Merge pull request #104 from maykinmedia/release/2.1.3

Release/2.1.3
maykinmedia · May 3, 2024 · 2da2e5f · 2da2e5f
2 parents ff3e275 + 554920b
commit 2da2e5f
Show file tree

Hide file tree

Showing 16 changed files with 216 additions and 19 deletions.
diff --git a/.bumpversion.cfg b/.bumpversion.cfg
@@ -1,7 +1,7 @@
 [bumpversion]
 commit = False
 tag = False
-current_version = 2.1.2
+current_version = 2.1.3
 
 [bumpversion:file:README.rst]
 

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -61,7 +61,7 @@ jobs:
           DB_PASSWORD: ''
 
       - name: Publish coverage report
-        uses: codecov/codecov-action@v1
+        uses: codecov/codecov-action@v4
 
   docker:
     needs: tests

diff --git a/CHANGELOG.rst b/CHANGELOG.rst
@@ -2,6 +2,16 @@
 Change history
 ==============
 
+2.1.3 (2024-05-03)
+------------------
+
+Bugfix release
+
+This release addresses a security weakness.
+
+* [GHSA-3wcp-29hm-g82c] replaced PK for Token model.
+
+
 2.1.2 (2024-02-06)
 ------------------
 

diff --git a/README.NL.rst b/README.NL.rst
@@ -2,7 +2,7 @@
 Objecttypen API
 ===============
 
-:Version: 2.1.2
+:Version: 2.1.3
 :Source: https://github.com/maykinmedia/objecttypes-api
 :Keywords: objecten, assets, zaakobjecten
 
@@ -36,10 +36,10 @@ Versie          Release datum   API specificatie
 ==============  ==============  =============================
 latest          n/a             `ReDoc <https://redocly.github.io/redoc/?url=https://raw.githubusercontent.com/maykinmedia/objecttypes-api/master/src/objecttypes/api/v2/openapi.yaml>`_,
                                 `Swagger <https://petstore.swagger.io/?url=https://raw.githubusercontent.com/maykinmedia/objecttypes-api/master/src/objecttypes/api/v2/openapi.yaml>`_,
-                                (`verschillen <https://github.com/maykinmedia/objecttypes-api/compare/2.1.2..master#diff-b9c28fec6c3f3fa5cff870d24601d6ab7027520f3b084cc767aefd258cb8c40a>`_)
-2.1.2           2022-06-24      `ReDoc <https://redocly.github.io/redoc/?url=https://raw.githubusercontent.com/maykinmedia/objecttypes-api/2.1.2/src/objecttypes/api/v2/openapi.yaml>`_,
-                                `Swagger <https://petstore.swagger.io/?url=https://raw.githubusercontent.com/maykinmedia/objecttypes-api/2.1.2/src/objecttypes/api/v2/openapi.yaml>`_
-                                (`verschillen <https://github.com/maykinmedia/objecttypes-api/compare/2.0.0..2.1.2#diff-b9c28fec6c3f3fa5cff870d24601d6ab7027520f3b084cc767aefd258cb8c40a>`_)
+                                (`verschillen <https://github.com/maykinmedia/objecttypes-api/compare/2.1.3..master#diff-b9c28fec6c3f3fa5cff870d24601d6ab7027520f3b084cc767aefd258cb8c40a>`_)
+2.1.3           2022-06-24      `ReDoc <https://redocly.github.io/redoc/?url=https://raw.githubusercontent.com/maykinmedia/objecttypes-api/2.1.3/src/objecttypes/api/v2/openapi.yaml>`_,
+                                `Swagger <https://petstore.swagger.io/?url=https://raw.githubusercontent.com/maykinmedia/objecttypes-api/2.1.3/src/objecttypes/api/v2/openapi.yaml>`_
+                                (`verschillen <https://github.com/maykinmedia/objecttypes-api/compare/2.0.0..2.1.3#diff-b9c28fec6c3f3fa5cff870d24601d6ab7027520f3b084cc767aefd258cb8c40a>`_)
 2.0.0           2021-10-04      `ReDoc <https://redocly.github.io/redoc/?url=https://raw.githubusercontent.com/maykinmedia/objecttypes-api/2.0.0/src/objecttypes/api/v2/openapi.yaml>`_,
                                 `Swagger <https://petstore.swagger.io/?url=https://raw.githubusercontent.com/maykinmedia/objecttypes-api/2.0.0/src/objecttypes/api/v2/openapi.yaml>`_
                                 (`verschillen <https://github.com/maykinmedia/objecttypes-api/compare/1.2.0..2.0.0#diff-b9c28fec6c3f3fa5cff870d24601d6ab7027520f3b084cc767aefd258cb8c40a>`_)

diff --git a/README.rst b/README.rst
@@ -2,7 +2,7 @@
 Objecttypes API
 ===============
 
-:Version: 2.1.2
+:Version: 2.1.3
 :Source: https://github.com/maykinmedia/objecttypes-api
 :Keywords: objects, assets, zaakobjecten
 
