR`39 zf^nhlisPkf&0klm|GHY$y}C{C)?LD`>|WowT5+Y?tTQ<-`T8!kmj9{R-nCkG)#|p( zolE~zZ|mBe`Ri(Y#RCYmb!*+};`7ZgmmL?M)koElsj7#RzbcCqk0~VbGTBoyEOj%l zG6QfO+KL8BW`JpIqoq0c$@T$B_!QIri~$!g?L%VlA*S6JgX(PG!7ukW!`iS#eUaU-1@r{u2q}c4<~<#*s+Ews9A@ z54pqK3)~~zQf@XknH$H2gInq&_HlMTo5K#&ex-dvTd&n=PH7&|+^(6e@o2I&dQB8q zguBQ~n%)|j`Umyb>i5;{>ig9T)l<}Y>SVQ9Jw)9HE(8ClI;#3q^|tC|)zhjqs%5Gh zRIRFNRf#G|6{ljAXO-`fK~I74)k^M$8<#aCiSXuYB~x``f4%n@5meUJ~3a#F+-5vY1KPzdZ$D0)i9x#vYt+9 zx02~EmQNL1RR*(W{k39tN)(euhwR0JrB0)MGL6`aBbdRAQz#0NR)jESA=R&KQa?tA z^bWJ$VbMFRdWTK#u$)H|w*5-CQck z3bqxqnZdROeTLXJU2JQ!>TNc?&91jO^l4&Su_Q_;N);OiAyUM~kWLmGyXc0qXb2O| zjHl0@MT4c|g&~Ag2%H3MY{moI#No4A^;VnSYS&vGdaF}EM(nY3;b^hP%O#`44ue^z z*de4HVuyAS5_r?-)LTt@+n=*mv0<>*0&|FHzh>MoLnNZ3)ULNU^cJVyBofiN(AWu= z#jZDW!lf6llu@@ETj=g4%+kUpoI-my;Uwv3Wj!o!451Ir zz!4D!eg95{{lpo8k?SkYNFVz6UK}}yWg=m*>5T@x(V{16W>80tqqpzHVQoge_DY#X z!SofX)gl6wh#UA%Z`Uiur7oluB8*ip7hz<<{`DrkSuYKW14uI>j8TuJ3{mMtVa^V{ z;@&z=zJx1_dq9f5)dqY1t8g>@S-52RDEO*Y5}qt3w}M2RPiBz@QcJvK3MnInB!{Gt z@x%$2GIb=D3;~aDe?o`~?y>*Q{m7l?PIE`OL)?DuV{SM12DhDinR}kw$UVWWbYvp4T^FJm(O{#xD;+IXXlJu0ym6{^pE3ek=PDyNO-Tu45l!?_-y?F3B&1ExK z7dx7@vU)b29oj|X0uNQIp!l@MUPK3R8yh7I%n#(;)t!dqafl1JpWF-n?mNg$WFdII zo8VHRpG+kc5GRmFGD$KSLu|xAM!>mt1Q|&B5G|1t3HJ-!>im{F!F|Pj&V9;#z`f1A z#%Q> zi+BI%gSX&JnwXE5QGGR}&Q`%=-2`~Nk&Ex5Z#W^<{0DL=f*13oG*F9^=vF6I(#mN# z35}$NT%1pj`vI;@cx=tbF4|ZPWwFqVZu3E^%?B0hZo(O~G!N&{lX*Cu+J&;?qu@b= zW~)U6LU!wD0l{c!Mucozu25DDWhW*;**bx~)p^2W6wacC(SYih4N|LZP-b^RA6x!_ z6a6?lrgWVH%B~*22hO9M0QrU$N?lRHYgpkm%4~pptp(pGg~4f~%FQ@aNG+rW zps-Z%j>WRiOTgKF43xFEVL7h{wT34*k`_`8OqxrQVA00Fa+SkEJ;i;-y$5W#fqRf! z418AyTGs>!Y#GUga%#}MPQY4woqfK`n%R`3eFn8Zk8lniDRkIJ)+$kcrOHulR*zIa zqG2?Cwht`84>=w8hH|>%YelL&SN656GqvyJg#@s(VxJ{O0|#;q1SzabjU-W z`~;0aHNm29J^>G+mxk>@BT=nTG?;q#AOm<=?%4z0vS~r6_l2~Nezyk=L(_vrhELJ( zfj#*x+h=@=?ncpN)$)*p5Hw$;T=ZyGx@UOdVpc;_vzV<9dMMKc&tzu@WfIWR#f3Rs z@mEeylfpJ#5fTeS_ud6G1kG%RBeuS%D3*kD9CmlunwL#$usSyZ8?J-9@b|%)-%@4jkTBGJpupa-J@%S+_wmCXBL_^RlPe zqW?*xCm6sp{(ora{|lj=G1>i|+5bq8YZ@eED)4#+L}*q5*LXEMG}-EB)gEvO_?5eq zxr*l$K7~qND|=H`AZ?e{NVQBIeg_w$&1gCzk_Otd=h94l-Q?0)T!cA8&mqGCH$`*JBW~BFIg)tZ! zY@Y@15YqIun^w*O%$7&P4$uv=0JAZ2{r#a7IH7yz_p;Ko= z;I3><;?9bMU8*RuG)3{&Ok&gUASBb+`Se8cO&}RG=cEpH1b{{aJLd@4VCVdR}2e=2Jfo`TBG;= z@H`Ej2(*U%@xv2z+C-qWPjvO%)@XVrUg)(1XpP?%{~4WM0<=04_CG_zO7Z=ptO<)) zfh|HLlO-gQn*;jt5baFO7EOq{UbRydtz4+stI)}>mwg}$msT?y@C96m)()rRIGL@`AwnBDT z9w%>&3HQ-tL30zONsXkB-R8Lhuu0E%6Xs*}1sqLjL*RIi?U=8dX zb{pJ}Er2-S!{C2yBro<{b6J$q1PkWcr&#b>MkXr2!8CpG50u#sp)*q%S|=ta2+1f& z(lu51t`4#d66qZ2HktB&AJJ07-zHlns`s$9e{elcYTtS@-1(um{TC2eem_1)7rulu z+ZX!q4fwKRA5`bt*W4t$iU8RTkdHHTjL>M!i})~o^Cg_rv3GzJsD$Y4JoXQEEl2?m zxDX5B+)|T_b@+RH4c4M(;41;56ri4M_yL9U zt2f^Ygij8N1Lt;N&;I)LA5~lv6bE~^1AC6EuCJhfYzOv?YCnc)-VT91>1#i>mIuW_ z=uTiyY3TPa(aN2|BF%iYF%VvQWswSB2w3?XV3r(NzN(@mxcqI;!}7;RcORpb&jaT0 z*FUn*4bKDS-lMY5wH5`J|GXDq`G=;ywwG>w0T>?-n0g1D+K%s++7^v&rt8+gXAQXA z^*OnD6pa(s$wRO@?Ue_Q1_tEP!g0dtd<3V`P1HT$`I2lmhwpKtI~v z#+88q89^zq<{n%rkGg%%8?EWWcL6Naxg3v^hQEE_1v-B@P(JXn6&JJAiL2h#Jg8&mKU>xwqf^&fZuHXj&9-u(EHR{8IbkUtaIlA?lt$_%*7cG1c zz_}P#k3kO)dn~y2-xm~>e{mdJt$kJ7OVgl!M;)V@r`)f!DwfEy)1%nLY50$u4V4Qzv8EH0dP5imwbm-{sBBbGE8?g z5I#@fahUdV@SO+qng<70%oTVXzVmP%IB}fIGJsZ|2To+&^VZT0=YbPP>(<}c+A8q4 zk|Njy-|uW>uf z=S*6-5W2nfB%UgD-jkh5PoKms(%}b>Mp5r6ST45P>@x%5Gp;O`GT=DpY2jlOdwPFc zQ7`OiM!NSj>_qHHoSIuF@Vb%aeGWZ@pV{mT445wPx{0p-98Z-GZQuG(>oj4D10ucv znq!Z>zL(Db0%-2#a-X4L2Z3gV3%^BQIS4dc-gtdyu3zA4Bh5Jk7{?zi*%=t%6S&$$ z?>_`I4}UnMoGyA7c+i>q!2UplH@LSscf;Nm|4QS+K)5Hkw;k9m?8A>V$5*(6d)u7% zKzNwvEeg;z@4>*Di-(M&XWxT?wQVf=ruEw3-uBA-IH_cG;_C;6t!9{Pg+$m+6q&+? zqL6gnQeeZm>&mvG*e7rN^9CY2ENm|FxZw68TS4d$3my~v6br;RA!;~^6_oq}9*Awn z!TGS_7r`@f6nqh7AHiem%ixAMycxNQTO2&F zsD(-|! za2`&>_iz}#fiK}R_z2#Ex8POS30q(ztcCx;6Yv-;2L?;mcTM=2cFY-z{o0)fCN&@! ze+z=<8U#&M2u4>TxTOrih@l873lI#=Mvy-k!4L}qvkrlFAcBF(2>SOykeGlVItD?v z9teU$5CkYCNZ=fYe^-C&V-mgw&$;+81)S&LJks<%c+QJm26To0NR3|l-z&mC^Ppq< zENs1X3WCk!5o~Beux=EB=SLuTx*Wk1MF{?tg*K3;CM7 zN}eYR$plhH%p{(uxYOKTZj+~Lf@}Sz(sC%_yd3U~7mmVex&h+o9W(=gzDokgBAA3* z`2{J5eEJYQLK5gWaD$1okzZ*F?Mc2NuaPxS4UL?a4kH%s3=Z17-aE1k1UQVGg~P~> zFTiuSElz+V$Wb_g1^d8rq@!1ul3T!W3rG@qiY|g4FdO@}dtW+$G&%(y#APjVl94kF-A*7_Y;!B!q3D%R}~xt|2HRfk9u z3GpfplN924TNUNm6_Cs(93iQmq4+U6Acf8f@$^!qkuVl^ltf~6fM>jFK$k#y+8rEx z498&yPP-O7J60AF9?^@ibgkmAVW%W2>pA>8KuXC{8c0XO6S&4aYdS`XNl#CxQ0IAAnMlGt+m(7Y>NtrY5$ne*(g<7qJ?>*9 zBd4*IsOanG)Io{C-@`$q^AqqKyqp*S-*WI1d17Q2( zNxuL%AhkOV2e9lzU*y`WFUTYwO!lg|XxZ61V zdkuGUDtQZK=WY)Qr)M1>L!vzI@@iTZ?pXs-B<9MB6-@I3iKe3>SkVd6oAhF1Pmsa5 zg_j|g#Cl?Rqo<9glDPGc&~AiwM6--jL{H+`q*J7Xw#TpqCy9n6NT0Fnvy-HMg1jo4 z$S=ED(smVOPP>S>{5b=*Z5`uFJ_QuODGE*VPqjaw~=xROIUQ zHAN-*g3|1=>Y>`~`l=dRVRg1G&rnceuoM*OwK{{LxU9M&e}v5#oX@*MNL^XAL0?vz zlU-DxwdM^SW~t4tuhi#P4YTHGbBnX9Yz0Nt#pNcg-j-ccHzKc~u%t?pQ=OM<6)MXt z;dh=E9o#GP9+=q_VoU*jQX! zJ=9WSsm!gbG@6WshG9A8n#w9Rc@Z&o6cpr}YRd8p%C!0A=31SlxVE$;zr>VXP+p|T zE3c@uX-s)mO-@OkNozFcm<%Q6!s7CLy{^z~E~vF-SJ4PC28^B3IHqm#1Q0O!SRqtKf|gwX-5&SMEm3p38sH{i;BQEQV{)rY*WXz z`{duIBI+ATLI3Vn6%pS^l>YH{rT_K)lD371qZ}Hub8r%lBL6-IcB%su?1!BsBIw4d zHsINbH6${Ke$C;jcoEG)3ikSdb`&a*<>YU(ocE9O|6sVx?~bbn!_RQ=5A=80O$(%j z1^fxKuku>|KM#i_tO_oV!@rBEnh52^& zYYu)!x9cc;E$tDoulJKal>2k@^`M3-1bT>rJLnY}=#<#|?vrAS+tUtMh-UYS>Kt*afHt1r)CJ2PotR+LH0`XPlVTBH|8deH;Wj5Bv3?1ghg3`xF*18o;b zxQ_$L=gHlKq_B0D(MZ1f6PZB<`0#EQNHojL10|buf%FZQ*gz!*?WPnu5%bBJ14fK+nZWjCQNlsnL4#?oO6Osqcx~C_@_N5dCRuNB861~EYv_A$tEX#%nmu@dh$Pkf`UMh8iQ2cEF29f<2A9Zal6JKqnB94a zOk-;=lb#IgOJqw-0JWf`|K0;#GE@ir6_O?95V*j>1?=|&unUW5hys2=TaDjmfc>(P z23+&KQ=vj{fCm99Kf-lN0C;-wuG3o7wZ(5J61rSQfm>%6=lrY~FrFSN6qLz9;)M z2h7C6LUZ9(Vr3I@p@gKfEx9m)3}RjLUj|Zo)>>F86 zhxykwjN^uJTSy{#4jq*RxV9nGrDyNvLw}ON7Un|~3oU>o_Kt+v3P1>&>a@4EI$Isi z$(d4p2GbXSo@7Z&i(>N%z)7+_TZ5uE6+#^$IV`IfV%W4ITz#$&KU@S?{NwA0YJ;8u za9lcHKf-Y&^h;pJ7eTZFp5)+3{9XZ#HALX5Nr0H$sI?mmc59PbXD~IY4H{#U+ODyi z)q0n~Zq_;U8okj7vlFMZwK@~i6B66)5Mv)!QzwXOE@`B zbQ;*DH4u1>1j`cr4F}&~{b!IC3)umGKAP{8$_je}iGf;A*8~IWS`29WF;NgP62uOKBY{qRlgXqpJJqfxlU8joJ6&pv!(>$(tp-g~ zgwAC#Sd5JT5~Bf5OX7H17Vv|>PG5!|0lu=I;51T=Ws+`<1>hloP=J5{X=MuTU5>xTscXGgJd?S9Lh-9)s{-uSPtE#X=2$o9H_nnIEuX+a{73p(ldjfLK zg0*CUnXP<*??Z;MNgpX9*@3nELAGN(UrMUjx-YPx&j!Ac3}@~LA)Y<4fj7lTEDz#z zc=(`>o}kasBJwlw5FPh9H;L0N$?m~)xA8Gat|pWRXQM`KHJNp4gAO;|;V?VYO%}6G z*N6trY|yYtxAA#N8oQ;*Wigx87K6#GHZNJg7r?t_bu`t~nJ|jt|Gwbb6lv9nV3CGl;oLZbto!X&u z8Ljq4ld;iYWS%*EPLkEq=rS~F9cq`si~_20Sk(@T-k~;{99D}_tGBweX7=+OJ~hei z(mOR~g9C@tJJkl0%cQp2jX1jAqHA>MU0MUSESk$_C%KFkgVv(et2K7L28G^*2h5<+ zsLf3li(ThLGI93j=JLIgjCeen^msg+S_gUp29rZ=aXArlG#Lzfr(L6S8rX@sd{L4^ z+tjGTFSXNYN7bftp=#6WkZcW(fc}uP$z@`79sGbKJ!&9_-RMx8kXJaS8R^to%xbF+ z7jM!#T~4Q!J=wtZou-hHd$qa&*IE?lE zPCbU)pJAqG7l!9Ap%6a~?4?C~eiZN=#DE3L&{#eJO_*5WVFoOg{iH+G%dg}KiHCM6 z9q4Zkp$=kCNjA00$@!6=m7schc{-b|`} zQX1mryLi(#@^c6ad65^`9h>z9-jBxSWJw3+nIGZ;s$sgTQ2Zxffr8lRq?Qa!yrgf8i(K$%x7+pawn*_ zFJX3bubeYl3~a-GzSI}1a+t=vh5MeYqwUC~5>~sJPhv%0Tz7q^75>A^i!