(allura) branch master updated: for ease of development, make trusted_login_source allow some usernames

[br...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

brondsem pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/allura.git


The following commit(s) were added to refs/heads/master by this push:
     new 37e951560 for ease of development, make trusted_login_source allow some usernames
37e951560 is described below

commit 37e951560def17f2753069e533f21cd506f892bc
Author: Dave Brondsema <db...@slashdotmedia.com>
AuthorDate: Wed Aug 6 13:21:19 2025 -0400

    for ease of development, make trusted_login_source allow some usernames
---
 Allura/allura/lib/plugin.py | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/Allura/allura/lib/plugin.py b/Allura/allura/lib/plugin.py
index e676eb14a..c93c5b304 100644
--- a/Allura/allura/lib/plugin.py
+++ b/Allura/allura/lib/plugin.py
@@ -100,6 +100,13 @@ class AuthenticationProvider:
     cfg_prefix_pwds = 'auth.password.'
     default_pwd_algo = 'scrypt'  # noqa: S105
 
+    # for dev only.  these are some of the bootstrap.py users
+    auth_code_bypass_users = [
+        'root',
+        'admin1',
+        'test-user',
+    ]
+
     def __init__(self, request):
         self.request = request
 
@@ -555,6 +562,11 @@ def get_login_detail(self, request, user):
     def trusted_login_source(self, user, login_details) -> str | False:
         # TODO: could also factor in User-Agent but hard to know what parts of the UA are meaningful to check here
         from allura import model as M
+
+        if asbool(config['debug']) and (not user.has_active_sessions() or user.username in self.auth_code_bypass_users):
+            # make it easier for dev: if never logged-in, or certain test users, allow.
+            return 'dev access'
+
         for prev_login in M.UserLoginDetails.query.find({'user_id': user._id}):
             if prev_login['ip'] == login_details['ip']:
                 return 'exact ip'