phoenix-integration

make user-defined network from db

implements custom filtering for user service

customized auth to work with phoenix

fixes bug in non-incognito browsers

creates user in h at moment of auth if it does not exist

canonical determination of authority

Create .gitlab-ci.yml

Add proxy prefix

Add hypothesis base url to assets

fetches user based on default authority, not hard-coded authority

hack to authenticate user a second time when building session

replaces request.authenticated_userid

client expects userid, not username

resolves root session issue in security policy, removes hack solution in session model

dynamically manages tosdr url via store for dev env (to-do : staging, prod)

adds tosdr base domain to client settings

removes print statement

fixes error that is interpreting every h request as api request

Update .gitlab-ci.yml

exposes es with a network

queries annotations in es based on strict uri

determines asset path based on env

forces username compliance for tosdr users created in h

Build stable image

relies on phoenix docker-compose for db, es

Author: michielbdejong

.gitlab-ci.yml

@@ -0,0 +1,36 @@
+# You can override the included template(s) by including variable overrides
+# SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
+# Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
+# Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
+# Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
+# Note that environment variables can be set in several places
+# See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
+
+stages:
+- publish
+
+
+docker-nightly:
+  stage: publish
+  image:
+    name: gcr.io/kaniko-project/executor:v1.9.0-debug
+    entrypoint:
+    - ''
+  script:
+  - /kaniko/executor --context "${CI_PROJECT_DIR}" --dockerfile "${CI_PROJECT_DIR}/Dockerfile"
+    --destination "${CI_REGISTRY_IMAGE}:nightly"
+  rules:
+  - if: $CI_COMMIT_BRANCH == "phoenix-integration"
+
+
+docker-prod:
+  stage: publish
+  image:
+    name: gcr.io/kaniko-project/executor:v1.9.0-debug
+    entrypoint:
+    - ''
+  script:
+  - /kaniko/executor --context "${CI_PROJECT_DIR}" --dockerfile "${CI_PROJECT_DIR}/Dockerfile"
+    --destination "${CI_REGISTRY_IMAGE}:${CI_COMMIT_TAG}" --destination "${CI_REGISTRY_IMAGE}:stable"
+  rules:
+  - if: $CI_COMMIT_TAG

conf/development.ini

@@ -13,6 +13,7 @@ h.bouncer_url: http://localhost:8000
 h.client_rpc_allowed_origins: http://localhost:8001 https://localhost:48001
 h.client_url: {current_scheme}://{current_host}:3001/hypothesis
 h.websocket_url: ws://localhost:5001/ws
+h.tosdr: http://localhost:9090
 
 h.debug: True
 h.reload_assets: True

conf/production.ini

@@ -8,6 +8,8 @@ use: call:h.app:create_app
 
 [filter:proxy-prefix]
 use: egg:PasteDeploy#prefix
+prefix = /hypothesis
+
 
 [loggers]
 keys = root, alembic, gunicorn.error, h

docker-compose.yml

@@ -1,25 +1,4 @@
 services:
-  postgres:
-    image: postgres:15.6-alpine
-    ports:
-      - '127.0.0.1:5432:5432'
-    healthcheck:
-        test: ["CMD", "pg_isready", "-U", "postgres"]
-        interval: 1s
-    environment:
-      POSTGRES_HOST_AUTH_METHOD: trust
-    networks:
-      - dbs
-  elasticsearch:
-    image: hypothesis/elasticsearch:latest
-    ports:
-      - '127.0.0.1:9200:9200'
-    healthcheck:
-        test: curl --fail --silent http://localhost:9200 >/dev/null
-        interval: 3s
-        start_period: 1m
-    environment:
-      - discovery.type=single-node
   rabbit:
     image: rabbitmq:3.12-management-alpine
     ports:
@@ -31,4 +10,9 @@ networks:
   # To avoid having unnecessary dependencies between the projects
   # the network is created with `docker network create dbs` in each project's Makefile (make services)
   dbs:
+    name: dbs
+    external: true
+  elasticsearch:
+    name: elasticsearch
     external: true
+  

h/assets.py

@@ -1,5 +1,6 @@
 """View for serving static assets under `/assets`."""
 
