internlm/SWE-Fixer-Train-110K huggingface dataset:
Repository: pypi/warehouse

Issue:
Improve Alembic story
Fixes #10053.

Adds `alembic.ini`.
Runs `black` and `isort` after generating migrations.


Discussion:
/spent 1h

Resolving patch:
diff --git a/warehouse/db.py b/warehouse/db.py
--- a/warehouse/db.py
+++ b/warehouse/db.py
@@ -115,6 +115,11 @@ def _configure_alembic(config):
     alembic_cfg = alembic.config.Config()
     alembic_cfg.set_main_option("script_location", "warehouse:migrations")
     alembic_cfg.set_main_option("url", config.registry.settings["database.url"])
+    alembic_cfg.set_section_option("post_write_hooks", "hooks", "black, isort")
+    alembic_cfg.set_section_option("post_write_hooks", "black.type", "console_scripts")
+    alembic_cfg.set_section_option("post_write_hooks", "black.entrypoint", "black")
+    alembic_cfg.set_section_option("post_write_hooks", "isort.type", "console_scripts")
+    alembic_cfg.set_section_option("post_write_hooks", "isort.entrypoint", "isort")
     return alembic_cfg
 
 


Test patch:
diff --git a/tests/unit/test_db.py b/tests/unit/test_db.py
--- a/tests/unit/test_db.py
+++ b/tests/unit/test_db.py
@@ -82,7 +82,10 @@ def handler(config):
 
 
 def test_configure_alembic(monkeypatch):
-    config_obj = pretend.stub(set_main_option=pretend.call_recorder(lambda *a: None))
+    config_obj = pretend.stub(
+        set_main_option=pretend.call_recorder(lambda *a: None),
+        set_section_option=pretend.call_recorder(lambda *a: None),
+    )
 
     def config_cls():
         return config_obj
@@ -100,6 +103,13 @@ def config_cls():
         pretend.call("script_location", "warehouse:migrations"),
         pretend.call("url", config.registry.settings["database.url"]),
     ]
+    assert alembic_config.set_section_option.calls == [
+        pretend.call("post_write_hooks", "hooks", "black, isort"),
+        pretend.call("post_write_hooks", "black.type", "console_scripts"),
+        pretend.call("post_write_hooks", "black.entrypoint", "black"),
+        pretend.call("post_write_hooks", "isort.type", "console_scripts"),
+        pretend.call("post_write_hooks", "isort.entrypoint", "isort"),
+    ]
 
 
 def test_raises_db_available_error(pyramid_services, metrics):
Repository: pypi/warehouse

Issue:
OIDC publishers should be manageable within the admin app
Breakout of #11296: PyPI's admins should be able to administrate OIDC publishers (both full and "pending") from within the admin app/views.


Discussion:

Resolving patch:
diff --git a/warehouse/admin/views/projects.py b/warehouse/admin/views/projects.py
--- a/warehouse/admin/views/projects.py
+++ b/warehouse/admin/views/projects.py
@@ -129,6 +129,7 @@ def project_detail(project, request):
         "releases": releases,
         "maintainers": maintainers,
         "journal": journal,
+        "oidc_publishers": project.oidc_publishers,
         "ONE_MB": ONE_MB,
         "MAX_FILESIZE": MAX_FILESIZE,
         "ONE_GB": ONE_GB,


Test patch:
diff --git a/tests/unit/admin/views/test_projects.py b/tests/unit/admin/views/test_projects.py
--- a/tests/unit/admin/views/test_projects.py
+++ b/tests/unit/admin/views/test_projects.py
@@ -19,6 +19,7 @@
 
 from pyramid.httpexceptions import HTTPBadRequest, HTTPMovedPermanently, HTTPSeeOther
 
+from tests.common.db.oidc import GitHubPublisherFactory
 from warehouse.admin.views import projects as views
 from warehouse.packaging.models import Project, Role
 from warehouse.search.tasks import reindex_project
@@ -84,6 +85,7 @@ def test_gets_project(self, db_request):
             [RoleFactory(project=project) for _ in range(5)],
             key=lambda x: (x.role_name, x.user.username),
         )
+        oidc_publishers = [GitHubPublisherFactory(projects=[project]) for _ in range(5)]
         db_request.matchdict["project_name"] = str(project.normalized_name)
         result = views.project_detail(project, db_request)
 
