Feature/prevent project creation - #11889
Open
futa-ikeda wants to merge 94 commits into
Open
Conversation
Adds PREVENT_PROJECT_CREATION waffle flag and a ProjectCreationNotAllowed permission class that returns 403 on POST to /v2/nodes/ when the flag is on. Flag off leaves existing behavior unchanged.
[ENG-11081] Prevent POST /v2/nodes/ when project creation flag is active
[ENG-11088] Prevent POST /v2/nodes/<id>/forks/ when project creation flag is active
…aft_node.py based on the waffle flag
…on flag is active
…ion_classes Replaces full redeclaration with BaseChildrenList.permission_classes + (ProjectCreationNotAllowed,) so NodeChildrenList stays in sync automatically if the base class permissions change.
…ildren [ENG-11089] Prevent POST /v2/nodes/<id>/children/ when project creation flag is active
[ENG-11090] Prevent DraftNodes from getting converted into Nodes in osf/models/draft_node.py based on the waffle flag
[ENG-11394] Make new permission class for when project editing is not allowed
[ENG-11395] Prevent project wiki updates via API
… active Adds CollectionSubmissionsNotAllowed permission class that returns 405 on POST requests to collection submissions when the PROJECT_READ_ONLY waffle flag is active. The check runs before CanSubmitToCollectionOrPublic so the flag takes precedence over the provider's allow_submissions setting.
…on-submissions ENG-11246: Prevent collection submissions via API when project_read_only flag is active
…ssions implementation
…use it may be time consuming
…ia API Adds ProjectEditingNotAllowed permission class to CustomItemMetadataDetail to block PUT/PATCH requests to /v2/custom_item_metadata_records/<id>/ when the PROJECT_READ_ONLY waffle flag is active. Returns 405 when blocked. Includes tests for both the blocked and allowed cases.
[ENG-11399] management command to reject all outstanding pending collection_submissions implementation
[ENG-11416] 1.5.1 BE: Prevent registrations based on projects
[ENG-11421] 1.6.4 BE/GV: Prevent new addons connection
[ENG-11554] 1.3.15 BE: Add new Permission class for node relationships
[ENG-11418] Prevent uploads of new files and folders based on the waffle flag value.
ProjectEditingNotAllowed now permits PATCH requests (single or bulk) against /v2/nodes/ when the only attribute being changed is public: true. PUT and all other PATCH shapes, including public: false and public: true bundled with any other attribute, remain blocked under PROJECT_READ_ONLY.
…cess requests Adds reject_pending_node_requests, a management command/celery task modeled on reject_pending_collection_submissions that rejects all pending access and institutional curator requests (NodeRequest.machine_state == pending), skipping withdrawal-type requests since those belong to registration moderation, not project access. Supports --dry for a rollback-only run. Wired into the admin app's Management Commands page. Also fixes a missing return statement in the existing RejectPendingCollectionSubmissions admin view, found while mirroring it.
…public 1.3.16 BE: Allow users to make projects public, but not private
[ENG-11902] Prevent requests to projects based on waffle flag
patched_run_reject called NodeRequest.run_reject for the non-error item, but that name was itself patched, so it recursed into itself instead of the real method. Capture the original method before patching, same pattern already used in the DB-failure test below it.
…node-requests 1.9.3 BE: Create management command to auto-reject pending project access requests
…, but not connect new addons
…velop-into-feature-base
…ranch feature/prevent-project-creation carried its own prior reconciliation migration (0045_merge_20260710_1411), while develop progressed independently through 0045_downloadevent .. 0049_project_enter. Both chains hang off 0044_notification_scheduled, leaving two divergent leaf nodes after this merge. Verified via a full dependency-graph parse of every osf migration file (not just these two) that these were the only two leaves before the fix, and that this migration is the only leaf after it.
1.6.6 BE: Allow users to configure/disconnect existing storage addons…
… the relationship points to a draft node
[ENG-11939] 1.1.14 BE: Prevent `registered_from` relationship from getting serialized in the API if the `registered_from` relationship points to a draft node
Update file upload prevention logic
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ticket
Purpose
Changes
Side Effects
QE Notes
CE Notes
Documentation