Require 2FA to add a Trusted Publisher (pypi#14360)

* Require 2FA to add a Trusted Publisher * Apply suggestions from code review --------- Co-authored-by: Dustin Ingram <di@users.noreply.github.com>
ActiveState · Aug 16, 2023 · 496338e · 496338e
1 parent 1cf6b3f
commit 496338e
Show file tree

Hide file tree

Showing 3 changed files with 45 additions and 19 deletions.
diff --git a/warehouse/locale/messages.pot b/warehouse/locale/messages.pot
@@ -1268,10 +1268,10 @@ msgstr ""
 #: warehouse/templates/manage/organizations.html:232
 #: warehouse/templates/manage/organizations.html:250
 #: warehouse/templates/manage/organizations.html:269
-#: warehouse/templates/manage/project/publishing.html:78
-#: warehouse/templates/manage/project/publishing.html:93
-#: warehouse/templates/manage/project/publishing.html:108
-#: warehouse/templates/manage/project/publishing.html:123
+#: warehouse/templates/manage/project/publishing.html:79
+#: warehouse/templates/manage/project/publishing.html:94
+#: warehouse/templates/manage/project/publishing.html:109
+#: warehouse/templates/manage/project/publishing.html:124
 #: warehouse/templates/manage/project/roles.html:273
 #: warehouse/templates/manage/project/roles.html:284
 #: warehouse/templates/manage/project/roles.html:296
@@ -2423,7 +2423,7 @@ msgstr ""
 #: warehouse/templates/manage/organization/roles.html:53
 #: warehouse/templates/manage/organization/roles.html:172
 #: warehouse/templates/manage/organizations.html:90
-#: warehouse/templates/manage/project/publishing.html:76
+#: warehouse/templates/manage/project/publishing.html:77
 #: warehouse/templates/manage/project/roles.html:50
 #: warehouse/templates/manage/project/roles.html:85
 #: warehouse/templates/manage/project/roles.html:115
@@ -4125,42 +4125,42 @@ msgid "The project (on PyPI) that will be created when this publisher is used"
 msgstr ""
 
 #: warehouse/templates/manage/account/publishing.html:52
-#: warehouse/templates/manage/project/publishing.html:81
+#: warehouse/templates/manage/project/publishing.html:82
 msgid "owner"
 msgstr ""
 
 #: warehouse/templates/manage/account/publishing.html:54
-#: warehouse/templates/manage/project/publishing.html:83
+#: warehouse/templates/manage/project/publishing.html:84
 msgid "The GitHub organization name or GitHub username that owns the repository"
 msgstr ""
 
 #: warehouse/templates/manage/account/publishing.html:62
-#: warehouse/templates/manage/project/publishing.html:91
+#: warehouse/templates/manage/project/publishing.html:92
 msgid "Repository name"
 msgstr ""
 
 #: warehouse/templates/manage/account/publishing.html:67
-#: warehouse/templates/manage/project/publishing.html:96
+#: warehouse/templates/manage/project/publishing.html:97
 msgid "repository"
 msgstr ""
 
 #: warehouse/templates/manage/account/publishing.html:69
-#: warehouse/templates/manage/project/publishing.html:98
+#: warehouse/templates/manage/project/publishing.html:99
 msgid "The name of the GitHub repository that contains the publishing workflow"
 msgstr ""
 
 #: warehouse/templates/manage/account/publishing.html:77
-#: warehouse/templates/manage/project/publishing.html:106
+#: warehouse/templates/manage/project/publishing.html:107
 msgid "Workflow name"
 msgstr ""
 
 #: warehouse/templates/manage/account/publishing.html:82
-#: warehouse/templates/manage/project/publishing.html:111
+#: warehouse/templates/manage/project/publishing.html:112
 msgid "workflow.yml"
 msgstr ""
 
 #: warehouse/templates/manage/account/publishing.html:84
-#: warehouse/templates/manage/project/publishing.html:113
+#: warehouse/templates/manage/project/publishing.html:114
 msgid ""
 "The filename of the publishing workflow. This file should exist in the "
 "<code>.github/workflows/</code> directory in the repository configured "
@@ -4170,22 +4170,22 @@ msgstr ""
 #: warehouse/templates/manage/account/publishing.html:92
 #: warehouse/templates/manage/account/publishing.html:174
 #: warehouse/templates/manage/project/publishing.html:47
-#: warehouse/templates/manage/project/publishing.html:121
+#: warehouse/templates/manage/project/publishing.html:122
 msgid "Environment name"
 msgstr ""
 
