-
Notifications
You must be signed in to change notification settings - Fork 44
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Handle users' permissions when pulling data via pull-through distributions #1659
Handle users' permissions when pulling data via pull-through distributions #1659
Conversation
275c623
to
b46d85d
Compare
CHANGES/1657.bugfix
Outdated
@@ -0,0 +1 @@ | |||
Disallowed anonymous users to pull new content via a pull-through caching distribution. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
can you add that anonymous users could still pull 'cached' content?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I did not read through the code, but how this scenario will be handled:
Anonymos user pulls content (from existing repo) but there is an updated content remotely? We should not be allowing this, because as a result of such operation a new repo version will be created and more bits will be pulled down into pulp
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Anonymos user pulls content (from existing repo) but there is an updated content remotely?
Good catch! I may want to introduce another check in
pulp_container/pulp_container/app/registry_api.py
Line 1031 in da8a70f
if distribution.remote and distribution.pull_through_distribution_id: |
pulp_container/pulp_container/app/registry.py
Line 132 in da8a70f
if distribution.remote_id and distribution.pull_through_distribution_id: |
can you add that anonymous users could still pull 'cached' content?
Is "new content" not explicit enough?
b46d85d
to
5742557
Compare
5742557
to
59939fb
Compare
I am still trying to figure out how to restrict the access to content-app for anonymous users. Checking the basic auth header is not enough. |
Actually, we do not need to restrict the access to content-app. Similarly, we do not pass a token to content-app and check the access scope. Everything is tested inside api-app. So, I am making this PR ready for review. |
4a02891
to
84b9f36
Compare
24a9188
to
67809ea
Compare
67809ea
to
78ca84c
Compare
9ea4125
to
dd6c2a4
Compare
dd6c2a4
to
5174376
Compare
2d37cc3
to
3ccfc8f
Compare
3ccfc8f
to
4e40f43
Compare
4e40f43
to
cdd5575
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I do not see anything out of the odinary.
Only looked at: "Enforce permission checks while pulling from pull-through distributions"
elif type(obj) is models.ContainerPushRepositoryVersion: | ||
for dist in obj.repository.distributions.all(): | ||
if request.user.has_perm(permission, dist.cast().namespace): | ||
return True |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
So this never triggered?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Correct. And we do not have such a model.
and distribution.pull_through_distribution_id | ||
and request.user.is_authenticated | ||
and distribution.pull_through_distribution | ||
and permission_checker.has_pull_through_permissions(distribution) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This (and a similar one below) is the core of the change, right?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, once we pass through the registry token steps and a user can access the particular endpoint, we should finally ensure that users without valid permissions cannot pull new content into a repository. But, they can still pull existing content.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This granularity cannot be achieved purely with token authentication. That is why I had to introduce this check.
When I was testing this change, I was receiving errors like: "Repository not found", but the remote repository was available. Then, I realized the error was because of the lack of authentication. for example:
Trying to pull from a private pull-through distribution, it returned:
instead of "repository not found". |
The idea is to not change the default behaviour. Once there is no such a repository existing in Pulp, we should return 404 in case an unauthorized user is trying to pull it. If the repository exists, and it is private, we should return 401 when the unauthorized user is accessing it. This whole workflow should be transparent to pull-through caching. I think more granular error handling is not needed in this case. |
closes #1657
closes #1623
closes #1624