Merge branch 'main' of github.com:readthedocs/readthedocs.org into humitos/addons/flyout-versions-sorting-algorithm

Author: humitos

CHANGELOG.rst

@@ -1,3 +1,30 @@
+Version 10.21.0
+---------------
+
+:Date: March 04, 2024
+
+* `@stsewd <https://github.com/stsewd>`__: Project: force PR previews to match repo only if the repo is public (`#11184 <https://github.com/readthedocs/readthedocs.org/pull/11184>`__)
+* `@github-actions[bot] <https://github.com/github-actions[bot]>`__: Dependencies: all packages updated via pip-tools (`#11180 <https://github.com/readthedocs/readthedocs.org/pull/11180>`__)
+* `@ericholscher <https://github.com/ericholscher>`__: Init path to ensure it exists (`#11178 <https://github.com/readthedocs/readthedocs.org/pull/11178>`__)
+* `@stsewd <https://github.com/stsewd>`__: Project: build both default and latest version when saving the project form (`#11177 <https://github.com/readthedocs/readthedocs.org/pull/11177>`__)
+* `@humitos <https://github.com/humitos>`__: Build: show the YAML config file before validating it (`#11175 <https://github.com/readthedocs/readthedocs.org/pull/11175>`__)
+* `@humitos <https://github.com/humitos>`__: Notification: make the OAuth one dismissable (`#11172 <https://github.com/readthedocs/readthedocs.org/pull/11172>`__)
+* `@humitos <https://github.com/humitos>`__: Build: set CANCELLED state when the build is cancelled (`#11171 <https://github.com/readthedocs/readthedocs.org/pull/11171>`__)
+* `@stsewd <https://github.com/stsewd>`__: Project: merge basic and advanced forms (`#11169 <https://github.com/readthedocs/readthedocs.org/pull/11169>`__)
+* `@humitos <https://github.com/humitos>`__: Admin: remove temporal opt-out email settings (`#11164 <https://github.com/readthedocs/readthedocs.org/pull/11164>`__)
+* `@humitos <https://github.com/humitos>`__: New dashboard: notification to point users there (`#11161 <https://github.com/readthedocs/readthedocs.org/pull/11161>`__)
+* `@stsewd <https://github.com/stsewd>`__: Allauth: Include Bitbucket in the list of social accounts (`#11160 <https://github.com/readthedocs/readthedocs.org/pull/11160>`__)
+* `@humitos <https://github.com/humitos>`__: Release 10.20.0 (`#11158 <https://github.com/readthedocs/readthedocs.org/pull/11158>`__)
+* `@stsewd <https://github.com/stsewd>`__: Allauth: define secrets in settings (`#11156 <https://github.com/readthedocs/readthedocs.org/pull/11156>`__)
+* `@hoyes <https://github.com/hoyes>`__: Dev: Default RTD_DJANGO_DEBUG to False if not set (`#11154 <https://github.com/readthedocs/readthedocs.org/pull/11154>`__)
+* `@humitos <https://github.com/humitos>`__: Build: bugfix to show build notifications (`#11153 <https://github.com/readthedocs/readthedocs.org/pull/11153>`__)
+* `@ewjoachim <https://github.com/ewjoachim>`__: Fix Poetry instructions (`#11152 <https://github.com/readthedocs/readthedocs.org/pull/11152>`__)
+* `@humitos <https://github.com/humitos>`__: VCS: deprecation dates at application level (`#11147 <https://github.com/readthedocs/readthedocs.org/pull/11147>`__)
+* `@humitos <https://github.com/humitos>`__:  Notifications: allow dismiss user's notifications  (`#11130 <https://github.com/readthedocs/readthedocs.org/pull/11130>`__)
+* `@humitos <https://github.com/humitos>`__: Projects: remove old/non-used fields (`#11124 <https://github.com/readthedocs/readthedocs.org/pull/11124>`__)
+* `@stsewd <https://github.com/stsewd>`__: Match login template with changes from .com (`#11101 <https://github.com/readthedocs/readthedocs.org/pull/11101>`__)
+* `@humitos <https://github.com/humitos>`__: Addons + Proxito: return `X-RTD-Resolver-Filename` and inject via CF (`#11100 <https://github.com/readthedocs/readthedocs.org/pull/11100>`__)
+
 Version 10.20.0
 ---------------
 

common

@@ -77,7 +77,7 @@
 
 master_doc = "index"
 copyright = "Read the Docs, Inc & contributors"
-version = "10.20.0"
+version = "10.21.0"
 release = version
 exclude_patterns = ["_build", "shared", "_includes"]
 default_role = "obj"

docs/conf.py

@@ -130,5 +130,41 @@ ELASTICSEARCH_DSL_AUTOSYNC
 
 This setting is used for automatically indexing objects to elasticsearch.
 
