PyPI package event notification feature

[vishleshp]

What's the problem this feature will solve?
It seems deleting a pypi package is possible - How to remove a package from Pypi

This can cause problems if multiple team members have access to PyPI account holding the PyPI package and permissions. A person can accidentally delete a package if a person don't know dependent packages using the specific versions of a particular package.

It would be great if pypi starts supporting notifications feature where PyPI can send a notification if someone performs delete operation.

Also, in addition, it would be great to have notification when someone performs a upload of new package in PyPI repo, everyone receives notification.

Describe the solution you'd like

Basic ask:
It would be great if PyPI starts supporting notifications feature where PyPI can send a notification if someone performs delete operation.
Good to have:
It would be great to have notification when someone performs a upload of new package in PyPI repo, everyone receives notification.

Additional context
https://stackoverflow.com/questions/55710802/how-to-protect-pypi-package-from-being-deleted

[brainwane]

My gut tells me we should implement this with or after #5863, and that it might in fact be blocked on #5863.

[brainwane]

Yup: to do this the right way, we should wait till we have #5863 implemented, so we can draw on the event logging and use it to trigger this notification.

[brainwane]

Now unblocked! See #5863 for related issues and requests for notifications of specific kinds of events, and #6339 for events currently being logged.

[calvin]

What would be the notification medium? Email?

[vishleshpatel]

@calvin email shall be sufficient. Even better if SMS can be added too.

[calvin]

Scope:

• Send a email notification to all collaborators when new version of the package is uploaded.
• Send a email notification to all collaborators when a version is deleted.
• Send a email notification to all collaborators when a file from a version is deleted.
• Send a email notification to all collaborators when the project is deleted.

[MVrachev]

@calvin are you working on this?

If not, I want to work on that issue.

[MVrachev]

I will work on this.
First I plan to implement email notifications to all contributors when

• project was deleted
• a version of a project was deleted

Then probably I will work on the rest of the features.

[MVrachev]

How can I test this feature locally?

I didn't succeed with trying:

1. I created a new build with my changes.
2. Then I used make serve and make initdb
3. I logged in with the ewdurbin profile.
4. In Account options, I added my email address.
5. From the logs, it seems that the email was successfully sent.
6. Then I looked at my profile and I didn't saw any email from Warehouse...
   Checked multiple times with 2 different email addresses.

[ewdurbin]

@MVrachev local development environment for warehouse does not deliver emails to the internet. instead, the emails are accepted by the development SMTP service stand-in and will appear in the docker logs.

That's not the most friendly, we should probably look into replacing this stand-in with something like MailHog.

[MVrachev]

The base work for

• Send a email notification to all collaborators when a version is deleted.
• Send a email notification to all collaborators when a version is deleted.

is completed by me in pr #7071

I plan to continue my work with:

• Send a email notification to all collaborators when a file from a version is deleted.

After reading issue #997 I realized that
Send a email notification to all collaborators when new version of the package is uploaded is not so simple to be implemented if you want to do it the right way with option to opt out from those emails.

That's why I think Send a email notification to all collaborators when new version of the package is uploaded is shouldn't be considered as part of this issue.

[MVrachev]

@calvin when you mentioned that it will be good to Send a email notification to all collaborators when a file from a version is deleted. what did you mean?

I find in the warehouse repository only delete_project_release_file function in the warehouse\manage\views.py file.
Do you mean that?

[berinhard]

Should this issue still be open? @vishleshp says at the issue description:

Basic ask:
It would be great if PyPI starts supporting notifications feature where PyPI can send a notification if someone performs delete operation.
Good to have:
It would be great to have notification when someone performs a upload of new package in PyPI repo, everyone receives notification.

I think #7071 and #7498 (thanks @MVrachev) already covers the basic part and #997 address what's left in a more detailed way. But I'm not sure if this issue also stands for a more generic and extensible notification system. Is that the case?

[di]

Yep, closing this.