read only group and extra logging (#1307)

YasenT · cursoragent · web-flow · commit 0f236fca0e03 · 2026-07-03T14:30:37.000+02:00
* read only group  and extra logging

* style: apply ruff format (line-length 120) to lightwell readonly group changes

Co-authored-by: Cursor &lt;cursoragent@cursor.com&gt;

* fix(tests): remove unused file_bindings argument in readonly group test

Ruff's ARG001 check flagged the unused fixture in changed lines.

Co-authored-by: Cursor &lt;cursoragent@cursor.com&gt;

---------

Co-authored-by: Cursor &lt;cursoragent@cursor.com&gt;
diff --git a/CHANGES/lightwell-readonly-group.feature b/CHANGES/lightwell-readonly-group.feature
@@ -0,0 +1 @@
+Added a hardcoded ``Lightwell-ReadOnly`` group: members get read-only (``SAFE_METHODS``) access to the ``lightwell`` domain's non-PyPI endpoints (repository/content/artifact listing, Pulp REST API, Maven content API), independent of any ``DomainOrg`` association. Unlike normal groups (linked to a domain via ``DomainOrg``, which grant unrestricted read+write access), this group grants no write access and does not bypass the existing ``lightwell-network`` feature check on the domain's PyPI views.
diff --git a/pulp_service/pulp_service/app/authorization.py b/pulp_service/pulp_service/app/authorization.py
@@ -27,6 +27,13 @@
 # Feature entitlement required to read the lightwell domain's PyPI views (simple API, etc.)
 # for orgs that don't have a DomainOrg association with the domain. See has_permission().
 LIGHTWELL_NETWORK_FEATURE = "lightwell-network"
+# Hardcoded group whose members get read-only (SAFE_METHODS) access to the lightwell
+# domain's non-PyPI endpoints (repository/content/artifact listing, Pulp REST API, Maven
+# content API), independent of any DomainOrg association. This is a plain Group -- there is
+# no DomainOrg row backing this access, unlike the normal group-based access model. It does
+# NOT grant write access, and it does NOT apply to PyPI views, which are still gated
+# exclusively by the lightwell-network feature check (see _check_pypi_safe_method_access()).
+LIGHTWELL_READONLY_GROUP_NAME = "Lightwell-ReadOnly"
 
 
 class DomainBasedPermission(BasePermission):
@@ -64,12 +71,25 @@ def _has_pypi_read_access(self, request, domain):
         org_id = self.get_org_id(decoded_header_content)
 
         if user.is_authenticated and self._has_domain_access(domain_pk, org_id, user):
+            _logger.info("lightwell PyPI access GRANTED via DomainOrg: user=%s org_id=%s", user, org_id)
             return True
 
         if org_id is None:
+            _logger.info(
+                "lightwell PyPI access DENIED: no org_id in identity header and no DomainOrg match (user=%s)",
+                user,
+            )
             return False
 
-        return self._has_lightwell_network_feature(org_id)
+        allowed = self._has_lightwell_network_feature(org_id)
+        _logger.info(
+            "lightwell PyPI access %s via %s feature check: org_id=%s user=%s",
+            "GRANTED" if allowed else "DENIED",
+            LIGHTWELL_NETWORK_FEATURE,
+            org_id,
+            user,
+        )
+        return allowed
 
     def _has_lightwell_network_feature(self, org_id):
         """
@@ -82,6 +102,17 @@ def _has_lightwell_network_feature(self, org_id):
         except PermissionError:
             return False
 
+    def _has_lightwell_readonly_group_access(self, user):
+        """
+        Members of the hardcoded LIGHTWELL_READONLY_GROUP_NAME group get read-only
+        (SAFE_METHODS) access to the lightwell domain's non-PyPI endpoints, independent of
+        any DomainOrg association. Unlike normal groups (linked to a domain via DomainOrg,
+        which grant unrestricted read+write access), this is a standalone check based purely
+        on group membership + the hardcoded lightwell domain name -- see has_permission() and
+        scope_queryset() for where this is applied.
+        """
+        return user.is_authenticated and user.groups.filter(name=LIGHTWELL_READONLY_GROUP_NAME).exists()
+
     def _check_pypi_safe_method_access(self, request, view, domain):
         """
         Returns True/False for a SAFE_METHOD request to a PyPI `view`, or None if `view`
@@ -102,22 +133,36 @@ def _check_pypi_safe_method_access(self, request, view, domain):
             return self._has_pypi_read_access(request, domain)
         return True
 
+    def _check_safe_method_access(self, request, view, domain, user):
+        """
+        Returns True/False for a SAFE_METHOD request, or None if none of the SAFE_METHOD
+        shortcuts (public domains, PyPI views, the lightwell read-only group) apply -- the
+        caller should then fall through to the standard DomainOrg-based checks below.
+        """
+        if domain and domain.name.startswith("public-"):
+            return True
+
+        pypi_access = self._check_pypi_safe_method_access(request, view, domain)
+        if pypi_access is not None:
+            return pypi_access
+
+        if domain and domain.name == LIGHTWELL_DOMAIN_NAME and self._has_lightwell_readonly_group_access(user):
+            return True
+
+        return None
+
     def has_permission(self, request, view):  # noqa: PLR0911
         # Admins have all permissions
         if request.user.is_superuser:
             return True
 
         user = request.user
 
-        # Allow safe requests on public domains for all users, authenticated or not
         if request.method in SAFE_METHODS:
             domain = getattr(request, "pulp_domain", None)
-            if domain and domain.name.startswith("public-"):
-                return True
-
-            pypi_access = self._check_pypi_safe_method_access(request, view, domain)
-            if pypi_access is not None:
-                return pypi_access
+            safe_method_access = self._check_safe_method_access(request, view, domain, user)
+            if safe_method_access is not None:
+                return safe_method_access
 
         if not user.is_authenticated:
             return False
@@ -219,4 +264,7 @@ def scope_queryset(self, view, qs):
         if org_id is not None:
             query |= Q(domain_orgs__org_id=org_id)
 