@@ -92,6 +94,7 @@ def test_gets_project(self, db_request):
             "releases": [],
             "maintainers": roles,
             "journal": journals[:30],
+            "oidc_publishers": oidc_publishers,
             "ONE_MB": views.ONE_MB,
             "MAX_FILESIZE": views.MAX_FILESIZE,
             "MAX_PROJECT_SIZE": views.MAX_PROJECT_SIZE,
Repository: pypi/warehouse

Issue:
Webauthn allows me to register my phone as security key but not login with it
<!--
    NOTE: This issue should be for problems with PyPI itself, including:
    * pypi.org
    * test.pypi.org
    * files.pythonhosted.org

    This issue should NOT be for a project installed from PyPI. If you are
    having an issue with a specific package, you should reach out to the
    maintainers of that project directly instead.

    Furthermore, this issue should NOT be for any non-PyPI properties (like
    python.org, docs.python.org, etc.)

    If your problem is related to search (a new or updated project doesn't
    appear in the PyPI search results), please wait for a couple of hours
    and check again before reporting it. The search index may take some
    time to be updated.
-->

**Describe the bug**
Webauthn allows me to register my phone as security key but not login with it

**Expected behavior**
After closing the native is security key prompt, A chrome prompt like this should pop up and allows me to select my phone to use as a security key
![ss](https://user-images.githubusercontent.com/62752664/220800866-232ebbed-8b27-4805-a4d9-210b3349b3c6.png)


**To Reproduce**
Add a android phone as a security key by visiting your profile and clicking add security key and follow the expected behavior
Then logout and try to login with the same expected behaviour

**My Platform**
Windows 10 and chrome version Version 110.0.5481.177 (Official Build) (64-bit)

**Additional context**
None



Discussion:
I think I can reproduce this: the only option that it presents is for a security key, regardless of whether a security key is enabled or not, correct?

Resolving patch:
diff --git a/warehouse/utils/webauthn.py b/warehouse/utils/webauthn.py
--- a/warehouse/utils/webauthn.py
+++ b/warehouse/utils/webauthn.py
@@ -25,7 +25,6 @@
     AttestationConveyancePreference,
     AuthenticationCredential,
     AuthenticatorSelectionCriteria,
-    AuthenticatorTransport,
     PublicKeyCredentialDescriptor,
     RegistrationCredential,
     UserVerificationRequirement,
@@ -47,15 +46,7 @@ def _get_webauthn_user_public_key_credential_descriptors(user, *, rp_id):
     usage within the webauthn API.
     """
     return [
-        PublicKeyCredentialDescriptor(
-            id=base64url_to_bytes(credential.credential_id),
-            transports=[
-                AuthenticatorTransport.USB,
-                AuthenticatorTransport.NFC,
-                AuthenticatorTransport.BLE,
-                AuthenticatorTransport.INTERNAL,
-            ],
-        )
+        PublicKeyCredentialDescriptor(id=base64url_to_bytes(credential.credential_id))
         for credential in user.webauthn
     ]
 


Test patch:
Repository: pypi/warehouse

Issue:
OIDC: Create an audience route
Creating this as a reminder for myself.

The OIDC minting routes should include an `/_/oidc/audience` endpoint that just returns the OIDC audience expected by any particular Warehouse instance.

xref #12465 


Discussion:

Resolving patch:
diff --git a/warehouse/oidc/__init__.py b/warehouse/oidc/__init__.py
--- a/warehouse/oidc/__init__.py
+++ b/warehouse/oidc/__init__.py
@@ -34,4 +34,5 @@ def includeme(config):
     # to simplify caching exclusion.
     auth = config.get_settings().get("auth.domain")
 
-    config.add_route("oidc.mint_token", "/_/oidc/github/mint-token", domain=auth)
+    config.add_route("oidc.audience", "/_/oidc/audience", domain=auth)
+    config.add_route("oidc.github.mint_token", "/_/oidc/github/mint-token", domain=auth)
diff --git a/warehouse/oidc/views.py b/warehouse/oidc/views.py
--- a/warehouse/oidc/views.py
+++ b/warehouse/oidc/views.py
@@ -13,6 +13,7 @@
 import time
 
 from pydantic import BaseModel, StrictStr, ValidationError
+from pyramid.response import Response
 from pyramid.view import view_config
 from sqlalchemy import func
 
@@ -44,7 +45,26 @@ def _ratelimiters(request):
 
 
 @view_config(
-    route_name="oidc.mint_token",
+    route_name="oidc.audience",
+    require_methods=["GET"],
+    renderer="json",
+    require_csrf=False,
+    has_translations=False,
+)
+def oidc_audience(request):
+    oidc_enabled = request.registry.settings[
+        "warehouse.oidc.enabled"
+    ] and not request.flags.enabled(AdminFlagValue.DISALLOW_OIDC)
+
+    if not oidc_enabled:
+        return Response(status=403, json={"message": "OIDC functionality not enabled"})
+
+    audience = request.registry.settings["warehouse.oidc.audience"]
+    return {"audience": audience}
+
+
+@view_config(
+    route_name="oidc.github.mint_token",
     require_methods=["POST"],
     renderer="json",
     require_csrf=False,


Test patch:
diff --git a/tests/unit/oidc/test_views.py b/tests/unit/oidc/test_views.py
--- a/tests/unit/oidc/test_views.py
+++ b/tests/unit/oidc/test_views.py
@@ -43,6 +43,35 @@ def test_ratelimiters():
     ]
 
 
+@pytest.mark.parametrize(
+    ("registry", "admin"), [(False, False), (False, True), (True, True)]
+)
+def test_oidc_audience_not_enabled(registry, admin):
+    request = pretend.stub(
+        registry=pretend.stub(settings={"warehouse.oidc.enabled": registry}),
+        flags=pretend.stub(enabled=lambda *a: admin),
+    )
+
+    response = views.oidc_audience(request)
+    assert response.status_code == 403
+    assert response.json == {"message": "OIDC functionality not enabled"}
+
+
+def test_oidc_audience():
+    request = pretend.stub(
+        registry=pretend.stub(
+            settings={
+                "warehouse.oidc.enabled": True,
+                "warehouse.oidc.audience": "fakeaudience",
+            }
+        ),
+        flags=pretend.stub(enabled=lambda *a: False),
+    )
+
+    response = views.oidc_audience(request)
+    assert response == {"audience": "fakeaudience"}
+
+
 @pytest.mark.parametrize(
     ("registry", "admin"), [(False, False), (False, True), (True, True)]
 )
Repository: pypi/warehouse

Issue:
Display organization member roles in a matrix
To improve user experience, the roles within an organization can be displayed in a matrix with check marks to indicate what each type of user can and cannot do.

The description of billing manager should also say what that role cannot do. 


Discussion:
So this is a proposed improvement to this?



![Image](https://user-images.githubusercontent.com/1200832/199564859-06df7468-5f59-49f0-ab29-a2df8fcad435.png)


Seems the minimum viable resolution here would be to change the last sentence above to say "Can *only* manage billing for the organization."?
Yes, the existing paragraphs are really hard to parse for difference between the roles. Something like this would be more clear:

| Role | Member | Manager | Owner | Billing Manager |
| ----------- | ----------- | - | - | - |
| Own/maintain specific projects | ✅ |  ✅ |  ✅ |  ❌ | 
| Create new projects | ❌ |  ✅ |  ✅ |  ❌ | 
| Create/manage teams | ❌ |  ✅ |  ✅ |  ❌ | 
| Invite/manage organization members | ❌ |  ❌ |  ✅ |  ❌ | 
| Delete projects | ❌ |  ❌ |  ✅ |  ❌ | 
| Delete the organization | ❌ |  ❌ |  ✅ |  ❌ | 
| Manage billing | ✅ |  ✅ |  ✅ |  ✅ | 

(It's unclear to me who exactly has the 'manage billing' permission as well, that last line might be wrong).

> Seems the minimum viable resolution here would be to change the last sentence above to say "Can only manage billing for the organization."?

