canned-prompts/service/migrations/versions/0002_namespace_claims.py

40 lines
1.3 KiB
Python
Raw Normal View History

CANP-WP-0006 T04: publish API POST /packages takes {registry, source, files}, where files is the same shape GET /archives returns — so an archive round-trips into a publish without translation and a mirror is a GET followed by a POST. A test verifies the round-trip by digest rather than asserting it. Validation is the reference implementation's, applied to the posted files materialized in a temporary directory. Only reserved paths and manifest-referenced files are stored (section 2), path traversal is refused, identical re-publishes are accepted, and different content under the same id@version is 409 (section 17). The identity mechanism, stated plainly rather than implied: a single shared bearer token proving the caller is the operator of this service. It is not per-publisher identity — every token holder is indistinguishable — and auth.py says so where someone might otherwise assume more. With no token configured the service is read-only. That is the correct default rather than an inconvenience: section 20.1 asks a registry to refuse publication into a closed namespace it does not consider the publisher to own, and an unauthenticated service considers nobody to own anything. Namespace claims live in namespace_claims (migration 0002) and are enforced here, which a filesystem registry cannot do at all — but only as precisely as the identity allows. A closed namespace is protected from anonymous callers; it cannot be attributed among several publishers. Per-publisher identity is deferred and is the main thing between this and a registry several people can publish to. Migration hygiene found while adding 0002: autogenerate proposed an ALTER COLUMN TYPE on package_files.package_version_id, because the foreign key's type was left to inference and compared as a variant against a reflected plain type. SQLite cannot alter a column type, so 0002 failed halfway — table created, revision unstamped, the partially-applied state that is worst to debug later. Fixed at the cause: the column is typed explicitly, and 0001 was corrected rather than patched over, which is legitimate only because it has never run outside this repo's tests. alembic check now reports no drift. Health tests now compute the expected migration head from the script directory instead of hardcoding it, so adding a migration cannot fail them spuriously. Service tests 22 -> 33; reference unaffected at 99. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM Assistant: claude-code Assistant-Model: opus Assistant-Process: 388925@bnt-lap001 Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502
2026-09-06 20:30:00 +02:00
"""namespace claims
Registry namespace ownership (section 20.1). Descriptive on a filesystem
registry, which cannot authenticate a publisher; enforced here, which can
though only as strongly as the identity behind it.
Revision ID: 0002
Revises: 0001
"""
from alembic import op
import sqlalchemy as sa
BigIntPK = sa.BigInteger().with_variant(sa.Integer, "sqlite")
revision = '0002'
down_revision = '0001'
branch_labels = None
depends_on = None
def upgrade() -> None:
# ### commands auto generated by Alembic - please adjust! ###
op.create_table('namespace_claims',
sa.Column('id', sa.BigInteger().with_variant(sa.Integer(), 'sqlite'), autoincrement=True, nullable=False),
sa.Column('tenant', sa.String(length=64), nullable=False),
sa.Column('registry', sa.String(length=128), nullable=False),
sa.Column('namespace', sa.String(length=256), nullable=False),
sa.Column('policy', sa.String(length=16), nullable=False),
sa.Column('owner', sa.String(length=256), nullable=True),
sa.PrimaryKeyConstraint('id'),
sa.UniqueConstraint('tenant', 'registry', 'namespace', name='uq_namespace_claim')
)
# ### end Alembic commands ###
def downgrade() -> None:
# ### commands auto generated by Alembic - please adjust! ###
op.drop_table('namespace_claims')
# ### end Alembic commands ###