diff --git a/.github/workflows/security_checks.yml b/.github/workflows/security_checks.yml index 26e914ec..5726a60c 100644 --- a/.github/workflows/security_checks.yml +++ b/.github/workflows/security_checks.yml @@ -18,8 +18,9 @@ jobs: - uses: fortran-lang/setup-fpm@v5 with: - fpm-version: 'v0.10.1' - github-token: ${{ secrets.GITHUB_TOKEN }} + fpm-version: 'v0.10.2' + github-token: ${{ secrets.GITHUB_TOKEN }} + fpm-repository: https://github.com/henilp105/fpm - name: Setup Python uses: actions/setup-python@v5 diff --git a/backend/models/namespace.py b/backend/models/namespace.py index 55677531..95c22da3 100644 --- a/backend/models/namespace.py +++ b/backend/models/namespace.py @@ -9,7 +9,7 @@ def __init__(self, namespace, description, author, maintainers=[], admins=[], pa self.author = author self.maintainers = maintainers self.admins = admins - self.packages = [] + self.packages = packages # Create a to_json method. def to_json(self): diff --git a/backend/namespaces.py b/backend/namespaces.py index 736c5856..01040160 100644 --- a/backend/namespaces.py +++ b/backend/namespaces.py @@ -171,7 +171,7 @@ def namespace_packages(namespace): "name": 1, "description": 1, "author": 1, - "updatedAt": 1, + "updated_at": 1, }, ) @@ -185,7 +185,7 @@ def namespace_packages(namespace): "name": package["name"], "description": package["description"], "author": author_obj.username, - "updatedAt": package["updatedAt"], + "updated_at": package["updated_at"], }) return ( @@ -201,20 +201,7 @@ def namespace_packages(namespace): @app.route("/namespaces//admins", methods=["POST"]) @swag_from("documentation/get_namespace_admins.yaml", methods=["POST"]) -@jwt_required() def namespace_admins(namespace): - uuid = get_jwt_identity() - - if not uuid: - return jsonify({"code": 401, "message": "Unauthorized"}), 401 - - user = db.users.find_one({"uuid": uuid}) - - if not user: - return jsonify({"code": 404, "message": "User not found"}), 404 - - user_obj = User.from_json(user) - namespace_doc = db.namespaces.find_one({"namespace": namespace}) if not namespace_doc: @@ -222,9 +209,6 @@ def namespace_admins(namespace): namespace_obj = Namespace.from_json(namespace_doc) - if not user_obj.id in namespace_obj.admins and not user_obj.id in namespace_obj.maintainers: - return jsonify({"code": 401, "message": "Unauthorized"}), 401 - admins = [] for i in namespace_obj.admins: @@ -239,17 +223,7 @@ def namespace_admins(namespace): @app.route("/namespaces//maintainers", methods=["POST"]) @swag_from("documentation/get_namespace_maintainers.yaml", methods=["POST"]) -@jwt_required() def namespace_maintainers(namespace): - uuid = get_jwt_identity() - - if not uuid: - return jsonify({"code": 401, "message": "Unauthorized"}), 401 - - user = db.users.find_one({"uuid": uuid}) - - if not user: - return jsonify({"code": 404, "message": "User not found"}), 404 namespace_doc = db.namespaces.find_one({"namespace": namespace}) @@ -257,10 +231,6 @@ def namespace_maintainers(namespace): return jsonify({"code": 404, "message": "Namespace not found"}), 404 namespace_obj = Namespace.from_json(namespace_doc) - user_obj = User.from_json(user) - - if not user_obj.id in namespace_obj.admins and not user_obj.id in namespace_obj.maintainers: - return jsonify({"code": 401, "message": "Unauthorized"}), 401 maintainers = [] diff --git a/backend/packages.py b/backend/packages.py index 9e4cd0f3..db16aff3 100644 --- a/backend/packages.py +++ b/backend/packages.py @@ -837,18 +837,9 @@ def create_token_upload_token_package(namespace_name, package_name): ) -@app.route("/packages///maintainers", methods=["GET"]) -@swag_from("documentation/package_maintainers.yaml", methods=["GET"]) -@jwt_required() +@app.route("/packages///maintainers", methods=["GET","POST"]) +@swag_from("documentation/package_maintainers.yaml", methods=["GET","POST"]) def package_maintainers(namespace, package): - uuid = get_jwt_identity() - - user = db.users.find_one({"uuid": uuid}) - - if not user: - return jsonify({"code": 401, "message": "Unauthorized"}), 401 - - user_obj = User.from_json(user) namespace_doc = db.namespaces.find_one({"namespace": namespace}) diff --git a/backend/requirements.txt b/backend/requirements.txt index b2a9c814..2cc7dbdc 100755 --- a/backend/requirements.txt +++ b/backend/requirements.txt @@ -10,4 +10,5 @@ semantic-version docker toml flask-jwt-extended -numpy \ No newline at end of file +numpy +markdown \ No newline at end of file diff --git a/backend/user.py b/backend/user.py index 4bf7e027..85d6fb9c 100644 --- a/backend/user.py +++ b/backend/user.py @@ -76,7 +76,7 @@ def profile(username): "name": package_doc["name"], "namespace": namespace["namespace"], "description": package_doc["description"], - "updatedAt": package_doc["updated_at"], + "updated_at": package_doc["updated_at"], "isNamespaceMaintainer": isNamespaceMaintainer, "isNamespaceAdmin": isNamespaceAdmin, "isPackageMaintainer": isPackageMaintainer, @@ -119,7 +119,7 @@ def profile(username): "name": package["name"], "namespace": namespace["namespace"], "description": package["description"], - "updatedAt": package["updated_at"], + "updated_at": package["updated_at"], "isNamespaceMaintainer": isNamespaceMaintainer, "isPackageMaintainer": isPackageMaintainer, } @@ -149,8 +149,9 @@ def profile(username): @app.route("/users/delete", methods=["POST"]) @swag_from("documentation/delete_user.yaml", methods=["POST"]) +@jwt_required() def delete_user(): - uuid = request.form.get("uuid") + uuid = get_jwt_identity() username = request.form.get("username") if not uuid: @@ -173,8 +174,9 @@ def delete_user(): @app.route("/users/account", methods=["POST"]) @swag_from("documentation/get_user_account.yaml", methods=["POST"]) +@jwt_required() def account(): - uuid = request.form.get("uuid") + uuid = get_jwt_identity() if not uuid: return jsonify({"message": "Unauthorized", "code": 401}), 401 else: @@ -263,8 +265,9 @@ def transfer_account(): @app.route("//maintainer", methods=["POST"]) @swag_from("documentation/add_package_maintainer.yaml", methods=["POST"]) +@jwt_required() def add_maintainers_to_package(username): - uuid = request.form.get("uuid") + uuid = get_jwt_identity() username_to_be_added = request.form.get("username") package = request.form.get("package") namespace = request.form.get("namespace") @@ -344,8 +347,9 @@ def add_maintainers_to_package(username): @app.route("//maintainer/remove", methods=["POST"]) @swag_from("documentation/remove_package_maintainer.yaml", methods=["POST"]) +@jwt_required() def remove_maintainers_from_package(username): - uuid = request.form.get("uuid") + uuid = get_jwt_identity() username_to_be_removed = request.form.get("username") package = request.form.get("package") namespace = request.form.get("namespace") @@ -430,8 +434,9 @@ def remove_maintainers_from_package(username): @app.route("//namespace/maintainer", methods=["POST"]) @swag_from("documentation/add_namespace_maintainer.yaml", methods=["POST"]) +@jwt_required() def add_maintainers_to_namespace(username): - uuid = request.form.get("uuid") + uuid = get_jwt_identity() username_to_be_added = request.form.get("username") namespace = request.form.get("namespace") @@ -499,8 +504,9 @@ def add_maintainers_to_namespace(username): @app.route("//namespace/maintainer/remove", methods=["POST"]) @swag_from("documentation/remove_namespace_maintainer.yaml", methods=["POST"]) +@jwt_required() def remove_maintainers_from_namespace(username): - uuid = request.form.get("uuid") + uuid = get_jwt_identity() username_to_be_removed = request.form.get("username") namespace = request.form.get("namespace") @@ -575,8 +581,9 @@ def remove_maintainers_from_namespace(username): @app.route("//namespace/admin", methods=["POST"]) @swag_from("documentation/add_namespace_admin.yaml", methods=["POST"]) +@jwt_required() def add_admins_to_namespace(username): - uuid = request.form.get("uuid") + uuid = get_jwt_identity() username_to_be_added = request.form.get("username") namespace = request.form.get("namespace") @@ -639,8 +646,9 @@ def add_admins_to_namespace(username): @app.route("//namespace/admin/remove", methods=["POST"]) @swag_from("documentation/remove_namespace_admin.yaml", methods=["POST"]) +@jwt_required() def remove_admins_from_namespace(username): - uuid = request.form.get("uuid") + uuid = get_jwt_identity() username_to_be_removed = request.form.get("username") namespace = request.form.get("namespace") diff --git a/backend/validate.py b/backend/validate.py index 194adccb..9dc08ef6 100755 --- a/backend/validate.py +++ b/backend/validate.py @@ -1,6 +1,7 @@ from app import app import subprocess import toml +import html from mongo import db from mongo import file_storage from bson.objectid import ObjectId @@ -8,6 +9,7 @@ import toml from check_digests import check_digests from typing import Union,List, Tuple, Dict, Any +import markdown def run_command(command: str) -> Union[str, None]: @@ -82,6 +84,13 @@ def process_package(packagename: str) -> Tuple[bool, Union[dict, None], str]: cleanup_command = f'rm -rf static/temp/{packagename} static/temp/{packagename}.tar.gz' # run_command(cleanup_command) print(result) + + if 'description' in parsed_toml and parsed_toml['description'] == "README.md": + try: + with open(f'static/temp/{packagename}/README.md', 'r') as file: + parsed_toml['description'] = markdown.markdown(file.read()) # Sanitize HTML content + except: + parsed_toml['description'] = "README.md not found." if result[0]==-1: # Package verification failed diff --git a/frontend/src/components/packageItem.js b/frontend/src/components/packageItem.js index 554cc7e7..bd3c619a 100644 --- a/frontend/src/components/packageItem.js +++ b/frontend/src/components/packageItem.js @@ -55,7 +55,12 @@ const PackageItem = ({ packageEntity }) => {
- Namespace {packageEntity.namespace} + + Namespace {packageEntity.namespace} +