Skip to content

Commit 8fe83cc

Browse files
Turbo87Turbo87
committed
version::yank: Use token scope restrictions
1 parent ebbdd35 commit 8fe83cc

8 files changed

+684
-1
lines changed

‎src/controllers/version/yank.rs

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ use swirl::Job;
55

66
use super::{extract_crate_name_and_semver, version_and_crate};
77
use crate::controllers::cargo_prelude::*;
8+
use crate::models::token::EndpointScope;
89
use crate::models::Rights;
910
use crate::models::{insert_version_owner_action, VersionAction};
1011
use crate::schema::versions;
@@ -32,9 +33,14 @@ pub fn unyank(req: &mut dyn RequestExt) -> EndpointResult {
3233
fn modify_yank(req: &mut dyn RequestExt, yanked: bool) -> EndpointResult {
3334
// FIXME: Should reject bad requests before authentication, but can't due to
3435
// lifetime issues with `req`.
35-
let auth = AuthCheck::default().check(req)?;
36+
3637
let (crate_name, semver) = extract_crate_name_and_semver(req)?;
3738

39+
let auth = AuthCheck::default()
40+
.with_endpoint_scope(EndpointScope::Yank)
41+
.for_crate(crate_name)
42+
.check(req)?;
43+
3844
let conn = req.db_write()?;
3945
let (version, krate) = version_and_crate(&conn, crate_name, semver)?;
4046
let api_token_id = auth.api_token_id();

‎src/tests/http-data/routes_crates_versions_yank_unyank_auth_token_user_with_correct_crate_scope.json

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
[
2+
{
3+
"request": {
4+
"uri": "http://alexcrichton-test.s3.amazonaws.com/crates/fyk/fyk-1.0.0.crate",
5+
"method": "PUT",
6+
"headers": [
7+
[
8+
"accept",
9+
"*/*"
10+
],
11+
[
12+
"accept-encoding",
13+
"gzip"
14+
],
15+
[
16+
"content-length",
17+
"35"
18+
],
19+
[
20+
"content-type",
21+
"application/gzip"
22+
]
23+
],
24+
"body": "H4sIAAAAAAAA/+3AAQEAAACCIP+vbkhQwKsBLq+17wAEAAA="
25+
},
26+
"response": {
27+
"status": 200,
28+
"headers": [],
29+
"body": ""
30+
}
31+
},
32+
{
33+
"request": {
34+
"uri": "http://alexcrichton-test.s3.amazonaws.com/3/f/fyk",
35+
"method": "PUT",
36+
"headers": [
37+
[
38+
"accept",
39+
"*/*"
40+
],
41+
[
42+
"accept-encoding",
43+
"gzip"
44+
],
45+
[
46+
"content-length",
47+
"157"
48+
],
49+
[
50+
"content-type",
51+
"text/plain"
52+
]
53+
],
54+
"body": "eyJuYW1lIjoiZnlrIiwidmVycyI6IjEuMC4wIiwiZGVwcyI6W10sImNrc3VtIjoiYWNiNTYwNGIxMjZhYzg5NGMxZWIxMWM0NTc1YmYyMDcyZmVhNjEyMzJhODg4ZTQ1Mzc3MGM3OWQ3ZWQ1NjQxOSIsImZlYXR1cmVzIjp7fSwieWFua2VkIjpmYWxzZSwibGlua3MiOm51bGx9Cg=="
55+
},
56+
"response": {
57+
"status": 200,
58+
"headers": [],
59+
"body": ""
60+
}
61+
},
62+
{
63+
"request": {
64+
"uri": "http://alexcrichton-test.s3.amazonaws.com/3/f/fyk",
65+
"method": "PUT",
66+
"headers": [
67+
[
68+
"accept",
69+
"*/*"
70+
],
71+
[
72+
"accept-encoding",
73+
"gzip"
74+
],
75+
[
76+
"content-length",
77+
"156"
78+
],
79+
[
80+
"content-type",
81+
"text/plain"
82+
]
83+
],
84+
"body": "eyJuYW1lIjoiZnlrIiwidmVycyI6IjEuMC4wIiwiZGVwcyI6W10sImNrc3VtIjoiYWNiNTYwNGIxMjZhYzg5NGMxZWIxMWM0NTc1YmYyMDcyZmVhNjEyMzJhODg4ZTQ1Mzc3MGM3OWQ3ZWQ1NjQxOSIsImZlYXR1cmVzIjp7fSwieWFua2VkIjp0cnVlLCJsaW5rcyI6bnVsbH0K"
85+
},
86+
"response": {
87+
"status": 200,
88+
"headers": [],
89+
"body": ""
90+
}
91+
},
92+
{
93+
"request": {
94+
"uri": "http://alexcrichton-test.s3.amazonaws.com/3/f/fyk",
95+
"method": "PUT",
96+
"headers": [
97+
[
98+
"accept",
99+
"*/*"
100+
],
101+
[
102+
"accept-encoding",
103+
"gzip"
104+
],
105+
[
106+
"content-length",
107+
"157"
108+
],
109+
[
110+
"content-type",
111+
"text/plain"
112+
]
113+
],
114+
"body": "eyJuYW1lIjoiZnlrIiwidmVycyI6IjEuMC4wIiwiZGVwcyI6W10sImNrc3VtIjoiYWNiNTYwNGIxMjZhYzg5NGMxZWIxMWM0NTc1YmYyMDcyZmVhNjEyMzJhODg4ZTQ1Mzc3MGM3OWQ3ZWQ1NjQxOSIsImZlYXR1cmVzIjp7fSwieWFua2VkIjpmYWxzZSwibGlua3MiOm51bGx9Cg=="
115+
},
116+
"response": {
117+
"status": 200,
118+
"headers": [],
119+
"body": ""
120+
}
121+
}
122+
]

‎src/tests/http-data/routes_crates_versions_yank_unyank_auth_token_user_with_correct_endpoint_scope.json

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
[
2+
{
3+
"request": {
4+
"uri": "http://alexcrichton-test.s3.amazonaws.com/crates/fyk/fyk-1.0.0.crate",
5+
"method": "PUT",
6+
"headers": [
7+
[
8+
"accept",
9+
"*/*"
10+
],
11+
[
12+
"accept-encoding",
13+
"gzip"
14+
],
15+
[
16+
"content-length",
17+
"35"
18+
],
19+
[
20+
"content-type",
21+
"application/gzip"
22+
]
23+
],
24+
"body": "H4sIAAAAAAAA/+3AAQEAAACCIP+vbkhQwKsBLq+17wAEAAA="
25+
},
26+
"response": {
27+
"status": 200,
28+
"headers": [],
29+
"body": ""
30+
}
31+
},
32+
{
33+
"request": {
34+
"uri": "http://alexcrichton-test.s3.amazonaws.com/3/f/fyk",
35+
"method": "PUT",
36+
"headers": [
37+
[
38+
"accept",
39+
"*/*"
40+
],
41+
[
42+
"accept-encoding",
43+
"gzip"
44+
],
45+
[
46+
"content-length",
47+
"157"
48+
],
49+
[
50+
"content-type",
51+
"text/plain"
52+
]
53+
],
54+
"body": "eyJuYW1lIjoiZnlrIiwidmVycyI6IjEuMC4wIiwiZGVwcyI6W10sImNrc3VtIjoiYWNiNTYwNGIxMjZhYzg5NGMxZWIxMWM0NTc1YmYyMDcyZmVhNjEyMzJhODg4ZTQ1Mzc3MGM3OWQ3ZWQ1NjQxOSIsImZlYXR1cmVzIjp7fSwieWFua2VkIjpmYWxzZSwibGlua3MiOm51bGx9Cg=="
55+
},
56+
"response": {
57+
"status": 200,
58+
"headers": [],
59+
"body": ""
60+
}
61+
},
62+
{
63+
"request": {
64+
"uri": "http://alexcrichton-test.s3.amazonaws.com/3/f/fyk",
65+
"method": "PUT",
66+
"headers": [
67+
[
68+
"accept",
69+
"*/*"
70+
],
71+
[
72+
"accept-encoding",
73+
"gzip"
74+
],
75+
[
76+
"content-length",
77+
"156"
78+
],
79+
[
80+
"content-type",
81+
"text/plain"
82+
]
83+
],
84+
"body": "eyJuYW1lIjoiZnlrIiwidmVycyI6IjEuMC4wIiwiZGVwcyI6W10sImNrc3VtIjoiYWNiNTYwNGIxMjZhYzg5NGMxZWIxMWM0NTc1YmYyMDcyZmVhNjEyMzJhODg4ZTQ1Mzc3MGM3OWQ3ZWQ1NjQxOSIsImZlYXR1cmVzIjp7fSwieWFua2VkIjp0cnVlLCJsaW5rcyI6bnVsbH0K"
85+
},
86+
"response": {
87+
"status": 200,
88+
"headers": [],
89+
"body": ""
90+
}
91+
},
92+
{
93+
"request": {
94+
"uri": "http://alexcrichton-test.s3.amazonaws.com/3/f/fyk",
95+
"method": "PUT",
96+
"headers": [
97+
[
98+
"accept",
99+
"*/*"
100+
],
101+
[
102+
"accept-encoding",
103+
"gzip"
104+
],
105+
[
106+
"content-length",
107+
"157"
108+
],
109+
[
110+
"content-type",
111+
"text/plain"
112+
]
113+
],
114+
"body": "eyJuYW1lIjoiZnlrIiwidmVycyI6IjEuMC4wIiwiZGVwcyI6W10sImNrc3VtIjoiYWNiNTYwNGIxMjZhYzg5NGMxZWIxMWM0NTc1YmYyMDcyZmVhNjEyMzJhODg4ZTQ1Mzc3MGM3OWQ3ZWQ1NjQxOSIsImZlYXR1cmVzIjp7fSwieWFua2VkIjpmYWxzZSwibGlua3MiOm51bGx9Cg=="
115+
},
116+
"response": {
117+
"status": 200,
118+
"headers": [],
119+
"body": ""
120+
}
121+
}
122+
]

‎src/tests/http-data/routes_crates_versions_yank_unyank_auth_token_user_with_correct_wildcard_crate_scope.json

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
[
2+
{
3+
"request": {
4+
"uri": "http://alexcrichton-test.s3.amazonaws.com/crates/fyk/fyk-1.0.0.crate",
5+
"method": "PUT",
6+
"headers": [
7+
[
8+
"accept",
9+
"*/*"
10+
],
11+
[
12+
"accept-encoding",
13+
"gzip"
14+
],
15+
[
16+
"content-length",
17+
"35"
18+
],
19+
[
20+
"content-type",
21+
"application/gzip"
22+
]
23+
],
24+
"body": "H4sIAAAAAAAA/+3AAQEAAACCIP+vbkhQwKsBLq+17wAEAAA="
25+
},
26+
"response": {
27+
"status": 200,
28+
"headers": [],
29+
"body": ""
30+
}
31+
},
32+
{
33+
"request": {
34+
"uri": "http://alexcrichton-test.s3.amazonaws.com/3/f/fyk",
35+
"method": "PUT",
36+
"headers": [
37+
[
38+
"accept",
39+
"*/*"
40+
],
41+
[
42+
"accept-encoding",
43+
"gzip"
44+
],
45+
[
46+
"content-length",
47+
"157"
48+
],
49+
[
50+
"content-type",
51+
"text/plain"
52+
]
53+
],
54+
"body": "eyJuYW1lIjoiZnlrIiwidmVycyI6IjEuMC4wIiwiZGVwcyI6W10sImNrc3VtIjoiYWNiNTYwNGIxMjZhYzg5NGMxZWIxMWM0NTc1YmYyMDcyZmVhNjEyMzJhODg4ZTQ1Mzc3MGM3OWQ3ZWQ1NjQxOSIsImZlYXR1cmVzIjp7fSwieWFua2VkIjpmYWxzZSwibGlua3MiOm51bGx9Cg=="
55+
},
56+
"response": {
57+
"status": 200,
58+
"headers": [],
59+
"body": ""
60+
}
61+
},
62+
{
63+
"request": {
64+
"uri": "http://alexcrichton-test.s3.amazonaws.com/3/f/fyk",
65+
"method": "PUT",
66+
"headers": [
67+
[
68+
"accept",
69+
"*/*"
70+
],
71+
[
72+
"accept-encoding",
73+
"gzip"
74+
],
75+
[
76+
"content-length",
77+
"156"
78+
],
79+
[
80+
"content-type",
81+
"text/plain"
82+
]
83+
],
84+
"body": "eyJuYW1lIjoiZnlrIiwidmVycyI6IjEuMC4wIiwiZGVwcyI6W10sImNrc3VtIjoiYWNiNTYwNGIxMjZhYzg5NGMxZWIxMWM0NTc1YmYyMDcyZmVhNjEyMzJhODg4ZTQ1Mzc3MGM3OWQ3ZWQ1NjQxOSIsImZlYXR1cmVzIjp7fSwieWFua2VkIjp0cnVlLCJsaW5rcyI6bnVsbH0K"
85+
},
86+
"response": {
87+
"status": 200,
88+
"headers": [],
89+
"body": ""
90+
}
91+
},
92+
{
93+
"request": {
94+
"uri": "http://alexcrichton-test.s3.amazonaws.com/3/f/fyk",
95+
"method": "PUT",
96+
"headers": [
97+
[
98+
"accept",
99+
"*/*"
100+
],
101+
[
102+
"accept-encoding",
103+
"gzip"
104+
],
105+
[
106+
"content-length",
107+
"157"
108+
],
109+
[
110+
"content-type",
111+
"text/plain"
112+
]
113+
],
114+
"body": "eyJuYW1lIjoiZnlrIiwidmVycyI6IjEuMC4wIiwiZGVwcyI6W10sImNrc3VtIjoiYWNiNTYwNGIxMjZhYzg5NGMxZWIxMWM0NTc1YmYyMDcyZmVhNjEyMzJhODg4ZTQ1Mzc3MGM3OWQ3ZWQ1NjQxOSIsImZlYXR1cmVzIjp7fSwieWFua2VkIjpmYWxzZSwibGlua3MiOm51bGx9Cg=="
115+
},
116+
"response": {
117+
"status": 200,
118+
"headers": [],
119+
"body": ""
120+
}
121+
}
122+
]

0 commit comments

Comments
 (0)