vbatts/quay
Archived
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity
7368 commits 2 branches 62 tags 205 MiB
Commit graph

1837 commits

Author SHA1 Message Date
Evan Cordell
9515f18fb6 Add tufmetadata endpoint 2017-04-05 10:03:27 -04:00
Joseph Schorr
8c10b0787d Change appr error if you try to push to an image repository 
501 was confusing to the users, so change to 405 and add an error explaining why the push failed

Fixes https://github.com/app-registry/helm-plugin/issues/8#issuecomment-291553739
 2017-04-04 13:57:35 -04:00
josephschorr
1bfca871ec Merge pull request #2387 from coreos-inc/team-sync 
Team synchronization support in Quay Enterprise
 2017-04-03 18:26:29 -04:00
Joseph Schorr
55b1ad49ed Make team API decorators more descriptive for better readability 2017-04-03 15:35:44 -04:00
josephschorr
3f0f8159b7 Merge pull request #2499 from coreos-inc/docker-400 
Better error messages for Docker errors
 2017-04-03 11:39:07 -04:00
Joseph Schorr
47278cc559 Cleanup test fixtures 2017-04-03 11:31:30 -04:00
Joseph Schorr
04225f2d25 Add feature flag for team syncing 2017-04-03 11:31:29 -04:00
Joseph Schorr
b683088f87 Update tests for teams API 2017-04-03 11:31:29 -04:00
Joseph Schorr
eeadeb9383 Initial interfaces and support for team syncing worker 2017-04-03 11:31:29 -04:00
Joseph Schorr
8ea3977140 Add ability to enable, disable and view team syncing in UI and API 
Also extracts out some common testing infrastructure to make testing APIs easier now using pytest
 2017-04-03 11:31:29 -04:00
Joseph Schorr
f5a854c189 Add TeamSync database and API support 
Teams can now have a TeamSync entry in the database, indicating how they are synced via an external group. If found, then the user membership of the team cannot be changed via the API.
 2017-04-03 11:31:28 -04:00
Joseph Schorr
cae9d69376 Better error messages for Docker errors 2017-03-31 17:15:14 -04:00
Charlton Austin
484ecd961e Merge pull request #2497 from charltonaustin/add_in_dockerfile_path 
feat(add dockerfile_path to build api): added param to specify path
 2017-03-30 16:30:44 -04:00
Charlton Austin
63a2f0c14b feat(add dockerfile_path to build api): added in a dockerfile to specify path 
### Description of Changes

  this allows people to specify a context and a dockerfile path
 2017-03-30 16:30:00 -04:00
Joseph Schorr
147b812edb Remove out dated Enterprise landing page 
We now just redirect to the QE plans page

Fixes https://www.pivotaltracker.com/story/show/142166263
 2017-03-30 15:25:56 -04:00
Charlton Austin
d4177e6e33 fix(endpoints): appending dockerfile to api call 
### Description of Changes

