Repository: pypi/warehouse

Issue:
[OIDC] Replace (most) user-facing references to "OIDC" with "Trusted publish{ers,ing}"
This will more accurately reflect the terminology used in the PyPI docs and other public-facing resources.

@webknjaz pointed out that the email templates, specifically, need updating.


Discussion:
@hugovk pointed out a few other places that need updating:

* https://pypi.org/help/#openid-connect
* https://pypi.org/manage/account/publishing/
* https://pypi.org/manage/project/my-project-name/settings/publishing/

Resolving patch:
diff --git a/warehouse/email/__init__.py b/warehouse/email/__init__.py
--- a/warehouse/email/__init__.py
+++ b/warehouse/email/__init__.py
@@ -977,8 +977,8 @@ def send_recovery_code_reminder_email(request, user):
     return {"username": user.username}
 
 
-@_email("oidc-publisher-added")
-def send_oidc_publisher_added_email(request, user, project_name, publisher):
+@_email("trusted-publisher-added")
+def send_trusted_publisher_added_email(request, user, project_name, publisher):
     # We use the request's user, since they're the one triggering the action.
     return {
         "username": request.user.username,
@@ -988,8 +988,8 @@ def send_oidc_publisher_added_email(request, user, project_name, publisher):
     }
 
 
-@_email("oidc-publisher-removed")
-def send_oidc_publisher_removed_email(request, user, project_name, publisher):
+@_email("trusted-publisher-removed")
+def send_trusted_publisher_removed_email(request, user, project_name, publisher):
     # We use the request's user, since they're the one triggering the action.
     return {
         "username": request.user.username,
@@ -999,8 +999,8 @@ def send_oidc_publisher_removed_email(request, user, project_name, publisher):
     }
 
 
-@_email("pending-oidc-publisher-invalidated")
-def send_pending_oidc_publisher_invalidated_email(request, user, project_name):
+@_email("pending-trusted-publisher-invalidated")
+def send_pending_trusted_publisher_invalidated_email(request, user, project_name):
     return {
         "project_name": project_name,
     }
diff --git a/warehouse/manage/views/__init__.py b/warehouse/manage/views/__init__.py
--- a/warehouse/manage/views/__init__.py
+++ b/warehouse/manage/views/__init__.py
@@ -49,8 +49,6 @@
     send_collaborator_removed_email,
     send_collaborator_role_changed_email,
     send_email_verification_email,
-    send_oidc_publisher_added_email,
-    send_oidc_publisher_removed_email,
     send_password_change_email,
     send_primary_email_change_email,
     send_project_role_verification_email,
@@ -61,6 +59,8 @@
     send_removed_project_release_file_email,
     send_role_changed_as_collaborator_email,
     send_team_collaborator_added_email,
+    send_trusted_publisher_added_email,
+    send_trusted_publisher_removed_email,
     send_two_factor_added_email,
     send_two_factor_removed_email,
     send_unyanked_project_release_email,
@@ -1286,7 +1286,7 @@ def add_github_oidc_publisher(self):
                 return response
 
             for user in self.project.users:
-                send_oidc_publisher_added_email(
+                send_trusted_publisher_added_email(
                     self.request,
                     user,
                     project_name=self.project.name,
@@ -1355,7 +1355,7 @@ def delete_oidc_publisher(self):
                 return self.default_response
 
             for user in self.project.users:
-                send_oidc_publisher_removed_email(
+                send_trusted_publisher_removed_email(
                     self.request,
                     user,
                     project_name=self.project.name,
diff --git a/warehouse/oidc/views.py b/warehouse/oidc/views.py
--- a/warehouse/oidc/views.py
+++ b/warehouse/oidc/views.py
@@ -20,7 +20,7 @@
 from sqlalchemy import func
 
 from warehouse.admin.flags import AdminFlagValue
-from warehouse.email import send_pending_oidc_publisher_invalidated_email
+from warehouse.email import send_pending_trusted_publisher_invalidated_email
 from warehouse.events.tags import EventTag
 from warehouse.macaroons import caveats
 from warehouse.macaroons.interfaces import IMacaroonService
@@ -156,7 +156,7 @@ def _invalid(errors):
             .all()
         )
         for stale_publisher in stale_pending_publishers:
-            send_pending_oidc_publisher_invalidated_email(
+            send_pending_trusted_publisher_invalidated_email(
                 request,
                 stale_publisher.added_by,
                 project_name=stale_publisher.project_name,


