controllers/krate/publish: Add support for Trusted Publishing access tokens #11294
Conversation
Turbo87
added
C-enhancement ✨
This comment was marked as outdated.
This comment was marked as outdated.
When "Trusted Publishing" is used we can no longer associate the release with a specific crates.io user account. The column is already nullable since old releases did not track the information, so there are no changes needed on the database side.
|
🙋 I was wondering if we could use the creator of the trustpub config as |
|
I think that could be misleading, since it is not the person that triggered the release itself. It might be possible to figure out the releaser from the |
|
🙋 Another question came up. I noticed that only the regular (non-TrustPub) AuthType requires a verified email for publishing, while the TrustPub AuthType does not seem to require this. Would it be bad to ensure email is verified before creating a trustpub config? |
yeah, we should probably implement that 👍 |
| Some(_) => EndpointScope::PublishUpdate, | ||
| None => EndpointScope::PublishNew, | ||
| }; | ||
| let trustpub_token = req |
There was a problem hiding this comment.
I might still like a small explanatory comment here along the lines of:
| let trustpub_token = req | |
| // Trusted publishing tokens are distinguished from regular crates.io API tokens because they | |
| // use the Bearer auth scheme, so we look for that specific prefix. | |
| let trustpub_token = req |
But if you think that's unnecessary, that's not a blocker.
| .transpose() | ||
| .map_err(|_| forbidden("Invalid authentication token"))?; | ||
|
|
||
| let auth = if let Some(trustpub_token) = trustpub_token { |
There was a problem hiding this comment.
This is definitely clearer than before, so 👍.
This is the last major missing puzzle piece for the Trusted Publishing backend work: the ability to use temporary access tokens to publish new versions of crates.
Related:
PUT /api/v1/trusted_publishing/github_configsAPI endpoint #11113PUT /api/v1/trusted_publishing/tokensAPI endpoint #11131