  this was not passing back the correct path for the dockerfile
 2017-03-30 13:35:04 -04:00
Joseph Schorr
e142ad8e3d $CURRENT_YEAR 2017-03-29 17:03:57 -04:00
josephschorr
b4e79206a0 Merge pull request #2490 from coreos-inc/upload-cert-blocker 
Make custom cert upload not hang and handle errors properly
 2017-03-29 16:11:13 -04:00
Joseph Schorr
835acfc58e Make custom cert upload not hang and handle errors properly 2017-03-29 16:06:15 -04:00
Charlton Austin
df5a6aabe2 fix(buildman, endpoint): added in fix upload gzip and dockerfile 2017-03-29 15:12:33 -04:00
Charlton Austin
ca99535774 Merge pull request #2449 from charltonaustin/phase_two_config 
feat(build runner): added in context, dockerfile_location
 2017-03-28 14:14:36 -04:00
Charlton Austin
e6d201e0b0 feat(build runner): added in context, dockerfile_location 
this is a new feature meant to allow people to use any file as
  a dockerfile and any folder as a context directory
 2017-03-28 13:55:31 -04:00
Jimmy Zelinskie
65a17dc155 Merge pull request #2473 from coreos-inc/certs-fixes 
Fixes and improvements around custom certificate handling
 2017-03-27 15:08:36 -04:00
Jimmy Zelinskie
8931609775 Merge pull request #2469 from coreos-inc/appr_403_vs_401 
Use 401 for bad or missing credentials, 403 for forbidden access
 2017-03-27 11:39:23 -04:00
Jimmy Zelinskie
024f73ecd4 Merge pull request #2476 from coreos-inc/fix_bug_force_push 
Fix force push causing duplicated entries
 2017-03-27 11:39:12 -04:00
Evan Cordell
abd78bce56 Use constants for TUF roots 2017-03-27 11:37:17 -04:00
Evan Cordell
6ad107709c Change build_context_and_subject to take kwargs 2017-03-27 11:37:17 -04:00
Evan Cordell
21d969d309 Refactor tests, no g required 2017-03-27 11:37:17 -04:00
Evan Cordell
43dd974dca Determine which TUF root to show based on actual access, not requested 
access
 2017-03-27 11:37:17 -04:00
Antoine Legrand
d2ed37e158 Fix force push causing duplicated entries 2017-03-27 15:39:57 +02:00
Joseph Schorr
e509eb4cba Better custom cert handling in the superuser tool 
We now only allow certificates ending in .crt to be uploaded and we automatically install the certificate once it has been validated
 2017-03-24 17:15:26 -04:00
Antoine Legrand
35bebf9e99 Use 401 for bad or missing credentials, 403 for forbidden access 2017-03-24 18:46:13 +01:00
Joseph Schorr
94c5eca286 Add CNR API auth tests for public repos 2017-03-23 21:19:56 -04:00
Jimmy Zelinskie
0ce68706ee Merge pull request #2465 from coreos-inc/force_push 
Allow force push for app
 2017-03-23 21:05:08 -04:00
Antoine Legrand
16f2479a96 test: push twice same blob from different package 2017-03-24 00:39:04 +01:00
Antoine Legrand
bbd74eabd1 Allow force push for app 2017-03-23 22:50:07 +01:00
Joseph Schorr
ac4a79ae01 Update PR for rebase 2017-03-23 15:57:49 -04:00
Joseph Schorr
95e1cf6673 Make V2 login errors more descriptive 
If login fails, we now call validate again to get the reason for the failure, and then surface it to the user of the CLI. This allows for more actionable responses, such as:

$ docker login 10.0.2.2:5000
Username (devtable): devtable
Password:

