Merge tag '8.6.0' into rel

Author: ericholscher

.github/workflows/pip-tools.yaml

@@ -11,8 +11,15 @@ on:
     # Run weekly on day 0 at 00:00 UTC
     - cron: "0 0 * * 0"
 
+permissions:
+  contents: read
+
 jobs:
   update-dependencies:
+    permissions:
+      contents: write # to create branch (peter-evans/create-pull-request)
+      pull-requests: write # to create a PR (peter-evans/create-pull-request)
+
     name: Update dependencies
     runs-on: ubuntu-latest
     steps:

CHANGELOG.rst

@@ -1,3 +1,24 @@
+Version 8.6.0
+-------------
+
+:Date: September 28, 2022
+
+* `@github-actions[bot] <https://github.com/github-actions[bot]>`__: Dependencies: all packages updated via pip-tools (`#9621 <https://github.com/readthedocs/readthedocs.org/pull/9621>`__)
+* `@evildmp <https://github.com/evildmp>`__: Made some small changes to the MyST migration how-to (`#9620 <https://github.com/readthedocs/readthedocs.org/pull/9620>`__)
+* `@boahc077 <https://github.com/boahc077>`__: ci: add minimum GitHub at the workflow level for pip-tools.yaml (`#9617 <https://github.com/readthedocs/readthedocs.org/pull/9617>`__)
+* `@stsewd <https://github.com/stsewd>`__: Search: refactor API view (`#9613 <https://github.com/readthedocs/readthedocs.org/pull/9613>`__)
+* `@sashashura <https://github.com/sashashura>`__: GitHub Workflows security hardening (`#9609 <https://github.com/readthedocs/readthedocs.org/pull/9609>`__)
+* `@stsewd <https://github.com/stsewd>`__: Redirects: test with/without organizations (`#9605 <https://github.com/readthedocs/readthedocs.org/pull/9605>`__)
+* `@humitos <https://github.com/humitos>`__: Builds: concurrency small optimization (`#9602 <https://github.com/readthedocs/readthedocs.org/pull/9602>`__)
+* `@uvidyadharan <https://github.com/uvidyadharan>`__: Update intersphinx.rst (`#9601 <https://github.com/readthedocs/readthedocs.org/pull/9601>`__)
+* `@ericholscher <https://github.com/ericholscher>`__: Release 8.5.0 (`#9600 <https://github.com/readthedocs/readthedocs.org/pull/9600>`__)
+* `@github-actions[bot] <https://github.com/github-actions[bot]>`__: Dependencies: all packages updated via pip-tools (`#9596 <https://github.com/readthedocs/readthedocs.org/pull/9596>`__)
+* `@stsewd <https://github.com/stsewd>`__: OAuth: save refresh token (`#9594 <https://github.com/readthedocs/readthedocs.org/pull/9594>`__)
+* `@stsewd <https://github.com/stsewd>`__: Redirects: allow update (`#9593 <https://github.com/readthedocs/readthedocs.org/pull/9593>`__)
+* `@stsewd <https://github.com/stsewd>`__: Unresolver: strict validation for external versions and other fixes (`#9534 <https://github.com/readthedocs/readthedocs.org/pull/9534>`__)
+* `@stsewd <https://github.com/stsewd>`__: New unresolver implementation (`#9500 <https://github.com/readthedocs/readthedocs.org/pull/9500>`__)
+* `@stsewd <https://github.com/stsewd>`__: API v3: fix organizations permissions (`#8771 <https://github.com/readthedocs/readthedocs.org/pull/8771>`__)
+
 Version 8.5.0
 -------------
 

docs/conf.py

@@ -69,7 +69,7 @@
 
 master_doc = "index"
 copyright = "2010, Read the Docs, Inc & contributors"
-version = "8.5.0"
+version = "8.6.0"
 release = version
 exclude_patterns = ["_build"]
 default_role = "obj"

docs/user/guides/authors.rst

@@ -16,4 +16,4 @@ and :doc:`/intro/getting-started-with-mkdocs`.
    cross-referencing-with-sphinx
    intersphinx
    jupyter
-   migrate-rest-myst
+   Migrate from rST to MyST <migrate-rest-myst>

docs/user/guides/intersphinx.rst

@@ -83,8 +83,8 @@ Result:
    provided by Intersphinx:
 