That makes it more explicit for the last one, but the challenges parsing the differences between the other roles remains.

Resolving patch:
diff --git a/warehouse/organizations/models.py b/warehouse/organizations/models.py
--- a/warehouse/organizations/models.py
+++ b/warehouse/organizations/models.py
@@ -320,6 +320,11 @@ def __acl__(self):
             query.all(),
             key=lambda x: [e.value for e in OrganizationRoleType].index(x.role_name),
         ):
+            # *** NOTE ***:
+            # When updating these ACLS, please also update the matrix in
+            # `warehouse/templates/manage/organization/roles.html` to ensure that
+            # the UI is consistent with the actual ACLs.
+            #
             # Allow all people in organization read access.
             # Allow write access depending on role.
             if role.role_name == OrganizationRoleType.Owner:


Test patch:
Repository: pypi/warehouse

Issue:
Circular import for warehouse.oidc
Surfaced via:

```shellsession
python -c "import warehouse.oidc"
```


```
Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "workpath/warehouse/warehouse/oidc/__init__.py", line 13, in <module>
    from warehouse.oidc.interfaces import IOIDCPublisherService
  File "workpath/warehouse/warehouse/oidc/interfaces.py", line 19, in <module>
    from warehouse.packaging.models import Project
  File "workpath/warehouse/warehouse/packaging/__init__.py", line 17, in <module>
    from warehouse.accounts.models import Email, User
  File "workpath/warehouse/warehouse/accounts/__init__.py", line 22, in <module>
    from warehouse.accounts.security_policy import (
  File "workpath/warehouse/warehouse/accounts/security_policy.py", line 36, in <module>
    from warehouse.utils.security_policy import AuthenticationMethod
  File "workpath/warehouse/warehouse/utils/security_policy.py", line 21, in <module>
    from warehouse.oidc.models import OIDCPublisher
  File "workpath/warehouse/warehouse/oidc/models.py", line 24, in <module>
    from warehouse.oidc.interfaces import SignedClaims
ImportError: cannot import name 'SignedClaims' from partially initialized module 'warehouse.oidc.interfaces' (most likely due to a circular import) (workpath/warehouse/warehouse/oidc/interfaces.py)
```

This isn't posing a problem in production (yet). I found it when I tried to filter out the warnings from `InsecureOIDCPublisherWarning` - but we should figure out how to not have a circular import.


Discussion:
Working on this now!

Resolving patch:
diff --git a/warehouse/oidc/interfaces.py b/warehouse/oidc/interfaces.py
--- a/warehouse/oidc/interfaces.py
+++ b/warehouse/oidc/interfaces.py
@@ -16,11 +16,11 @@
 
 from zope.interface import Interface
 
-from warehouse.packaging.models import Project
 from warehouse.rate_limiting.interfaces import RateLimiterException
 
 if TYPE_CHECKING:
-    from warehouse.oidc.models import PendingOIDCPublisher  # pragma: no cover
+    from warehouse.oidc.models import PendingOIDCPublisher
+    from warehouse.packaging.models import Project
 
 SignedClaims = NewType("SignedClaims", dict[str, Any])
 


Test patch:
Repository: docker/docker-py

Issue:
Sanitize base_url
I spent ages trying to find out why all non-GET operations were failing. It turns out I had an extra slash (`/`) at the end of the `base_url` passed into `Client()`.

So I entered `c = Client("http://myhost.com/")` instead of `c = Client("http://myhost.com")`.

The traceback was not very clear:

``` python
In [19]: c.remove_image('aabd9dfce66d689928f028253970ccf1b35cfe9d4375d266414c4ef5e0bdcac4')
---------------------------------------------------------------------------
APIError                                  Traceback (most recent call last)
<ipython-input-19-bb4d163bc668> in <module>()
----> 1 c.remove_image('aabd9dfce66d689928f028253970ccf1b35cfe9d4375d266414c4ef5e0bdcac4')

docker/client.pyc in remove_image(self, image)
    567     def remove_image(self, image):
    568         res = self._delete(self._url("/images/" + image))
--> 569         self._raise_for_status(res)
    570
    571     def restart(self, container, timeout=10):

docker/client.pyc in _raise_for_status(self, response, explanation)
    103             response.raise_for_status()
    104         except requests.exceptions.HTTPError as e:
--> 105             raise APIError(e, response, explanation=explanation)
    106
    107     def _stream_result(self, response):

<type 'str'>: (<type 'exceptions.AttributeError'>, AttributeError("'NoneType' object has no attribute 'status_code'",))
```

