Skip to content

Cannot create scoped token to upload organisation package, but newly personal general token works. #13840

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
Carreau opened this issue Jun 2, 2023 · 7 comments · May be fixed by #13844
Open

Cannot create scoped token to upload organisation package, but newly personal general token works. #13840

Carreau opened this issue Jun 2, 2023 · 7 comments · May be fixed by #13844
Labels
bug 🐛 organizations

Comments

@Carreau
Copy link
Contributor

Carreau commented Jun 2, 2023 •
edited
Loading

Question 1)

  1. How am I supposed to create an IPython scope token ? Should I have been redirected to maybe https://pypi.org/manage/org/token/ ? Or is a personal token used to upload and IPython scope should be present ?
  • Curious I try to create a token with all permissions.
  • Try it.
  • twine upload works.
  • <pickachu face>

Question 2)

  • Was i suppose to be able to upload if I can't create a scope token ?
  • Is some of the logic wrong ?

Also uploading to https://upload.pypi.org/legacy/ returned HTML though it's an API endpoint, it maybe return something machine/terminal readable ?
@Carreau Carreau added bug 🐛 requires triaging maintainers need to do initial inspection of issue labels Jun 2, 2023
@Carreau Carreau changed the title Cannot create scoped token to upload organisation package, but personal general token works. Cannot create scoped token to upload organisation package, but newly personal general token works. Jun 2, 2023
@di
Copy link
Member

di commented Jun 2, 2023

I can confirm that projects that are in an organization are not being included in the list of scopes when creating a token at https://pypi.org/manage/account/token/, this seems to be a bug.

Also uploading to https://upload.pypi.org/legacy/ returned HTML though it's an API endpoint, it maybe return something machine/terminal readable ?

Are you able to share what the response was here?

@di di removed the requires triaging maintainers need to do initial inspection of issue label Jun 2, 2023
@di
Copy link
Member

di commented Jun 2, 2023

The list of projects comes from here:

warehouse/warehouse/manage/views/__init__.py

Lines 842 to 844 in cec621a

@property
def project_names(self):
return sorted(project.normalized_name for project in self.request.user.projects)

@Carreau
Copy link
Contributor Author

Carreau commented Jun 2, 2023

Are you able to share what the response was here?

twine upload --verbose dist/ipython-8.14.0*
INFO     Using configuration from ...
Uploading distributions to https://upload.pypi.org/legacy/
INFO     dist/ipython-8.14.0-py3-none-any.whl (780.0 KB)
INFO     dist/ipython-8.14.0.tar.gz (5.2 MB)
INFO     username set from config file
INFO     password set from config file
INFO     username: ...
INFO     password: <hidden>
Uploading ipython-8.14.0-py3-none-any.whl
100% ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 814.4/814.4 kB • 00:01 • 817.1 kB/s
INFO     Response from https://upload.pypi.org/legacy/:
         401 User mbussonn has two factor auth enabled, an API Token or Trusted Publisher must be used to upload in place of
         password.
INFO     <html>
          <head>
           <title>401 User mbussonn has two factor auth enabled, an API Token or Trusted Publisher must be used to upload in
         place of password.</title>
          </head>
          <body>
           <h1>401 User mbussonn has two factor auth enabled, an API Token or Trusted Publisher must be used to upload in place
         of password.</h1>
           This server could not verify that you are authorized to access the document you requested.  Either you supplied the
         wrong credentials (e.g., bad password), or your browser does not understand how to supply the credentials
         required.<br/><br/>
         User mbussonn has two factor auth enabled, an API Token or Trusted Publisher must be used to upload in place of
         password.


          </body>
         </html>
ERROR    HTTPError: 401 Unauthorized from https://upload.pypi.org/legacy/
         User mbussonn has two factor auth enabled, an API Token or Trusted Publisher must be used to upload in place of
         password.

There is already a 401, but I was astonished seeing html send to twine.

Twine 4.0.2

@di
Copy link
Member

di commented Jun 2, 2023

Ah, I thought you meant there was HTML in the error message. This is expected, this is how errors are communicated to twine, and you shouldn't see this unless you have verbosity turned on: https://github.com/pypa/twine/blob/0bb428c410b8df64c04dc881ac1db37d932f3066/twine/commands/upload.py#L149-L151

@Carreau
Copy link
Contributor Author

Carreau commented Jun 2, 2023

Ok, fair.

@di
Copy link
Member

di commented Jun 2, 2023

Confirming that this is a bug. Plan is for a two stage fix:

  • Short term, allow users to create project-scoped tokens for projects owned by orgs
  • Long term, allow org owners/maintainers to see all project-scoped tokens for users in the org (including revocation)

ewdurbin added a commit that referenced this issue Jun 2, 2023
@ewdurbin
Include all projects a User has access to in Add API token view
a57539d 
resolves #13840 (in the ugliest way possible)
@ewdurbin ewdurbin linked a pull request Jun 2, 2023 that will close this issue
Open
ewdurbin added a commit that referenced this issue Jun 2, 2023
@ewdurbin
Include all projects a User has access to in Add API token view
7162367 
resolves #13840 (in the ugliest way possible)
@ewdurbin ewdurbin mentioned this issue Jun 26, 2023
Merged
@maxnoe
Copy link

maxnoe commented Apr 17, 2025

We also just ran into this in our organization. Could this be addressed?

As a workaround, we had to add individual people back to the organization-owned project as "external collaborators".

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug 🐛 organizations
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Include all projects a User has access to in Add API token view pypi/warehouse
3 participants
@di @Carreau @maxnoe