Approach for resolving #6232

[ewdurbin]

Fixes #6232.

Resulting error messages:

Invalid Username/Password:

HTTPError: 403 Client Error: Invalid or non-existent authentication information. for url: http://localhost/legacy/

Invalid API Token:

HTTPError: 403 Client Error: Invalid or non-existent authentication information. for url: http://localhost/legacy/

Valid Username/Password that does not have permission:

HTTPError: 403 Client Error: The user '<USER_NAME>' isn't allowed to upload to project '< PROJECT_NAME >'. See http://localhost/help/#project-name for more information. for url: http://localhost/legacy/

Valid API Token missing scope for project:

HTTPError: 403 Client Error: Invalid API Token: project-scoped token is not valid for project '<PROJECT_NAME>' for url: http://localhost/legacy/

[woodruffw]

LGTM, although we could possibly use the message passed in each Denied instance (and pull the underlying error out from V1Caveat) instead of using isinstance to test the class of allowed. That might be a little easier to test + allow more error message reuse, but this approach is also fine.

[ewdurbin]

@dstufft do you have a preference for which approach to take here?

[ewdurbin]

Offered another approach based on feedback from @dstufft, though I'm still feeling really icky about how much we're having to bubble through.

[brainwane]

This item is a beta blocker https://github.com/pypa/warehouse/milestone/17 so it'd be nice to address this month so we can send out a pypi-announce email around Halloween (security is spooky!).

[brainwane]

I would like to wrap up the beta of the API token feature and email out an announcement to get more people using the feature. Thus: @ewdurbin could you please rebase this, and then @dstufft could you review it, so we can finish getting this merged and then get more people uploading with API tokens?

Thanks.

[brainwane]

IMO fixing this is still a blocker for coming out of beta #5661 (comment) -- @ewdurbin @di @woodruffw @yeraydiazdiaz could we finish this PR within the next few weeks so we can announce the feature on pypi-announce, increase adoption, and better secure PyPI packages?

[ewdurbin]

I think this is ready for review.