Serve policies from the repo URL like other resources

get_policy built its URL from a separate repo_organization field that
re-inserted the /repos/<org> path segment, even though every other
resource builds its URL directly from repo_url. That forced callers
whose repo_url already includes /repos/<org> to strip the suffix back
off just to have hex_core re-add it.

Build the policy URL from repo_url like get_package does, and verify the
signed payload against repo_name. The repo_organization config option,
its only consumer, is removed.

Author: ericmj

src/hex_core.erl

@@ -48,9 +48,6 @@
 %%
 %% * `repo_url' - URL to the repository (default: `https://repo.hex.pm').
 %%
-%% * `repo_organization' - Name of the organization repository, appends `/repos/:name'
-%%    to the repository URL and overrides the `repo_name' option.
-%%
 %% * `repo_verify' - If `true' will verify the repository signature (default: `true').
 %%
 %% * `repo_verify_origin' - If `true' will verify the repository signature origin,
@@ -114,7 +111,6 @@
     repo_name => binary(),
     repo_public_key => binary(),
     repo_url => binary(),
-    repo_organization => binary() | undefined,
     repo_verify => boolean(),
     repo_verify_origin => boolean(),
     send_100_continue => boolean(),
@@ -142,7 +138,6 @@ default_config() ->
         repo_name => <<"hexpm">>,
         repo_public_key => ?HEXPM_PUBLIC_KEY,
         repo_url => <<"https://repo.hex.pm">>,
-        repo_organization => undefined,
         repo_verify => true,
         repo_verify_origin => true,
         send_100_continue => true,

src/hex_repo.erl

@@ -92,15 +92,10 @@ get_package(Config, Name) when is_binary(Name) and is_map(Config) ->
 %% @doc
 %% Gets policy resource from the repository.
 %%
-%% Requires `repo_organization' to be set in the config; policies are
-%% always served from the per-organization namespace
-%% (`/repos/<organization>/policies/<name>'). Returns
-%% `{error, missing_repo_organization}' when it is not set.
-%%
 %% Examples:
 %%
 %% ```
-%% > Config = (hex_core:default_config())#{repo_organization => <<"myorg">>},
+%% > Config = (hex_core:default_config())#{repo_url => <<"https://repo.hex.pm/repos/myorg">>, repo_name => <<"myorg">>},
 %% > hex_repo:get_policy(Config, <<"strict-prod">>).
 %% {ok, {200, ...,
 %%       #{repository => <<"myorg">>,
@@ -109,19 +104,14 @@ get_package(Config, Name) when is_binary(Name) and is_map(Config) ->
 %% '''
 %% @end
 get_policy(Config, Name) when is_binary(Name) and is_map(Config) ->
-    case maps:get(repo_organization, Config, undefined) of
-        undefined ->
-            {error, missing_repo_organization};
-        Org when is_binary(Org) ->
-            Verify = maps:get(repo_verify_origin, Config, true),
-            Decoder = fun(Data) ->
-                case Verify of
-                    true -> hex_registry:decode_policy(Data, Org, Name);
-                    false -> hex_registry:decode_policy(Data, no_verify, no_verify)
-                end
-            end,
-            get_protobuf(Config, <<"policies/", Name/binary>>, Decoder)
-    end.
+    Verify = maps:get(repo_verify_origin, Config, true),
+    Decoder = fun(Data) ->
+        case Verify of
+            true -> hex_registry:decode_policy(Data, repo_name(Config), Name);
+            false -> hex_registry:decode_policy(Data, no_verify, no_verify)
+        end
+    end,
+    get_protobuf(Config, <<"policies/", Name/binary>>, Decoder).
 
 %% @doc
 %% Gets tarball from the repository.
@@ -358,7 +348,6 @@ verify_repo(Config) ->
     end.
 
 %% @private
-repo_name(#{repo_organization := Name}) when is_binary(Name) -> Name;
 repo_name(#{repo_name := Name}) when is_binary(Name) -> Name.
 
 %% @private
@@ -372,12 +361,8 @@ docs_url(Config, Name, Version) ->
     build_url(Config, <<"docs/", Filename/binary>>).
 
 %% @private
-build_url(#{repo_url := URI, repo_organization := Org}, Path) when is_binary(Org) ->
-    <<URI/binary, "/repos/", Org/binary, "/", Path/binary>>;
-build_url(#{repo_url := URI, repo_organization := undefined}, Path) ->
-    <<URI/binary, "/", Path/binary>>;
-build_url(Config, Path) ->
-    build_url(Config#{repo_organization => undefined}, Path).
+build_url(#{repo_url := URI}, Path) ->
+    <<URI/binary, "/", Path/binary>>.
 
 %% @private
 tarball_filename(Name, Version) ->

test/hex_repo_SUITE.erl

@@ -24,14 +24,12 @@ all() ->
         get_versions_test,
         get_package_test,
         get_policy_test,
-        get_policy_missing_org_test,
         get_tarball_test,
         get_tarball_to_file_test,
         get_docs_test,
         get_docs_to_file_test,
         get_hex_installs_test,
         get_public_key_test,
-        repo_org_not_set,
         fingerprint_test,
         fingerprint_equal_test
     ].
@@ -63,7 +61,10 @@ get_package_test(_Config) ->
     ok.
 
 get_policy_test(_Config) ->
-    Config = maps:put(repo_organization, <<"myorg">>, ?CONFIG),
+    Config = ?CONFIG#{
+        repo_url => <<"https://repo.test/repos/myorg">>,
+        repo_name => <<"myorg">>
+    },
 
     {ok,
         {200, _, #{
@@ -96,10 +97,6 @@ get_policy_test(_Config) ->
     {ok, {403, _, _}} = hex_repo:get_policy(Config, <<"nonexisting">>),
     ok.
 
-get_policy_missing_org_test(_Config) ->
-    {error, missing_repo_organization} = hex_repo:get_policy(?CONFIG, <<"strict-prod">>),
-    ok.
-
 get_tarball_test(_Config) ->
     {ok, {200, #{<<"etag">> := ETag}, Tarball}} = hex_repo:get_tarball(
         ?CONFIG, <<"ecto">>, <<"1.0.0">>
@@ -165,17 +162,6 @@ get_public_key_test(_Config) ->
     ),
     ok.
 
-repo_org_not_set(_Config) ->
-    Config = maps:remove(repo_organization, ?CONFIG),
-    {ok, {200, _, #{repository := <<"hexpm">>, releases := Releases}}} = hex_repo:get_package(
-        Config, <<"ecto">>
-    ),
-    [#{version := <<"1.0.0">>}] =
-        lists:filter(fun(#{version := Version}) -> Version == <<"1.0.0">> end, Releases),
-
-    {ok, {403, _, _}} = hex_repo:get_package(Config, <<"nonexisting">>),
-    ok.
-
 fingerprint_test(_Config) ->
     PublicKeyPem = <<
         "-----BEGIN PUBLIC KEY-----\n"