NuGetGallery

Merge of https://github.com/NuGet/NuGetGallery/pull/5788
See pull request for commit list

Overview:
Organizations Feature flagged.
Security Fixes.
Infinite loop on WeightedComparer fixed.
Tighter validation on .nupkg upload.
2FA support for MSA login.
Performance improvements.

f842ae7a3092fd45629d5e31986204cc42810df8 [Organizations] Use a configurable list to determine what users should be asked to transform to an organization with a deprecated password (#5588)
d0e1ed919fe0adc0652798e61cedf0179691fd22 [Organizations] Clone existing API keys to org admin on account transform (#5589)
fd8b3548fac63e4116bb43bba50f726cb209b855 [MSA] Signin assistance page; Register removal; Deprecation Config (#5586)
eeb6929d5b2ee145516c72b3ec6898e01a2a18a5 (origin/loshar-validation-notice) Fix SemVerLevel propagation in Odata Next links. (#5582)
f8aca2b35534db62b38b731c9c3cc56683472288 Removed Content include of clientaccesspolicy.xml (#5585)
262741eabb8d7ac72f7aef6ec463387833417c1a Add CopyFileAsync to ICoreFileStorageService (#5581)
c2443a18fbc8d6f1a33672c10b34aa74dafaffd7 Remove clientaccesspoliy.xml (#5580)
512cbd60c03dd486b382ec84544716ab072a8e00 Improve query performance for Manage Packages (#5573)
a5d96df745c8bf3d7b526aae68e6fd867bd9f027 [Organizations] Minor bug fixes from dev (#5576)
c988d4b69baad7c83ee21f372761580757bc88f6 Remove SecurePushSubscription (#5420)
276e9fec938b49ed7817268c9065834464ee9e9b (origin/cmanusymbol) [Organizations] Small UI fixes (#5567)
d8371bddd11e96d8f12793b7116b18bd45653f9f [Organizations] Include reserved namespaces and package ownership requests in Manage Packages page filtering (#5491)
dc09a1d247b8a4bdf2ac57fa7e59772e356f173b [Organizations] Add Organization (#5526)
04c982888b1af2ced6a2187c5bf889b5c879421f Enable TLS 1.2 in build.ps1 (#5563)
bcfe2bdf1b823fa28fcbdfc65c1fa178dcd3cab4 Added new DEV environment cert to the list of accepted. (#5487)
388736480de4bbb83ed6d2454ed8804ed8cf1d84 Add delay in validation enqueue (#5529)
0ec515d561015f4940a237ef9dbd3466814200e1 Move StorePackageFileInBackupLocationAsync to NuGetGallery.Core (#5549)
8eacea69c81eb9eeeaf3389a93c6e3fe46137ee5 Add telemetry for unlist, list, delete, reflow, and revalidate (#5540)
c2eac1f283729e90ade78ff497dd4c7bf5f71c4e ApiKey hash tool - fix whatif flag (#5554)
72090c614d428e2c76e7579ca3939349ce2f9c82 Add UpdatePackageStreamMetadataAsync to keep stream details up to date (#5548)
d0a8c6183ba70309b5d55770cf43cca124e90c7c (sb-nugetorg) Remove redundant TempData["Message"] when changing email (#5499)
e154636929f0c80735b0ab87611000f6b7ba53c7 Minimal disable of autocomplete. (#5542)
433de7c658f67f4535f28765ee05425bc7b6ac4b Enable reflowing of packages that don't pass valid version range rule (#5524)
7a86e823a1f75cf66a8dfaa43921555acda6ade3 [BugBash] Prevent added model errors from being reset by JQuery Validate (#5502)

Fix issues 5093: Delete account workflow should unlist all versions o... a78da3d
Organizations: transform account on confirmation (#5228) 3addad3
[Organizations]: UI for creating migration request (#5241) 90e8ada
Fix issue 1043: Obfuscate AI data on request redirect (#5236) 18bc2a1
[Organizations] Fixes and unit tests for UI upload for organizations 8572e9f
Obfuscate new transform account route (#5260) 8e4c30a
Fix typo on the report abuse form for Copyright "infringement" #5246 2858824
[2FA] Add AAD login support for NuGet Gallery (#5257) d29d2f1
Refactor section helpers into common ViewHelpers (#5269) b059181
Port edit documentation functionality to gallery and cleanup code rel... 1246665
Fix admin logins (#5276) 801139e
Move validation issue messages into a gallery view to ease revisions 3527bef
Fix issue: [DEV] Images missing from Dev environment (#5280) caa82d0
Update copyright for NuGet Gallery (#5278) ea802a5
fixUploadPackageFromUI (#5290) 9932215
Fix branding message formatting in Functional test (#5291) 2abe600
Remove usernames and emails from AI traces. (#5293) 4caac39
[Organizations] Manage Organizations page (#5292) fb75a6e
Issue 4258 - ContactOwners e-mails contain the package version numer... 0a897f7
SQL fix and addressing feedback from demo (#5275) 5d29d53
[Organizations] Fixes and unit tests for API upload for organizations 7a33bc3
[Organizations] Fix bugs with upload scenarios (#5330) d8b1d5c
Rewrite functionality that gets latest package versions for package o... 798d819
Fix: Non-standard ports causes problem with links (#5344) cb3d841
Add new validation issue messages (#5343) 965b236
Bug bash: fix transform issues (#5329) dcbf0ea
Organization bug bash: Manage Packages page (#5335) d682501
Fix ApiKeys page issues from bug bash (#5341) 455fbcc
Hide DeleteUser link for organizations (#5348) 69b67bd
[Organizations] Fix Manage Package Owners issues (#5336) 518c019
Create derived UserAccountViewModel for User (non-Organization) accou... a36fae4
Do not show organization packages on profile (#5349) 5b8fadd
Audit for DeleteAccount (#5297) 8333e17
Profile page should only show "Edit", "Manage Package Owners", and "D... cb773cf
Add support for ApiKey V3 in authentication flow (#5358) 58398c9
ApiKeys fix (#5366) 9b79fd6

• #5195, Update failed validation message to allow a specify email for package signing failure
• #5189, Lock UI upload/edit/unlist
• #5201, Fix API expiry notification email to use the correct URL
• #5202, Add link to package in Contact Owners email
• #5210, Cache AuditActor.GetLocalIpAddressAsync
• #5204, Schema for organization membership requests
• #5220, Pass returnUrl for NuGet sign in
• #5232, Admin UI for package locking
• #5235, Functional test for package locking
• #5063, Add configuration for user package deletes
• #5139, Add Validation Issues to Display Package page
• #5243, Fix expander for verify-metadata section package upload page
• #5129, Permissions tests for DisplayPackage
• #5146, ReportAbuse and ReportMyPackage permissions tests
• #5132, Add logged out tests for Manage Package Owners
• #5152, Add permissions tests for admins for Confirm/Reject ownership
• #5151, Permissions tests for Edit, Delete, Manage Package Owners, and SetLicenseReportVisibility (UI)
• #5153, Permissions tests for API Key list and create actions
• #5158, PermissionsService 2.0 (just implementation)
• #5196, Change Permissions Service 2.0 GetAccountsAllowedOnBehalfOf API
• #5180, Integrate PermissionsService 2.0 with Gallery
• #5229, [Organizations] Merge permissions service 2.0 feature branch into dev

• Add ShowAuthInHeader to allow status page to hide the auth UI (#4981)
• Enable showing auth in header for gallery (status will set these valu…
• Hide package metadata when the package is deleted (#4973)
• Fix test VerifyPackageKey_Returns404ForMissingPackage (#4985)
• Updating to the latest version of NuGet.Services.Validation (#4943)
• Add owner scope to API keys (#4935)
• [Prefix] Add auditing for reserved namespaces (#4940)
• Organization scope evaluation (#4945)
• [Organizations] Allow admins to accept package ownership requests on
• Updating package delete page
• Update Delete.cshtml
• Update Report Reasons (#4956)
• Admin - deleteaccount (#4936)
• Merge pull request #4961 from NuGet/karann-msft-patch-1
• Update ReportAbuseViewModel in tests to include signature for new rea…
• [Statistics] Introduce Community Statistics Reports (#4955)
• ReCreateAccountDeleteMigration (#4971)
• Fixing ApiScopeRequiredAttribute regression (#4968)
• Fix functional tests for default secure push (#4967)
• Not showing "indexing" message while validation is in progress. (#5000)
• Setting for blocking async validation in Gallery (#5009)
• [MSA] Encourage MSA logins on NuGet.org (#5004)
• Fix web ui test for signin flow (#5012)
• Account delete user flow (#4977)
• Add ApiKey owner scope auditing (#5011)
• Add initial support for user deletion request (#5007)
• Initial ApiKey owner (org) scope UI work (#4965)
• Fix missing validation errors in UI and add credential telemetry (#5023)
• Remove extra copyright text from owner support request page
• Merge pull request #5026 from NuGet/ryuyu-remove-extra-ownersupporttext
• Add the required prefix to the validation DB connection string (#5032)
• Show VerifyPackage errors correctly in UI (into dev) (#5035)
• Improve performance of the PermissionsService (#5001)

NOTE: This includes a fix to v2017.10.30

• Documentation parser and clamp fixes (#4853)
• Get rid of obsolete notifications on package details view (#4902)
• Delete owner requests upon package hard delete (#4898)
• [Prefix] List reserved namespaces in the manage packages page (#4901)
• Update number shortener to maintain enough sig figs for distinction. (#4896)
• Schema changes for Organization membership (#4904)
• Gallery constraints to prevent Organization authentication (#4915)
• Fix readme telemetry (#4905)
• Add support for building signed&unsigned nugetgallery.core packages (#4919)
• Slightly different way to initialize service bus topic client wrapper (#4917)
• Fix #4814 - do not consider unlisted prerelease versions when showing "newer prerelease available" message. (#4922)
• Use PackagePermissionsService to determine actions a user can perform on a package (#4923)
• Package URL generation method and checks whether package file exists (#4918)
• Switch Organizations to use TPT inheritance (was fix for Organization-User FK) (#4926)
• Add ability to reflow hard-deletes from Admin area (#4899)

Merge pull request #4875 from NuGet/dev - 9bf609c
Merge pull request #4874 from NuGet/admin-package-removal - e130d8f
Allow admin to delete all owners - 7e5a246
[Prefix] Manage package owners with respect to Prefix reservation (#4854) - 8a2a6b2
Add UI for validation tables (just orchestrator tables) (#4861) 1ecbca2
Change API Keys page note (#4864) - 9b484db
Log product information on push+verify events (#4860) - 9d5e42c
Task NuGet/Engineering#724 (#4856) - 6caa554
Add notification message to edit/verify package view (#4829) - e0e400b
Update DisplayPackage page to observe the Validating and FailedValida
e8d4e34
Add a hidden skip to content link. (#4847) - 078382f
Change maxRequestLength to 250MB (#4848) - 2e2679c
Revert #4844 (#4850) - b0887dc
Fix readme test that broke with nofollow change. (#4846) - 072e820
Task 724 PR feedback (#4845) - 0de47a7
Added credential key to AuditActor (#4844) - 820924c
Add nofollow to links (#4841) - 2db8fe9
X-NuGet-Protocol-Version for Functional tests (#4830) - 79fae0a
4701: Return 404, not 200, when package doesn't exist. (#4798) - efb23fc
Moved the DeletePackageFileAsync from IPackageFileService to ICorePac - 6686259
Show normalized version (incl metadata) in edit/delete package dropdo - 337604e
Adding configurable test for branding. falls back to default branding. (a1429d9
Fix caching of static files. (#4776) - 046d829
Update links to docs on register page to use new configuration (#4791) - 69d15ca
Latest Version on Manage Packages does not show SemVer 2.0.0 packages # - d10dfba
Moved CloudBlob* wrappers to NuGetGallery.Core (#4797) - 1b086f3
Add $count support to FindPackagesById() OData endpoints (#4790) - abfea8d
Specify the empty string area in UrlExtensions unless otherwise speci - a3a6a70
Log user safe exceptions (#4763) - 52a1c04
Disable custom pages for 400 errors (#4794) - 2162ec9
Package documentation telemetry (#4789) - b4189ae

• f5545582 - Add support for third-party tabs on package details page (#4605)
• 3263cdb1 - Fix external search service to reflect the verified flag (#4606)
• fd9d321d - [Prefix]Add visual indicator for Reserved prefix Packages (#4601)
• b0aff959 - Update Number display to clientside formatting for stats pages. (#4602)
• 450fc6c7 - [Prefix] Merge prefix reservation DB schema and service changes into DEV (#4590)
• 4771a589 - Remove CookieComplianceEnabled flag (#4588)
• f57f82f3 - Enumerate the package ID and versions to be deleted as hidden fields (#4580)
• 0968fe9a - Autofocus the search bar on the front page (#4581)
• 04428257 - Redirect preview.nuget.org to www.nuget.org (#4579)
• bb6201d7 - Add storage connection strings for each distinct purpose in the gallery (#4568)
• 5a711658 - Break long lines in the package details page (#4569)
• d4169b00 - Introduce a type to represent the different password reset results (instead of null and exceptions) (#4555)
• e83ae45a - Gracefully handle unconfirmed email addresses in password reset (#4551)

