diff --git a/requirements/dev.txt b/requirements/dev.txt index d9e3cfa5ed..e9ccb12d4c 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -219,7 +219,7 @@ cryptography==2.8 \ --hash=sha256:df6b4dca2e11865e6cfbfb708e800efb18370f5a46fd601d3755bc7f85b3a8a2 \ --hash=sha256:ecadccc7ba52193963c0475ac9f6fa28ac01e01349a2ca48509667ef41ffd2cf \ --hash=sha256:fb81c17e0ebe3358486cd8cc3ad78adbae58af12fc2bf2bc0bb84e8090fa5ce8 \ - # via apns2, moto, pyopenssl, requests, scrapy, service-identity, sshpubkeys + # via apns2, moto, pyopenssl, requests, scrapy, service-identity, social-auth-core, sshpubkeys cssselect==1.1.0 \ --hash=sha256:f612ee47b749c877ebae5bb77035d8f4202c6ad0f0fc1271b3c18ad6c4468ecf \ --hash=sha256:f95f8dedd925fd8f54edb3d2dfb44c190d9d18512377d3c1e2388d16126879bc \ @@ -757,10 +757,10 @@ social-auth-app-django==3.1.0 \ --hash=sha256:6d0dd18c2d9e71ca545097d57b44d26f59e624a12833078e8e52f91baf849778 \ --hash=sha256:9237e3d7b6f6f59494c3b02e0cce6efc69c9d33ad9d1a064e3b2318bcbe89ae3 \ --hash=sha256:f151396e5b16e2eee12cd2e211004257826ece24fc4ae97a147df386c1cd7082 -social-auth-core==3.2.0 \ - --hash=sha256:47cd2458c8fefd02466b0c514643e02ad8b61d8b4b69f7573e80882e3a97b0f0 \ - --hash=sha256:8320666548a532eb158968eda542bbe1863682357c432d8c4e28034a7f1e3b58 \ - --hash=sha256:d81ed681e3c0722300b61a0792c5db5d21206793f95ca810f010c1cc931c8d89 \ +social-auth-core==3.3.0 \ + --hash=sha256:24d8cf5b37daf9ebd3b3687546f80639db6dcd7f1279daa99bb26b0637a6aec0 \ + --hash=sha256:5e1ef182370bb2dab4c15a89be725737fb5b2242a12dc40cf22a23d9c00ebc5f \ + --hash=sha256:64688f99158debbf38f67a2735a8ad750a86cc8c849bfd23263a203337f7bcc6 \ # via social-auth-app-django sockjs-tornado==1.0.6 \ --hash=sha256:ec12b0c37723b0aac56610fb9b6aa68390720d0c9c2a10461df030c3a1d9af95 @@ -885,6 +885,10 @@ typing-extensions==3.7.4.1 \ --hash=sha256:cf8b63fedea4d89bab840ecbb93e75578af28f76f66c35889bd7065f5af88575 https://github.com/zulip/ultrajson/archive/70ac02becc3e11174cd5072650f885b30daab8a8.zip#egg=ujson==1.35+git \ --hash=sha256:e95c20f47093dc7376ddf70b95489979375fb6e88b8d7e4b5576d917dda8ef5a +unidecode==1.1.1 \ + --hash=sha256:1d7a042116536098d05d599ef2b8616759f02985c85b4fef50c78a5aaf10822a \ + --hash=sha256:2b6aab710c2a1647e928e36d69c21e76b453cd455f4e2621000e54b2a9b8cce8 \ + # via social-auth-core urllib3==1.25.7 \ --hash=sha256:a8a318824cc77d1fd4b2bec2ded92646630d7fe8619497b142c84a9e6f5a7293 \ --hash=sha256:f3c5fd51747d450d4dcf6f923c81f78f811aab8205fda64b0aba34a4e48b0745 \ diff --git a/requirements/prod.txt b/requirements/prod.txt index 199861a9e0..9e7f232e2f 100644 --- a/requirements/prod.txt +++ b/requirements/prod.txt @@ -139,7 +139,7 @@ cryptography==2.8 \ --hash=sha256:df6b4dca2e11865e6cfbfb708e800efb18370f5a46fd601d3755bc7f85b3a8a2 \ --hash=sha256:ecadccc7ba52193963c0475ac9f6fa28ac01e01349a2ca48509667ef41ffd2cf \ --hash=sha256:fb81c17e0ebe3358486cd8cc3ad78adbae58af12fc2bf2bc0bb84e8090fa5ce8 \ - # via apns2, pyopenssl, requests + # via apns2, pyopenssl, requests, social-auth-core cssselect==1.1.0 \ --hash=sha256:f612ee47b749c877ebae5bb77035d8f4202c6ad0f0fc1271b3c18ad6c4468ecf \ --hash=sha256:f95f8dedd925fd8f54edb3d2dfb44c190d9d18512377d3c1e2388d16126879bc \ @@ -505,10 +505,10 @@ social-auth-app-django==3.1.0 \ --hash=sha256:6d0dd18c2d9e71ca545097d57b44d26f59e624a12833078e8e52f91baf849778 \ --hash=sha256:9237e3d7b6f6f59494c3b02e0cce6efc69c9d33ad9d1a064e3b2318bcbe89ae3 \ --hash=sha256:f151396e5b16e2eee12cd2e211004257826ece24fc4ae97a147df386c1cd7082 -social-auth-core==3.2.0 \ - --hash=sha256:47cd2458c8fefd02466b0c514643e02ad8b61d8b4b69f7573e80882e3a97b0f0 \ - --hash=sha256:8320666548a532eb158968eda542bbe1863682357c432d8c4e28034a7f1e3b58 \ - --hash=sha256:d81ed681e3c0722300b61a0792c5db5d21206793f95ca810f010c1cc931c8d89 \ +social-auth-core==3.3.0 \ + --hash=sha256:24d8cf5b37daf9ebd3b3687546f80639db6dcd7f1279daa99bb26b0637a6aec0 \ + --hash=sha256:5e1ef182370bb2dab4c15a89be725737fb5b2242a12dc40cf22a23d9c00ebc5f \ + --hash=sha256:64688f99158debbf38f67a2735a8ad750a86cc8c849bfd23263a203337f7bcc6 \ # via social-auth-app-django sockjs-tornado==1.0.6 \ --hash=sha256:ec12b0c37723b0aac56610fb9b6aa68390720d0c9c2a10461df030c3a1d9af95 @@ -548,6 +548,10 @@ typing-extensions==3.7.4.1 \ --hash=sha256:cf8b63fedea4d89bab840ecbb93e75578af28f76f66c35889bd7065f5af88575 https://github.com/zulip/ultrajson/archive/70ac02becc3e11174cd5072650f885b30daab8a8.zip#egg=ujson==1.35+git \ --hash=sha256:e95c20f47093dc7376ddf70b95489979375fb6e88b8d7e4b5576d917dda8ef5a +unidecode==1.1.1 \ + --hash=sha256:1d7a042116536098d05d599ef2b8616759f02985c85b4fef50c78a5aaf10822a \ + --hash=sha256:2b6aab710c2a1647e928e36d69c21e76b453cd455f4e2621000e54b2a9b8cce8 \ + # via social-auth-core urllib3==1.25.7 \ --hash=sha256:a8a318824cc77d1fd4b2bec2ded92646630d7fe8619497b142c84a9e6f5a7293 \ --hash=sha256:f3c5fd51747d450d4dcf6f923c81f78f811aab8205fda64b0aba34a4e48b0745 \ diff --git a/version.py b/version.py index 2ef2d0dbe1..acf66c53d3 100644 --- a/version.py +++ b/version.py @@ -26,4 +26,4 @@ LATEST_RELEASE_ANNOUNCEMENT = "https://blog.zulip.org/2019/12/13/zulip-2-1-relea # historical commits sharing the same major version, in which case a # minor version bump suffices. -PROVISION_VERSION = '66.5' +PROVISION_VERSION = '67.0' diff --git a/zerver/tests/test_auth_backends.py b/zerver/tests/test_auth_backends.py index 9ddaaae9e3..4ef248e4d4 100644 --- a/zerver/tests/test_auth_backends.py +++ b/zerver/tests/test_auth_backends.py @@ -1396,7 +1396,7 @@ class GitHubAuthBackendTest(SocialAuthBase): @override_settings(SOCIAL_AUTH_GITHUB_TEAM_ID='zulip-webapp') def test_social_auth_github_team_not_member_failed(self) -> None: account_data_dict = self.get_account_data_dict(email=self.email, name=self.name) - with mock.patch('zproject.backends.GithubTeamBackend.user_data', + with mock.patch('social_core.backends.github.GithubTeamOAuth2.user_data', side_effect=AuthFailed('Not found')), \ mock.patch('logging.info') as mock_info: result = self.social_auth_test(account_data_dict, @@ -1408,7 +1408,7 @@ class GitHubAuthBackendTest(SocialAuthBase): @override_settings(SOCIAL_AUTH_GITHUB_TEAM_ID='zulip-webapp') def test_social_auth_github_team_member_success(self) -> None: account_data_dict = self.get_account_data_dict(email=self.email, name=self.name) - with mock.patch('zproject.backends.GithubTeamBackend.user_data', + with mock.patch('social_core.backends.github.GithubTeamOAuth2.user_data', return_value=account_data_dict): result = self.social_auth_test(account_data_dict, expect_choose_email_screen=True, @@ -1421,7 +1421,7 @@ class GitHubAuthBackendTest(SocialAuthBase): @override_settings(SOCIAL_AUTH_GITHUB_ORG_NAME='Zulip') def test_social_auth_github_organization_not_member_failed(self) -> None: account_data_dict = self.get_account_data_dict(email=self.email, name=self.name) - with mock.patch('zproject.backends.GithubOrganizationBackend.user_data', + with mock.patch('social_core.backends.github.GithubOrganizationOAuth2.user_data', side_effect=AuthFailed('Not found')), \ mock.patch('logging.info') as mock_info: result = self.social_auth_test(account_data_dict, @@ -1433,7 +1433,7 @@ class GitHubAuthBackendTest(SocialAuthBase): @override_settings(SOCIAL_AUTH_GITHUB_ORG_NAME='Zulip') def test_social_auth_github_organization_member_success(self) -> None: account_data_dict = self.get_account_data_dict(email=self.email, name=self.name) - with