Test patch:
diff --git a/tests/unit/email/test_init.py b/tests/unit/email/test_init.py
--- a/tests/unit/email/test_init.py
+++ b/tests/unit/email/test_init.py
@@ -5511,17 +5511,17 @@ def test_recovery_code_emails(
         ]
 
 
-class TestOIDCPublisherEmails:
+class TestTrustedPublisherEmails:
     @pytest.mark.parametrize(
         "fn, template_name",
         [
             (
-                email.send_pending_oidc_publisher_invalidated_email,
-                "pending-oidc-publisher-invalidated",
+                email.send_pending_trusted_publisher_invalidated_email,
+                "pending-trusted-publisher-invalidated",
             ),
         ],
     )
-    def test_pending_oidc_publisher_emails(
+    def test_pending_trusted_publisher_emails(
         self, pyramid_request, pyramid_config, monkeypatch, fn, template_name
     ):
         stub_user = pretend.stub(
@@ -5601,11 +5601,11 @@ def test_pending_oidc_publisher_emails(
     @pytest.mark.parametrize(
         "fn, template_name",
         [
-            (email.send_oidc_publisher_added_email, "oidc-publisher-added"),
-            (email.send_oidc_publisher_removed_email, "oidc-publisher-removed"),
+            (email.send_trusted_publisher_added_email, "trusted-publisher-added"),
+            (email.send_trusted_publisher_removed_email, "trusted-publisher-removed"),
         ],
     )
-    def test_oidc_publisher_emails(
+    def test_trusted_publisher_emails(
         self, pyramid_request, pyramid_config, monkeypatch, fn, template_name
     ):
         stub_user = pretend.stub(
diff --git a/tests/unit/manage/test_views.py b/tests/unit/manage/test_views.py
--- a/tests/unit/manage/test_views.py
+++ b/tests/unit/manage/test_views.py
@@ -6244,7 +6244,7 @@ def test_add_github_oidc_publisher_created(self, monkeypatch):
         monkeypatch.setattr(views, "GitHubPublisherForm", github_publisher_form_cls)
         monkeypatch.setattr(
             views,
-            "send_oidc_publisher_added_email",
+            "send_trusted_publisher_added_email",
             pretend.call_recorder(lambda *a, **kw: None),
         )
 
@@ -6282,7 +6282,7 @@ def test_add_github_oidc_publisher_created(self, monkeypatch):
         ]
         assert request.db.add.calls == [pretend.call(project.oidc_publishers[0])]
         assert github_publisher_form_obj.validate.calls == [pretend.call()]
-        assert views.send_oidc_publisher_added_email.calls == [
+        assert views.send_trusted_publisher_added_email.calls == [
             pretend.call(
                 request,
                 fakeuser,
@@ -6563,7 +6563,7 @@ def test_delete_oidc_publisher_registered_to_multiple_projects(self, monkeypatch
         monkeypatch.setattr(views, "DeletePublisherForm", delete_publisher_form_cls)
         monkeypatch.setattr(
             views,
-            "send_oidc_publisher_removed_email",
+            "send_trusted_publisher_removed_email",
             pretend.call_recorder(lambda *a, **kw: None),
         )
 
@@ -6610,7 +6610,7 @@ def test_delete_oidc_publisher_registered_to_multiple_projects(self, monkeypatch
         assert delete_publisher_form_cls.calls == [pretend.call(request.POST)]
         assert delete_publisher_form_obj.validate.calls == [pretend.call()]
 