`T{t$UI0 zEio*GjPxC7W6lRn8wteFfdurO#&LFy#_nn~>C`%h8MT1RsZra_XupkmjoH}b((BA-JKNEw z$PSjMquf&*_Y_onx+W|Soj+ih5Mi~Fd)nkI3d`Q32xslv`Eb%G9jaJXu}2Zap2$PD zuHzu)x-QaqHX&Z<%}hJ^+xclzoRhuVckuD#!A*Q3pW^Oc#aj0$`mnS;iV)T%QV3*m zA1Z>0QxdyaHt$n~N~#+CC#${cf%gF5WGl{-N{&>LpXrlOjO)%Of$qM;g@`IEahI^i z_9=S!#;o{Ip^%ATT|ZPr5m%?_q$;-bQ$=#*#A)NlH%JsWv@|8AxKpczh#DNHs?#{; zPZUXHOsC#h(1k7fM4=6cA0b4PWAofj&A<3q5y)14tOzG9o%&#@nT3C`#dCOX(37^%eJ~C`Q9)PM3K6NP_@ zgYUu??^m?3;{A#+M)o4dChk?}NUOxLIQH^h#jRw54vnlCkl(z|Mp!yI)rpC%KK+`i?x8#^K)vk_C)at`*`b zjARe*Qy9raA5A~(Q)p2+CVZ(dlgYlK!CxwZ+3jB{Qpm0B*)J8n$P~|`A>rQrUn+W2 z+T6gtjTDkG`w|=_Wcrt}fP?k04;CP0w*gy_sci3@1Apa84*caHNlyh!R%pvrV|x%4 z>8Gf0-$5HBS)hl}0yQX0V&G*COJ7H8^Sd4T9w*rYQcn3XU@x~RGyTyV-U3;OlOCqgaXu7Y0<(!GDBKJG@BMJXi!Hy z5iRr~GuhkGLON+;iWs3UnZ;6Lgp5e15D^hU?$XM7rKQ#0?3BT5@4OgcDeWlGPJ`l z_{KE7&Z0M2g5w~Y+-Op+R0rL>I`HPz0XJ56NO9+t(N#CrcdizGuhy$|mW1m_S6)+X zzP?)Vht(ZdC+DxJH(lQyZeC4)kAac48+v!T#NB~=_4_4m{Qthi9R(fR&<1iZwjuDg zAXwjs;05XSb8Rhx=cKFLXKVp%D{%ZIh?SpSLkX ztY9I{Y|aO0nC7zW?<;z<^|3-c8mZnNC=y5qI~yyc3z02o6C+S$-&cr~nqf1;=9arzzIPd}$0 z(Rb+^^kur0Zlr7I({wdmftSS{OX$6HKJB10=@i;Zo2i}NLaS*xEvC6NgPN%p+0&QC z(pv5`WOjp=S9<~&ny-T3qLOz15q47|x-D!-x~BthcFc{ugQo;W;(H+0M4 zK@3?Iz@0D`gO|y83*>^)P>)yPWl#h;Fc?grfdP<&ryvr#K`ena=s zJ@kG0Hhq=upquFnsA8U=tLVe@pLAgdy&Lb(Z=>yWA{|Sc=&iJt4x^>CfM(HjYM^O& zsh&uC(Qq1uH@ZCeja(pS$oJ$BIY9Q3kI8%FP4WuaMmCYPgz*J~PX4@bOMJ@@2 zO^IT5jDA7iLv}t-AEoyr|Hjji$hEKtK5!{0_&w=T9^)wDIpBtbKs*r|4$c91q{y~Hk=!35y zB5;P6DMJn_ST9jHS_x6U({+PELnF5lL!YN%HLSn~C`;g8G&~(J6YsKHae;QY1s^t) zLowt+2ADw$sn8eVAqpq>FZEp?#AXTy{l$Hqg_ZjxlX*Ed!d@Y+Rfw>m1}TjY43wKMMT3n(`#6jkuyAsuFo1HmOYTo3TNNSj?8QhSMdenE z7b0@8{`&|4mC+qn>$|el&3qVpJwoVNlOk^h#pJ*_H2hzo(O-k!&6~*dxp>z8g*+L9 z+GZGP8Vm9v4!Yx}U&6!j3O+a~$D^UeL(!e`m}%NiKcN3cy>btoO{FB}^Tf-S354Dx zf4}q;kB>pL9N6hj8bhXWA9LCz*|A>jeZof&tK@ofa0}f)yOW9B+xXG>=N-0LxgY$G z2r$+BFW_k-IZlQV;GV=?SmJqdaIJFCM|EG>l+3y+?6WmOQm^RkXZlD6Mc^7a7>!FP#OF2*NI)ZJL=qB68o~jdKM@&KL5N*I=%kcR~*94oFZd6u4Z)p=lI5f1QxYgV-d|)zzyhK&B0^jZ&K!0i? zuu6?;u=oD=h1C!*H4f%h;qxQz2tJ4Sqo!_e!e_#0i1e+_!9fGQF)AaM$!c7kgEQdN z@&47d8dvbf?`(~pE~e%DfbTwu@jP#;%OL&7roZ_i7KcFgJ@@fOu2UYnLd?A! z+)YoS*3LsE3*5b&lzuAm6LUd3l@}r(nD3dWTfryqt^B~#Rll64*{N$h>-4p}%D!c_ zC&W;~$7cSr%QMpOK!_=R&VB9SDtXr%JfZ1oPpWZ9WLVVecgmguhuNVK^l4mpEuzv) zrGCEGt`MH0Y{FXQGk=Mnf=|ct%)Lv<@`mmcqCnOk3eL?z6%NwnUJm|Z|H-<+gG;X`Xk59#3oI?ZJ_n3o@cE(mcB(uQV!fZ z{b$<%k1Acq9^4{C@QDF)gW0+*NN>-@lM37Wdro1^+^s^EpxIpd4|iO$r)7|lUEC@- zh4j0+g}P(=c>)LP*|KedOR4C#^~d_Yo~H-vn0dR9lrjWHej(Ay8( ztVRD4X^X{YNI2lgHE8c=v{OveGK*QE2wb~ z(lZz`N1>G}g|TSK)&SXqWIe^+dP5oA!9!?(sDMx+DrAU>4#d03&@97j85YQ}M26)u ztdij<88*nUNro;Nj*;P58Dgps$DAO;i87ol!>J1Bz>0SHV}^h?H=MUX`TlAi?C%#nFOEE|fK0X?(5*9%c*pT$tNfymFTR5qp;0uNM5{am79wsmi|I0bS3ivw zaS+@6wtsstX6(UdNZW&01R28SzO9V&+rXPycyPz+JY7wCwsI3Hseuc!7S?M$YfU(CJRy|w(qTq@glD|@ZRifZ9^IXJkE2HF#9a9qw2Q3p&bo7~f>dkD;S@e6dHsFfV z*2KJMGkHP{I<|ZRu1Ji@72M%QPlG|vPHYewcq+c0#VR%mQw2rs#DVTOy=S6P&wkq| zG{+M4zuuD+sggtYTq0aSnz)znL;86?eM30>7ge8xU z)@N67#|r7aOY@Gpe)lT;Fg+CmFBr)^JF_}{S|lAdUWfT^|`Vg{q$EMiI4d22T|QaoEBj4&AW3`fkt`p*_zoL=AgaQR+RjP2m@7Y@S#1tcEu(DYOTsgLHxyGn zwKwrC&E8YTgr}}-$j$wTa`_m2^%DwRnCHV%TbX=}(k~##dz*A|?r@uYjPAXFLT7&W zojCTx1z{>5+7`TvxqcQNRi=Ix?T#HPADfJexN!65pMG3lEITJ(TojU$`c2C?{FfG) z6sXFDUQ*LQd{~6h(Lnkdbx|OXlWgu=?hdX51x{oogUJYEOXZlcQ>(_-SjUd5uG9=O zPMx#jJ7#+F&btJ0>`H95^iMV6sCEjqRbT?S)$dCjcqdY9d% zw~Nh1Q>WHU%AZ)^EUs=Zscg~a78Z@yX$z}!D;$Oi)w9M_PN{9x*G`(o^ciHJalF3O zXsR7nIxbspb5-X}t7@Jxqo%ypGP%9jZmF%SpJ|vQ%20vm`sMTIp)0P?v9di`XWc$_|h>gxti8m+bq{Kws{CiHsZRARX?VBhJKt$EG}y-Yi}N2TElu|5@XgM zKeN61^7DT_{ABlJl3vEibwjHR+LET~na%mbZBv?@RgU%%Y3(gDE7MBNGg@c1j%k@z zRh+A7EGwxQS75Jbon$GhVtX@5Ki}OT43TbXhpg|KpaXW#Ad;B%cV9QN-!~gf8 z?e*_$r8A)9;w7E1k#@xp?Iry9{pZb9s=mH*xNl}OS;$#bshY*~CHCA|RH@9(gagd-tx&*roD_1{c**5Yu&5X-H>--6*P>d?1hXpJAFE+B zI1*PKL~gw<8az!^!>%m)X112KokEKOv)lKwu+zAFUH?gqZ0%{GmQP+(6~Thfpb8$W zdu0{7*r;^L=GQql##DU;&tKU>NwRX zvT?U6k;Y%$vXK~7M_}mk*0o#qO7!nrc5?&SBwLxC165f<*n0^p-Eobwm9eT-%>wjB1TZ1vp<-|Q zTeRXZxs63H4wu^?Vljx-avL9RF^VJP>92lTOkxeoddu$;fAA){#C4KOj93J|S~>Zq zGLF6Xrn2`y*%`Nrfr0q{=ZIDjL$RRW(Jmnn?=RJA#bD;%t?UH`F_abWR>s?8s;qkP zRv%&%N6X|{jiS{g+B@M6nN(l7)gm_fBsopW4{f1QWGeR&m$oE3+IuQo_2JDur}5}H zXxZoeRgpr**8hxfhmS+gLB|H9s7CXd=br7y7N)4C@(Is9xriwTs8$H!^Z$9?9XkeH z2OZltK-H`a)`m^5Z${Ta%Vwpj`YJ<0#yD**^vASpPb!WY@l4rycevA2i|LHyfvVAw zR&KWJqAT$N`+9ogx+A?YlAHz-4fh90I4|bwdJ^`TSyj%aOX5vHmE~PISoI=dM~td0 ze^hca?}^#^s%n)(287M9O-8kAzuj(5aF*)VzpKZyO zGF1WbE)7%NNB=?y#n$##E$91`kGz{zB&urp#Q8;cvS$-fM_Bia64<3g)DfBG;vMbn zs1CL4jXtVuJ~a5ThgfiuY6VXRb|kUql2pqhwR8JF@@Ets8H!BrDKTBZ7qh=7N2v-V zcK=A&Lq=5vTQx*g$VBA1_wW!^EKw3@!2LrzTn#L=w`xUV>Mp&Ul?~!79Nuitf+V^f zug(Orf!MjT+(OQRBAGHAUkea?V#{T7%>jXb@a*`?WiqpuDvLv}yCY_pw(id~HYLx# zD^(7-p&I){GmA}`cS8+!Oko>r%9uZ@$-SXa9%yKpGWCWUnSy7_l 0 - def test_requestrepobuild_with_credentials(self): + def test_requestrepobuild_with_robot(self): self.login(ADMIN_ACCESS_USER) - # Ensure where not yet building. + # Ensure we are not yet building. json = self.getJsonResponse(RepositoryBuildList, params=dict(repository=ADMIN_ACCESS_USER + '/simple')) assert len(json['builds']) == 0 # Request a (fake) build. - pull_creds = { - 'username': 'foo', - 'password': 'bar', - 'registry': 'baz' - } + pull_robot = ADMIN_ACCESS_USER + '+dtrobot' self.postResponse(RepositoryBuildList, params=dict(repository=ADMIN_ACCESS_USER + '/simple'), - data=dict(file_id='foobarbaz', pull_credentials=pull_creds), + data=dict(file_id='foobarbaz', pull_robot=pull_robot), expected_code=201) # Check for the build. @@ -1007,7 +1003,28 @@ class TestRequestRepoBuild(ApiTestCase): params=dict(repository=ADMIN_ACCESS_USER + '/building')) assert len(json['builds']) > 0 - + + + def test_requestrepobuild_with_invalid_robot(self): + self.login(ADMIN_ACCESS_USER) + + # Request a (fake) build. + pull_robot = ADMIN_ACCESS_USER + '+invalidrobot' + self.postResponse(RepositoryBuildList, + params=dict(repository=ADMIN_ACCESS_USER + '/simple'), + data=dict(file_id='foobarbaz', pull_robot=pull_robot), + expected_code=404) + + def test_requestrepobuild_with_unauthorized_robot(self): + self.login(ADMIN_ACCESS_USER) + + # Request a (fake) build. + pull_robot = 'freshuser+anotherrobot' + self.postResponse(RepositoryBuildList, + params=dict(repository=ADMIN_ACCESS_USER + '/simple'), + data=dict(file_id='foobarbaz', pull_robot=pull_robot), + expected_code=403) + class TestWebhooks(ApiTestCase): @@ -1746,7 +1763,7 @@ class TestBuildTriggers(ApiTestCase): # Verify that the robot was saved. self.assertEquals(True, activate_json['is_active']) - self.assertEquals(ADMIN_ACCESS_USER + '+dtrobot', activate_json['pull_user']['name']) + self.assertEquals(ADMIN_ACCESS_USER + '+dtrobot', activate_json['pull_robot']['name']) # Start a manual build. start_json = self.postJsonResponse(ActivateBuildTrigger, diff --git a/util/names.py b/util/names.py index b705bec36..57fafdd10 100644 --- a/util/names.py +++ b/util/names.py @@ -26,4 +26,7 @@ def format_robot_username(parent_username, robot_shortname): return '%s+%s' % (parent_username, robot_shortname) def parse_robot_username(robot_username): + if not '+' in robot_username: + return None + return robot_username.split('+', 2) diff --git a/workers/dockerfilebuild.py b/workers/dockerfilebuild.py index 6e8be1f4d..9d552a4ae 100644 --- a/workers/dockerfilebuild.py +++ b/workers/dockerfilebuild.py @@ -352,13 +352,14 @@ class DockerfileBuildWorker(Worker): job_details['repository'], job_details['build_uuid']) + pull_credentials = job_details.get('pull_credentials', None) + job_config = json.loads(repository_build.job_config) resource_url = user_files.get_file_url(repository_build.resource_key) tag_names = job_config['docker_tags'] build_subdir = job_config['build_subdir'] repo = job_config['repository'] - pull_credentials = job_config.get('pull_credentials', None) access_token = repository_build.access_token.code From 6ff46cc450e6566757ab5173636313620c2f3b34 Mon Sep 17 00:00:00 2001 From: Joseph Schorr Date: Tue, 1 Apr 2014 22:12:51 -0400 Subject: [PATCH 08/58] Clarify upload language for .zip and .tar.gz --- static/directives/dockerfile-build-form.html | 2 +- static/partials/new-repo.html | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/static/directives/dockerfile-build-form.html b/static/directives/dockerfile-build-form.html index da808ec04..54f409b0a 100644 --- a/static/directives/dockerfile-build-form.html +++ b/static/directives/dockerfile-build-form.html @@ -12,7 +12,7 @@

- Upload a Dockerfile or a zip file containing a Dockerfile in the root directory + Upload a Dockerfile or an archive (.zip or .tar.gz) containing a Dockerfile in the root directory
diff --git a/static/partials/new-repo.html b/static/partials/new-repo.html index 686073a6b..87832987c 100644 --- a/static/partials/new-repo.html +++ b/static/partials/new-repo.html @@ -118,11 +118,11 @@
- +
- +
@@ -140,7 +140,7 @@
-
Upload DockerfileZIP file
+
Upload DockerfileArchive
Date: Wed, 2 Apr 2014 12:12:10 -0400 Subject: [PATCH 09/58] Update the docker-py dependency to point to our patched library. --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 0b942eee1..46def6790 100644 --- a/requirements.txt +++ b/requirements.txt @@ -16,7 +16,7 @@ beautifulsoup4==4.3.2 blinker==1.3 boto==2.27.0 distribute==0.6.34 -docker-py==0.3.0 +git+https://github.com/DevTable/docker-py.git ecdsa==0.11 gevent==1.0 greenlet==0.4.2 From 204fecc1f9d11c32eceb32c018203bc16fd056df Mon Sep 17 00:00:00 2001 From: jakedt Date: Wed, 2 Apr 2014 12:22:32 -0400 Subject: [PATCH 10/58] Restore the cache buster. --- endpoints/common.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/endpoints/common.py b/endpoints/common.py index e25d7c797..749cf3ba0 100644 --- a/endpoints/common.py +++ b/endpoints/common.py @@ -91,7 +91,7 @@ def random_string(): def render_page_template(name, **kwargs): resp = make_response(render_template(name, route_data=json.dumps(get_route_data()), - cache_buster='foobarbaz', **kwargs)) + cache_buster=random_string(), **kwargs)) resp.headers['X-FRAME-OPTIONS'] = 'DENY' return resp From b95d3ec329f29efb6a1a188d3cc6d4a2d59eba85 Mon Sep 17 00:00:00 2001 From: jakedt Date: Wed, 2 Apr 2014 19:32:41 -0400 Subject: [PATCH 11/58] Add a watchdog timer to the build worker to kill a build step that takes more than 20 minutes. --- workers/dockerfilebuild.py | 31 +++++++++++++++++++++++++++++-- workers/worker.py | 12 +++++++++--- 2 files changed, 38 insertions(+), 5 deletions(-) diff --git a/workers/dockerfilebuild.py b/workers/dockerfilebuild.py index 9d552a4ae..744057574 100644 --- a/workers/dockerfilebuild.py +++ b/workers/dockerfilebuild.py @@ -12,6 +12,8 @@ from docker import Client, APIError from tempfile import TemporaryFile, mkdtemp from zipfile import ZipFile from functools import partial +from datetime import datetime, timedelta +from threading import Event from data.queue import dockerfile_build_queue from data import model @@ -31,6 +33,8 @@ logger = logging.getLogger(__name__) user_files = app.config['USERFILES'] build_logs = app.config['BUILDLOGS'] +TIMEOUT_PERIOD_MINUTES = 20 + class StatusWrapper(object): def __init__(self, build_uuid): @@ -316,6 +320,8 @@ class DockerfileBuildWorker(Worker): 'application/gzip': DockerfileBuildWorker.__prepare_tarball, } + self._timeout = Event() + @staticmethod def __prepare_zip(request_file): build_dir = mkdtemp(prefix='docker-build-') @@ -347,7 +353,24 @@ class DockerfileBuildWorker(Worker): return build_dir + def watchdog(self): + logger.debug('Running build watchdog code.') + + docker_cl = Client() + + # Iterate the running containers and kill ones that have been running more than 20 minutes + for container in docker_cl.containers(): + start_time = datetime.fromtimestamp(container[u'Created']) + running_time = datetime.now() - start_time + if running_time > timedelta(minutes=TIMEOUT_PERIOD_MINUTES): + logger.warning('Container has been running too long: %s with command: %s', + container[u'Id'], container[u'Command']) + docker_cl.kill(container[u'Id']) + self._timeout.set() + def process_queue_item(self, job_details): + self._timeout.clear() + repository_build = model.get_repository_build(job_details['namespace'], job_details['repository'], job_details['build_uuid']) @@ -370,7 +393,7 @@ class DockerfileBuildWorker(Worker): start_msg = ('Starting job with resource url: %s repo: %s' % (resource_url, repo)) - log_appender(start_msg) + logger.debug(start_msg) docker_resource = requests.get(resource_url, stream=True) c_type = docker_resource.headers['content-type'] @@ -402,7 +425,11 @@ class DockerfileBuildWorker(Worker): log_appender('error', build_logs.PHASE) repository_build.phase = 'error' repository_build.save() - log_appender('Unable to build dockerfile.', build_logs.ERROR) + if self._timeout.is_set(): + log_appender('Build step was terminated after %s minutes.' % TIMEOUT_PERIOD_MINUTES, + build_logs.ERROR) + else: + log_appender('Unable to build dockerfile.', build_logs.ERROR) return True log_appender('pushing', build_logs.PHASE) diff --git a/workers/worker.py b/workers/worker.py index be4984bdd..a525913a1 100644 --- a/workers/worker.py +++ b/workers/worker.py @@ -9,10 +9,12 @@ logger = logging.getLogger(__name__) class Worker(object): - def __init__(self, queue, poll_period_seconds=30, reservation_seconds=300): + def __init__(self, queue, poll_period_seconds=30, reservation_seconds=300, + watchdog_period_seconds=60): self._sched = Scheduler() self._poll_period_seconds = poll_period_seconds self._reservation_seconds = reservation_seconds + self._watchdog_period_seconds = watchdog_period_seconds self._stop = Event() self._queue = queue @@ -20,6 +22,10 @@ class Worker(object): """ Return True if complete, False if it should be retried. """ raise NotImplementedError('Workers must implement run.') + def watchdog(self): + """ Function that gets run once every watchdog_period_seconds. """ + pass + def poll_queue(self): logger.debug('Getting work item from queue.') @@ -43,8 +49,8 @@ class Worker(object): logger.debug("Scheduling worker.") self._sched.start() - self._sched.add_interval_job(self.poll_queue, - seconds=self._poll_period_seconds) + self._sched.add_interval_job(self.poll_queue, seconds=self._poll_period_seconds) + self._sched.add_interval_job(self.watchdog, seconds=self._watchdog_period_seconds) while not self._stop.wait(1): pass From 7c466dab7d82e10056af51889eb37f1427faa596 Mon Sep 17 00:00:00 2001 From: Joseph Schorr Date: Wed, 2 Apr 2014 23:33:58 -0400 Subject: [PATCH 12/58] - Add an analyze method on triggers that, when given trigger config, will attempt to analyze the trigger's Dockerfile and determine what pull credentials, if any, are needed and available - Move the build trigger setup UI into its own directive (makes things cleaner) - Fix a bug in the entitySearch directive around setting the current entity - Change the build trigger setup UI to use the new analyze method and flow better --- endpoints/api/trigger.py | 138 +++++++++++++++- endpoints/trigger.py | 50 +++++- initdb.py | 2 +- static/css/quay.css | 10 +- static/directives/entity-search.html | 2 +- static/directives/setup-trigger-dialog.html | 100 ++++++++++++ static/js/app.js | 171 +++++++++++++++++++- static/js/controllers.js | 60 +------ static/partials/repo-admin.html | 69 +------- test/data/test.db | Bin 544768 -> 544768 bytes test/test_api_security.py | 129 ++++++++++++++- test/test_api_usage.py | 87 +++++++++- util/dockerfileparse.py | 72 +++++++++ 13 files changed, 759 insertions(+), 131 deletions(-) create mode 100644 static/directives/setup-trigger-dialog.html create mode 100644 util/dockerfileparse.py diff --git a/endpoints/api/trigger.py b/endpoints/api/trigger.py index c62367f52..7798280a1 100644 --- a/endpoints/api/trigger.py +++ b/endpoints/api/trigger.py @@ -16,8 +16,9 @@ from endpoints.trigger import (BuildTrigger as BuildTriggerBase, TriggerDeactiva TriggerActivationException, EmptyRepositoryException, RepositoryReadException) from data import model -from auth.permissions import UserAdminPermission, AdministerOrganizationPermission +from auth.permissions import UserAdminPermission, AdministerOrganizationPermission, ReadRepositoryPermission from util.names import parse_robot_username +from util.dockerfileparse import parse_dockerfile logger = logging.getLogger(__name__) @@ -232,6 +233,141 @@ class BuildTriggerActivate(RepositoryParamResource): raise Unauthorized() +@resource('/v1/repository//trigger//analyze') +@internal_only +class BuildTriggerAnalyze(RepositoryParamResource): + """ Custom verb for analyzing the config for a build trigger and suggesting various changes + (such as a robot account to use for pulling) + """ + schemas = { + 'BuildTriggerAnalyzeRequest': { + 'id': 'BuildTriggerAnalyzeRequest', + 'type': 'object', + 'required': [ + 'config' + ], + 'properties': { + 'config': { + 'type': 'object', + 'description': 'Arbitrary json.', + } + } + }, + } + + @require_repo_admin + @nickname('analyzeBuildTrigger') + @validate_json_request('BuildTriggerAnalyzeRequest') + def post(self, namespace, repository, trigger_uuid): + """ Analyze the specified build trigger configuration. """ + try: + trigger = model.get_build_trigger(namespace, repository, trigger_uuid) + except model.InvalidBuildTriggerException: + raise NotFound() + + handler = BuildTriggerBase.get_trigger_for_service(trigger.service.name) + new_config_dict = request.get_json()['config'] + + try: + # Load the contents of the Dockerfile. + contents = handler.load_dockerfile_contents(trigger.auth_token, new_config_dict) + if not contents: + return { + 'status': 'error', + 'message': 'Could not read the Dockerfile for the trigger' + } + + # Parse the contents of the Dockerfile. + parsed = parse_dockerfile(contents) + if not parsed: + return { + 'status': 'error', + 'message': 'Could not parse the Dockerfile specified' + } + + # Determine the base image (i.e. the FROM) for the Dockerfile. + base_image = parsed.get_base_image() + if not base_image: + return { + 'status': 'warning', + 'message': 'No FROM line found in the Dockerfile' + } + + # Check to see if the base image lives in Quay. + quay_registry_prefix = '%s/' % (app.config['URL_HOST']) + + if not base_image.startswith(quay_registry_prefix): + return { + 'status': 'publicbase' + } + + # Lookup the repository in Quay. + result = base_image[len(quay_registry_prefix):].split('/', 2) + if len(result) != 2: + return { + 'status': 'warning', + 'message': '"%s" is not a valid Quay repository path' % (base_image) + } + + (base_namespace, base_repository) = result + found_repository = model.get_repository(base_namespace, base_repository) + if not found_repository: + return { + 'status': 'error', + 'message': 'Repository "%s" was not found' % (base_image) + } + + # If the repository is private and the user cannot see that repo, then + # mark it as not found. + can_read = ReadRepositoryPermission(base_namespace, base_repository) + if found_repository.visibility.name != 'public' and not can_read: + return { + 'status': 'error', + 'message': 'Repository "%s" was not found' % (base_image) + } + + # Check to see if the repository is public. If not, we suggest the + # usage of a robot account to conduct the pull. + read_robots = [] + + if AdministerOrganizationPermission(base_namespace).can(): + def robot_view(robot): + return { + 'name': robot.username, + 'kind': 'user', + 'is_robot': True + } + + def is_valid_robot(user): + # Make sure the user is a robot. + if not user.robot: + return False + + # Make sure the current user can see/administer the robot. + (robot_namespace, shortname) = parse_robot_username(user.username) + return AdministerOrganizationPermission(robot_namespace).can() + + repo_perms = model.get_all_repo_users(base_namespace, base_repository) + read_robots = [robot_view(perm.user) for perm in repo_perms if is_valid_robot(perm.user)] + + return { + 'namespace': base_namespace, + 'name': base_repository, + 'is_public': found_repository.visibility.name == 'public', + 'robots': read_robots, + 'status': 'analyzed', + 'dockerfile_url': handler.dockerfile_url(trigger.auth_token, new_config_dict) + } + + except RepositoryReadException as rre: + return { + 'status': 'error', + 'message': rre.message + } + + raise NotFound() + + @resource('/v1/repository//trigger//start') class ActivateBuildTrigger(RepositoryParamResource): """ Custom verb to manually activate a build trigger. """ diff --git a/endpoints/trigger.py b/endpoints/trigger.py index d5573a513..57e32df66 100644 --- a/endpoints/trigger.py +++ b/endpoints/trigger.py @@ -2,6 +2,7 @@ import logging import io import os.path import tarfile +import base64 from github import Github, UnknownObjectException, GithubException from tempfile import SpooledTemporaryFile @@ -46,6 +47,19 @@ class BuildTrigger(object): def __init__(self): pass + def dockerfile_url(self, auth_token, config): + """ + Returns the URL at which the Dockerfile for the trigger can be found or None if none/not applicable. + """ + return None + + def load_dockerfile_contents(self, auth_token, config): + """ + Loads the Dockerfile found for the trigger's config and returns them or None if none could + be found/loaded. + """ + return None + def list_build_sources(self, auth_token): """ Take the auth information for the specific trigger type and load the @@ -168,7 +182,6 @@ class GithubBuildTrigger(BuildTrigger): return config - def list_build_sources(self, auth_token): gh_client = self._get_client(auth_token) usr = gh_client.get_user() @@ -219,6 +232,41 @@ class GithubBuildTrigger(BuildTrigger): raise RepositoryReadException(message) + def dockerfile_url(self, auth_token, config): + source = config['build_source'] + subdirectory = config.get('subdir', '') + path = subdirectory + '/Dockerfile' if subdirectory else 'Dockerfile' + + gh_client = self._get_client(auth_token) + try: + repo = gh_client.get_repo(source) + master_branch = repo.master_branch or 'master' + return 'https://github.com/%s/blob/%s/%s' % (source, master_branch, path) + except GithubException as ge: + return None + + def load_dockerfile_contents(self, auth_token, config): + gh_client = self._get_client(auth_token) + + source = config['build_source'] + subdirectory = config.get('subdir', '') + path = subdirectory + '/Dockerfile' if subdirectory else 'Dockerfile' + + try: + repo = gh_client.get_repo(source) + file_info = repo.get_file_contents(path) + if file_info is None: + return None + + content = file_info.content + if file_info.encoding == 'base64': + content = base64.b64decode(content) + return content + + except GithubException as ge: + message = ge.data.get('message', 'Unable to read Dockerfile: %s' % source) + raise RepositoryReadException(message) + @staticmethod def _prepare_build(config, repo, commit_sha, build_name, ref): # Prepare the download and upload URLs diff --git a/initdb.py b/initdb.py index 854f83f8a..3ddb601f3 100644 --- a/initdb.py +++ b/initdb.py @@ -295,7 +295,7 @@ def populate_database(): __generate_repository(new_user_1, 'complex', 'Complex repository with many branches and tags.', - False, [(new_user_2, 'read')], + False, [(new_user_2, 'read'), (dtrobot[0], 'read')], (2, [(3, [], 'v2.0'), (1, [(1, [(1, [], ['prod'])], 'staging'), diff --git a/static/css/quay.css b/static/css/quay.css index 919c0ddc9..93f32f0a1 100644 --- a/static/css/quay.css +++ b/static/css/quay.css @@ -3456,7 +3456,7 @@ pre.command:before { position: relative; - height: 100px; + height: 75px; opacity: 1; } @@ -3607,10 +3607,10 @@ pre.command:before { margin-right: 34px; } -.trigger-option-section:not(:last-child) { - border-bottom: 1px solid #eee; - padding-bottom: 16px; - margin-bottom: 16px; +.trigger-option-section:not(:first-child) { + border-top: 1px solid #eee; + padding-top: 16px; + margin-top: 10px; } .trigger-option-section .entity-search-element .twitter-typeahead { diff --git a/static/directives/entity-search.html b/static/directives/entity-search.html index 04dac6c0f..bc1c0a94e 100644 --- a/static/directives/entity-search.html +++ b/static/directives/entity-search.html @@ -1,5 +1,5 @@ - +
+

Setup new build trigger

+
+
+ +
+
+
+
+
+ + +
+
+ Checking pull credential requirements... +
+ +
+
+ {{ pullRequirements.message }} +
+
+ {{ pullRequirements.message }} +
+
+ The + Dockerfile found + Dockerfile found + depends on repository + + {{ pullRequirements.namespace }}/{{ pullRequirements.name }} + which requires + a robot account for pull access, because it is marked private. +
+
+ + + + + + + + + + +
+
+ Pull Credentials: +
+ 		+
+ In order to set pull credentials for a build trigger, you must be an Administrator of the namespace {{ repository.namespace }} +
+
+ + +
+
+ +
+ +
+ Note: We've automatically selected robot account , since it has access to the repository. +
+
+ Note: No robot account currently has access to the repository. Please create one and/or assign access in the + repository's admin panel. +
+
+
+ +
+
+ + +
+
+
+
+
diff --git a/static/js/app.js b/static/js/app.js index 311b531fb..2aaf412c0 100644 --- a/static/js/app.js +++ b/static/js/app.js @@ -2650,6 +2650,7 @@ quayApp.directive('entitySearch', function () { controller: function($scope, $element, Restangular, UserService, ApiService) { $scope.lazyLoading = true; $scope.isAdmin = false; + $scope.currentEntityInternal = $scope.currentEntity; $scope.lazyLoad = function() { if (!$scope.namespace || !$scope.lazyLoading) { return; } @@ -2732,7 +2733,9 @@ quayApp.directive('entitySearch', function () { }; $scope.clearEntityInternal = function() { + $scope.currentEntityInternal = null; $scope.currentEntity = null; + if ($scope.entitySelected) { $scope.entitySelected(null); } @@ -2746,6 +2749,7 @@ quayApp.directive('entitySearch', function () { } if ($scope.isPersistent) { + $scope.currentEntityInternal = entity; $scope.currentEntity = entity; } @@ -2870,6 +2874,16 @@ quayApp.directive('entitySearch', function () { $scope.$watch('inputTitle', function(title) { input.setAttribute('placeholder', title); }); + + $scope.$watch('currentEntity', function(entity) { + if ($scope.currentEntityInternal != entity) { + if (entity) { + $scope.setEntityInternal(entity, false); + } else { + $scope.clearEntityInternal(); + } + } + }); } }; return directiveDefinitionObject; @@ -3407,6 +3421,145 @@ quayApp.directive('dropdownSelectMenu', function () { }); +quayApp.directive('setupTriggerDialog', function () { + var directiveDefinitionObject = { + templateUrl: '/static/directives/setup-trigger-dialog.html', + replace: false, + transclude: false, + restrict: 'C', + scope: { + 'repository': '=repository', + 'trigger': '=trigger', + 'counter': '=counter', + 'canceled': '&canceled', + 'activated': '&activated' + }, + controller: function($scope, $element, ApiService, UserService) { + $scope.show = function() { + $scope.pullEntity = null; + $scope.publicPull = true; + $scope.showPullRequirements = false; + + $('#setupTriggerModal').modal({}); + $('#setupTriggerModal').on('hidden.bs.modal', function () { + $scope.$apply(function() { + $scope.cancelSetupTrigger(); + }); + }); + }; + + $scope.isNamespaceAdmin = function(namespace) { + return UserService.isNamespaceAdmin(namespace); + }; + + $scope.cancelSetupTrigger = function() { + $scope.canceled({'trigger': $scope.trigger}); + }; + + $scope.hide = function() { + $('#setupTriggerModal').modal('hide'); + }; + + $scope.setPublicPull = function(value) { + $scope.publicPull = value; + }; + + $scope.checkAnalyze = function(isValid) { + if (!isValid) { + $scope.publicPull = true; + $scope.pullEntity = null; + $scope.showPullRequirements = false; + $scope.checkingPullRequirements = false; + return; + } + + $scope.checkingPullRequirements = true; + $scope.showPullRequirements = true; + $scope.pullRequirements = null; + + var params = { + 'repository': $scope.repository.namespace + '/' + $scope.repository.name, + 'trigger_uuid': $scope.trigger.id + }; + + var data = { + 'config': $scope.trigger.config + }; + + ApiService.analyzeBuildTrigger(data, params).then(function(resp) { + $scope.pullRequirements = resp; + + if (resp['status'] == 'publicbase') { + $scope.publicPull = true; + $scope.pullEntity = null; + } else if (resp['namespace']) { + $scope.publicPull = false; + + if (resp['robots'] && resp['robots'].length > 0) { + $scope.pullEntity = resp['robots'][0]; + } else { + $scope.pullEntity = null; + } + } + + $scope.checkingPullRequirements = false; + }, function(resp) { + $scope.pullRequirements = resp; + $scope.checkingPullRequirements = false; + }); + }; + + $scope.activate = function() { + var params = { + 'repository': $scope.repository.namespace + '/' + $scope.repository.name, + 'trigger_uuid': $scope.trigger.id + }; + + var data = { + 'config': $scope.trigger['config'] + }; + + if ($scope.pullEntity) { + data['pull_robot'] = $scope.pullEntity['name']; + } + + ApiService.activateBuildTrigger(data, params).then(function(resp) { + trigger['is_active'] = true; + trigger['pull_robot'] = resp['pull_robot']; + $scope.activated({'trigger': $scope.trigger}); + }, function(resp) { + $scope.hide(); + $scope.canceled({'trigger': $scope.trigger}); + + bootbox.dialog({ + "message": resp['data']['message'] || 'The build trigger setup could not be completed', + "title": "Could not activate build trigger", + "buttons": { + "close": { + "label": "Close", + "className": "btn-primary" + } + } + }); + }); + }; + + var check = function() { + if ($scope.counter && $scope.trigger && $scope.repository) { + $scope.show(); + } + }; + + $scope.$watch('trigger', check); + $scope.$watch('counter', check); + $scope.$watch('repository', check); + } + }; + return directiveDefinitionObject; +}); + + + quayApp.directive('triggerSetupGithub', function () { var directiveDefinitionObject = { priority: 0, @@ -3416,15 +3569,18 @@ quayApp.directive('triggerSetupGithub', function () { restrict: 'C', scope: { 'repository': '=repository', - 'trigger': '=trigger' + 'trigger': '=trigger', + 'analyze': '&analyze' }, controller: function($scope, $element, ApiService) { + $scope.analyzeCounter = 0; $scope.setupReady = false; $scope.loading = true; $scope.handleLocationInput = function(location) { $scope.trigger['config']['subdir'] = location || ''; $scope.isInvalidLocation = $scope.locations.indexOf(location) < 0; + $scope.analyze({'isValid': !$scope.isInvalidLocation}); }; $scope.handleLocationSelected = function(datum) { @@ -3435,6 +3591,7 @@ quayApp.directive('triggerSetupGithub', function () { $scope.currentLocation = location; $scope.trigger['config']['subdir'] = location || ''; $scope.isInvalidLocation = false; + $scope.analyze({'isValid': true}); }; $scope.selectRepo = function(repo, org) { @@ -3473,6 +3630,7 @@ quayApp.directive('triggerSetupGithub', function () { $scope.locations = null; $scope.trigger.$ready = false; $scope.isInvalidLocation = false; + $scope.analyze({'isValid': false}); return; } @@ -3485,12 +3643,14 @@ quayApp.directive('triggerSetupGithub', function () { } else { $scope.currentLocation = null; $scope.isInvalidLocation = resp['subdir'].indexOf('') < 0; + $scope.analyze({'isValid': !$scope.isInvalidLocation}); } }, function(resp) { $scope.locationError = resp['message'] || 'Could not load Dockerfile locations'; $scope.locations = null; $scope.trigger.$ready = false; $scope.isInvalidLocation = false; + $scope.analyze({'isValid': false}); }); } }; @@ -3535,7 +3695,14 @@ quayApp.directive('triggerSetupGithub', function () { }); }; - loadSources(); + var check = function() { + if ($scope.repository && $scope.trigger) { + loadSources(); + } + }; + + $scope.$watch('repository', check); + $scope.$watch('trigger', check); $scope.$watch('currentRepo', function(repo) { $scope.selectRepoInternal(repo); diff --git a/static/js/controllers.js b/static/js/controllers.js index 08bcca561..304347667 100644 --- a/static/js/controllers.js +++ b/static/js/controllers.js @@ -1165,6 +1165,8 @@ function RepoAdminCtrl($scope, Restangular, ApiService, KeyService, $routeParams $scope.githubRedirectUri = KeyService.githubRedirectUri; $scope.githubClientId = KeyService.githubClientId; + $scope.showTriggerSetupCounter = 0; + $scope.getBadgeFormat = function(format, repo) { if (!repo) { return; } @@ -1454,65 +1456,15 @@ function RepoAdminCtrl($scope, Restangular, ApiService, KeyService, $routeParams }; $scope.setupTrigger = function(trigger) { - $scope.triggerSetupReady = false; $scope.currentSetupTrigger = trigger; - - trigger['_pullEntity'] = null; - trigger['_publicPull'] = true; - - $('#setupTriggerModal').modal({}); - $('#setupTriggerModal').on('hidden.bs.modal', function () { - $scope.$apply(function() { - $scope.cancelSetupTrigger(); - }); - }); + $scope.showTriggerSetupCounter++; }; - $scope.isNamespaceAdmin = function(namespace) { - return UserService.isNamespaceAdmin(namespace); - }; + $scope.cancelSetupTrigger = function(trigger) { + if ($scope.currentSetupTrigger != trigger) { return; } - $scope.finishSetupTrigger = function(trigger) { - $('#setupTriggerModal').modal('hide'); - $scope.currentSetupTrigger = null; - - var params = { - 'repository': namespace + '/' + name, - 'trigger_uuid': trigger.id - }; - - var data = { - 'config': trigger['config'] - }; - - if (trigger['_pullEntity']) { - data['pull_robot'] = trigger['_pullEntity']['name']; - } - - ApiService.activateBuildTrigger(data, params).then(function(resp) { - trigger['is_active'] = true; - trigger['pull_robot'] = resp['pull_robot']; - }, function(resp) { - $scope.triggers.splice($scope.triggers.indexOf(trigger), 1); - bootbox.dialog({ - "message": resp['data']['message'] || 'The build trigger setup could not be completed', - "title": "Could not activate build trigger", - "buttons": { - "close": { - "label": "Close", - "className": "btn-primary" - } - } - }); - }); - }; - - $scope.cancelSetupTrigger = function() { - if (!$scope.currentSetupTrigger) { return; } - - $('#setupTriggerModal').modal('hide'); - $scope.deleteTrigger($scope.currentSetupTrigger); $scope.currentSetupTrigger = null; + $scope.deleteTrigger(trigger); }; $scope.startTrigger = function(trigger) { diff --git a/static/partials/repo-admin.html b/static/partials/repo-admin.html index f1ee224f5..e7656aaf9 100644 --- a/static/partials/repo-admin.html +++ b/static/partials/repo-admin.html @@ -377,76 +377,17 @@
-
{{ shownToken.friendlyName }}
- - - + +
-
+
-
+
An e-mail has been sent to {{ sentEmail }} to verify the change.
@@ -177,12 +186,12 @@
-
+
-
+
diff --git a/templates/base.html b/templates/base.html index 59e427da1..5a1638574 100644 --- a/templates/base.html +++ b/templates/base.html @@ -73,6 +73,7 @@ From 19a20a6c94efb9b659ffa11f17ce5ffcc380ba00 Mon Sep 17 00:00:00 2001 From: Joseph Schorr Date: Sun, 6 Apr 2014 00:36:19 -0400 Subject: [PATCH 21/58] Turn off all references and API calls to billing if the feature is disabled --- endpoints/api/__init__.py | 6 ++ endpoints/api/billing.py | 12 +++- endpoints/api/organization.py | 5 +- endpoints/api/subscribe.py | 4 ++ endpoints/api/user.py | 11 ++-- endpoints/web.py | 4 ++ static/directives/header-bar.html | 2 +- static/js/app.js | 26 ++++++-- static/js/controllers.js | 91 ++++++++++++++++----------- static/partials/new-organization.html | 7 ++- static/partials/org-admin.html | 24 ++++--- static/partials/user-admin.html | 5 +- 12 files changed, 135 insertions(+), 62 deletions(-) diff --git a/endpoints/api/__init__.py b/endpoints/api/__init__.py index 61c1f3e6a..97f766da7 100644 --- a/endpoints/api/__init__.py +++ b/endpoints/api/__init__.py @@ -124,6 +124,9 @@ def format_date(date): def add_method_metadata(name, value): def modifier(func): + if func is None: + return None + if '__api_metadata' not in dir(func): func.__api_metadata = {} func.__api_metadata[name] = value @@ -132,6 +135,9 @@ def add_method_metadata(name, value): def method_metadata(func, name): + if func is None: + return None + if '__api_metadata' in dir(func): return func.__api_metadata.get(name, None) return None diff --git a/endpoints/api/billing.py b/endpoints/api/billing.py index 1f31aa58b..89dda31f0 100644 --- a/endpoints/api/billing.py +++ b/endpoints/api/billing.py @@ -4,13 +4,14 @@ from flask import request from endpoints.api import (resource, nickname, ApiResource, validate_json_request, log_action, related_user_resource, internal_only, Unauthorized, NotFound, - require_user_admin) + require_user_admin, show_if, hide_if) from endpoints.api.subscribe import subscribe, subscription_view from auth.permissions import AdministerOrganizationPermission from auth.auth_context import get_authenticated_user from data import model from data.plans import PLANS +import features def carderror_response(e): return {'carderror': e.message}, 402 @@ -79,6 +80,7 @@ def get_invoices(customer_id): @resource('/v1/plans/') +@show_if(features.BILLING) class ListPlans(ApiResource): """ Resource for listing the available plans. """ @nickname('listPlans') @@ -91,6 +93,7 @@ class ListPlans(ApiResource): @resource('/v1/user/card') @internal_only +@show_if(features.BILLING) class UserCard(ApiResource): """ Resource for managing a user's credit card. """ schemas = { @@ -132,6 +135,7 @@ class UserCard(ApiResource): @resource('/v1/organization//card') @internal_only @related_user_resource(UserCard) +@show_if(features.BILLING) class OrganizationCard(ApiResource): """ Resource for managing an organization's credit card. """ schemas = { @@ -178,6 +182,7 @@ class OrganizationCard(ApiResource): @resource('/v1/user/plan') @internal_only +@show_if(features.BILLING) class UserPlan(ApiResource): """ Resource for managing a user's subscription. """ schemas = { @@ -234,6 +239,7 @@ class UserPlan(ApiResource): @resource('/v1/organization//plan') @internal_only @related_user_resource(UserPlan) +@show_if(features.BILLING) class OrganizationPlan(ApiResource): """ Resource for managing a org's subscription. """ schemas = { @@ -294,6 +300,7 @@ class OrganizationPlan(ApiResource): @resource('/v1/user/invoices') @internal_only +@show_if(features.BILLING) class UserInvoiceList(ApiResource): """ Resource for listing a user's invoices. """ @require_user_admin @@ -310,6 +317,7 @@ class UserInvoiceList(ApiResource): @resource('/v1/organization//invoices') @internal_only @related_user_resource(UserInvoiceList) +@show_if(features.BILLING) class OrgnaizationInvoiceList(ApiResource): """ Resource for listing an orgnaization's invoices. """ @nickname('listOrgInvoices') @@ -323,4 +331,4 @@ class OrgnaizationInvoiceList(ApiResource): return get_invoices(organization.stripe_id) - raise Unauthorized() \ No newline at end of file + raise Unauthorized() diff --git a/endpoints/api/organization.py b/endpoints/api/organization.py index 9cb6a267a..f89ddc5d5 100644 --- a/endpoints/api/organization.py +++ b/endpoints/api/organization.py @@ -5,7 +5,7 @@ from flask import request from endpoints.api import (resource, nickname, ApiResource, validate_json_request, request_error, related_user_resource, internal_only, Unauthorized, NotFound, - require_user_admin, log_action) + require_user_admin, log_action, show_if) from endpoints.api.team import team_view from endpoints.api.user import User, PrivateRepositories from auth.permissions import (AdministerOrganizationPermission, OrganizationMemberPermission, @@ -15,6 +15,8 @@ from data import model from data.plans import get_plan from util.gravatar import compute_hash +import features + logger = logging.getLogger(__name__) @@ -163,6 +165,7 @@ class Organization(ApiResource): @resource('/v1/organization//private') @internal_only @related_user_resource(PrivateRepositories) +@show_if(features.BILLING) class OrgPrivateRepositories(ApiResource): """ Custom verb to compute whether additional private repositories are available. """ @nickname('getOrganizationPrivateAllowed') diff --git a/endpoints/api/subscribe.py b/endpoints/api/subscribe.py index f9f9d7f14..efc2dfea7 100644 --- a/endpoints/api/subscribe.py +++ b/endpoints/api/subscribe.py @@ -6,6 +6,7 @@ from endpoints.common import check_repository_usage from data import model from data.plans import PLANS +import features logger = logging.getLogger(__name__) @@ -24,6 +25,9 @@ def subscription_view(stripe_subscription, used_repos): def subscribe(user, plan, token, require_business_plan): + if not features.BILLING: + return + plan_found = None for plan_obj in PLANS: if plan_obj['stripeId'] == plan: diff --git a/endpoints/api/user.py b/endpoints/api/user.py index f89d7ed62..40194a436 100644 --- a/endpoints/api/user.py +++ b/endpoints/api/user.py @@ -194,6 +194,7 @@ class User(ApiResource): @resource('/v1/user/private') @internal_only +@show_if(features.BILLING) class PrivateRepositories(ApiResource): """ Operations dealing with the available count of private repositories. """ @require_user_admin @@ -249,8 +250,7 @@ class ConvertToOrganization(ApiResource): 'description': 'Information required to convert a user to an organization.', 'required': [ 'adminUser', - 'adminPassword', - 'plan', + 'adminPassword' ], 'properties': { 'adminUser': { @@ -263,7 +263,7 @@ class ConvertToOrganization(ApiResource): }, 'plan': { 'type': 'string', - 'description': 'The plan to which the organizatino should be subscribed', + 'description': 'The plan to which the organization should be subscribed', }, }, }, @@ -290,8 +290,9 @@ class ConvertToOrganization(ApiResource): message='The admin user credentials are not valid') # Subscribe the organization to the new plan. - plan = convert_data['plan'] - subscribe(user, plan, None, True) # Require business plans + if features.BILLING: + plan = convert_data.get('plan', 'free') + subscribe(user, plan, None, True) # Require business plans # Convert the user to an organization. model.convert_user_to_organization(user, model.get_user(admin_username)) diff --git a/endpoints/web.py b/endpoints/web.py index 1e78b12af..e14c70e79 100644 --- a/endpoints/web.py +++ b/endpoints/web.py @@ -20,6 +20,8 @@ from util.names import parse_repository_name from util.gravatar import compute_hash from auth import scopes +import features + logger = logging.getLogger(__name__) web = Blueprint('web', __name__) @@ -54,6 +56,7 @@ def snapshot(path = ''): @web.route('/plans/') @no_cache +@route_show_if(features.BILLING) def plans(): return index('') @@ -152,6 +155,7 @@ def privacy(): @web.route('/receipt', methods=['GET']) +@route_show_if(features.BILLING) def receipt(): if not current_user.is_authenticated(): abort(401) diff --git a/static/directives/header-bar.html b/static/directives/header-bar.html index 1a6ade0b7..05f7e24cf 100644 --- a/static/directives/header-bar.html +++ b/static/directives/header-bar.html @@ -14,7 +14,7 @@
  • Repositories
  • Docs
  • Tutorial
    • -
  • Pricing
    • +
  • Pricing
  • Organizations
