This change now requires that PHP routes do not return HTTP 404
to be considered for the /metrics population. Additionally,
we make a small sanitization here to avoid trailing '/'
characters, unless we're on the homepage route.
Signed-off-by: Kevin Morris <kevr@0cost.org>
Along with this initial requests metric implementation,
we also now serve the `/metrics` route, which grabs request
metrics out of cache and renders them properly for Prometheus.
**NOTE** Metrics are only enabled when the aurweb system admin
has enabled caching by configuring `options.cache` correctly
in `$AUR_CONFIG`. Otherwise, an error is logged about no cache
being configured.
New dependencies have been added which require the use of
`composer`. See `INSTALL` for the dependency section in regards
to composer dependencies and how to install them properly for
aurweb.
Metrics are in the following forms:
aurweb_http_requests_count(method="GET",route="/some_route")
aurweb_api_requests_count(method="GET",route="/rpc",type="search")
This should allow us to search through the requests for specific routes
and queries.
Signed-off-by: Kevin Morris <kevr@0cost.org>
With FastAPI starting to come closer to a close, we've got to advertise
this deprecation so that users have some time to adjust before making
the changes. We have not specified a specific time here, but we'd like
this message to reach users of the RPC API for at least a month before
any modifications are made to the interface.
Signed-off-by: Kevin Morris <kevr@0cost.org>
With a recent curl update, it now rejects URLs with spaces in it.
We should probably fix this so that we can sanitize urls with spaces
to be used properly, but for now, just remove spaces in the directory.
Signed-off-by: Kevin Morris <kevr@0cost.org>
I think after 10-15 years we might want to adjust those values. With a
30min cache and 20 items per creation I would bet some new AUR packages
might be swept under the carpet.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
Some of the columns that were changed still want to be
case insensitive. Good thing our tables have nice
separation.
Signed-off-by: Kevin Morris <kevr@0cost.org>
MySql defaults to `utf8` and case insensitive collation so migrate these to case sensitive and `utf8mb4`
Closes#21
Signed-off-by: Leonidas Spyropoulos <artafinde@gmail.com>
op.drop_constraint requires a valid field to drop the constraint on.
Without this, downgrade cannot occur.
Signed-off-by: Kevin Morris <kevr@0cost.org>
This column holds a user ID issed by the single sign-on provider. For
Keycloak, it is an UUID. For more flexibility, we will be using a
standardly-sized VARCHAR field.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
The account deletion code tries to remove user from PackageNotifications
using the wrong column UsersID to identify the user by id. In the
PackagePackageNotifications table the foreign key is called UserID. In
the future ideally this would be unified into UserID for all tables.
Closes: #12
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
This feature was originally introduced by
f961ffd9c7 as a fix for FS#12898
<https://bugs.archlinux.org/task/12898>.
As of today, it is broken because of the `q.SessionID IS NULL` condition
in the WHERE clause, which can’t be true because SessionID is not
nullable. As a consequence, the session limit was not applied.
The fact the absence of the session limit hasn’t caused any issue so
far, and hadn’t even been noticed, suggests the feature is unneeded.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
We usually guard such queries and have both mysql and sqlite branches.
But I have not implemented the sqlite branch. Given sqlite is typically
used for local dev setups, the fact that "users with more than the
configured max simultaneous logins" can avoid getting some logins
annulled is probably not a huge risk.
And this always *used* to fail on sqlite, silently. Now, in php 8, it
raises PDOException, which prevents running the test server
Document this as a FIXME for now, until someone reimplements the query
for sqlite.
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
Due to missing whitespace at the end of strings during joining, we ended
up with the query fragment
"DelTS IS NULLAND NOT PinnedTS"
which should be
"DelTS IS NULL AND NOT PinnedTS"
So the check for pinned comments > 5 likely always failed.
In php 7, a completely broken query that raises exceptions in the
database engine was silently ignored... in php 8, it raises
Uncaught PDOException: SQLSTATE[HY000]: General error: 1 near "PinnedTS": syntax error in <file>
and aborts the page building. End result: users with permission to pin
comments cannot see any comments, or indeed page content below the first
comment header
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
The current package search query is quite poorly optimized and becomes a
resource hog when the offsets gets large enough. This DoSes the service.
A quick fix is to just ensure we have some limit to the number of hits
we return. The current hardcoding of 2500 is based on the following:
* 250 hits per page max
* 10 pages
We can maybe consider having it lower, but it seems easier to just have
this a multiple of 250 in the first iteration.
Signed-off-by: Morten Linderud <morten@linderud.pw>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
When using the sendmail() function with smtplib.SMTP or
smtplib.SMTP_SSL, the list of actual recipients for the email (to be
translated to RCPT commands) has to be provided as a parameter.
Update the notification script and add all Cc recipients to that
parameter.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
After f7a57c8 (Localize notification emails, 2018-05-17), the
server.sendmail line was not updated to now send the to the email
address but instead sends to (email, 'en') and as sendmail accepts an
iterable an email is also send to 'en'.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
This is the common convention for TAP, and makes harnesses like prove
automatically detect them. Plus, test suites don’t have to be shell
scripts anymore.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
This way the database will get stamped, and Git will create the
`versions` directory without which Alembic won’t work.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
The new schema was generated with sqlacodegen and then manually adjusted
to fit schema/aur-schema.sql faithfully, both in the organisation of the
code and in the SQL generated by SQLAlchemy.
Initializing the database now requires the new tool aurweb.initdb.
References to aur-schema.sql have been updated and the old schema
dropped.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
Do not add an opening <tbody> tag for every row. Instead, wrap all rows
in <tbody></tbody>.
While at it, also simplify the code used to color the rows.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
The try_login() function documents it returns an array containing an
'error' key, and our only caller *only* consults the 'error' key. Then
the function returns null instead of an array, if the login succeeded!
I question why we bother returning the new SID if we never use it,
surely we could either return the error or return default null. But, for
now, I'm just going to fix it to return what it's actually supposed to,
without changing the API.
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
If a db query returned NULL instead of an array, then accessing $row[0]
now throws a warning. The undocumented behavior of evaluating to NULL
is maintained, and we want to return NULL anyway, so add a check for the
value and fall back on the default function return type.
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
Add more options to configure the smtplib implementation for sending
notification emails.
The port can be changed using the new smtp-port option.
Encryption can be configured using smtp-use-ssl and smtp-use-starttls.
Keep in mind that you usually also need to change the port when enabling
either of these options.
Authentication can be configured using smtp-user and smtp-password.
Authentication is disabled if either of these values is empty.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
