Add ondelete and onupdate attributes to macaroon warning table (#…

…15832)

* Add ondelete and onupdate attributes to macaroon warning table

* Add test for ondelete behavior for macaroon warning table

tests/unit/packaging/test_models.py

@@ -19,9 +19,17 @@
 from pyramid.location import lineage
 
 from warehouse.authnz import Permissions
+from warehouse.macaroons import caveats
+from warehouse.macaroons.models import Macaroon
 from warehouse.oidc.models import GitHubPublisher
 from warehouse.organizations.models import TeamProjectRoleType
-from warehouse.packaging.models import File, Project, ProjectFactory, ReleaseURL
+from warehouse.packaging.models import (
+    File,
+    Project,
+    ProjectFactory,
+    ProjectMacaroonWarningAssociation,
+    ReleaseURL,
+)
 
 from ...common.db.oidc import GitHubPublisherFactory
 from ...common.db.organizations import (
@@ -277,6 +285,88 @@ def test_deletion_with_trusted_publisher(self, db_session):
         assert db_session.query(Project).filter_by(id=project.id).count() == 0
         assert db_session.query(GitHubPublisher).filter_by(id=publisher.id).count() == 1
 
+    def test_deletion_project_with_macaroon_warning(self, db_session, macaroon_service):
+        """
+        When we remove a Project, ensure that we also remove any related
+        warnings about the use of API tokens from the ProjectMacaroonWarningAssociation
+        table
+        """
+        project = DBProjectFactory.create()
+        owner = DBRoleFactory.create()
+        raw_macaroon, macaroon = macaroon_service.create_macaroon(
+            "fake location",
+            "fake description",
+            [caveats.RequestUser(user_id=str(owner.user.id))],
+            user_id=owner.user.id,
+        )
+
+        db_session.add(
+            ProjectMacaroonWarningAssociation(
+                macaroon_id=macaroon.id,
+                project_id=project.id,
+            )
+        )
+        assert (
+            db_session.query(ProjectMacaroonWarningAssociation)
+            .filter_by(project_id=project.id)
+            .count()
+            == 1
+        )
+
+        db_session.delete(project)
+        # Flush session to trigger any FK constraints
+        db_session.flush()
+
+        assert db_session.query(Project).filter_by(id=project.id).count() == 0
+        assert (
+            db_session.query(ProjectMacaroonWarningAssociation)
+            .filter_by(project_id=project.id)
+            .count()
+            == 0
+        )
+
+    def test_deletion_macaroon_with_macaroon_warning(
+        self, db_session, macaroon_service
+    ):
+        """
+        When we remove a Macaroon, ensure that we also remove any related
+        warnings about the use of API tokens from the ProjectMacaroonWarningAssociation
+        table
+        """
+        project = DBProjectFactory.create()
+        owner = DBRoleFactory.create()
+        raw_macaroon, macaroon = macaroon_service.create_macaroon(
+            "fake location",
+            "fake description",
+            [caveats.RequestUser(user_id=str(owner.user.id))],
+            user_id=owner.user.id,
+        )
+
+        db_session.add(
+            ProjectMacaroonWarningAssociation(
+                macaroon_id=macaroon.id,
+                project_id=project.id,
+            )
+        )
+        assert (
+            db_session.query(ProjectMacaroonWarningAssociation)
+            .filter_by(macaroon_id=macaroon.id)
+            .count()
+            == 1
+        )
+
+        db_session.delete(macaroon)
+        # Flush session to trigger any FK constraints
+        db_session.flush()
+
+        assert db_session.query(Macaroon).filter_by(id=macaroon.id).count() == 0
+        assert (
+            db_session.query(ProjectMacaroonWarningAssociation)
+            .filter_by(macaroon_id=macaroon.id)
+            .count()
+            == 0
+        )
+
 
 class TestDependency:
     def test_repr(self, db_session):

warehouse/migrations/versions/78ecf599841c_change_ondelete_macaroon_warning_table.py

@@ -0,0 +1,52 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""
+change_ondelete_macaroon_warning_table
+
+Revision ID: 78ecf599841c
+Revises: 444353e3eca2
+Create Date: 2024-04-22 15:50:58.878673
+"""
+
+from alembic import op
+
+revision = "78ecf599841c"
+down_revision = "444353e3eca2"
+
+
+def upgrade():
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.drop_constraint(
+        "project_macaroon_warning_association_project_id_fkey",
+        "project_macaroon_warning_association",
+        type_="foreignkey",
+    )
+    op.create_foreign_key(
+        None,
+        "project_macaroon_warning_association",
+        "projects",
+        ["project_id"],
+        ["id"],
+        onupdate="CASCADE",
+        ondelete="CASCADE",
+    )
+
+
+def downgrade():
+    op.drop_constraint(None, "project_macaroon_warning_association", type_="foreignkey")
+    op.create_foreign_key(
+        "project_macaroon_warning_association_project_id_fkey",
+        "project_macaroon_warning_association",
+        "projects",
+        ["project_id"],
+        ["id"],
+    )

warehouse/packaging/models.py

@@ -901,4 +901,7 @@ class ProjectMacaroonWarningAssociation(db.Model):
         ForeignKey("macaroons.id", onupdate="CASCADE", ondelete="CASCADE"),
         primary_key=True,
     )
-    project_id = mapped_column(ForeignKey("projects.id"), primary_key=True)
+    project_id = mapped_column(
+        ForeignKey("projects.id", onupdate="CASCADE", ondelete="CASCADE"),
+        primary_key=True,
+    )