 #: warehouse/templates/manage/account/publishing.html:96
-#: warehouse/templates/manage/project/publishing.html:125
+#: warehouse/templates/manage/project/publishing.html:126
 msgid "(optional)"
 msgstr ""
 
 #: warehouse/templates/manage/account/publishing.html:99
-#: warehouse/templates/manage/project/publishing.html:128
+#: warehouse/templates/manage/project/publishing.html:129
 msgid "release"
 msgstr ""
 
 #: warehouse/templates/manage/account/publishing.html:101
-#: warehouse/templates/manage/project/publishing.html:130
+#: warehouse/templates/manage/project/publishing.html:131
 #, python-format
 msgid ""
 "The name of the <a href=\"%(href)s\">GitHub Actions environment</a> that "
@@ -4197,7 +4197,7 @@ msgid ""
 msgstr ""
 
 #: warehouse/templates/manage/account/publishing.html:116
-#: warehouse/templates/manage/project/publishing.html:145
+#: warehouse/templates/manage/project/publishing.html:146
 #: warehouse/templates/manage/project/roles.html:320
 #: warehouse/templates/manage/team/roles.html:123
 msgid "Add"
@@ -4251,6 +4251,14 @@ msgid ""
 "trusted publishers <a href=\"%(href)s\">here</a>."
 msgstr ""
 
+#: warehouse/templates/manage/account/publishing.html:231
+#: warehouse/templates/manage/project/publishing.html:152
+#, python-format
+msgid ""
+"You must first enable <a href=\"%(href)s\">two-factor authentication</a> "
+"on your account before adding a new publisher."
+msgstr ""
+
 #: warehouse/templates/manage/account/recovery_codes-burn.html:34
 msgid ""
 "In order to verify that you have safely stored your recovery codes for "
@@ -5479,7 +5487,7 @@ msgstr ""
 msgid "Add a new publisher"
 msgstr ""
 
-#: warehouse/templates/manage/project/publishing.html:65
+#: warehouse/templates/manage/project/publishing.html:66
 #, python-format
 msgid ""
 "Read more about GitHub Actions's OpenID Connect support <a "

diff --git a/warehouse/templates/manage/account/publishing.html b/warehouse/templates/manage/account/publishing.html
@@ -208,6 +208,7 @@ <h2>{% trans %}Add a new pending publisher{% endtrans %}</h2>
     {% endtrans %}
   </p>
 
+  {% if request.user.has_two_factor %}
   {% set publishers = [("GitHub", github_form(request, pending_github_publisher_form))] %}
 
   <div class="horizontal-tabs" data-controller="horizontal-tabs" data-horizontal-tabs-index="0">
@@ -225,4 +226,12 @@ <h2>{% trans %}Add a new pending publisher{% endtrans %}</h2>
     {% endfor %}
   </div>
 
+  {% else %}{# user has not enabled 2FA #}
+  <div class="callout-block callout-block--warning">
+    {% trans href=request.route_path('manage.account.two-factor') %}
+    You must first enable <a href="{{ href }}">two-factor authentication</a> on your account before adding a new publisher.
+    {% endtrans %}
+  </div>
+  {% endif %}
+
 {% endblock %}
diff --git a/warehouse/templates/manage/project/publishing.html b/warehouse/templates/manage/project/publishing.html
@@ -59,6 +59,7 @@ <h2>{% trans %}Manage current publishers{% endtrans %}</h2>
     {% endif %}
 
     <h2 class="no-bottom-padding">{% trans %}Add a new publisher{% endtrans %}</h2>
+    {% if request.user.has_two_factor %}
     <h3>GitHub</h3>
 
     <p>
@@ -145,6 +146,14 @@ <h3>GitHub</h3>
         <input type="submit" value="{% trans %}Add{% endtrans %}" class="button button--primary">
       </div>
     </form>
+
+    {% else %}{# user has not enabled 2FA #}
+    <div class="callout-block callout-block--warning">
+      {% trans href=request.route_path('manage.account.two-factor') %}
+      You must first enable <a href="{{ href }}">two-factor authentication</a> on your account before adding a new publisher.
+      {% endtrans %}
+    </div>
+    {% endif %}
   </div>
 </div>