    .. prompt:: bash $
-      
-      python -msphinx.ext.intersphinx https://www.sphinx-doc.org/en/master/objects.inv
+
+      python -m sphinx.ext.intersphinx https://www.sphinx-doc.org/en/master/objects.inv
 
 Intersphinx in Read the Docs
 ----------------------------
@@ -167,7 +167,7 @@ You can use it like this:
    The inventory file is by default located at ``objects.inv``, for example ``https://readthedocs-docs.readthedocs-hosted.com/en/latest/objects.inv``.
 
    .. code:: python
-      
+
       # conf.py file
 
       intersphinx_mapping = {

docs/user/guides/migrate-rest-myst.md

@@ -1,4 +1,8 @@
-# Migrating from reStructuredText to MyST Markdown
+# How to migrate from reStructuredText to MyST Markdown
+
+In this guide, you will find
+how you can start writing Markdown in your existing reStructuredText project,
+or migrate it completely.
 
 Sphinx is usually associated with reStructuredText, the markup language
 {pep}`designed for the CPython project in the early '00s <287>`.
@@ -9,15 +13,11 @@ The most powerful of such extensions is {doc}`MyST-Parser <myst-parser:index>`,
 which implements a CommonMark-compliant, extensible Markdown dialect
 with support for the Sphinx roles and directives that make it so useful.
 
-In this guide, you will find
-how you can start writing Markdown in your existing reStructuredText project,
-or migrate it completely.
-
 If, **instead of migrating**, you are starting a new project from scratch,
 have a look at {doc}`myst-parser:intro`.
 If you are starting a **project for Jupyter**, you can start with Jupyter Book, which uses ``MyST-Parser``, see the official Jupyter Book tutorial: {doc}`jupyterbook:start/your-first-book`
 
-## Writing your content both in reStructuredText and MyST
+## How to write  your content both in reStructuredText and MyST
 
 It is useful to ask whether a migration is necessary in the first place.
 Doing bulk migrations of large projects with lots of work in progress
@@ -54,7 +54,7 @@ If you want to use a different suffix, you can do so by changing your
 `source_suffix` configuration value in `conf.py`.
 ```
 
-## Converting existing reStructuredText documentation to MyST
+## How to convert existing reStructuredText documentation to MyST
 
 To convert existing reST documents to MyST, you can use
 the `rst2myst` CLI script shipped by {doc}`rst-to-myst:index`.
@@ -71,7 +71,7 @@ $ rst2myst convert docs/**/*.rst  # Convert every .rst file under the docs direc
 
 This will create a `.md` MyST file for every `.rst` source file converted.
 
-### Advanced usage of `rst2myst`
+### How to modify the behaviour of `rst2myst`
 
 The `rst2myst` accepts several flags to modify its behavior.
 All of them have sensible defaults, so you don't have to specify them
@@ -90,7 +90,7 @@ These are a few options you might find useful:
 You can read the full list of options in
 {doc}``the `rst2myst` documentation <rst-to-myst:cli>``.
 
-## Enabling optional syntax
+## How to enable optional syntax
 
 Some reStructuredText syntax will require you to enable certain MyST plugins.
 For example, to write [reST definition lists], you need to add a
@@ -108,7 +108,7 @@ in their documentation.
 
 [reST definition lists]: https://docutils.sourceforge.io/docs/user/rst/quickref.html#definition-lists
 
-## Writing reStructuredText syntax within MyST
+## How to write reStructuredText syntax within MyST
 
 There is a small chance that `rst2myst` does not properly understand a piece of reST syntax,
 either because there is a bug in the tool

package.json

@@ -1,6 +1,6 @@
 {
   "name": "readthedocs",
-  "version": "8.5.0",
+  "version": "8.6.0",
   "description": "Read the Docs build dependencies",
   "author": "Read the Docs, Inc <[email protected]>",
   "scripts": {

readthedocs/__init__.py

@@ -1,4 +1,4 @@
 """Read the Docs."""
 
 
-__version__ = "8.5.0"
+__version__ = "8.6.0"

readthedocs/api/v3/mixins.py

@@ -3,10 +3,7 @@
 from rest_framework.response import Response
 
 from readthedocs.builds.models import Version
-from readthedocs.core.history import (
-    safe_update_change_reason,
-    set_change_reason,
-)
+from readthedocs.core.history import safe_update_change_reason, set_change_reason
 from readthedocs.organizations.models import Organization
 from readthedocs.projects.models import Project
 
@@ -191,6 +188,13 @@ def has_admin_permission(self, user, organization):
 
         return False
 
+    def is_admin_member(self, user, organization):
+        return (
+            Project.objects.for_admin_user(user=user)
+            .filter(organizations__in=[organization])
+            .exists()
+        )
+
     def admin_organizations(self, user):
         return Organization.objects.for_admin_user(user=user)
 

readthedocs/api/v3/permissions.py

@@ -62,6 +62,13 @@ def has_permission(self, request, view):
             return True
 
 
+class IsOrganizationAdminMember(BasePermission):
+    def has_permission(self, request, view):
+        organization = view._get_parent_organization()
+        if view.is_admin_member(request.user, organization):
+            return True
+
+
 class UserOrganizationsListing(BasePermission):
 
     def has_permission(self, request, view):

readthedocs/api/v3/serializers.py

@@ -485,7 +485,6 @@ def _validate_remote_repository(self, data):
         If we cannot ensure the relationship here, this method should raise a
         `ValidationError`.
         """
-        pass
 
     def validate_name(self, value):
         potential_slug = slugify(value)
@@ -580,7 +579,7 @@ class ProjectSerializer(FlexFieldsModelSerializer):
     .. note::
 
        When using organizations, projects don't have the concept of users.
-       But we have organization.users.
+       But we have organization.owners.
     """
 
     homepage = serializers.SerializerMethodField()
@@ -592,9 +591,7 @@ class ProjectSerializer(FlexFieldsModelSerializer):
     translation_of = serializers.SerializerMethodField()
     default_branch = serializers.CharField(source='get_default_branch')
     tags = serializers.StringRelatedField(many=True)
-
-    if not settings.RTD_ALLOW_ORGANIZATIONS:
-        users = UserSerializer(many=True)
+    users = UserSerializer(many=True)
 
     _links = ProjectLinksSerializer(source='*')
 
@@ -624,13 +621,10 @@ class Meta:
 
             # NOTE: ``expandable_fields`` must not be included here. Otherwise,
             # they will be tried to be rendered and fail
-            # 'users',
             # 'active_versions',
-
-            '_links',
+            "_links",
+            "users",
         ]
-        if not settings.RTD_ALLOW_ORGANIZATIONS:
-            fields.append('users')
 
         expandable_fields = {
             # NOTE: this has to be a Model method, can't be a
@@ -656,6 +650,15 @@ class Meta:
             ),
         }
 
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        # When using organizations, projects don't have the concept of users.
+        # But we have organization.owners.
+        # Set here instead of at the class level,
+        # so is easier to test.
+        if settings.RTD_ALLOW_ORGANIZATIONS:
+            self.fields.pop("users", None)
+
     def get_homepage(self, obj):
         # Overridden only to return ``None`` when the project_url is ``''``
         return obj.project_url or None

readthedocs/api/v3/tests/mixins.py

@@ -101,6 +101,7 @@ def setUp(self):
         self.others_token = fixture.get(Token, key='other', user=self.other)
         self.others_project = fixture.get(
             Project,
+            id=2,
             slug='others-project',
             related_projects=[],
             main_language_project=None,

readthedocs/api/v3/views.py

@@ -3,10 +3,7 @@
 from rest_flex_fields import is_expanded
 from rest_flex_fields.views import FlexFieldsMixin
 from rest_framework import status
-from rest_framework.authentication import (
-    SessionAuthentication,
-    TokenAuthentication,
-)
+from rest_framework.authentication import SessionAuthentication, TokenAuthentication
 from rest_framework.decorators import action
 from rest_framework.metadata import SimpleMetadata
 from rest_framework.mixins import (
@@ -20,11 +17,7 @@
 from rest_framework.renderers import BrowsableAPIRenderer
 from rest_framework.response import Response
 from rest_framework.throttling import AnonRateThrottle, UserRateThrottle
-from rest_framework.viewsets import (
-    GenericViewSet,
-    ModelViewSet,
-    ReadOnlyModelViewSet,
-)
+from rest_framework.viewsets import GenericViewSet, ModelViewSet, ReadOnlyModelViewSet
 from rest_framework_extensions.mixins import NestedViewSetMixin
 
 from readthedocs.builds.models import Build, Version
@@ -58,7 +51,12 @@
     UpdateChangeReasonMixin,
     UpdateMixin,
 )
-from .permissions import CommonPermissions, IsProjectAdmin
+from .permissions import (
+    CommonPermissions,
+    IsOrganizationAdminMember,
+    IsProjectAdmin,
+    UserOrganizationsListing,
+)
 from .renderers import AlphabeticalSortedJSONRenderer
 from .serializers import (
     BuildCreateSerializer,
@@ -393,16 +391,19 @@ def perform_create(self, serializer):
         serializer.save()
 
 
-class OrganizationsViewSetBase(APIv3Settings, NestedViewSetMixin,
-                               OrganizationQuerySetMixin,
-                               ReadOnlyModelViewSet):
+class OrganizationsViewSet(
+    APIv3Settings,
+    NestedViewSetMixin,
+    OrganizationQuerySetMixin,
+    ReadOnlyModelViewSet,
+):
 
     model = Organization
     lookup_field = 'slug'
     lookup_url_kwarg = 'organization_slug'
     queryset = Organization.objects.all()
     serializer_class = OrganizationSerializer
-
+    permission_classes = [UserOrganizationsListing | IsOrganizationAdminMember]
     permit_list_expands = [
         'projects',
         'teams',
@@ -422,19 +423,16 @@ def get_queryset(self):
         return super().get_queryset()
 
 
-class OrganizationsViewSet(SettingsOverrideObject):
-    _default_class = OrganizationsViewSetBase
-
-
-class OrganizationsProjectsViewSetBase(APIv3Settings, NestedViewSetMixin,
-                                       OrganizationQuerySetMixin,
-                                       ReadOnlyModelViewSet):
+class OrganizationsProjectsViewSet(
+    APIv3Settings, NestedViewSetMixin, OrganizationQuerySetMixin, ReadOnlyModelViewSet
+):
 
     model = Project
     lookup_field = 'slug'
     lookup_url_kwarg = 'project_slug'
     queryset = Project.objects.all()
     serializer_class = ProjectSerializer
+    permission_classes = [IsOrganizationAdminMember]
     permit_list_expands = [
         'organization',
         'organization.teams',
@@ -444,10 +442,6 @@ def get_view_name(self):
         return f'Organizations Projects {self.suffix}'
 
 
-class OrganizationsProjectsViewSet(SettingsOverrideObject):
-    _default_class = OrganizationsProjectsViewSetBase
-
-
 class RemoteRepositoryViewSet(
     APIv3Settings,
     RemoteQuerySetMixin,

readthedocs/builds/querysets.py

@@ -205,9 +205,9 @@ def concurrent(self, project):
         """
         limit_reached = False
         query = Q(
-            project__slug=project.slug,
+            project=project,
             # Limit builds to 5 hours ago to speed up the query
-            date__gte=timezone.now() - datetime.timedelta(hours=5),
+            date__gt=timezone.now() - datetime.timedelta(hours=5),
         )
 
         if project.main_language_project: