Skip to content

Update project creation limits #20046

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
JacobCoffee wants to merge 13 commits into
base: main
Choose a base branch
from
Draft

Update project creation limits #20046

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
606e2be
begin throttling due to massive influx of crud
JacobCoffee May 8, 2026
2a0cc2d
also limit trusted pub and org proj. creation
JacobCoffee May 8, 2026
dcf060d
fix: test
JacobCoffee May 8, 2026
00f028a
we dont have this anymore so the test tree fails, fixing
JacobCoffee May 8, 2026
51a5956
revert limits, but they will be lowered in infra env settings
JacobCoffee May 8, 2026
fd28ee5
fix: give creator stub an id for unconditional ratelimit check
JacobCoffee May 8, 2026
41a6bd1
return exc for toomany created instead of some opaque error
JacobCoffee May 8, 2026
a162387
return exc for toomany created instead of some opaque error here too
JacobCoffee May 8, 2026
38ae2e7
test: cover TooManyProjectsCreated paths for org and trusted-pub crea…
JacobCoffee May 8, 2026
4146bd4
address review concerns around retry data
JacobCoffee May 8, 2026
fb9633b
address review concerns around retry data
JacobCoffee May 8, 2026
91a23fc
fix: query user bucket by creator.id, not remote_addr
JacobCoffee May 8, 2026
ee55d98
test: cover None resets_in path for project-create ratelimit handlers
JacobCoffee May 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion tests/unit/packaging/test_services.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1030,7 +1030,7 @@ def test_check_project_test_new_disallowed(self, db_request):
service = ProjectService(session=db_request.db)

with pytest.raises(HTTPForbidden) as exc:
service.create_project("foo", pretend.stub(), db_request, ratelimited=False)
service.create_project("foo", pretend.stub(), db_request)
Comment thread
JacobCoffee marked this conversation as resolved.
Outdated

resp = exc.value
assert resp.status_code == 403
Expand Down
30 changes: 15 additions & 15 deletions warehouse/locale/messages.pot
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 0 additions & 1 deletion warehouse/manage/views/organizations.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -881,7 +881,6 @@ def add_organization_project(self):
self.request.user,
request=self.request,
creator_is_owner=False,
ratelimited=False,
)
Comment on lines 882 to 885
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot May 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Catch project rate-limit errors when adding org projects

This call now goes through ProjectService.create_project() with rate limiting enabled, but this view still only catches HTTPException. When a user has exceeded project.create.* limits, create_project() raises TooManyProjectsCreated (a RateLimiterException, not an HTTPException), so the exception escapes and turns a normal validation failure into a 500 for organization project creation attempts.

Useful? React with 👍 / 👎.

except HTTPException as exc:
form.new_project_name.errors.append(exc.detail)
Expand Down
1 change: 0 additions & 1 deletion warehouse/oidc/views.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -225,7 +225,6 @@ def mint_token(
pending_publisher.added_by,
request,
creator_is_owner=pending_publisher.organization_id is None,
ratelimited=False,
organization_id=pending_publisher.organization_id,
)
Comment on lines 225 to 229
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot May 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Catch project rate-limit errors in pending publisher minting

Pending-publisher token minting now invokes rate-limited project creation, but this block only handles HTTPException. If the pending publisher owner has hit project creation limits, create_project() raises TooManyProjectsCreated (not an HTTPException), which is unhandled here and results in a server error instead of a structured API error response.

Useful? React with 👍 / 👎.

except HTTPException as exc:
Expand Down
7 changes: 2 additions & 5 deletions warehouse/packaging/services.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -500,11 +500,9 @@ def create_project(
request,
*,
creator_is_owner=True,
ratelimited=True,
organization_id=None,
):
if ratelimited:
self._check_ratelimits(request, creator)
self._check_ratelimits(request, creator)

# Check for AdminFlag set by a PyPI Administrator disabling new project
# registration, reasons for this include Spammers, security
Expand Down Expand Up @@ -716,8 +714,7 @@ def create_project(
)
request.db.delete(stale_publisher)

if ratelimited:
self._hit_ratelimits(request, creator)
self._hit_ratelimits(request, creator)
return project


Expand Down
Loading