@@ -35,10 +35,10 @@ Version         Release date    API specification
 ==============  ==============  =============================
 latest          n/a             `ReDoc <https://redocly.github.io/redoc/?url=https://raw.githubusercontent.com/maykinmedia/objecttypes-api/master/src/objecttypes/api/v2/openapi.yaml>`_,
                                 `Swagger <https://petstore.swagger.io/?url=https://raw.githubusercontent.com/maykinmedia/objecttypes-api/master/src/objecttypes/api/v2/openapi.yaml>`_,
-                                (`diff <https://github.com/maykinmedia/objecttypes-api/compare/2.1.2..master#diff-b9c28fec6c3f3fa5cff870d24601d6ab7027520f3b084cc767aefd258cb8c40a>`_)
-2.1.2           2022-06-24      `ReDoc <https://redocly.github.io/redoc/?url=https://raw.githubusercontent.com/maykinmedia/objecttypes-api/2.1.2/src/objecttypes/api/v2/openapi.yaml>`_,
-                                `Swagger <https://petstore.swagger.io/?url=https://raw.githubusercontent.com/maykinmedia/objecttypes-api/2.1.2/src/objecttypes/api/v2/openapi.yaml>`_
-                                (`diff <https://github.com/maykinmedia/objecttypes-api/compare/2.0.0..2.1.2#diff-b9c28fec6c3f3fa5cff870d24601d6ab7027520f3b084cc767aefd258cb8c40a>`_)
+                                (`diff <https://github.com/maykinmedia/objecttypes-api/compare/2.1.3..master#diff-b9c28fec6c3f3fa5cff870d24601d6ab7027520f3b084cc767aefd258cb8c40a>`_)
+2.1.3           2022-06-24      `ReDoc <https://redocly.github.io/redoc/?url=https://raw.githubusercontent.com/maykinmedia/objecttypes-api/2.1.3/src/objecttypes/api/v2/openapi.yaml>`_,
+                                `Swagger <https://petstore.swagger.io/?url=https://raw.githubusercontent.com/maykinmedia/objecttypes-api/2.1.3/src/objecttypes/api/v2/openapi.yaml>`_
+                                (`diff <https://github.com/maykinmedia/objecttypes-api/compare/2.0.0..2.1.3#diff-b9c28fec6c3f3fa5cff870d24601d6ab7027520f3b084cc767aefd258cb8c40a>`_)
 2.0.0           2021-10-04      `ReDoc <https://redocly.github.io/redoc/?url=https://raw.githubusercontent.com/maykinmedia/objecttypes-api/2.0.0/src/objecttypes/api/v2/openapi.yaml>`_,
                                 `Swagger <https://petstore.swagger.io/?url=https://raw.githubusercontent.com/maykinmedia/objecttypes-api/2.0.0/src/objecttypes/api/v2/openapi.yaml>`_
                                 (`diff <https://github.com/maykinmedia/objecttypes-api/compare/1.2.0..2.0.0#diff-b9c28fec6c3f3fa5cff870d24601d6ab7027520f3b084cc767aefd258cb8c40a>`_)

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "objecttypes",
-  "version": "2.1.2",
+  "version": "2.1.3",
   "description": "objecttypes project",
   "main": "src/objecttypes/static/bundles/objecttypes-js.js",
   "directories": {

diff --git a/publiccode.yaml b/publiccode.yaml
@@ -7,7 +7,7 @@ publiccodeYmlVersion: '0.2'
 name: Objecttypes API
 url: 'http://github.com/maykinmedia/objecttypes-api.git'
 softwareType: standalone/backend
-softwareVersion: 2.1.2
+softwareVersion: 2.1.3
 releaseDate: '2021-01-13'
 logo: 'https://github.com/maykinmedia/objects-api/blob/master/docs/logo.png'
 platforms:

diff --git a/src/objecttypes/api/v2/openapi.yaml b/src/objecttypes/api/v2/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
   title: Objecttypes API
-  version: 2.1.2 (v2)
+  version: 2.1.3 (v2)
   description: |+
     An API to manage Object types.
 

diff --git a/src/objecttypes/conf/api.py b/src/objecttypes/conf/api.py
@@ -1,7 +1,7 @@
 from vng_api_common.conf.api import *  # noqa - imports white-listed
 
-API_VERSION = "2.1.2"
-VERSIONS = {"v1": "1.2.0", "v2": "2.1.2"}
+API_VERSION = "2.1.3"
+VERSIONS = {"v1": "1.2.0", "v2": "2.1.3"}
 
 
 # api settings

diff --git a/src/objecttypes/token/migrations/0004_rename_tokenauth_oldtokenauth.py b/src/objecttypes/token/migrations/0004_rename_tokenauth_oldtokenauth.py
@@ -0,0 +1,16 @@
+# Generated by Django 4.2.11 on 2024-05-02 12:56
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("token", "0003_auto_20210315_1547"),
+    ]
+
+    operations = [
+        migrations.RenameModel(
+            old_name="TokenAuth",
+            new_name="OldTokenAuth",
+        ),
+    ]
diff --git a/src/objecttypes/token/migrations/0005_tokenauth.py b/src/objecttypes/token/migrations/0005_tokenauth.py
@@ -0,0 +1,90 @@
+# Generated by Django 4.2.11 on 2024-05-02 13:01
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("token", "0004_rename_tokenauth_oldtokenauth"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="TokenAuth",
+            fields=[
+                (
+                    "id",
+                    models.AutoField(
+                        auto_created=True,
+                        primary_key=True,
+                        serialize=False,
+                        verbose_name="ID",
+                    ),
+                ),
+                ("token", models.CharField(max_length=40, verbose_name="token")),
+                (
+                    "contact_person",
+                    models.CharField(
+                        help_text="Name of the person in the organization who can access the API",
+                        max_length=200,
+                        verbose_name="contact person",
+                    ),
+                ),
+                (
+                    "email",
+                    models.EmailField(
+                        help_text="Email of the person, who can access the API",
+                        max_length=254,
+                        verbose_name="email",
+                    ),
+                ),
+                (
+                    "organization",
+                    models.CharField(
+                        blank=True,
+                        help_text="Organization which has access to the API",
+                        max_length=200,
+                        verbose_name="organization",
+                    ),
+                ),
+                (
+                    "last_modified",
+                    models.DateTimeField(
+                        auto_now=True,
+                        help_text="Last date when the token was modified",
+                        verbose_name="last modified",
+                    ),
+                ),
+                (
+                    "created",
+                    models.DateTimeField(
+                        auto_now_add=True,
+                        help_text="Date when the token was created",
+                        verbose_name="created",
+                    ),
+                ),
+                (
+                    "application",
+                    models.CharField(
+                        blank=True,
+                        help_text="Application which has access to the API",
+                        max_length=200,
+                        verbose_name="application",
+                    ),
+                ),
+                (
+                    "administration",
+                    models.CharField(
+                        blank=True,
+                        help_text="Administration which has access to the API",
+                        max_length=200,
+                        verbose_name="administration",
+                    ),
+                ),
+            ],
+            options={
+                "verbose_name": "token authorization",
+                "verbose_name_plural": "token authorizations",
+            },
+        ),
+    ]
diff --git a/src/objecttypes/token/migrations/0006_copy_token_auth.py b/src/objecttypes/token/migrations/0006_copy_token_auth.py
@@ -0,0 +1,49 @@
+from django.db import migrations
+
+
+def switch_to_new_token_model(apps, _):
+    OldTokenAuth = apps.get_model("token", "OldTokenAuth")
+    TokenAuth = apps.get_model("token", "TokenAuth")
+
+    for old_token in OldTokenAuth.objects.all():
+        TokenAuth.objects.get_or_create(
+            token=old_token.token,
+            defaults={
+                "contact_person": old_token.contact_person,
+                "email": old_token.email,
+                "organization": old_token.organization,
+                "last_modified": old_token.last_modified,
+                "created": old_token.created,
+                "application": old_token.application,
+                "administration": old_token.administration,
+            },
+        )
+
+
+def switch_to_old_token_model(apps, _):
+    OldTokenAuth = apps.get_model("token", "OldTokenAuth")
+    TokenAuth = apps.get_model("token", "TokenAuth")
+
+    for token in TokenAuth.objects.all():
+        OldTokenAuth.objects.get_or_create(
+            token=token.token,
+            defaults={
+                "contact_person": token.contact_person,
+                "email": token.email,
+                "organization": token.organization,
+                "last_modified": token.last_modified,
+                "created": token.created,
+                "application": token.application,
+                "administration": token.administration,
+            },
+        )
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("token", "0005_tokenauth"),
+    ]
+
+    operations = [
+        migrations.RunPython(switch_to_new_token_model, switch_to_old_token_model),
+    ]
diff --git a/src/objecttypes/token/migrations/0007_delete_oldtokenauth.py b/src/objecttypes/token/migrations/0007_delete_oldtokenauth.py
@@ -0,0 +1,15 @@
+# Generated by Django 4.2.11 on 2024-05-02 13:03
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("token", "0006_copy_token_auth"),
+    ]
+
+    operations = [
+        migrations.DeleteModel(
+            name="OldTokenAuth",
+        ),
+    ]
diff --git a/src/objecttypes/token/migrations/0008_alter_tokenauth_token.py b/src/objecttypes/token/migrations/0008_alter_tokenauth_token.py
@@ -0,0 +1,17 @@
+# Generated by Django 4.2.11 on 2024-05-02 13:04
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("token", "0007_delete_oldtokenauth"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="tokenauth",
+            name="token",
+            field=models.CharField(max_length=40, unique=True, verbose_name="token"),
+        ),
+    ]
diff --git a/src/objecttypes/token/models.py b/src/objecttypes/token/models.py
@@ -6,7 +6,7 @@
 
 
 class TokenAuth(models.Model):
-    token = models.CharField(_("token"), max_length=40, primary_key=True)
+    token = models.CharField(_("token"), max_length=40, unique=True)
     contact_person = models.CharField(
         _("contact person"),
         max_length=200,