-        assert views.send_oidc_publisher_removed_email.calls == [
+        assert views.send_trusted_publisher_removed_email.calls == [
             pretend.call(
                 request, fakeuser, project_name="fakeproject", publisher=publisher
             )
@@ -6664,7 +6664,7 @@ def test_delete_oidc_publisher_entirely(self, monkeypatch):
         monkeypatch.setattr(views, "DeletePublisherForm", delete_publisher_form_cls)
         monkeypatch.setattr(
             views,
-            "send_oidc_publisher_removed_email",
+            "send_trusted_publisher_removed_email",
             pretend.call_recorder(lambda *a, **kw: None),
         )
 
@@ -6709,7 +6709,7 @@ def test_delete_oidc_publisher_entirely(self, monkeypatch):
         assert delete_publisher_form_cls.calls == [pretend.call(request.POST)]
         assert delete_publisher_form_obj.validate.calls == [pretend.call()]
 
-        assert views.send_oidc_publisher_removed_email.calls == [
+        assert views.send_trusted_publisher_removed_email.calls == [
             pretend.call(
                 request, fakeuser, project_name="fakeproject", publisher=publisher
             )
diff --git a/tests/unit/oidc/test_views.py b/tests/unit/oidc/test_views.py
--- a/tests/unit/oidc/test_views.py
+++ b/tests/unit/oidc/test_views.py
@@ -136,7 +136,7 @@ def body(self):
         assert isinstance(err["description"], str)
 
 
-def test_mint_token_from_oidc_publisher_verify_jwt_signature_fails():
+def test_mint_token_from_trusted_publisher_verify_jwt_signature_fails():
     oidc_service = pretend.stub(
         verify_jwt_signature=pretend.call_recorder(lambda token: None),
     )
@@ -166,7 +166,7 @@ def test_mint_token_from_oidc_publisher_verify_jwt_signature_fails():
     assert oidc_service.verify_jwt_signature.calls == [pretend.call("faketoken")]
 
 
-def test_mint_token_from_oidc_publisher_lookup_fails():
+def test_mint_token_from_trusted_publisher_lookup_fails():
     claims = pretend.stub()
     oidc_service = pretend.stub(
         verify_jwt_signature=pretend.call_recorder(lambda token: claims),
@@ -292,7 +292,7 @@ def test_mint_token_from_oidc_pending_publisher_ok(
     ]
 
 
-def test_mint_token_from_pending_oidc_publisher_invalidates_others(
+def test_mint_token_from_pending_trusted_publisher_invalidates_others(
     monkeypatch, db_request
 ):
     time = pretend.stub(time=pretend.call_recorder(lambda: 0))
@@ -320,13 +320,13 @@ def test_mint_token_from_pending_oidc_publisher_invalidates_others(
         )
         emailed_users.append(user)
 
-    send_pending_oidc_publisher_invalidated_email = pretend.call_recorder(
+    send_pending_trusted_publisher_invalidated_email = pretend.call_recorder(
         lambda *a, **kw: None
     )
     monkeypatch.setattr(
         views,
-        "send_pending_oidc_publisher_invalidated_email",
-        send_pending_oidc_publisher_invalidated_email,
+        "send_pending_trusted_publisher_invalidated_email",
+        send_pending_trusted_publisher_invalidated_email,
     )
 
     db_request.registry.settings = {"warehouse.oidc.enabled": True}
@@ -365,7 +365,7 @@ def test_mint_token_from_pending_oidc_publisher_invalidates_others(
 
     # We should have sent one invalidation email for each pending publisher that
     # was invalidated by the minting operation.
-    assert send_pending_oidc_publisher_invalidated_email.calls == [
+    assert send_pending_trusted_publisher_invalidated_email.calls == [
         pretend.call(db_request, emailed_users[0], project_name="does_not_exist"),
         pretend.call(db_request, emailed_users[1], project_name="does-not-exist"),
         pretend.call(db_request, emailed_users[2], project_name="dOeS-NoT-ExISt"),