Individual file deletion

Author: di

tests/unit/manage/test_views.py

@@ -351,6 +351,151 @@ def test_delete_project_release_bad_confirm(self):
             )
         ]
 
+    def test_delete_project_release_file(self, monkeypatch):
+        release_file = pretend.stub(
+            filename='foo-bar.tar.gz',
+            id=str(uuid.uuid4()),
+        )
+        release = pretend.stub(
+            version='1.2.3',
+            project=pretend.stub(name='foobar'),
+        )
+        request = pretend.stub(
+            POST={
+                'confirm_filename': release_file.filename,
+                'file_id': release_file.id,
+            },
+            method="POST",
+            db=pretend.stub(
+                delete=pretend.call_recorder(lambda a: None),
+                add=pretend.call_recorder(lambda a: None),
+                query=lambda a: pretend.stub(
+                    filter=lambda *a: pretend.stub(one=lambda: release_file),
+                ),
+            ),
+            route_path=pretend.call_recorder(lambda *a, **kw: '/the-redirect'),
+            session=pretend.stub(
+                flash=pretend.call_recorder(lambda *a, **kw: None)
+            ),
+            user=pretend.stub(),
+            remote_addr=pretend.stub(),
+        )
+        journal_obj = pretend.stub()
+        journal_cls = pretend.call_recorder(lambda **kw: journal_obj)
+        monkeypatch.setattr(views, 'JournalEntry', journal_cls)
+
+        view = views.ManageProjectRelease(release, request)
+
+        result = view.delete_project_release_file()
+
+        assert isinstance(result, HTTPSeeOther)
+        assert result.headers["Location"] == "/the-redirect"
+
+        assert request.session.flash.calls == [
+            pretend.call(
+                f"Successfully deleted file {release_file.filename!r}.",
+                queue="success",
+            )
+        ]
+        assert request.db.delete.calls == [pretend.call(release_file)]
+        assert request.db.add.calls == [pretend.call(journal_obj)]
+        assert journal_cls.calls == [
+            pretend.call(
+                name=release.project.name,
+                action=f"remove file {release_file.filename}",
+                version=release.version,
+                submitted_by=request.user,
+                submitted_from=request.remote_addr,
+            ),
+        ]
+        assert request.route_path.calls == [
+            pretend.call(
+                'manage.project.release',
+                project_name=release.project.name,
+                version=release.version,
+            )
+        ]
+
+    def test_delete_project_release_file_no_confirm(self):
+        release = pretend.stub(
+            version='1.2.3',
+            project=pretend.stub(name='foobar'),
+        )
+        request = pretend.stub(
+            POST={'confirm_filename': ''},
+            method="POST",
+            db=pretend.stub(delete=pretend.call_recorder(lambda a: None)),
+            route_path=pretend.call_recorder(lambda *a, **kw: '/the-redirect'),
+            session=pretend.stub(
+                flash=pretend.call_recorder(lambda *a, **kw: None)
+            ),
+        )
+        view = views.ManageProjectRelease(release, request)
+
+        result = view.delete_project_release_file()
+
+        assert isinstance(result, HTTPSeeOther)
+        assert result.headers["Location"] == "/the-redirect"
+
+        assert request.db.delete.calls == []
+        assert request.session.flash.calls == [
+            pretend.call(
+                "Must confirm the request.", queue='error'
+            )
+        ]
+        assert request.route_path.calls == [
+            pretend.call(
+                'manage.project.release',
+                project_name=release.project.name,
+                version=release.version,
+            )
+        ]
+
+    def test_delete_project_release_file_bad_confirm(self):
+        release_file = pretend.stub(
+            filename='foo-bar.tar.gz',
+            id=str(uuid.uuid4()),
+        )
+        release = pretend.stub(
+            version='1.2.3',
+            project=pretend.stub(name='foobar'),
+        )
+        request = pretend.stub(
+            POST={'confirm_filename': 'invalid'},
+            method="POST",
+            db=pretend.stub(
+                delete=pretend.call_recorder(lambda a: None),
+                query=lambda a: pretend.stub(
+                    filter=lambda *a: pretend.stub(one=lambda: release_file),
+                ),
+            ),
+            route_path=pretend.call_recorder(lambda *a, **kw: '/the-redirect'),
+            session=pretend.stub(
+                flash=pretend.call_recorder(lambda *a, **kw: None)
+            ),
+        )
+        view = views.ManageProjectRelease(release, request)
+
+        result = view.delete_project_release_file()
+
+        assert isinstance(result, HTTPSeeOther)
+        assert result.headers["Location"] == "/the-redirect"
+
+        assert request.db.delete.calls == []
+        assert request.session.flash.calls == [
+            pretend.call(
+                f"'invalid' is not the same as {release_file.filename!r}",
+                queue="error",
+            )
+        ]
+        assert request.route_path.calls == [
+            pretend.call(
+                'manage.project.release',
+                project_name=release.project.name,
+                version=release.version,
+            )
+        ]
+
 
 class TestManageProjectRoles:
 

warehouse/manage/views.py

@@ -23,7 +23,7 @@
 from warehouse.manage.forms import (
     CreateRoleForm, ChangeRoleForm, SaveProfileForm
 )
-from warehouse.packaging.models import JournalEntry, Role
+from warehouse.packaging.models import JournalEntry, Role, File
 from warehouse.utils.project import confirm_project, remove_project
 
 
@@ -186,6 +186,71 @@ def delete_project_release(self):
             )
         )
 
+    @view_config(
+        request_method="POST",
+        request_param=["confirm_filename", "file_id"]
+    )
+    def delete_project_release_file(self):
+        filename = self.request.POST.get('confirm_filename')
+        if not filename:
+            self.request.session.flash(
+                "Must confirm the request.", queue='error'
+            )
+            return HTTPSeeOther(
+                self.request.route_path(
+                    'manage.project.release',
+                    project_name=self.release.project.name,
+                    version=self.release.version,
+                )
+            )
+
+        release_file = (
+            self.request.db.query(File)
+            .filter(
+                File.name == self.release.project.name,
+                File.id == self.request.POST.get('file_id'),
+            )
+            .one()
+        )
+
+        if filename != release_file.filename:
+            self.request.session.flash(
+                f"{filename!r} is not the same as {release_file.filename!r}",
+                queue="error",
+            )
+            return HTTPSeeOther(
+                self.request.route_path(
+                    'manage.project.release',
+                    project_name=self.release.project.name,
+                    version=self.release.version,
+                )
+            )
+
+        self.request.db.add(
+            JournalEntry(
+                name=self.release.project.name,
+                action=f"remove file {release_file.filename}",
+                version=self.release.version,
+                submitted_by=self.request.user,
+                submitted_from=self.request.remote_addr,
+            ),
+        )
+
+        self.request.db.delete(release_file)
+
+        self.request.session.flash(
+            f"Successfully deleted file {release_file.filename!r}.",
+            queue="success",
+        )
+
+        return HTTPSeeOther(
+            self.request.route_path(
+                'manage.project.release',
+                project_name=self.release.project.name,
+                version=self.release.version,
+            )
+        )
+
 
 @view_config(
     route_name="manage.project.roles",

warehouse/templates/manage/release.html

@@ -139,7 +139,10 @@ <h3 class="modal__title">Delete Release {{ release.version }}?</h3>
     <div id="delete-file-modal-{{ loop.index }}" class="modal">
       {% set project_name = project.normalized_name %}
       <div class="modal__content" role="dialog">
-        <form method="POST" action="" class="modal__form">
+        <form method="POST" class="modal__form">
+          <input name="csrf_token" type="hidden" value="{{ request.session.get_csrf_token() }}">
+          <input name="file_id" type="hidden" value="{{ file.id }}">
+          {{ file.id }}
           <a href="#modal-close" title="Close" class="modal__close">
             <i class="fa fa-times" aria-hidden="true"></i>
             <span class="sr-only">close</span>
@@ -150,9 +153,8 @@ <h3 class="modal__title">Delete {{ file.filename }}?</h3>
               <p>Warning: This action cannot be undone!</p>
             </div>
             <p>Confirm the project name to continue.</p>
-            <input name="csrf_token" type="hidden" value="{{ request.session.get_csrf_token() }}">
-            <label for="confirm">Project Name</label>
-            <input name="confirm" type="text" placeholder="Confirm project name" autocomplete="off" autocorrect="off" autocapitalize="off">
+            <label for="confirm_filename">File name</label>
+            <input name="confirm_filename" type="text" placeholder="Confirm file name" autocomplete="off" autocorrect="off" autocapitalize="off">
           </div>
           <div class="modal__footer">
             <a href="#modal-close" class="button modal__action">Cancel</a>