mock.patch('zproject.backends.GithubOrganizationBackend.user_data', + with mock.patch('social_core.backends.github.GithubOrganizationOAuth2.user_data', return_value=account_data_dict): result = self.social_auth_test(account_data_dict, expect_choose_email_screen=True, diff --git a/zproject/backends.py b/zproject/backends.py index 3c3a2bada4..2468b38628 100644 --- a/zproject/backends.py +++ b/zproject/backends.py @@ -17,9 +17,8 @@ import logging import magic import ujson from abc import ABC, abstractmethod -from typing import Any, Dict, List, Optional, Set, Tuple, Type, Union, no_type_check +from typing import Any, Dict, List, Optional, Set, Tuple, Type, Union from typing_extensions import TypedDict -from urllib.parse import urljoin from zxcvbn import zxcvbn from django_auth_ldap.backend import LDAPBackend, LDAPReverseEmailSearch, \ @@ -36,7 +35,7 @@ from django.urls import reverse from requests import HTTPError from onelogin.saml2.errors import OneLogin_Saml2_Error from social_core.backends.github import GithubOAuth2, GithubOrganizationOAuth2, \ - GithubTeamOAuth2, GithubMemberOAuth2 + GithubTeamOAuth2 from social_core.backends.azuread import AzureADOAuth2 from social_core.backends.base import BaseAuth from social_core.backends.google import GoogleOAuth2 @@ -1224,13 +1223,13 @@ class GitHubAuthBackend(SocialAuthMixin, GithubOAuth2): access_token, *args, **kwargs ) elif team_id is not None: - backend = GithubTeamBackend(self.strategy, self.redirect_uri) + backend = GithubTeamOAuth2(self.strategy, self.redirect_uri) try: return backend.user_data(access_token, *args, **kwargs) except AuthFailed: return dict(auth_failed_reason="GitHub user is not member of required team") elif org_name is not None: - backend = GithubOrganizationBackend(self.strategy, self.redirect_uri) + backend = GithubOrganizationOAuth2(self.strategy, self.redirect_uri) try: return backend.user_data(access_token, *args, **kwargs) except AuthFailed: @@ -1238,42 +1237,6 @@ class GitHubAuthBackend(SocialAuthMixin, GithubOAuth2): raise AssertionError("Invalid configuration") - def _user_data(self, access_token: str, path: Any=None) -> Any: - # Monkey patching. Should be removed once upstream merges a fix for - # https://github.com/python-social-auth/social-core/issues/430 - url = urljoin(self.api_url(), 'user{0}'.format(path or '')) - return self.get_json(url, headers={'Authorization': 'token {0}'.format(access_token)}) - -class GithubMemberUserDataMixin(GithubMemberOAuth2): - """ - This mixin class and the ones inheriting from it serve as a way - to monkey-patch a fix for https://github.com/python-social-auth/social-core/issues/430 - Changes from the commit adding this should be reverted once the issue is fixed upstream. - """ - @no_type_check - def user_data(self, access_token: str, *args: Any, **kwargs: Any) -> Any: # nocoverage - # this is copy-pasted from a good PR upstream that fixes the issue. - """Loads user data from service""" - user_data = super(GithubMemberOAuth2, self).user_data( - access_token, *args, **kwargs - ) - headers = {'Authorization': 'token {0}'.format(access_token)} - try: - self.request(self.member_url(user_data), headers=headers) - except HTTPError as err: - # if the user is a member of the organization, response code - # will be 204, see http://bit.ly/ZS6vFl - if err.response.status_code != 204: - raise AuthFailed(self, - 'User doesn\'t belong to the organization') - return user_data - -class GithubTeamBackend(GithubMemberUserDataMixin, GithubTeamOAuth2): - pass - -class GithubOrganizationBackend(GithubMemberUserDataMixin, GithubOrganizationOAuth2): - pass - @external_auth_method class AzureADAuthBackend(SocialAuthMixin, AzureADOAuth2): sort_order = 50