Only by looking at the access logs on the docker machine I saw that all requests were being redirected with a 301 (Moved Permanently):

```
10.33.33.1 - dockerapi [23/Nov/2013:00:51:11 +0000] "DELETE //v1.6/images/aabd9dfce66d689928f028253970ccf1b35cfe9d4375d266414c4ef5e0bdcac4 HTTP/1.1" 301 0 "-" "python-requests/1.2.3 CPython/2.7.5 Darwin/12.5.0"
10.33.33.1 - dockerapi [23/Nov/2013:00:51:11 +0000] "GET /v1.6/images/aabd9dfce66d689928f028253970ccf1b35cfe9d4375d266414c4ef5e0bdcac4 HTTP/1.1" 404 19 "-" "python-requests/1.2.3 CPython/2.7.5 Darwin/12.5.0"
```

This worked for `GET` requests, but other request types failed.

My suggestion would be to sanitize `base_url` through `urlparse` or always use `urljoin` to join base_url and the rest of the url.



Discussion:

Resolving patch:
diff --git a/docker/client.py b/docker/client.py
--- a/docker/client.py
+++ b/docker/client.py
@@ -70,6 +70,8 @@ def __init__(self, base_url="unix://var/run/docker.sock", version="1.6",
         super(Client, self).__init__()
         if base_url.startswith('unix:///'):
             base_url = base_url.replace('unix:/', 'unix:')
+        if base_url.endswith('/'):
+            base_url = base_url[:-1]
         self.base_url = base_url
         self._version = version
         self._timeout = timeout


Test patch:
Repository: docker/docker-py

Issue:
Push(stream=True) does not work anymore.
```
$ cat test.py 
import docker

c = docker.Client()
for line in c.push("test_image", stream=True):
    print line
$ sudo venv/bin/python test.py 
Traceback (most recent call last):
  File "test.py", line 4, in <module>
    for line in c.push("test_image", stream=True):
  File "/home/{username}/docker-py/docker/client.py", line 230, in _stream_helper
    size = int(socket.readline(), 16)
IOError: [Errno 11] Resource temporarily unavailable
```

I suspect #117 or #123 broke this. Seems like it's a blocking vs nonblocking socket issue.



Discussion:
ping @mpetazzoni 

Yeah I think I stumbled upon this too. I'll try to take a look.

I am running into this too, however, when I run the same exact commands individually through ipython, the command blocks, (even with stream=True) but it ultimately succeeds. Is streaming disabled if the session is interactive or something?


Resolving patch:
diff --git a/docker/client.py b/docker/client.py
--- a/docker/client.py
+++ b/docker/client.py
@@ -227,7 +227,9 @@ def _stream_result_socket(self, response):
 
     def _stream_helper(self, response):
         """Generator for data coming from a chunked-encoded HTTP response."""
-        socket = self._stream_result_socket(response).makefile()
+        socket_fp = self._stream_result_socket(response)
+        socket_fp.setblocking(1)
+        socket = socket_fp.makefile()
         while True:
             size = int(socket.readline(), 16)
             if size <= 0:


Test patch:
Repository: docker/docker-py

Issue:
Support multiple link aliases to same target
This is possible with Docker:

```
docker run -t -i -link redis:db -link redis:db1 -name webapp ubuntu bash
```

But the `links` argument to `start()` in docker-py takes a dictionary mapping name to alias, so multiple aliases are not possible.

Two possible fixes:

1) `links` could optionally take a list of tuples
2) we could swap round the mapping of the `links` dictionary, because alias is unique (backwards incompatible!)



