scope basic auth to specific routes (#7186)

Author: ewdurbin

tests/unit/accounts/test_core.py

@@ -33,12 +33,23 @@
 
 
 class TestLogin:
+    def test_invalid_route(self, pyramid_request, pyramid_services):
+        service = pretend.stub(find_userid=pretend.call_recorder(lambda username: None))
+        pyramid_services.register_service(IUserService, None, service)
+        pyramid_services.register_service(
+            IPasswordBreachedService, None, pretend.stub()
+        )
+        pyramid_request.matched_route = pretend.stub(name="route_name")
+        assert accounts._basic_auth_login("myuser", "mypass", pyramid_request) is None
+        assert service.find_userid.calls == []
+
     def test_with_no_user(self, pyramid_request, pyramid_services):
         service = pretend.stub(find_userid=pretend.call_recorder(lambda username: None))
         pyramid_services.register_service(IUserService, None, service)
         pyramid_services.register_service(
             IPasswordBreachedService, None, pretend.stub()
         )
+        pyramid_request.matched_route = pretend.stub(name="forklift.legacy.file_upload")
         assert accounts._basic_auth_login("myuser", "mypass", pyramid_request) is None
         assert service.find_userid.calls == [pretend.call("myuser")]
 
@@ -56,6 +67,7 @@ def test_with_invalid_password(self, pyramid_request, pyramid_services):
         pyramid_services.register_service(
             IPasswordBreachedService, None, pretend.stub()
         )
+        pyramid_request.matched_route = pretend.stub(name="forklift.legacy.file_upload")
         assert accounts._basic_auth_login("myuser", "mypass", pyramid_request) is None
         assert service.find_userid.calls == [pretend.call("myuser")]
         assert service.get_user.calls == [pretend.call(1)]
@@ -78,6 +90,7 @@ def test_with_disabled_user_no_reason(self, pyramid_request, pyramid_services):
         pyramid_services.register_service(
             IPasswordBreachedService, None, pretend.stub()
         )
+        pyramid_request.matched_route = pretend.stub(name="forklift.legacy.file_upload")
         assert accounts._basic_auth_login("myuser", "mypass", pyramid_request) is None
         assert service.find_userid.calls == [pretend.call("myuser")]
         assert service.get_user.calls == [pretend.call(1)]
@@ -104,6 +117,7 @@ def test_with_disabled_user_compromised_pw(self, pyramid_request, pyramid_servic
             None,
             pretend.stub(failure_message_plain="Bad Password!"),
         )
+        pyramid_request.matched_route = pretend.stub(name="forklift.legacy.file_upload")
 
         with pytest.raises(BasicAuthBreachedPassword) as excinfo:
             assert (
@@ -140,6 +154,8 @@ def test_with_valid_password(self, monkeypatch, pyramid_request, pyramid_service
             IPasswordBreachedService, None, breach_service
         )
 
+        pyramid_request.matched_route = pretend.stub(name="forklift.legacy.file_upload")
+
         now = datetime.datetime.utcnow()
 
         with freezegun.freeze_time(now):
@@ -188,6 +204,8 @@ def test_via_basic_auth_compromised(
             IPasswordBreachedService, None, breach_service
         )
 
+        pyramid_request.matched_route = pretend.stub(name="forklift.legacy.file_upload")
+
         with pytest.raises(BasicAuthBreachedPassword) as excinfo:
             accounts._basic_auth_login("myuser", "mypass", pyramid_request)
 

warehouse/accounts/__init__.py

@@ -51,6 +51,9 @@ def _format_exc_status(exc, message):
 
 
 def _basic_auth_login(username, password, request):
+    if request.matched_route.name not in ["forklift.legacy.file_upload"]:
+        return
+
     login_service = request.find_service(IUserService, context=None)
     breach_service = request.find_service(IPasswordBreachedService, context=None)