Error response from daemon: Get http://10.0.2.2:5000/v2/: unauthorized: Client login with unencrypted passwords is disabled. Please generate an encrypted password in the user admin panel for use here.
 2017-03-23 15:42:45 -04:00
Joseph Schorr
651666b60b Refactor our auth handling code to be cleaner 
Breaks out the validation code from the auth context modification calls, makes decorators easier to define and adds testing for each individual piece. Will be the basis of better error messaging in the following change.
 2017-03-23 15:42:45 -04:00
Joseph Schorr
1bd4422da9 Move auth decorators into a decorators module 
The non-decorators will be broken out in the followup change
 2017-03-23 15:42:45 -04:00
Joseph Schorr
abf179eb09 Move fixtures under test, since they are shared globally 2017-03-23 15:42:45 -04:00
Joseph Schorr
c9a5ce6701 Start validating login in CNR 
Fixes https://www.pivotaltracker.com/story/show/142342305
 2017-03-23 15:07:46 -04:00
Joseph Schorr
ef4569f2c5 Add very basic security tests for CNR APIs 2017-03-23 13:14:12 -04:00
Joseph Schorr
b765836cfd Make sure blobs in CNR are auth checked 2017-03-23 12:41:56 -04:00
Jimmy Zelinskie
77d2b9b290 endpoints.appr.test: mark failing db restore test 
This test should fail as long as the CNR tests use 'v1' in the
mediatype.
 2017-03-23 11:24:15 -04:00
Joseph Schorr
35b500aa2a Fix test override 2017-03-23 11:17:05 -04:00
Joseph Schorr
e7d7849937 Make sure channels and releases match the tag regex 2017-03-23 00:55:36 -04:00
Joseph Schorr
3277fe9b4e Make sure repository names in APPR match regex 2017-03-23 00:51:54 -04:00
Joseph Schorr
1145651b7a Work towards fixing tests 2017-03-23 00:37:39 -04:00
Joseph Schorr
069208f2f1 Break out repo kind checking into its own decorator 
We then use that decorator both in the API and in the permissions check decorator
 2017-03-23 00:01:37 -04:00
Joseph Schorr
4c34b00b38 Prevent CNR methods from auth-ing on non-app repos 2017-03-22 23:56:34 -04:00
Jimmy Zelinskie
3d0e63d8e5 endpoints.appr.decorators: isolate appr decorators 2017-03-22 23:53:03 -04:00
Jimmy Zelinskie
6dfd1ef660 endpoints.appr.test: include CNR fixtures 2017-03-22 23:42:19 -04:00
Jimmy Zelinskie
82bcd45727 endpoints: clarify repo access decorators 2017-03-22 23:41:38 -04:00
Jimmy Zelinskie
cafde81322 endpoints.appr.test: init 2017-03-22 22:57:22 -04:00
Jimmy Zelinskie
102c671587 endpoints.appr: init 2017-03-22 22:57:21 -04:00
Jimmy Zelinskie
3ccf3c5f33 Merge pull request #2447 from jzelinskie/cnr-step2 
CNR Step 2
 2017-03-22 18:45:51 -04:00
Joseph Schorr
df1e7f90e0 Add verb security tests and fix small issues 2017-03-22 18:29:53 -04:00
Jimmy Zelinskie
d5fa2ad0c0 endpoints.verbs: abort 405 for non-container repos 2017-03-22 17:50:58 -04:00
Joseph Schorr
dcb970b783 Add registry app repository failure test 2017-03-22 17:26:59 -04:00
Jimmy Zelinskie
ca7a0f14d8 endpoints.v1: return 405 for non-docker repos 2017-03-22 17:26:59 -04:00
Jimmy Zelinskie
48ba59d615 endpoints.v2: only work on docker repositories 2017-03-22 17:26:59 -04:00
Joseph Schorr
178373293d Disable web endpoints for app repos 2017-03-22 15:51:19 -04:00
Joseph Schorr
54efed62ee Make sure start_build cannot be called for app repos 2017-03-22 15:51:19 -04:00
Joseph Schorr
30b532254c Disallow non-apps-supported APIs for application repositories 2017-03-22 15:51:19 -04:00
Jimmy Zelinskie
a2bac7dabd endpoints.v1: only work on docker repositories 2017-03-22 14:31:22 -04:00
Joseph Schorr
ff7f78e990 Have blob uploads be checked against configurable max layer size 2017-03-21 13:16:55 -04:00
Joseph Schorr
239b6d7cf8 Make LayerTooLarge error more informative 2017-03-21 13:14:11 -04:00
Joseph Schorr
dd7f254f96 Have blob uploads be checked against configurable max layer size 2017-03-21 13:14:11 -04:00
josephschorr
4bee4dbfff Merge pull request #2443 from coreos-inc/build-webhook-tests 
Add tests for build web hooks endpoint
 2017-03-20 16:26:57 -04:00
Joseph Schorr
8bbe0e5e9b Always allow robot accounts to be selected by admins in trigger setup 
Currently during trigger setup, if we don't know for sure that a robot account is necessary, we don't show the option to select one. This fails if the user has a Dockerfile in a branch or tag with a private base image *or* they *intend* to add a private base image once the trigger is setup. Following this change, we always show the option to select a robot account, even if it isn't determined to be strictly necessary.
 2017-03-20 13:24:55 -04:00
Joseph Schorr
6f567e0850 Add tests for build web hooks endpoint 2017-03-20 13:22:59 -04:00
Joseph Schorr
cfb81c977f Add UI for editing labels on a manifest 2017-03-14 11:34:43 -04:00
Joseph Schorr
69e476b1f4 Fix param regex for path params with complex filters 2017-03-14 11:34:43 -04:00
Joseph Schorr
e90cab4d77 Change revert tag into restore tag and add manifest support 2017-03-14 11:34:42 -04:00
Joseph Schorr
af743b156b Show manifest digests in place of V1 ids in the tag view when possible 2017-03-14 11:34:41 -04:00
josephschorr
432b2d3fe8 Merge pull request #2392 from coreos-inc/search-optimization 
Optimize repository search by changing our lookup strategy
 2017-03-10 15:44:26 -05:00
Joseph Schorr
d42ec4e585 Abstract out constant scores into constants 2017-03-10 14:06:39 -05:00
Joseph Schorr
3813d0d23d Add tests for all notification event calls 2017-03-10 11:26:12 -05:00
Joseph Schorr
48db77b521 Fix bug in QSS notifications 2017-03-10 11:25:55 -05:00
Joseph Schorr
b5bb76cdea Optimize repository search by changing our lookup strategy 
Previous to this change, repositories were looked up unfiltered in six different queries, and then filtered using the permissions model, which issued a query per repository found, making search incredibly slow. Instead, we now lookup a chunk of repositories unfiltered and then filter them via a single query to the database. By layering the filtering on top of the lookup, each as queries, we can minimize the number of queries necessary, without (at the same time) using a super expensive join.

Other changes:
- Remove the 5 page pre-lookup on V1 search and simply return that there is one more page available, until there isn't. While technically not correct, it is much more efficient, and no one should be using pagination with V1 search anyway.
- Remove the lookup for repos without entries in the RAC table. Instead, we now add a new RAC entry when the repository is created for *the day before*, with count 0, so that it is immediately searchable
- Remove lookup of results with a matching namespace; these aren't very relevant anyway, and it overly complicates sorting
 2017-03-09 19:47:55 -05:00
Jimmy Zelinskie
850c32ebfb Merge pull request #2298 from jzelinskie/maintainers 
MAINTAINERS: init owners to subpkgs
 2017-03-09 17:30:38 -05:00
Joseph Schorr
0ab6388e30 Add support for null ref, as that can be the value if a default branch is not chosen 2017-03-07 20:39:42 -05:00
josephschorr
aa2f88d321 Merge pull request #2337 from coreos-inc/new-trigger-ux 
Implement new create and manager trigger UI
 2017-03-02 18:15:32 -05:00
Joseph Schorr
9e6c368f7a Make QSS multiple notification messaging nicer 2017-03-01 16:11:11 -05:00
Joseph Schorr
eff1827d9d Batch QSS notifications after initial scan 2017-03-01 15:42:49 -05:00
Joseph Schorr
8e863b8cf5 Implement new create and manager trigger UI 
Implements the new trigger setup user interface, which is now a linear workflow found on its own page, rather than a tiny modal dialog

Fixes #1187
 2017-02-28 16:51:42 -05:00
Charlton Austin
59d6cf8a86 Merge pull request #2376 from charltonaustin/quay_jwts_indicate_which_root_a_user_should_see_137968801 
Adding in what metadata_root_name to JWT
 2017-02-23 17:10:21 -05:00
Charlton Austin
e87404c327 Adding in what metadata_root_name to JWT 2017-02-22 16:59:19 -05:00
Joseph Schorr
3f1d394e14 Catch IOErrors when starting builds 
Fixes https://sentry.io/coreos/backend-production/issues/207144068/
 2017-02-22 13:20:04 -05:00
Joseph Schorr
9db20ff961 Catch SSL errors due to timeouts in Github calls 
Fixes https://sentry.io/coreos/backend-production/issues/219378902/
 2017-02-22 13:20:04 -05:00
Joseph Schorr
89b7c13da5 Catch team member invite missing exception 
Fixes https://sentry.io/coreos/backend-production/issues/195926082/
 2017-02-22 13:18:22 -05:00
Joseph Schorr
a319c55616 Don't make permissions request in search for public callers 
They are unnecessary, so we can skip them
 2017-02-17 12:22:21 -05:00
Joseph Schorr
198bdf88bc Move OAuth login into its own endpoints module 2017-02-16 16:27:54 -05:00
Joseph Schorr
0167e1e7bf Style fixes 2017-02-16 16:27:54 -05:00
Joseph Schorr
d47696b69c Add support for sub binding field 2017-02-16 16:27:53 -05:00
Joseph Schorr
7b386e9d63 Move endpoint test fixtures to a non-conftest file 2017-02-16 16:27:53 -05:00
Joseph Schorr
2c35383724 Allow OAuth and OIDC login engines to bind to fields in internal auth 
This feature is subtle but very important: Currently, when a user logs in via an "external" auth system (such as Github), they are either logged into an existing bound account or a new account is created for them in the database. While this normally works jut fine, it hits a roadblock when the *internal* auth system configured is not the database, but instead something like LDAP. In that case, *most* Enterprise customers will prefer that logging in via external auth (like OIDC) will also *automatically* bind the newly created account to the backing *internal* auth account. For example, login via PingFederate OIDC (backed by LDAP) should also bind the new QE account to the associated LDAP account, via either username or email. This change allows for this binding field to be specified, and thereafter will perform the proper lookups and bindings.
 2017-02-16 16:27:53 -05:00
Joseph Schorr
c6b0376d61 Remove unnecessary email generation in OAuth login 
Handled by the `emaIl_required` flag already
 2017-02-16 16:27:53 -05:00
Joseph Schorr
92c0b5ac3e Fix handling of None queries 2017-02-16 15:26:45 -05:00