Discussion:

Resolving patch:
diff --git a/docker/client.py b/docker/client.py
--- a/docker/client.py
+++ b/docker/client.py
@@ -705,8 +705,11 @@ def start(self, container, binds=None, port_bindings=None, lxc_conf=None,
         start_config['PublishAllPorts'] = publish_all_ports
 
         if links:
+            if isinstance(links, dict):
+                links = six.iteritems(links)
+
             formatted_links = [
-                '{0}:{1}'.format(k, v) for k, v in sorted(six.iteritems(links))
+                '{0}:{1}'.format(k, v) for k, v in sorted(links)
             ]
 
             start_config['Links'] = formatted_links


Test patch:
diff --git a/tests/test.py b/tests/test.py
--- a/tests/test.py
+++ b/tests/test.py
@@ -525,6 +525,31 @@ def test_start_container_with_multiple_links(self):
             {'Content-Type': 'application/json'}
         )
 
+    def test_start_container_with_links_as_list_of_tuples(self):
+        # one link
+        try:
+            link_path = 'path'
+            alias = 'alias'
+            self.client.start(fake_api.FAKE_CONTAINER_ID,
+                              links=[(link_path, alias)])
+        except Exception as e:
+            self.fail('Command should not raise exception: {0}'.format(e))
+
+        args = fake_request.call_args
+        self.assertEqual(
+            args[0][0],
+            'unix://var/run/docker.sock/v1.6/containers/3cc2351ab11b/start'
+        )
+        self.assertEqual(
+            json.loads(args[1]['data']),
+            {"PublishAllPorts": False, "Privileged": False,
+             "Links": ["path:alias"]}
+        )
+        self.assertEqual(
+            args[1]['headers'],
+            {'Content-Type': 'application/json'}
+        )
+
     def test_start_container_privileged(self):
         try:
             self.client.start(fake_api.FAKE_CONTAINER_ID, privileged=True)
Repository: docker/docker-py

Issue:
logs(stream=True) broken for python 3.3
I'm unable to iterate over logs as a stream for a container in python 3.3. It seems like some of the private apis have changed. I poked around for a minute but this is over my head. I pip installed the master.zip on commit ef009e114a3be

Code to reproduce:

``` python
for chunk in d.logs(c, stream=True):
    print(chunk)
```

Error

``` python
 Traceback (most recent call last):
   File "/home/m/Code/dockerstuff/d.py", line 100, in main
     for chunk in d.logs(c, stream=True):
   File "/home/m/.virtualenvs/d/lib/python3.3/site-packages/docker/client.py", line 257, in _multiplexed_socket_stream_helper
     socket = self._stream_result_socket(response)
   File "/home/m/.virtualenvs/d/lib/python3.3/site-packages/docker/client.py", line 226, in _stream_result_socket
     return response.raw._fp.fp._sock
AttributeError: '_io.BufferedReader' object has no attribute '_sock'
```



Discussion:
Hmm, interesting. I did do some changes recently to log streaming so it certainly is the cause of your issue. Have you confirmed that this only happens with Python 3.3? (I would think so, since I have no issues with 2.7).

No. I have only tested on 3.3


Resolving patch:
diff --git a/docker/client.py b/docker/client.py
--- a/docker/client.py
+++ b/docker/client.py
@@ -228,7 +228,10 @@ def _create_websocket_connection(self, url):
 
     def _get_raw_response_socket(self, response):
         self._raise_for_status(response)
-        return response.raw._fp.fp._sock
+        if six.PY3:
+            return response.raw._fp.fp.raw._sock
+        else:
+            return response.raw._fp.fp._sock
 
     def _stream_helper(self, response):
         """Generator for data coming from a chunked-encoded HTTP response."""
@@ -264,14 +267,19 @@ def _multiplexed_socket_stream_helper(self, response):
         socket = self._get_raw_response_socket(response)
 
         def recvall(socket, size):
-            data = ''
+            blocks = []
             while size > 0:
                 block = socket.recv(size)
                 if not block:
                     return None
 
-                data += block
+                blocks.append(block)
                 size -= len(block)
+
+            sep = bytes() if six.PY3 else str()
+            data = sep.join(blocks)
+            if six.PY3:
+                data = data.decode('utf-8')
             return data
 
         while True:


Test patch: