From 6260aa7d858dddbb54e7c738a17b4b287a713776 Mon Sep 17 00:00:00 2001
From: Joseph Schorr <jschorr@gmail.com>
Date: Tue, 25 Feb 2014 12:11:19 -0500
Subject: [PATCH 1/6] Never wrap entity references

---
 static/css/quay.css              | 8 ++++++++
 static/directives/logs-view.html | 4 ++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/static/css/quay.css b/static/css/quay.css
index 0bb108ed3..ba72550ed 100644
--- a/static/css/quay.css
+++ b/static/css/quay.css
@@ -234,6 +234,10 @@ i.toggle-icon:hover {
   top: 4px;
 }
 
+.entity-reference-element {
+  white-space: nowrap;
+}
+
 .entity-reference-element i.fa-exclamation-triangle {
   color: #c09853;
   margin-left: 10px;
@@ -394,6 +398,10 @@ i.toggle-icon:hover {
   line-height: 25px;
 }
 
+.logs-view-element .log-performer {
+  white-space: nowrap;
+}
+
 .billing-options-element .current-card {
   font-size: 16px;
   margin-bottom: 20px;
diff --git a/static/directives/logs-view.html b/static/directives/logs-view.html
index 45d3f50fc..d6405d342 100644
--- a/static/directives/logs-view.html
+++ b/static/directives/logs-view.html
@@ -53,10 +53,10 @@
           </td>
           <td>{{ log.datetime }}</td>
           <td>
-            <span ng-show="log.performer">              
+            <span class="log-performer" ng-show="log.performer">              
               <span class="entity-reference" entity="log.performer" namespace="organization.name"></span>
             </span>
-            <span ng-show="!log.performer && log.metadata.token">
+            <span class="log-performer" ng-show="!log.performer && log.metadata.token">
               <i class="fa fa-key"></i>
               <span>{{ log.metadata.token }}</span>
             </span>

From 1100e72d9e8de9c96fc558a307572f3f51e15a6a Mon Sep 17 00:00:00 2001
From: Joseph Schorr <jschorr@gmail.com>
Date: Tue, 25 Feb 2014 12:32:56 -0500
Subject: [PATCH 2/6] Make robot accounts clickable if they are accessible to
 the user

---
 static/directives/entity-reference.html | 24 ++++++---
 static/directives/entity-search.html    |  4 ++
 static/js/app.js                        | 68 +++++++++++++++++++++----
 3 files changed, 78 insertions(+), 18 deletions(-)

diff --git a/static/directives/entity-reference.html b/static/directives/entity-reference.html
index 6cb91a5c0..12ee81f86 100644
--- a/static/directives/entity-reference.html
+++ b/static/directives/entity-reference.html
@@ -1,19 +1,27 @@
 <span class="entity-reference-element">
-  <span ng-show="entity.kind == 'team'">
+  <span ng-if="entity.kind == 'team'">
     <i class="fa fa-group" title="Team" bs-tooltip="tooltip.title" data-container="body"></i> 
     <span class="entity-name">
-      <span ng-show="!getIsAdmin(namespace)">{{entity.name}}</span>
-      <span ng-show="getIsAdmin(namespace)"><a href="/organization/{{ namespace }}/teams/{{ entity.name }}">{{entity.name}}</a></span>
+      <span ng-if="!getIsAdmin(namespace)">{{entity.name}}</span>
+      <span ng-if="getIsAdmin(namespace)"><a href="/organization/{{ namespace }}/teams/{{ entity.name }}">{{entity.name}}</a></span>
     </span>
   </span>
-  <span ng-show="entity.kind != 'team'">
+  <span ng-if="entity.kind != 'team'">
     <i class="fa fa-user" ng-show="!entity.is_robot" title="User" bs-tooltip="tooltip.title" data-container="body"></i>
     <i class="fa fa-wrench" ng-show="entity.is_robot" title="Robot Account" bs-tooltip="tooltip.title" data-container="body"></i> 
-    <span class="entity-name">
-      <span ng-show="entity.is_robot" class="prefix">{{getPrefix(entity.name)}}</span><span>{{getShortenedName(entity.name)}}</span>
+    <span class="entity-name" ng-if="entity.is_robot">
+      <a href="{{ getRobotUrl(entity.name) }}" ng-if="getIsAdmin(getPrefix(entity.name))">
+        <span class="prefix">{{ getPrefix(entity.name) }}+</span><span>{{ getShortenedName(entity.name) }}</span>
+      </a>
+      <span ng-if="!getIsAdmin(getPrefix(entity.name))">
+        <span class="prefix">{{ getPrefix(entity.name) }}+</span><span>{{ getShortenedName(entity.name) }}</span>
+      </span>
+    </span>
+    <span class="entity-name" ng-if="!entity.is_robot">
+      <span>{{getShortenedName(entity.name)}}</span>
     </span>
   </span>
-  <i class="fa fa-exclamation-triangle" ng-show="entity.is_org_member === false"
-     title="This user is not a member of the organization" bs-tooltip="tooltip.title">
+  <i class="fa fa-exclamation-triangle" ng-if="entity.is_org_member === false"
+     title="This user is not a member of the organization" bs-tooltip="tooltip.title" data-container="body">
   </i>
 </span>
diff --git a/static/directives/entity-search.html b/static/directives/entity-search.html
index e87f3e2c3..04dac6c0f 100644
--- a/static/directives/entity-search.html
+++ b/static/directives/entity-search.html
@@ -7,6 +7,10 @@
     </button>
     <ul class="dropdown-menu" role="menu" aria-labelledby="entityDropdownMenu">
       <li ng-show="lazyLoading" style="padding: 10px"><div class="quay-spinner"></div></li>
+
+      <li role="presentation" class="dropdown-header" ng-show="!lazyLoading && !robots && !isAdmin && !teams">
+        You do not have permission to manage teams and robots for this organization
+      </li>
       
       <li role="presentation" ng-repeat="team in teams" ng-show="!lazyLoading"
           ng-click="setEntity(team.name, 'team', false)">
diff --git a/static/js/app.js b/static/js/app.js
index cdb939745..771ae6098 100644
--- a/static/js/app.js
+++ b/static/js/app.js
@@ -838,15 +838,34 @@ quayApp.directive('entityReference', function () {
       'entity': '=entity',
       'namespace': '=namespace'
     },
-    controller: function($scope, $element, UserService) {
+    controller: function($scope, $element, UserService, $sanitize) {
       $scope.getIsAdmin = function(namespace) {
         return UserService.isNamespaceAdmin(namespace);
       };
 
+      $scope.getRobotUrl = function(name) {
+        var namespace = $scope.getPrefix(name);
+        if (!namespace) {
+          return '';
+        }
+
+        if (!$scope.getIsAdmin(namespace)) {
+          return '';
+        }
+
+        var org = UserService.getOrganization(namespace);
+        if (!org) {
+          // This robot is owned by the user.
+          return '/user/?tab=robots&showRobot=' + $sanitize(name);
+        }
+
+        return '/organization/' + org['name'] + '/admin?tab=robots&showRobot=' + $sanitize(name);
+      };
+
       $scope.getPrefix = function(name) {
         if (!name) { return ''; }
         var plus = name.indexOf('+');
-        return name.substr(0, plus + 1);
+        return name.substr(0, plus);
       };
 
       $scope.getShortenedName = function(name) {
@@ -1500,7 +1519,7 @@ quayApp.directive('robotsManager', function () {
       'organization': '=organization',
       'user': '=user'
     },
-    controller: function($scope, $element, ApiService) {
+    controller: function($scope, $element, ApiService, $routeParams) {
       $scope.ROBOT_PATTERN = ROBOT_PATTERN;
       $scope.robots = null;
       $scope.loading = false;
@@ -1511,6 +1530,15 @@ quayApp.directive('robotsManager', function () {
         $scope.shownRobot = info;
         $scope.showRobotCounter++;
       };
+      
+      $scope.findRobotIndexByName = function(name) {
+        for (var i = 0; i < $scope.robots.length; ++i) {
+          if ($scope.robots[i].name == name) {
+            return i;
+          }
+        }
+        return -1;
+      };
 
       $scope.getShortenedName = function(name) {
         var plus = name.indexOf('+');
@@ -1534,11 +1562,9 @@ quayApp.directive('robotsManager', function () {
       $scope.deleteRobot = function(info) {
         var shortName = $scope.getShortenedName(info.name);
         ApiService.deleteRobot($scope.organization, null, {'robot_shortname': shortName}).then(function(resp) {
-          for (var i = 0; i < $scope.robots.length; ++i) {
-            if ($scope.robots[i].name == info.name) {
-              $scope.robots.splice(i, 1);
-              return;
-            }
+          var index = $scope.findRobotIndexByName(info.name);
+          if (index >= 0) {
+            $scope.robots.splice(index, 1);
           }
         }, function() {
            bootbox.dialog({
@@ -1562,6 +1588,13 @@ quayApp.directive('robotsManager', function () {
         ApiService.getRobots($scope.organization).then(function(resp) {
           $scope.robots = resp.robots;
           $scope.loading = false;
+
+          if ($routeParams.showRobot) {
+            var index = $scope.findRobotIndexByName($routeParams.showRobot);
+            if (index >= 0) {
+              $scope.showRobot($scope.robots[index]);
+            }
+          }
         });
       };
 
@@ -2004,8 +2037,17 @@ quayApp.directive('entitySearch', function () {
       $scope.lazyLoad = function() {
         if (!$scope.namespace || !$scope.lazyLoading) { return; }
 
+        // Determine whether we can admin this namespace.
         $scope.isAdmin = UserService.isNamespaceAdmin($scope.namespace);
 
+        // If the scope is an organization and we are not part of it, then nothing more we can do.
+        if (!$scope.isAdmin && $scope.isOrganization && !UserService.getOrganization($scope.namespace)) {
+          $scope.teams = null;
+          $scope.robots = null;
+          $scope.lazyLoading = false;
+          return;
+        }
+
         if ($scope.isOrganization && $scope.includeTeams) {
           ApiService.getOrganization(null, {'orgname': $scope.namespace}).then(function(resp) {
             $scope.teams = resp.teams;
@@ -3098,8 +3140,14 @@ quayApp.run(['$location', '$rootScope', 'Restangular', 'UserService', 'PlanServi
       var tabName = e.target.getAttribute('data-target').substr(1);
       $rootScope.$apply(function() {
         var isDefaultTab = $('a[data-toggle="tab"]')[0] == e.target;
-        var data = isDefaultTab ? {} : {'tab':  tabName};
-        $location.search(data);
+        var newSearch = $.extend($location.search(), {});
+        if (isDefaultTab) {
+          delete newSearch['tab'];
+        } else {
+          newSearch['tab'] = tabName;
+        }
+
+        $location.search(newSearch);
       });
       
       e.preventDefault();        

From a120f6c64a9d6a97a2810f9afdadf1d71d22485c Mon Sep 17 00:00:00 2001
From: Joseph Schorr <jschorr@gmail.com>
Date: Tue, 25 Feb 2014 14:15:12 -0500
Subject: [PATCH 3/6] Make sure all aborts have message information

---
 auth/auth.py          | 11 ++++++-----
 endpoints/registry.py |  2 +-
 util/http.py          |  3 ++-
 3 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/auth/auth.py b/auth/auth.py
index 9c6281aef..f751d6814 100644
--- a/auth/auth.py
+++ b/auth/auth.py
@@ -1,7 +1,7 @@
 import logging
 
 from functools import wraps
-from flask import request, _request_ctx_stack, abort, session
+from flask import request, _request_ctx_stack, abort as flask_abort, session
 from flask.ext.principal import identity_changed, Identity
 from base64 import b64decode
 
@@ -10,6 +10,7 @@ from app import app
 from permissions import QuayDeferredPermissionUser
 
 from util.names import parse_namespace_repository
+from util.http import abort
 
 
 logger = logging.getLogger(__name__)
@@ -89,13 +90,13 @@ def process_token(auth):
 
   if len(token_details) != 1:
     logger.warning('Invalid token format: %s' % auth)
-    abort(401)
+    abort(401, message="Invalid token format: %(auth)", issue='invalid-auth-token', auth=auth)
 
   token_vals = {val[0]: val[1] for val in
                 (detail.split('=') for detail in token_details)}
   if 'signature' not in token_vals:
     logger.warning('Token does not contain signature: %s' % auth)
-    abort(401)
+    abort(401, message="Token does not contain a valid signature: %(auth)", issue='invalid-auth-token', auth=auth)
 
   try:
     token_data = model.load_token_data(token_vals['signature'])
@@ -103,7 +104,7 @@ def process_token(auth):
   except model.InvalidTokenException:
     logger.warning('Token could not be validated: %s' %
                    token_vals['signature'])
-    abort(401)
+    abort(401, message="Token could not be validated: %(auth)", issue='invalid-auth-token', auth=auth)
 
   logger.debug('Successfully validated token: %s' % token_data.code)
   ctx = _request_ctx_stack.top
@@ -134,7 +135,7 @@ def extract_namespace_repo_from_session(f):
     if 'namespace' not in session or 'repository' not in session:
       logger.error('Unable to load namespace or repository from session: %s' %
                    session)
-      abort(400)
+      abort(400, message="Missing namespace in request")
 
     return f(session['namespace'], session['repository'], *args, **kwargs)
   return wrapper
diff --git a/endpoints/registry.py b/endpoints/registry.py
index 9727d5ccb..211c2e12b 100644
--- a/endpoints/registry.py
+++ b/endpoints/registry.py
@@ -259,7 +259,7 @@ def get_image_json(namespace, repository, image_id, headers):
     data = store.get_content(store.image_json_path(namespace, repository,
                                                    image_id, uuid))
   except IOError:
-    flask_abort(404)
+    abort(404, message='Image data not found')
 
   try:
     size = store.get_size(store.image_layer_path(namespace, repository,
diff --git a/util/http.py b/util/http.py
index 6592768cc..a678c97ec 100644
--- a/util/http.py
+++ b/util/http.py
@@ -2,7 +2,6 @@ import logging
 
 from app import mixpanel
 from flask import request, abort as flask_abort, jsonify
-from auth.auth import get_authenticated_user, get_validated_token
 
 logger = logging.getLogger(__name__)
 
@@ -16,6 +15,8 @@ DEFAULT_MESSAGE[409] = 'Conflict'
 DEFAULT_MESSAGE[501] = 'Not Implemented'
 
 def abort(status_code, message=None, issue=None, **kwargs):
+  from auth.auth import get_authenticated_user, get_validated_token
+
   message = (str(message) % kwargs if message else
              DEFAULT_MESSAGE.get(status_code, ''))
 

From 61ca29de0435917386b46b4d558c9fc19c6f4233 Mon Sep 17 00:00:00 2001
From: Joseph Schorr <jschorr@gmail.com>
Date: Tue, 25 Feb 2014 15:07:24 -0500
Subject: [PATCH 4/6] Move the auth context methods into their own file so that
 we don't have auth trying to import itself

---
 auth/auth.py          | 11 +----------
 auth/auth_context.py  |  7 +++++++
 endpoints/index.py    |  4 ++--
 endpoints/registry.py |  2 +-
 util/http.py          |  2 +-
 5 files changed, 12 insertions(+), 14 deletions(-)
 create mode 100644 auth/auth_context.py

diff --git a/auth/auth.py b/auth/auth.py
index f751d6814..fb08b9184 100644
--- a/auth/auth.py
+++ b/auth/auth.py
@@ -1,7 +1,7 @@
 import logging
 
 from functools import wraps
-from flask import request, _request_ctx_stack, abort as flask_abort, session
+from flask import request, _request_ctx_stack, session
 from flask.ext.principal import identity_changed, Identity
 from base64 import b64decode
 
@@ -15,15 +15,6 @@ from util.http import abort
 
 logger = logging.getLogger(__name__)
 
-
-def get_authenticated_user():
-  return getattr(_request_ctx_stack.top, 'authenticated_user', None)
-
-
-def get_validated_token():
-  return getattr(_request_ctx_stack.top, 'validated_token', None)
-
-
 def process_basic_auth(auth):
   normalized = [part.strip() for part in auth.split(' ') if part]
   if normalized[0].lower() != 'basic' or len(normalized) != 2:
diff --git a/auth/auth_context.py b/auth/auth_context.py
new file mode 100644
index 000000000..09ff8d759
--- /dev/null
+++ b/auth/auth_context.py
@@ -0,0 +1,7 @@
+from flask import _request_ctx_stack
+
+def get_authenticated_user():
+  return getattr(_request_ctx_stack.top, 'authenticated_user', None)
+
+def get_validated_token():
+  return getattr(_request_ctx_stack.top, 'validated_token', None)
diff --git a/endpoints/index.py b/endpoints/index.py
index 864805b9a..e75cb020d 100644
--- a/endpoints/index.py
+++ b/endpoints/index.py
@@ -9,8 +9,8 @@ from collections import OrderedDict
 from data import model, userevent
 from data.queue import webhook_queue
 from app import mixpanel, app
-from auth.auth import (process_auth, get_authenticated_user,
-                       get_validated_token)
+from auth.auth import process_auth
+from auth.auth_context import get_authenticated_user, get_validated_token
 from util.names import parse_repository_name
 from util.email import send_confirmation_email
 from auth.permissions import (ModifyRepositoryPermission, UserPermission,
diff --git a/endpoints/registry.py b/endpoints/registry.py
index 211c2e12b..51bb7219e 100644
--- a/endpoints/registry.py
+++ b/endpoints/registry.py
@@ -2,7 +2,7 @@ import logging
 import json
 
 from flask import (make_response, request, session, Response, redirect,
-                   Blueprint, abort as flask_abort)
+                   Blueprint)
 from functools import wraps
 from datetime import datetime
 from time import time
diff --git a/util/http.py b/util/http.py
index a678c97ec..1068696fe 100644
--- a/util/http.py
+++ b/util/http.py
@@ -2,6 +2,7 @@ import logging
 
 from app import mixpanel
 from flask import request, abort as flask_abort, jsonify
+from auth.auth_context import get_authenticated_user, get_validated_token
 
 logger = logging.getLogger(__name__)
 
@@ -15,7 +16,6 @@ DEFAULT_MESSAGE[409] = 'Conflict'
 DEFAULT_MESSAGE[501] = 'Not Implemented'
 
 def abort(status_code, message=None, issue=None, **kwargs):
-  from auth.auth import get_authenticated_user, get_validated_token
 
   message = (str(message) % kwargs if message else
              DEFAULT_MESSAGE.get(status_code, ''))

From 4b689a7a7c27ee8ec1d4dbf41ea7a8a84aa72db9 Mon Sep 17 00:00:00 2001
From: jakedt <jake@devtable.com>
Date: Tue, 25 Feb 2014 16:31:52 -0500
Subject: [PATCH 5/6] Fix the translation of old ids to new ids, again.

---
 data/model.py              | 21 ++++++++++++++++-----
 endpoints/index.py         |  6 ++----
 initdb.py                  |  3 ++-
 test/test_image_sharing.py |  2 +-
 4 files changed, 21 insertions(+), 11 deletions(-)

diff --git a/data/model.py b/data/model.py
index 79738ec4e..876f4e0a5 100644
--- a/data/model.py
+++ b/data/model.py
@@ -884,16 +884,20 @@ def create_repository(namespace, name, creating_user, visibility='private'):
   return repo
 
 
-def __translate_ancestry(old_ancestry, translations, existing_images):
+def __translate_ancestry(old_ancestry, translations, repository, username):
   if old_ancestry == '/':
     return '/'
 
   def translate_id(old_id):
+    logger.debug('Translating id: %s', old_id)
     if old_id not in translations:
       # Figure out which docker_image_id the old id refers to, then find a
       # a local one
       old = Image.select(Image.docker_image_id).where(Image.id == old_id).get()
-      translations[old_id] = existing_images[old.docker_image_id]
+      image_in_repo = find_create_or_link_image(old.docker_image_id,
+                                                repository, username,
+                                                translations)
+      translations[old_id] = image_in_repo.id
 
     return translations[old_id]
 
@@ -902,9 +906,14 @@ def __translate_ancestry(old_ancestry, translations, existing_images):
   return '/%s/' % '/'.join(new_ids)
 
 
-def create_or_link_image(docker_image_id, repository, username, translations,
-                         existing_images):
+def find_create_or_link_image(docker_image_id, repository, username,
+                              translations):
   with transaction_factory(db):
+    repo_image = get_repo_image(repository.namespace, repository.name,
+                                docker_image_id)
+    if repo_image:
+      return repo_image
+
     query = (Image
       .select(Image, ImageStorage)
       .distinct()
@@ -926,7 +935,8 @@ def create_or_link_image(docker_image_id, repository, username, translations,
       logger.debug(msg, docker_image_id, to_copy.storage.uuid)
       
       new_image_ancestry = __translate_ancestry(to_copy.ancestors,
-                                                translations, existing_images)
+                                                translations, repository,
+                                                username)
 
       storage = to_copy.storage
       origin_image_id = to_copy.id
@@ -939,6 +949,7 @@ def create_or_link_image(docker_image_id, repository, username, translations,
                              ancestors=new_image_ancestry)
 
     if origin_image_id:
+      logger.debug('Storing translation %s -> %s', origin_image_id, new_image.id)
       translations[origin_image_id] = new_image.id
 
     return new_image
diff --git a/endpoints/index.py b/endpoints/index.py
index e75cb020d..549bcfec8 100644
--- a/endpoints/index.py
+++ b/endpoints/index.py
@@ -193,17 +193,15 @@ def create_repository(namespace, repository):
                               for desc in image_descriptions])
   new_repo_images = dict(added_images)
 
-  existing_image_translations = {}
   for existing in model.get_repository_images(namespace, repository):
     if existing.docker_image_id in new_repo_images:
-      existing_image_translations[existing.docker_image_id] = existing.id
       added_images.pop(existing.docker_image_id)
 
   username = get_authenticated_user() and get_authenticated_user().username
   translations = {}
   for image_description in added_images.values():
-    model.create_or_link_image(image_description['id'], repo, username,
-                               translations, existing_image_translations)
+    model.find_create_or_link_image(image_description['id'], repo, username,
+                                    translations)
 
   response = make_response('Created', 201)
 
diff --git a/initdb.py b/initdb.py
index 87cc31dcf..06ca0053c 100644
--- a/initdb.py
+++ b/initdb.py
@@ -67,7 +67,8 @@ def __create_subtree(repo, structure, creator_username, parent):
     logger.debug('new docker id: %s' % docker_image_id)
     checksum = __gen_checksum(docker_image_id)
 
-    new_image = model.create_or_link_image(docker_image_id, repo, None, {}, {})
+    new_image = model.find_create_or_link_image(docker_image_id, repo, None,
+                                                {})
     new_image.storage.uuid = IMAGE_UUIDS[image_num % len(IMAGE_UUIDS)]
     new_image.storage.save()
 
diff --git a/test/test_image_sharing.py b/test/test_image_sharing.py
index 40e9485cd..bdc85cedf 100644
--- a/test/test_image_sharing.py
+++ b/test/test_image_sharing.py
@@ -43,7 +43,7 @@ class TestImageSharing(unittest.TestCase):
 
   def createStorage(self, docker_image_id, repository=REPO, username=ADMIN_ACCESS_USER):
     repository_obj = model.get_repository(repository.split('/')[0], repository.split('/')[1])
-    image = model.create_or_link_image(docker_image_id, repository_obj, username, {}, {})
+    image = model.find_create_or_link_image(docker_image_id, repository_obj, username, {})
     return image.storage.id
 
   def assertSameStorage(self, docker_image_id, storage_id, repository=REPO, username=ADMIN_ACCESS_USER):

From fa4c925e4db6689c19273076c597e3f45ebfad11 Mon Sep 17 00:00:00 2001
From: jakedt <jake@devtable.com>
Date: Tue, 25 Feb 2014 16:54:49 -0500
Subject: [PATCH 6/6] Allow exception tracebacks to get logged to the log file.

---
 endpoints/common.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/endpoints/common.py b/endpoints/common.py
index 0f9e027c8..77e155098 100644
--- a/endpoints/common.py
+++ b/endpoints/common.py
@@ -57,12 +57,14 @@ def common_login(db_user):
 
 @app.errorhandler(model.DataModelException)
 def handle_dme(ex):
-  return make_response(ex.message, 400)
+  logger.exception(ex)
+  return make_response('Internal Server Error', 500)
 
 
 @app.errorhandler(KeyError)
 def handle_dme_key_error(ex):
-  return make_response(ex.message, 400)
+  logger.exception(ex)
+  return make_response('Internal Server Error', 500)
 
 
 def generate_csrf_token():