Give the IntegrityService access to the session

Author: di

tests/conftest.py

@@ -555,7 +555,7 @@ def activestate_oidc_service(db_session):
 
 @pytest.fixture
 def integrity_service(db_session):
-    return attestations_services.NullIntegrityService()
+    return attestations_services.NullIntegrityService(db_session)
 
 
 @pytest.fixture

tests/unit/attestations/test_services.py

@@ -66,7 +66,7 @@ def test_get_provenance_digest(self, db_request):
         )
 
         file = FileFactory.create()
-        service = services.NullIntegrityService()
+        service = services.NullIntegrityService(session=db_request.db)
 
         provenance = service.generate_provenance(db_request, file, [VALID_ATTESTATION])
         assert isinstance(provenance, Provenance)
@@ -87,6 +87,7 @@ def test_persist_attestations_succeeds(self, db_request, storage_service):
         integrity_service = IntegrityService(
             storage=storage_service,
             metrics=pretend.stub(),
+            session=db_request.db,
         )
 
         file = FileFactory.create()
@@ -113,6 +114,7 @@ def test_parse_attestations_fails_no_publisher(self, db_request):
         integrity_service = IntegrityService(
             storage=pretend.stub(),
             metrics=pretend.stub(),
+            session=db_request.db,
         )
 
         db_request.oidc_publisher = None
@@ -126,6 +128,7 @@ def test_parse_attestations_fails_unsupported_publisher(self, db_request):
         integrity_service = IntegrityService(
             storage=pretend.stub(),
             metrics=pretend.stub(),
+            session=db_request.db,
         )
         db_request.oidc_publisher = pretend.stub(publisher_name="not-existing")
         with pytest.raises(
@@ -138,6 +141,7 @@ def test_parse_attestations_fails_malformed_attestation(self, metrics, db_reques
         integrity_service = IntegrityService(
             storage=pretend.stub(),
             metrics=metrics,
+            session=db_request.db,
         )
 
         db_request.oidc_publisher = pretend.stub(publisher_name="GitHub")
@@ -157,6 +161,7 @@ def test_parse_attestations_fails_multiple_attestations(self, metrics, db_reques
         integrity_service = IntegrityService(
             storage=pretend.stub(),
             metrics=metrics,
+            session=db_request.db,
         )
 
         db_request.oidc_publisher = pretend.stub(publisher_name="GitHub")
@@ -195,6 +200,7 @@ def test_parse_attestations_fails_verification(
         integrity_service = IntegrityService(
             storage=pretend.stub(),
             metrics=metrics,
+            session=db_request.db,
         )
 
         db_request.oidc_publisher = pretend.stub(
@@ -224,6 +230,7 @@ def test_parse_attestations_fails_wrong_predicate(
         integrity_service = IntegrityService(
             storage=pretend.stub(),
             metrics=metrics,
+            session=db_request.db,
         )
         db_request.oidc_publisher = pretend.stub(
             publisher_name="GitHub",
@@ -258,6 +265,7 @@ def test_parse_attestations_succeeds(self, metrics, monkeypatch, db_request):
         integrity_service = IntegrityService(
             storage=pretend.stub(),
             metrics=metrics,
+            session=db_request.db,
         )
         db_request.oidc_publisher = pretend.stub(
             publisher_name="GitHub",
@@ -283,6 +291,7 @@ def test_generate_provenance_fails_unsupported_publisher(self, db_request, metri
         integrity_service = IntegrityService(
             storage=pretend.stub(),
             metrics=pretend.stub(),
+            session=db_request.db,
         )
 
         db_request.oidc_publisher = pretend.stub(publisher_name="not-existing")
@@ -309,6 +318,7 @@ def test_generate_provenance_succeeds(
         integrity_service = IntegrityService(
             storage=storage_service,
             metrics=metrics,
+            session=db_request.db,
         )
 
         file = FileFactory.create()
@@ -361,6 +371,7 @@ def test_persist_provenance_succeeds(self, db_request, storage_service, metrics)
         integrity_service = IntegrityService(
             storage=storage_service,
             metrics=metrics,
+            session=db_request.db,
         )
         file = FileFactory.create()
         assert integrity_service._persist_provenance(provenance, file) is None
@@ -376,6 +387,7 @@ def test_get_provenance_digest_succeeds(self, db_request, metrics, storage_servi
         integrity_service = IntegrityService(
             storage=storage_service,
             metrics=metrics,
+            session=db_request.db,
         )
 
         db_request.oidc_publisher = GitHubPublisherFactory.create()
@@ -396,6 +408,7 @@ def test_get_provenance_digest_fails_no_attestations(self, db_request):
         integrity_service = IntegrityService(
             storage=pretend.stub(),
             metrics=pretend.stub(),
+            session=db_request.db,
         )
 
         assert integrity_service.get_provenance_digest(file) is None

warehouse/attestations/services.py

@@ -111,17 +111,18 @@ def _extract_attestations_from_request(request: Request) -> list[Attestation]:
 
 @implementer(IIntegrityService)
 class NullIntegrityService:
-    def __init__(self):
+    def __init__(self, session):
         warnings.warn(
             "NullIntegrityService is intended only for use in development, "
             "you should not use it in production due to the lack of actual "
             "attestation verification.",
             InsecureIntegrityServiceWarning,
         )
+        self.db = session
 
     @classmethod
-    def create_service(cls, _context, _request):
-        return cls()
+    def create_service(cls, _context, request):
+        return cls(session=request.db)
 
     def parse_attestations(
         self, request: Request, _distribution: Distribution
@@ -165,19 +166,17 @@ def get_provenance_digest(self, file: File) -> str | None:
 
 @implementer(IIntegrityService)
 class IntegrityService:
-    def __init__(
-        self,
-        storage: IFileStorage,
-        metrics: IMetricsService,
-    ):
+    def __init__(self, storage: IFileStorage, metrics: IMetricsService, session):
         self.storage: IFileStorage = storage
         self.metrics: IMetricsService = metrics
+        self.db = session
 
     @classmethod
-    def create_service(cls, _context, request: Request):
+    def create_service(cls, _context, request):
         return cls(
             storage=request.find_service(IFileStorage, name="archive"),
             metrics=request.find_service(IMetricsService),
+            session=request.db,
         )
 
     def parse_attestations(