    • diff --git a/static/js/app.js b/static/js/app.js index 532512bb0..4c60e1c4d 100644 --- a/static/js/app.js +++ b/static/js/app.js @@ -876,8 +876,8 @@ quayApp = angular.module('quay', ['ngRoute', 'chieffancypants.loadingBar', 'angu return keyService; }]); - $provide.factory('PlanService', ['KeyService', 'UserService', 'CookieService', 'ApiService', - function(KeyService, UserService, CookieService, ApiService) { + $provide.factory('PlanService', ['KeyService', 'UserService', 'CookieService', 'ApiService', 'Features', + function(KeyService, UserService, CookieService, ApiService, Features) { var plans = null; var planDict = {}; var planService = {}; @@ -903,7 +903,9 @@ quayApp = angular.module('quay', ['ngRoute', 'chieffancypants.loadingBar', 'angu }; planService.notePlan = function(planId) { - CookieService.putSession('quay.notedplan', planId); + if (Features.BILLING) { + CookieService.putSession('quay.notedplan', planId); + } }; planService.isOrgCompatible = function(plan) { @@ -929,7 +931,7 @@ quayApp = angular.module('quay', ['ngRoute', 'chieffancypants.loadingBar', 'angu planService.handleNotedPlan = function() { var planId = planService.getAndResetNotedPlan(); - if (!planId) { return false; } + if (!planId || !Features.BILLING) { return false; } UserService.load(function() { if (UserService.currentUser().anonymous) { @@ -974,6 +976,8 @@ quayApp = angular.module('quay', ['ngRoute', 'chieffancypants.loadingBar', 'angu }; planService.verifyLoaded = function(callback) { + if (!Features.BILLING) { return; } + if (plans) { callback(plans); return; @@ -1033,10 +1037,14 @@ quayApp = angular.module('quay', ['ngRoute', 'chieffancypants.loadingBar', 'angu }; planService.getSubscription = function(orgname, success, failure) { - ApiService.getSubscription(orgname).then(success, failure); + if (!Features.BILLING) { return; } + + ApiService.getSubscription(orgname).then(success, failure); }; planService.setSubscription = function(orgname, planId, success, failure, opt_token) { + if (!Features.BILLING) { return; } + var subscriptionDetails = { plan: planId }; @@ -1056,6 +1064,8 @@ quayApp = angular.module('quay', ['ngRoute', 'chieffancypants.loadingBar', 'angu }; planService.getCardInfo = function(orgname, callback) { + if (!Features.BILLING) { return; } + ApiService.getCard(orgname).then(function(resp) { callback(resp.card); }, function() { @@ -1064,6 +1074,8 @@ quayApp = angular.module('quay', ['ngRoute', 'chieffancypants.loadingBar', 'angu }; planService.changePlan = function($scope, orgname, planId, callbacks) { + if (!Features.BILLING) { return; } + if (callbacks['started']) { callbacks['started'](); } @@ -1089,6 +1101,8 @@ quayApp = angular.module('quay', ['ngRoute', 'chieffancypants.loadingBar', 'angu }; planService.changeCreditCard = function($scope, orgname, callbacks) { + if (!Features.BILLING) { return; } + if (callbacks['opening']) { callbacks['opening'](); } @@ -1145,6 +1159,8 @@ quayApp = angular.module('quay', ['ngRoute', 'chieffancypants.loadingBar', 'angu }; planService.showSubscribeDialog = function($scope, orgname, planId, callbacks) { + if (!Features.BILLING) { return; } + if (callbacks['opening']) { callbacks['opening'](); } diff --git a/static/js/controllers.js b/static/js/controllers.js index 08bcca561..33b17772f 100644 --- a/static/js/controllers.js +++ b/static/js/controllers.js @@ -1607,7 +1607,9 @@ function RepoAdminCtrl($scope, Restangular, ApiService, KeyService, $routeParams } function UserAdminCtrl($scope, $timeout, $location, ApiService, PlanService, UserService, CookieService, KeyService, - $routeParams, $http) { + $routeParams, $http, Features) { + $scope.Features = Features; + if ($routeParams['migrate']) { $('#migrateTab').tab('show') } @@ -1690,13 +1692,15 @@ function UserAdminCtrl($scope, $timeout, $location, ApiService, PlanService, Use }; $scope.showConvertForm = function() { - PlanService.getMatchingBusinessPlan(function(plan) { - $scope.org.plan = plan; - }); + if (Features.BILLING) { + PlanService.getMatchingBusinessPlan(function(plan) { + $scope.org.plan = plan; + }); - PlanService.getPlans(function(plans) { - $scope.orgPlans = plans; - }); + PlanService.getPlans(function(plans) { + $scope.orgPlans = plans; + }); + } $scope.convertStep = 1; }; @@ -1711,7 +1715,7 @@ function UserAdminCtrl($scope, $timeout, $location, ApiService, PlanService, Use var data = { 'adminUser': $scope.org.adminUser, 'adminPassword': $scope.org.adminPassword, - 'plan': $scope.org.plan.stripeId + 'plan': $scope.org.plan ? $scope.org.plan.stripeId : '' }; ApiService.convertUserToOrganization(data).then(function(resp) { @@ -1912,7 +1916,7 @@ function V1Ctrl($scope, $location, UserService) { UserService.updateUserIn($scope); } -function NewRepoCtrl($scope, $location, $http, $timeout, UserService, ApiService, PlanService, KeyService) { +function NewRepoCtrl($scope, $location, $http, $timeout, UserService, ApiService, PlanService, KeyService, Features) { UserService.updateUserIn($scope); $scope.githubRedirectUri = KeyService.githubRedirectUri; @@ -2034,13 +2038,19 @@ function NewRepoCtrl($scope, $location, $http, $timeout, UserService, ApiService var checkPrivateAllowed = function() { if (!$scope.repo || !$scope.repo.namespace) { return; } + if (!Features.BILLING) { + $scope.checkingPlan = false; + $scope.planRequired = null; + return; + } + $scope.checkingPlan = true; var isUserNamespace = $scope.isUserNamespace; ApiService.getPrivateAllowed(isUserNamespace ? null : $scope.repo.namespace).then(function(resp) { $scope.checkingPlan = false; - if (resp['privateAllowed']) { + if (resp['privateAllowed']) { $scope.planRequired = null; return; } @@ -2160,18 +2170,20 @@ function OrgViewCtrl($rootScope, $scope, ApiService, $routeParams) { loadOrganization(); } -function OrgAdminCtrl($rootScope, $scope, $timeout, Restangular, $routeParams, UserService, PlanService, ApiService) { +function OrgAdminCtrl($rootScope, $scope, $timeout, Restangular, $routeParams, UserService, PlanService, ApiService, Features) { var orgname = $routeParams.orgname; // Load the list of plans. - PlanService.getPlans(function(plans) { - $scope.plans = plans; - $scope.plan_map = {}; - - for (var i = 0; i < plans.length; ++i) { - $scope.plan_map[plans[i].stripeId] = plans[i]; - } - }); + if (Features.BILLING) { + PlanService.getPlans(function(plans) { + $scope.plans = plans; + $scope.plan_map = {}; + + for (var i = 0; i < plans.length; ++i) { + $scope.plan_map[plans[i].stripeId] = plans[i]; + } + }); + } $scope.orgname = orgname; $scope.membersLoading = true; @@ -2354,30 +2366,39 @@ function OrgsCtrl($scope, UserService) { browserchrome.update(); } -function NewOrgCtrl($scope, $routeParams, $timeout, $location, UserService, PlanService, ApiService, CookieService) { +function NewOrgCtrl($scope, $routeParams, $timeout, $location, UserService, PlanService, ApiService, CookieService, Features) { + $scope.Features = Features; + $scope.holder = {}; + UserService.updateUserIn($scope); var requested = $routeParams['plan']; - // Load the list of plans. - PlanService.getPlans(function(plans) { - $scope.plans = plans; - $scope.currentPlan = null; - if (requested) { - PlanService.getPlan(requested, function(plan) { - $scope.currentPlan = plan; - }); - } - }); + if (Features.BILLING) { + // Load the list of plans. + PlanService.getPlans(function(plans) { + $scope.plans = plans; + $scope.currentPlan = null; + if (requested) { + PlanService.getPlan(requested, function(plan) { + $scope.currentPlan = plan; + }); + } + }); + } $scope.signedIn = function() { - PlanService.handleNotedPlan(); + if (Features.BILLING) { + PlanService.handleNotedPlan(); + } }; $scope.signinStarted = function() { - PlanService.getMinimumPlan(1, true, function(plan) { - PlanService.notePlan(plan.stripeId); - }); + if (Features.BILLING) { + PlanService.getMinimumPlan(1, true, function(plan) { + PlanService.notePlan(plan.stripeId); + }); + } }; $scope.setPlan = function(plan) { @@ -2409,7 +2430,7 @@ function NewOrgCtrl($scope, $routeParams, $timeout, $location, UserService, Plan }; // If the selected plan is free, simply move to the org page. - if ($scope.currentPlan.price == 0) { + if (!Features.BILLING || $scope.currentPlan.price == 0) { showOrg(); return; } diff --git a/static/partials/new-organization.html b/static/partials/new-organization.html index be99bae98..5f4756cfe 100644 --- a/static/partials/new-organization.html +++ b/static/partials/new-organization.html @@ -66,13 +66,14 @@
    -
    +
    Choose your organization's plan -
    +
    - diff --git a/static/partials/org-admin.html b/static/partials/org-admin.html index 139579aa8..2b7b0be80 100644 --- a/static/partials/org-admin.html +++ b/static/partials/org-admin.html @@ -6,15 +6,23 @@
    @@ -22,12 +30,12 @@
    -
    +
    -
    +
    @@ -67,12 +75,12 @@
    -
    +
    -
    +
    diff --git a/static/partials/user-admin.html b/static/partials/user-admin.html index fcfb157c1..0a0bb1f82 100644 --- a/static/partials/user-admin.html +++ b/static/partials/user-admin.html @@ -243,13 +243,14 @@
    -
    +
    - From badf002e92e5ad5283574ebd2a1ea001f0be615b Mon Sep 17 00:00:00 2001 From: Joseph Schorr Date: Sun, 6 Apr 2014 00:50:30 -0400 Subject: [PATCH 22/58] Turn off all references and API calls to github login if the feature is disabled --- endpoints/callbacks.py | 5 ++++- static/directives/signin-form.html | 5 +++-- static/directives/signup-form.html | 13 +++++++++---- static/js/app.js | 4 +++- static/js/controllers.js | 2 ++ static/partials/user-admin.html | 2 +- 6 files changed, 22 insertions(+), 9 deletions(-) diff --git a/endpoints/callbacks.py b/endpoints/callbacks.py index 0f110c098..2f801af88 100644 --- a/endpoints/callbacks.py +++ b/endpoints/callbacks.py @@ -3,7 +3,7 @@ import logging from flask import request, redirect, url_for, Blueprint from flask.ext.login import current_user -from endpoints.common import render_page_template, common_login +from endpoints.common import render_page_template, common_login, route_show_if from app import app, mixpanel from data import model from util.names import parse_repository_name @@ -11,6 +11,7 @@ from util.http import abort from auth.permissions import AdministerRepositoryPermission from auth.auth import require_session_login +import features logger = logging.getLogger(__name__) @@ -48,6 +49,7 @@ def get_github_user(token): @callback.route('/github/callback', methods=['GET']) +@route_show_if(features.GITHUB_LOGIN) def github_oauth_callback(): error = request.args.get('error', None) if error: @@ -101,6 +103,7 @@ def github_oauth_callback(): @callback.route('/github/callback/attach', methods=['GET']) +@route_show_if(features.GITHUB_LOGIN) @require_session_login def github_oauth_attach(): token = exchange_github_code_for_token(request.args.get('code')) diff --git a/static/directives/signin-form.html b/static/directives/signin-form.html index 814955ce6..f56b8f8db 100644 --- a/static/directives/signin-form.html +++ b/static/directives/signin-form.html @@ -6,12 +6,13 @@ placeholder="Password" ng-model="user.password"> -