Technical:

• Add AntiForgery tokens to some actions that were missing them #4490

Functional:

• Merge in feature-redesign (#3770)
• Fix calculation of stats (#4513)

For more details, see the following deployment record:

#4068

Changes since the previous release:

• [730f54e] SemVer2 support #3758
• [83d258d], [344e6b2], [41e8931], [5316f6a] Update Terms of Use
• [acee6f7] Fix migration issue (#3865)
• [36d594f] Support MinClientVersion <= 4.1.0.0 (#3860)
• [ba13855], [7a586a6] Front page V3 feed compatibility should mention NuGet 4.x/VS 2017 (#3729)
• [b84d965] Improved the Gallery's Screen Reader Accessibility (#3902)
• [cdcb6a8] Pressing edit or undo on the verify package page does not reset focus (#3919)
• [b2c49c8] Adding recommended index to the Packages table (#3950)
• [b9d3484] Improved NuGet Gallery's Accessibility (#3936)
• [ce1bf4e] Update CSS to show focused elements. (#3939)
• [319bc79] Make PackageDownloadsDetail and PackageDownloadsByVersion graphs update without refreshing the page (#3951)
• [74cd45a] Scoped API keys UI - disabled elements are accessible using tab (#3963)
• [6a7b75c] Fix: "Example glob patterns" button and "close" button are not accessible using keyboard (#3968)
• [9ea3066] Key creation telemetry (#3855)
• [a1bc005] Temp keys policy onboarding (#3854)
• [cdc08cb] Temp keys telemetry and auditing (#3945)
• [3f25393] Allow auto outlining. Fix issue with outline on click. (#3983)
• [eddf514] Parse tags list before comparing on package validation completion (#3992)
• [d0bc5c0] Update Report Abuse Page (#3985)
• [863b88b] Fixed Report Abuse Page's Accessibility (#4001)
• [49747f1] Use ServerCommon's Response Code Processor (#3999)
• [b0edded] On package validation failure an actionable error message should be displayed. #3916
• [95f00cd] Fix the date format on stats page (#4057)
• [0aea0dd] Update telemetry processors (#4059)
• [2319b4b] Average download shown incorrectly when its 1.x #4039
• [68e84b6] Support for policy propagation (#4061)
• Gallery V2 autocomplete endpoint should be hijacked to search service #4097

For more details, see the following deployment record:

#3830

Changes since the previous release:

• [ea0181834c91138ce4822d6fe44fc9172b17b66d] Fix for 2483 Author and description null checks & tests (#3741)
• [b24f0845f9a800e36a881554cceb43be1dfbbe22] Update flaky assert dependent on system clocks (#3771)
• [718f4061e1ad32dfee64ba374095723174892236] Code and tests for issue 3732 (#3735)
• [a01b0f8e421b444c3b3f8cb93e752eb5a1639722] PR#3741 test fix, per integration with PR#3728 (#3794)
• [c3cac986f3930c41bf4699bb2324f32aea114b25] Ignore everything under App_Data (#3804)
• [d80197f179dc9130ce12abb05f8e0404e5f26f9d] IsVerificationKeyUsed telemetry fix (#3806)
• [cd091c71cd6b340a617b857f6d6f3566c9b7d268] fix issue 3790 (#3798)
• [aaf3d8cf3f323e2c8561e025c9380375534443b5] Fix gallery audit trail does not show full version string (#3801)
• [b5fd9b0d1b393e78a6a11dee8c5b7f2c21c53262] 100% Table width for Manage My Package overview (#3783)
• [53e74aeb7a3e04992ed200af43f0a17ff71dffde] Temp keys user policies (#3820)
• [764119db1486cdcf0ae73ae3962f9afaaddbbdd2] Functional tests (disabled) for temp keys policies (#3829)
• [d0d025d6eaf268a122302f582fe307391fdb39c9] Log unhandled exceptions (#3833)
• [547931a99f9cb369b81bf8ba8aff0205dc7159d0] PR 3829 feedback (#3838)
• [f86270976da0eaa960c5bc9b69a3ce7857bfa1c6] Simplified development setup

For more details, see the following deployment record:

#3611

Changes since the previous release:

• [e6dd6e4] Change telemetry time to use correct format (#3690)
• [551fd86] UpdateIsLatest concurrent unlist fix (#3695)
• [9ccd227] Revert UpdateIsLatest optimistic concurrency changes (#3707)

The gallery will be deployed. There are no schema changes.