+import os
 import importlib_resources
 from h_assets import Environment, assets_view
 from pyramid.settings import asbool
@@ -9,8 +10,12 @@ def includeme(config):  # pragma: no cover
     auto_reload = asbool(config.registry.settings.get("h.reload_assets", False))
     h_files = importlib_resources.files("h")
 
+    asset_path = "/hypothesis/assets"
+    if "ASSET_PATH" in os.environ:
+        asset_path = os.environ["ASSET_PATH"]
+
     assets_env = Environment(
-        assets_base_url="/assets",
+        assets_base_url=asset_path,
         bundle_config_path=h_files / "assets.ini",
         manifest_path=h_files / "../build/manifest.json",
         auto_reload=auto_reload,

h/config.py

@@ -28,6 +28,7 @@ def configure(environ=None, settings=None):  # pylint: disable=too-many-statemen
         environ = os.environ
     if settings is None:  # pragma: no cover
         settings = {}
+
     settings_manager = SettingsManager(settings, environ)
     # Configuration for external components
     settings_manager.set("broker_url", "BROKER_URL")
@@ -88,6 +89,9 @@ def configure(environ=None, settings=None):  # pylint: disable=too-many-statemen
     # secret.
     settings_manager.set("h.client_oauth_id", "CLIENT_OAUTH_ID")
 
+    # Base domain for tosdr
+    settings_manager.set("h.tosdr", "TOSDR_URL")
+
     # The list of origins that the client will respond to cross-origin RPC
     # requests from.
     settings_manager.set(

h/search/query.py

@@ -268,14 +268,16 @@ def __call__(self, search, params):
             [u for u in wildcard_uris if wildcard_uri_is_valid(u)],
             normalize_method=self._wildcard_uri_normalized,
         )
+        strict_uri = uris[0]
         uris = self._normalize_uris(uris)
 
         queries = []
         if wildcard_uris:
             queries = [Q("wildcard", **{"target.scope": u}) for u in wildcard_uris]
         if uris:
             queries.append(Q("terms", **{"target.scope": uris}))
-        return search.query("bool", should=queries)
+        # TOSDR
+        return search.query(Q("bool", must=[Q("match", uri=strict_uri)]))
 
     def _normalize_uris(self, query_uris, normalize_method=uri.normalize):
         uris = set()

h/security/policy/combined.py

@@ -74,6 +74,7 @@ def _call_sub_policies(self, method, request, *args, **kwargs):
             return getattr(self._ui_policy, method)(request, *args, **kwargs)
 
         # Then we try the bearer header (or `access_token` GET param)
+
         result = getattr(self._bearer_token_policy, method)(request, *args, **kwargs)
 
         if not result and self._http_basic_auth_policy.handles(request):
@@ -87,7 +88,9 @@ def _call_sub_policies(self, method, request, *args, **kwargs):
 
     @staticmethod
     def _is_api_request(request):
-        return request.path.startswith("/api") and request.path not in [
+        return (request.path.startswith("/api") or request.path.startswith("/hypothesis/api")) and request.path not in [
             "/api/token",
             "/api/badge",
+            "/hypothesis/api/token",
+            "/hypothesis/api/badge"
         ]

h/services/user.py

@@ -1,4 +1,5 @@
 import sqlalchemy as sa
+from sqlalchemy.sql import text
 
 from h.models import User, UserIdentity
 from h.util.db import on_transaction_end
@@ -50,6 +51,7 @@ def fetch(self, userid_or_username, authority=None):
         :rtype: h.models.User or None
 
         """
+
         if authority is not None:
             username = userid_or_username
         else:
@@ -65,12 +67,19 @@ def fetch(self, userid_or_username, authority=None):
             self._cache[cache_key] = (
                 self.session.query(User)
                 .filter_by(username=username)
-                .filter_by(authority=authority)
+                # comment for tosdr
+                # .filter_by(authority=authority)
                 .one_or_none()
             )
 
         return self._cache[cache_key]
 
+    def fetch_from_tosdr(self, h_key):
+        statement = text("SELECT * FROM users WHERE h_key =:x")
+        statement = statement.bindparams(x=h_key)
+        user_tosdr = self.session.execute(statement).one_or_none()
+        return user_tosdr
+
     def fetch_all(self, userids):
         """
         Fetch a list of users by their userids.

h/session.py

@@ -31,10 +31,15 @@ def profile(request, authority=None):
         authority = user.authority
     else:
         authority = authority or request.default_authority
+    
+    userid = request.authenticated_userid
+
+    if not userid:
+        userid = user.userid
 
     return dict(
         {
-            "userid": request.authenticated_userid,
+            "userid": userid,
             "authority": authority,
             "groups": _current_groups(request, authority),
             "features": request.feature.all(),