Warehouse: Email all owners when a new owner/maintainer is added

[edmorley]

To make account compromise more obvious, it would be great if all owners of a package were emailed when a new owner or maintainer was added to a package.

In addition, if a user is removed from a role, then that user should also be emailed (eg to prevent an attacker who has compromised one owner, from silently removing other owners of a package, prior to uploading a new malicious package, thereby circumventing #997).

[brainwane]

Thanks for the great suggestion, @edmorley, and sorry for the slow response!

This would be a useful security/audit feature, and in addition, we should also send an email notification to newly added collaborators. And now that we have better email management in Warehouse (just added in the past few weeks), it's far easier to add this feature.

Today in our development meeting we discussed where this should go on our development roadmap. The most urgent task is to improve Warehouse to the point where we can redirect pypi.python.org to pypi.org so the site is more sustainable and reliable. Since this feature isn't something that the legacy site has, I've moved it to a future milestone. But that doesn't have to stop a volunteer from working on it now; if someone wants to write up a pull request for it, go ahead!

Thanks and sorry again for the wait.

[Mariatta]

I'd be interested to work on this.
I'm not familiar with the codebase yet. Quick look at https://github.com/pypa/warehouse/blob/master/warehouse/manage/views.py#L550, perhaps around there we can send the email to owners. Am I in the right track for this?
Thanks :)

[brainwane]

Thanks, @Mariatta! I'll defer to @di who implemented the email management.

[di]

@Mariatta Yep, that's the right spot!

I think we should break this up into two emails we send when a new collaborator is added:

• Notification to existing owners that a new collaborator has been added (we probably don't need to send this to the current user).
• Notification to the new collaborator that they have been added.

[Mariatta]

Thanks! In https://github.com/pypa/warehouse/pull/3155 I added the code to send email when a new collaborator has been added. Feel free to suggest different copy for the email.

I have not addressed the part about emailing when a user removed from the project, or when the role changed (from Owner-> Maintainer, or vice versa). I think that should be done in a separate PR.

[edmorley]

Thank you for implementing this @Mariatta! :-)