For more details, see the following deployment record:
https://github.com/NuGet/NuGetGallery/issues/3611

The gallery will be deployed. There are no schema changes.

Full Changelog

• Contact-Page: Add Required-badge and use fieldset (#3418) … 48cfd9b
• Merge remote-tracking branch 'origin/master' into dev fcf18bb
• added required badge (#3415) d55c629
• Add certificate fingerprint (thumbprint) for new nuget.org SSL certif… … d4b91ba
• Enable trace listeners for app insights (#3523) 2b94a5e
• Prevent $BuildBranch overwriting (#3528) f8405f3
• Update Octopus link (#3533) 88624ed
• Fix P1 and P2 functional tests (#3539) … cf3c6df
• Make functional tests output xml instead of html and use VSTest inste… … 4b99fbf
• Add Deploy-StaticContent.ps1 (#3529) 2ed3fee
• Allow package title reuse with soft-deleted package (#3570) 81f0cd5
• refactor test hook (#3580) 5949008
• Enable delay signing on NuGetGallery.Core (#3583) … 6cb94e5
• Create symbols package for NuGetGallery.Core (#3584) 8ed911b
• Don't sign NuGetGallery.Core quite yet (NuGetDeployment is broken) (#… … e9d6651
• Import sign.targets only if it exists (#3590) … 32f16af
• Scoped api keys - bug fixes (#3592) … e79a969
• Fix api key add/remove e-mail message (#3591) … a151dae

Full details are available here: https://github.com/NuGet/NuGetGallery/issues/3510

Changes

• Functional:
  • Multiple API keys (https://github.com/NuGet/NuGetGallery/issues/3246)
  • Turn on query filtering on prod (#3464)
  • Handle case where $filter makes Package(Id=...,Version=...) yield an empty result (#3435)
  • Do not allow login on read-only gallery (#3503)

Full details are available here: https://github.com/NuGet/NuGetGallery/issues/3508

Changes

• Build
  • Improved build script (PR https://github.com/NuGet/NuGetGallery/pull/3477)
  • Enable UseBasicParsing on PowerShell web requests (PR https://github.com/NuGet/NuGetGallery/pull/3488)
• Test
  • Allow functional tests to run against any URL (issue https://github.com/NuGet/NuGetGallery/issues/3483, PR https://github.com/NuGet/NuGetGallery/pull/3489)
  • Fix functional tests (issue https://github.com/NuGet/Engineering/issues/188, PR https://github.com/NuGet/NuGetGallery/pull/3501)
• Functional
  • Filter out unsupported credentials (PR https://github.com/NuGet/NuGetGallery/pull/3479)

Full details are available here: #3476

Changes

• Functional
  • None
• Technical
  • Prevent overwriting of packages in blob storage (#3457)
  • Delete uploaded package from blob storage if saving changes to DB fails (#3469)
  • Enforce HttpOnly and Secure cookie attributes (#3463)

Changes

• Functional:
  • Filter specific OData query patterns. https://github.com/NuGet/Home/wiki/Filter-OData-query-requests. (https://github.com/NuGet/NuGetGallery/pull/3373)
  • Enable angle brackets search queries.(https://github.com/NuGet/NuGetGallery/pull/3388)
• Technical
  • Add more package validation to v2 API push (https://github.com/NuGet/NuGetGallery/pull/3446)

Full details are available here: #3323

Changes

• Functional
  • Feature: Add message for AddOwner request (https://github.com/NuGet/NuGetGallery/pull/3359)
  • Prevent unconfirmed users from re-enabling password auth (#3392)
  • add ability to remove myself from the owner list (#3379)
• Technical
  • Removed Google Analytics
  • Add no follow rel (#3353)
  • Upgrade build script to use latest version of bin-skim utility (#3395)
  • Add link to package details page on support requests view (when request relates to a package)(#3396)
  • Fix OData endpoint throwing 400 exceptions (#3397)
  • Filter out 400 and 404 response codes from failed requests telemetry (#3399)
  • Timestamps of packages in feed are not synchronized #3365 (#3377)

Full details are available here: https://github.com/NuGet/NuGetGallery/issues/3268

Changes:

• Functional
  • Lock user account for a period of time after failed login attempt (#3261)
  • Change cookie expiration time from 14 days to 6 hours (#3266)
  • Fix footer overlapping content on package statistics page(#3302)
• Technical
  • Fix exception in AI - Heads Totals action not found in controller (#3278)
  • Fix failing requests due to extra spaces in URL(#3296)
  • Fix elmah errors for null reference(#3300)