+        if self._has_lightwell_readonly_group_access(user):
+            query |= Q(name=LIGHTWELL_DOMAIN_NAME)
+
         return qs.filter(query).distinct()
diff --git a/pulp_service/pulp_service/tests/functional/test_lightwell_readonly_group_permission.py b/pulp_service/pulp_service/tests/functional/test_lightwell_readonly_group_permission.py
@@ -0,0 +1,234 @@
+"""
+Functional tests for the hardcoded LIGHTWELL_READONLY_GROUP_NAME group enforced by
+DomainBasedPermission, scoped specifically to the "lightwell" domain's non-PyPI endpoints
+(Pulp REST API: repository listing, etc.).
+
+Unlike normal groups (created through CreateDomainView's group_name flow and linked to a
+domain via DomainOrg, which grant unrestricted read+write access), membership in this
+hardcoded group grants read-only (SAFE_METHODS) access to the lightwell domain, independent
+of any DomainOrg association. It does not grant write access, and it does not apply to the
+lightwell domain's PyPI views, which remain gated exclusively by the lightwell-network
+feature check (see test_lightwell_feature_permission.py) -- group membership must not bypass
+that check.
+
+These follow the pattern used in test_group_based_permissions.py (group setup via gen_group
+/ UsersApi / GroupsUsersApi) and test_lightwell_feature_permission.py (the "lightwell"
+domain/PyPI fixtures).
+
+NOTE: like test_lightwell_feature_permission.py, this is keyed off the literal domain name
+"lightwell" (see pulp_service.app.authorization.LIGHTWELL_DOMAIN_NAME), so the domain created
+here can't use a random per-test suffix. These tests assume they run against an ephemeral
+Pulp instance where no "lightwell" domain already exists, and are not run concurrently with
+other tests that also create a "lightwell" domain.
+"""
+
+import json
+from base64 import b64encode
+from urllib.parse import urljoin
+from uuid import uuid4
+
+import pytest
+import requests
+
+from pulp_service.app.authorization import LIGHTWELL_READONLY_GROUP_NAME
+
+LIGHTWELL_DOMAIN_NAME = "lightwell"
+
+# An org with no DomainOrg association with the test domain and no lightwell-network
+# feature entitlement; only used to own the test domain/repo/distribution.
+DOMAIN_OWNER_ORG_ID = "555555555"
+# A distinct org used for the group members created in these tests, so they never
+# accidentally collide with the domain owner's DomainOrg association.
+GROUP_MEMBER_ORG_ID = "666666666"
+
+
+def _identity_header(org_id, username):
+    identity = {
+        "identity": {
+            "org_id": org_id,
+            "internal": {"org_id": org_id},
+            "user": {"username": username},
+        }
+    }
+    return b64encode(json.dumps(identity).encode()).decode()
+
+
+def _combined_username(org_id, username):
+    """Matches the "{org_id}|{username}" format RHTermsBasedRegistryAuthentication resolves
+    identity headers to (see pulp_service.app.authentication)."""
+    return f"{org_id}|{username}"
+
+
+@pytest.fixture
+def lightwell_readonly_group(gen_group):
+    """The hardcoded read-only group, created with its real (hardcoded) name."""
+    return gen_group(name=LIGHTWELL_READONLY_GROUP_NAME)
+
+
+@pytest.fixture
+def configure_lightwell_domain(
+    anonymous_user,
+    gen_object_with_cleanup,
+    pulpcore_bindings,
+    file_bindings,
+    python_bindings,
+    bindings_cfg,
+):
+    """
+    Creates the "lightwell" domain (owned by DOMAIN_OWNER_ORG_ID, no relation to the
+    read-only group), with a File repository and a PyPI-distributed Python repository.
+
+    Returns (repos_url, pypi_url, owner_header).
+    """
+    owner_header = _identity_header(DOMAIN_OWNER_ORG_ID, "lightwell-readonly-test-owner")
+
+    with anonymous_user:
+        pulpcore_bindings.DomainsApi.api_client.default_headers["x-rh-identity"] = owner_header
+
+        gen_object_with_cleanup(
+            pulpcore_bindings.DomainsApi,
+            {
+                "name": LIGHTWELL_DOMAIN_NAME,
+                "storage_class": "pulpcore.app.models.storage.FileSystem",
+                "storage_settings": {"MEDIA_ROOT": "/var/lib/pulp/media/"},
+            },
+        )
+
+        file_bindings.RepositoriesFileApi.api_client.default_headers["x-rh-identity"] = owner_header
+        gen_object_with_cleanup(
+            file_bindings.RepositoriesFileApi, {"name": str(uuid4())}, pulp_domain=LIGHTWELL_DOMAIN_NAME
+        )
+
+        python_bindings.RepositoriesPythonApi.api_client.default_headers["x-rh-identity"] = owner_header
+        repo = gen_object_with_cleanup(
+            python_bindings.RepositoriesPythonApi, {"name": str(uuid4())}, pulp_domain=LIGHTWELL_DOMAIN_NAME
+        )
+
+        python_bindings.DistributionsPypiApi.api_client.default_headers["x-rh-identity"] = owner_header
+        pypi_base_path = str(uuid4())
+        gen_object_with_cleanup(
+            python_bindings.DistributionsPypiApi,
+            {"name": str(uuid4()), "base_path": pypi_base_path, "repository": repo.pulp_href},
+            pulp_domain=LIGHTWELL_DOMAIN_NAME,
+        )
+
+    repos_url = urljoin(bindings_cfg.host, f"/api/pulp/{LIGHTWELL_DOMAIN_NAME}/api/v3/repositories/file/file/")
+    pypi_url = urljoin(bindings_cfg.host, f"/api/pypi/{LIGHTWELL_DOMAIN_NAME}/{pypi_base_path}/simple/")
+
+    yield repos_url, pypi_url, owner_header
+
+    pulpcore_bindings.DomainsApi.api_client.default_headers.pop("x-rh-identity", None)
+    file_bindings.RepositoriesFileApi.api_client.default_headers.pop("x-rh-identity", None)
+    python_bindings.RepositoriesPythonApi.api_client.default_headers.pop("x-rh-identity", None)
+    python_bindings.DistributionsPypiApi.api_client.default_headers.pop("x-rh-identity", None)
+
+
+@pytest.fixture
+def gen_readonly_group_member(pulpcore_bindings, gen_object_with_cleanup, lightwell_readonly_group):
+    """Creates a user that's a member of the hardcoded read-only group, and returns an
+    x-rh-identity header for that user."""
+
+    def _gen_member(username_suffix):
+        username = f"readonly-member-{username_suffix}-{uuid4()}"
+        combined_username = _combined_username(GROUP_MEMBER_ORG_ID, username)
+        gen_object_with_cleanup(
+            pulpcore_bindings.UsersApi,
+            {"username": combined_username, "groups": [lightwell_readonly_group.pulp_href]},
+        )
+        return _identity_header(GROUP_MEMBER_ORG_ID, username)
+
+    return _gen_member
+
+
+def test_readonly_group_member_can_read_lightwell_repositories(configure_lightwell_domain, gen_readonly_group_member):
+    """A user with no DomainOrg association, whose only access path is membership in the
+    hardcoded read-only group, can list repositories in the lightwell domain."""
+    repos_url, _, _ = configure_lightwell_domain
+    headers = {"x-rh-identity": gen_readonly_group_member("read")}
+
+    response = requests.get(repos_url, headers=headers, timeout=30)
+
+    assert response.status_code == 200
+
+
+def test_non_member_denied_reading_lightwell_repositories(
+    configure_lightwell_domain, gen_object_with_cleanup, pulpcore_bindings
+):
+    """A user with no DomainOrg association and no read-only group membership gets 403 when
+    listing repositories in the lightwell domain."""
+    repos_url, _, _ = configure_lightwell_domain
+    username = f"non-member-{uuid4()}"
+    combined_username = _combined_username(GROUP_MEMBER_ORG_ID, username)
+    gen_object_with_cleanup(pulpcore_bindings.UsersApi, {"username": combined_username})
+    headers = {"x-rh-identity": _identity_header(GROUP_MEMBER_ORG_ID, username)}
+
+    response = requests.get(repos_url, headers=headers, timeout=30)
+
+    assert response.status_code == 403
+
+
+def test_readonly_group_member_write_denied(configure_lightwell_domain, gen_readonly_group_member):
+    """The read-only group grants no write access -- a member must still be denied when
+    trying to create a repository in the lightwell domain."""
+    repos_url, _, _ = configure_lightwell_domain
+    headers = {"x-rh-identity": gen_readonly_group_member("write")}
+
+    response = requests.post(repos_url, headers=headers, json={"name": str(uuid4())}, timeout=30)
+
+    assert response.status_code in (401, 403)
+
+
+def test_readonly_group_member_pypi_still_requires_feature(configure_lightwell_domain, gen_readonly_group_member):
+    """Read-only group membership does not bypass the lightwell-network feature check on
+    PyPI views -- a member with no feature entitlement and no DomainOrg association still
+    gets 403 on the PyPI simple API."""
+    _, pypi_url, _ = configure_lightwell_domain
+    headers = {"x-rh-identity": gen_readonly_group_member("pypi")}
+
+    response = requests.get(pypi_url, headers=headers, timeout=30)
+
+    assert response.status_code == 403
+
+
+def test_readonly_group_member_denied_on_other_domains(
+    pulpcore_bindings, anonymous_user, gen_object_with_cleanup, gen_readonly_group_member, bindings_cfg
+):
+    """Membership in the lightwell read-only group grants no access to domains other than
+    lightwell."""
+    other_domain_owner_header = _identity_header("777777777", "other-domain-owner")
+    domain_name = f"not-lightwell-{uuid4()}"
+
+    with anonymous_user:
+        pulpcore_bindings.DomainsApi.api_client.default_headers["x-rh-identity"] = other_domain_owner_header
+        gen_object_with_cleanup(
+            pulpcore_bindings.DomainsApi,
+            {
+                "name": domain_name,
+                "storage_class": "pulpcore.app.models.storage.FileSystem",
+                "storage_settings": {"MEDIA_ROOT": "/var/lib/pulp/media/"},
+            },
+        )
+        pulpcore_bindings.DomainsApi.api_client.default_headers.pop("x-rh-identity", None)
+
+    repos_url = urljoin(bindings_cfg.host, f"/api/pulp/{domain_name}/api/v3/repositories/file/file/")
+    headers = {"x-rh-identity": gen_readonly_group_member("other-domain")}
+
+    response = requests.get(repos_url, headers=headers, timeout=30)
+
+    assert response.status_code == 403
+
+
+def test_readonly_group_member_sees_lightwell_domain_in_listing(
+    configure_lightwell_domain, gen_readonly_group_member, bindings_cfg
+):
+    """The lightwell domain shows up in GET /domains/ for read-only group members, via
+    DomainBasedPermission.scope_queryset()."""
+    del configure_lightwell_domain  # ensure the "lightwell" domain exists
+    headers = {"x-rh-identity": gen_readonly_group_member("domain-list")}
+    domains_url = urljoin(bindings_cfg.host, "/api/pulp/api/v3/domains/")
+
+    response = requests.get(domains_url, headers=headers, timeout=30)
+
+    assert response.status_code == 200
+    domain_names = {domain["name"] for domain in response.json()["results"]}
+    assert LIGHTWELL_DOMAIN_NAME in domain_names
diff --git a/pulp_service/pulp_service/tests/unit/test_domain_based_permission.py b/pulp_service/pulp_service/tests/unit/test_domain_based_permission.py

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	+Added a hardcoded ``Lightwell-ReadOnly`` group: members get read-only (``SAFE_METHODS``) access to the ``lightwell`` domain's non-PyPI endpoints (repository/content/artifact listing, Pulp REST API, Maven content API), independent of any ``DomainOrg`` association. Unlike normal groups (linked to a domain via ``DomainOrg``, which grant unrestricted read+write access), this group grants no write access and does not bypass the existing ``lightwell-network`` feature check on the domain's PyPI views.