#4240 API: ACLs for the pull request operations are only for project tokens
Closed: Fixed 5 years ago by pingou. Opened 5 years ago by lenkaseg.

Expected

Open a pull request via API with user token (when pull requests are allowed for that project)

Actual behavior

APIError: Invalid or expired token. Please visit http://localhost:5000/settings#api-keys to get or renew your API token.

It seems there is no ACL support for user tokens while opening pull requests.
This is what I get with git grep api_login_required

pagure/api/__init__.py:def api_login_required(acls=None):
pagure/api/fork.py:    api_login_required,
pagure/api/fork.py:@api_login_required(acls=["pull_request_merge"])
pagure/api/fork.py:@api_login_required(acls=["pull_request_rebase"])
pagure/api/fork.py:@api_login_required(acls=["pull_request_close"])
pagure/api/fork.py:@api_login_required(acls=["pull_request_comment"])
pagure/api/fork.py:@api_login_required(acls=["pull_request_flag"])
pagure/api/fork.py:@api_login_required(acls=["pull_request_subscribe"])
pagure/api/fork.py:@api_login_required(acls=["pull_request_create"])
pagure/api/issue.py:    api_login_required,
pagure/api/issue.py:@api_login_required(acls=["issue_create"])
pagure/api/issue.py:@api_login_required(acls=["issue_change_status", "issue_update"])
pagure/api/issue.py:@api_login_required(acls=["issue_update_milestone", "issue_update"])
pagure/api/issue.py:@api_login_required(acls=["issue_comment", "issue_update"])
pagure/api/issue.py:@api_login_required(acls=["issue_assign", "issue_update"])
pagure/api/issue.py:@api_login_required(acls=["issue_subscribe"])
pagure/api/issue.py:@api_login_required(acls=["issue_update_custom_fields", "issue_update"])
pagure/api/issue.py:@api_login_required(acls=["issue_update_custom_fields", "issue_update"])
pagure/api/project.py:    api_login_required,
pagure/api/project.py:@api_login_required(acls=["create_project"])
pagure/api/project.py:@api_login_required(acls=["modify_project"])
pagure/api/project.py:@api_login_required(acls=["fork_project"])
pagure/api/project.py:@api_login_required(acls=["generate_acls_project"])
pagure/api/project.py:@api_login_required(acls=["create_branch"])
pagure/api/project.py:@api_login_required(acls=["commit_flag"])
pagure/api/project.py:@api_login_required(acls=["update_watch_status"])
pagure/api/project.py:@api_login_required(acls=["modify_project"])
pagure/api/project.py:@api_login_required(acls=["modify_project"])
pagure/api/project.py:@api_login_required(acls=["modify_project"])

On the web it's possible to open a pull request for a project where PRs are allowed for any user. I think the same should be enabled for the API way: the user API token (when valid) should enable the user to open PR (if PRs allowed and if project is visible).


Metadata Update from @pingou:
- Issue tagged with: RFE

5 years ago

With packit (@ttomecek) and the-new-hotness now using the API to create PRs to projects in src.fedoraproject.org it will be nice to make this working.

@zlopez it was already fixed actually, it's just a change in the configuration.

You can access https://src.fedoraproject.org/settings/token/new and create API token to create or modify a PR against any project.

I'm going to close this ticket as fixed since it is :)

Metadata Update from @pingou:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

5 years ago

Is this also fixed on stg.src.fp.o, because this is where I testing it and it didn't work last week.

@zlopez I'm seeing the same ACLs there (I believe src.stg was fixed way earlier than src.fp.o because of the freeze)

@pingou
Maybe this is different issue, I'm getting Pull-Request have been deactivated for this project. However there isn't any issue if I want to create it manually.

Here is the whole request and response from vcr:

- request:
    body: title=Update+to+0.0.24&branch_to=master&branch_from=master&initial_comment=This+pull+request+was+automatically+generated+by+the-new-hotness+for+0ad+to+update+it+to+version+0.0.24
    headers:
      Accept:
      - '*/*'
      Accept-Encoding:
      - gzip, deflate
      Authorization:
      - token LD7DLW5U3CIF8MHAD51QPNT934XM44WMKNTT2UMH6JXV34259WOV9BEEV4V2PWGY
      Connection:
      - keep-alive
      Content-Length:
      - '178'
      Content-Type:
      - application/x-www-form-urlencoded
      Cookie:
      - disgit_pagure=eyJfcGVybWFuZW50Ijp0cnVlLCJjc3JmIjp7IiBiIjoiWlRnek56a3pNbVEwWW1JellUZzBZV1UxTkRCaU56QmxNRE5oTWpRMU5USmpaV0ZrWldaa1pRPT0ifX0.D4zdDQ.ViJ3TrXc6P0NwlrZH4eUHz2JuNQ
      User-Agent:
      - python-requests/2.21.0
    method: POST
    uri: https://src.stg.fedoraproject.org//api/0/fork/zlopez/rpms/0ad/pull-request/new
  response:
    body:
      string: "{\n  \"error\": \"Pull-Request have been deactivated for this project\"\
        ,\n  \"error_code\": \"EPULLREQUESTSDISABLED\"\n}"
    headers:
      AppServer:
      - proxy01.stg.phx2.fedoraproject.org
      AppTime:
      - D=139929
      Connection:
      - Keep-Alive
      Content-Length:
      - '109'
      Content-Type:
      - application/json
      Date:
      - Mon, 08 Apr 2019 13:24:29 GMT
      Keep-Alive:
      - timeout=15, max=498
      Referrer-Policy:
      - same-origin
      Server:
      - Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips mod_auth_gssapi/1.5.1
        mod_wsgi/3.4 Python/2.7.5
      Set-Cookie:
      - disgit_pagure=eyJfcGVybWFuZW50Ijp0cnVlLCJjc3JmIjp7IiBiIjoiWlRnek56a3pNbVEwWW1JellUZzBZV1UxTkRCaU56QmxNRE5oTWpRMU5USmpaV0ZrWldaa1pRPT0ifX0.D4zdDQ.ViJ3TrXc6P0NwlrZH4eUHz2JuNQ;
        Expires=Thu, 09-May-2019 13:24:29 GMT; Secure; HttpOnly; Path=/
      Strict-Transport-Security:
      - max-age=31536000; includeSubDomains; preload
      X-Content-Type-Options:
      - nosniff
      X-Frame-Options:
      - SAMEORIGIN
      X-Xss-Protection:
      - 1; mode=block
    status:
      code: 404
      message: NOT FOUND
version: 1

It's a different issue. Your fork does not support PR (they are deactivated), so its new-PR endpoint blocks you and this is one place where the current API is not sufficient :(

Should I create a new issue for this?

Login to comment on this ticket.

Metadata