-
 .. _elasticsearch-dsl-py.connections.configure: https://elasticsearch-dsl.readthedocs.io/en/stable/configuration.html#multiple-clusters
+
+
+Docker pass-through settings
+----------------------------
+
+If you run a Docker environment, it is possible to pass some secrets through to
+the Docker containers from your host system. For security reasons, we do not
+commit these secrets to our repository. Instead, we individually define these
+settings for our local environments.
+
+We recommend using `direnv`_ for storing local development secrets.
+
+.. _direnv: https://direnv.net/
+
+Allauth secrets
+~~~~~~~~~~~~~~~
+
+It is possible to set the Allauth application secrets for our supported
+providers using the following environment variables:
+
+.. envvar:: RTD_SOCIALACCOUNT_PROVIDERS_GITHUB_CLIENT_ID
+.. envvar:: RTD_SOCIALACCOUNT_PROVIDERS_GITHUB_SECRET
+.. envvar:: RTD_SOCIALACCOUNT_PROVIDERS_GITLAB_CLIENT_ID
+.. envvar:: RTD_SOCIALACCOUNT_PROVIDERS_GITLAB_SECRET
+.. envvar:: RTD_SOCIALACCOUNT_PROVIDERS_BITBUCKET_OAUTH2_CLIENT_ID
+.. envvar:: RTD_SOCIALACCOUNT_PROVIDERS_BITBUCKET_OAUTH2_SECRET
+.. envvar:: RTD_SOCIALACCOUNT_PROVIDERS_GOOGLE_CLIENT_ID
+.. envvar:: RTD_SOCIALACCOUNT_PROVIDERS_GOOGLE_SECRET
+
+Stripe secrets
+~~~~~~~~~~~~~~
+
+The following secrets are required to use ``djstripe`` and our Stripe integration.
+
+.. envvar:: RTD_STRIPE_SECRET
+.. envvar:: RTD_STRIPE_PUBLISHABLE
+.. envvar:: RTD_DJSTRIPE_WEBHOOK_SECRET

docs/dev/settings.rst

@@ -36,9 +36,9 @@ Learn how to configure this SSO method with our :doc:`/guides/setup-single-sign-
 SSO with Google Workspace
 -------------------------
 
-This feature allows you to restrict access to users with a specific email address (e.g. ``[email protected]``),
+This feature allows you to easily manage access to users with a specific email address (e.g. ``[email protected]``),
 where ``company.com`` is a registered Google Workspace domain.
-As this identity provider does not provide authorization over each project a user has access to,
+As this identity provider does not provide information about which projects a user has access to,
 permissions are managed by the :ref:`internal Read the Docs's teams <commercial/organizations:Team Types>` authorization system.
 
 This feature is only available on the **Pro plan** and above.

docs/user/commercial/single-sign-on.rst

@@ -26,7 +26,8 @@ Privacy levels
 
    Privacy levels are only supported on :doc:`/commercial/index`.
 
-If you didn’t import your project manually, the privacy level of pull request previews will match your repository,
+If you didn’t import your project manually and your repository is public,
+the privacy level of pull request previews will be set to *Public*,
 otherwise it will be set to *Private*.
 Public pull request previews are available to anyone with the link to the preview,
 while private previews are only available to users with access to the Read the Docs project.

docs/user/guides/pull-requests.rst

@@ -24,7 +24,8 @@ User setup
 ~~~~~~~~~~
 
 Using this setup,
-all users who have access to the configured Google Workspace will be granted a subset of permissions on your organization automatically on account creation.
+all users who have access to the configured Google Workspace will automatically join to your organization when they sign up with their Google account.
+Existing users will not be automatically joined to the organization.
 
 You can still add outside collaborators and manage their access.
 There are two ways to manage this access:
@@ -42,6 +43,14 @@ However, you can define which teams users matching your company's domain email a
 2. Select **Google** in the :guilabel:`Provider` drop-down.
 3. Press :guilabel:`Save`.
 
+After enabling SSO with Google Workspace,
+all users with email addresses from your configured Google Workspace domain will be required to signup using their Google account.
+
+.. warning::
+
+   Existing users with email addresses from your configured Google Workspace domain will not be required to link their Google account,
+   but they won't be automatically joined to your organization.
+
 Configure team for all users to join
 ------------------------------------
 
@@ -62,7 +71,23 @@ Revoke user's access to all the projects
 ----------------------------------------
 
 By disabling the Google Workspace account with email ``[email protected]``,
-you revoke access to all the projects that user had access and disable login on Read the Docs completely for that user.
+you revoke access to all the projects the linked Read the Docs user had access to,
+and disable login on Read the Docs completely for that user.
+
+.. warning::
+
+   If the user signed up to Read the Docs previously to enabling SSO with Google Workspace on your organization,
+   they may still have access to their account and projects if they were manually added to a team.
+
+   To completely revoke access to a user, remove them from all the teams they are part of.
+
+.. warning::
+
+   If the user was already signed in to Read the Docs when their access was revoked,
+   they may still have access to documentation pages until their session expires.
+   This is three days for the dashboard and documentation pages.
+
+   To completely revoke access to a user, remove them from all the teams they are part of.
 
 .. seealso::
 

docs/user/guides/setup-single-sign-on-google-email.rst

@@ -48,7 +48,8 @@ if you have environment variables with private information, make sure they aren'
 See :ref:`environment-variables:Environment variables and build process` for more information.
 
 On |com_brand| you can set pull request previews to be private or public,
-if you didn't import your project manually, the privacy level of pull request previews will match your repository.
+If you didn’t import your project manually and your repository is public,
+the privacy level of pull request previews will be set to *Public*.
 Public pull request previews are available to anyone with the link to the preview,
 while private previews are only available to users with access to the Read the Docs project.
 

docs/user/pull-requests.rst

@@ -1,6 +1,6 @@
 {
   "name": "readthedocs",
-  "version": "10.20.0",
+  "version": "10.21.0",
   "description": "Read the Docs build dependencies",
   "author": "Read the Docs, Inc <[email protected]>",
   "scripts": {

package.json

@@ -1,4 +1,4 @@
 """Read the Docs."""
 
 
-__version__ = "10.20.0"
+__version__ = "10.21.0"

readthedocs/__init__.py

@@ -37,8 +37,8 @@ def sync_versions_to_db(project, versions, type):
     :returns: set of versions' slug added
     """
     old_version_values = project.versions.filter(type=type).values_list(
-        'verbose_name',
-        'identifier',
+        "verbose_name",
+        "identifier",
     )
     old_versions = dict(old_version_values)
 
@@ -48,8 +48,8 @@ def sync_versions_to_db(project, versions, type):
     has_user_stable = False
     has_user_latest = False
     for version in versions:
-        version_id = version['identifier']
-        version_name = version['verbose_name']
+        version_id = version["identifier"]
+        version_name = version["verbose_name"]
         if version_name == STABLE_VERBOSE_NAME:
             has_user_stable = True
             created_version, created = _set_or_create_version(
@@ -90,7 +90,7 @@ def sync_versions_to_db(project, versions, type):
             )
 
             log.info(
-                'Re-syncing versions: version updated.',
+                "Re-syncing versions: version updated.",
                 version_verbose_name=version_name,
                 version_id=version_id,
             )
@@ -101,26 +101,22 @@ def sync_versions_to_db(project, versions, type):
     added.update(_create_versions(project, type, versions_to_create))
 
     if not has_user_stable:
-        stable_version = (
-            project.versions.filter(slug=STABLE, type=type).first()
-        )
+        stable_version = project.versions.filter(slug=STABLE, type=type).first()
         if stable_version:
             # Put back the RTD's stable version
             stable_version.machine = True
             stable_version.save()
     if not has_user_latest:
-        latest_version = (
-            project.versions.filter(slug=LATEST, type=type).first()
-        )
+        latest_version = project.versions.filter(slug=LATEST, type=type).first()
         if latest_version:
             # Put back the RTD's latest version
             latest_version.machine = True
             latest_version.save()
     if added:
         log.info(
-            'Re-syncing versions: versions added.',
+            "Re-syncing versions: versions added.",
             count=len(added),
-            versions=','.join(itertools.islice(added, 100)),
+            versions=",".join(itertools.islice(added, 100)),
         )
     return added
 
@@ -174,14 +170,8 @@ def _set_or_create_version(project, slug, version_id, verbose_name, type_):
 def _get_deleted_versions_qs(project, tags_data, branches_data):
     # We use verbose_name for tags
     # because several tags can point to the same identifier.
-    versions_tags = [
-        version['verbose_name']
-        for version in tags_data
-    ]
-    versions_branches = [
-        version['identifier']
-        for version in branches_data
-    ]
+    versions_tags = [version["verbose_name"] for version in tags_data]
+    versions_branches = [version["identifier"] for version in branches_data]
 
     to_delete_qs = (
         project.versions(manager=INTERNAL)
@@ -206,32 +196,28 @@ def delete_versions_from_db(project, tags_data, branches_data):
 
     :returns: The slug of the deleted versions from the database.
     """
-    to_delete_qs = (
-        _get_deleted_versions_qs(
-            project=project,
-            tags_data=tags_data,
-            branches_data=branches_data,
-        )
-        .exclude(active=True)
-    )
+    to_delete_qs = _get_deleted_versions_qs(
+        project=project,
+        tags_data=tags_data,
+        branches_data=branches_data,
+    ).exclude(active=True)
     _, deleted = to_delete_qs.delete()
-    versions_count = deleted.get('builds.Version', 0)
+    versions_count = deleted.get("builds.Version", 0)
     log.info(
-        'Re-syncing versions: versions deleted.', project_slug=project.slug, count=versions_count,
+        "Re-syncing versions: versions deleted.",
+        project_slug=project.slug,
+        count=versions_count,
     )
 
 
 def get_deleted_active_versions(project, tags_data, branches_data):
     """Return the slug of active versions that were deleted from the repository."""
-    to_delete_qs = (
-        _get_deleted_versions_qs(
-            project=project,
-            tags_data=tags_data,
-            branches_data=branches_data,
-        )
-        .filter(active=True)
-    )
-    return set(to_delete_qs.values_list('slug', flat=True))
+    to_delete_qs = _get_deleted_versions_qs(
+        project=project,
+        tags_data=tags_data,
+        branches_data=branches_data,
+    ).filter(active=True)
+    return set(to_delete_qs.values_list("slug", flat=True))
 
 
 def run_automation_rules(project, added_versions, deleted_active_versions):