Macaroon-based API keys

[woodruffw]

Based on dstufft#2.

TODO:

• Package-scoped tokens
• Unit tests

[woodruffw]

Thanks @moshez and @webknjaz! I'll be addressing your feedback, but could you hold off on providing more until the "[WIP]" is removed from the title? I'll be changing things pretty quickly, so I don't want to get caught in a review churn over code that isn't fully formed yet 😄

[di]

@webknjaz, did you see @woodruffw's request above?

I'll be addressing your feedback, but could you hold off on providing more until the "[WIP]" is removed from the title?

[woodruffw]

This should be ready for initial testing, for the adventurous.

Some quick notes:

• The UI is functional, but needs to be updated to conform to PyPI's design
• Our current auth-policy is drop-in compatible with Twine and distutils. When using a token, your "username" will be @token and your "password" will be the token itself

[brainwane]

Hope this helps!

[brainwane]

I am a maintainer of multiple projects: econ-ark and Forms990-analysis. I created an API token that was scoped to econ-ark and then tried to use it to upload a Forms990-analysis package, and got:
HTTPError: 403 Client Error: The user 'brainwane' isn't allowed to upload to project 'Forms990-analysis'. See http://localhost/help/#project-name for more information. for url: http://localhost/legacy/

This is not technically accurate -- this user account is allowed to upload to that project, but the token isn't. And maybe we don't want to leak the username in this error message. If we see that it's a token being used, can/should we change the error message in this case to something like "This token isn't allowed to upload to project 'name'"?

In the Docker logs, just for completeness: web_1 | [IP address] - @token [18/Jul/2019:01:03:01 +0000] "POST /legacy/ HTTP/1.1" 403 933 "-" "twine/1.13.0 pkginfo/1.5.0.1 requests/2.18.4 setuptools/41.0.1 requests-toolbelt/0.9.1 tqdm/4.32.2 CPython/3.7.3"

[woodruffw]

This is not technically accurate -- this user account is allowed to upload to that project, but the token isn't. And maybe we don't want to leak the username in this error message. If we see that it's a token being used, can/should we change the error message in this case to something like "This token isn't allowed to upload to project 'name'"?

Yep, this needs to be changed here:

https://github.com/pypa/warehouse/blob/0d9c726153394cf6aca178c9015c467707fbaa2e/warehouse/forklift/legacy.py#L944-L954

It might be difficult to parametrize the error message in this context, so I could replace "user" with "credential owned by user" -- thoughts?

Re: leaking the username: this check happens after an authorization check, so we already have a valid credential (just not one for this package). As such it isn't an infoleak per se (and might be useful to users doing complicated deployments, since their error messages will tell them which underlying user identity failed).