Trusted publishing changes

[netomi]

Work in progress on the trusted publishing feature. Opened as a draft so the changes are visible as they land.

So far

• Move TrustedPublishingAPI into org.eclipse.openvsx.trustedpublishing — the controller sat in the root package while the rest of the feature (service, config, providers, entities' repository) is in the trustedpublishing package. Pure move, endpoint paths unchanged.
• Add TrustedPublishingAPITest — there was no controller-level test coverage. 26 tests in a @WebMvcTest slice (service, Eclipse service and user service mocked) covering all five endpoints:
  • POST /user/namespace/{ns}/trusted-publishing/create — anonymous access, each missing mandatory field, path/body namespace mismatch, successful registration, unknown namespace, non-owner, rejected registration
  • GET /user/namespace/{ns}/trusted-publishing — anonymous access, publishers + registrable extensions, empty result, unknown namespace, feature disabled, non-owner
  • POST /user/namespace/{ns}/trusted-publishing/delete/{id} — anonymous access, success, unknown publisher, non-owner
  • POST /api/-/trusted-publishing/token — each missing field, successful exchange (asserting no login is consulted), no matching publisher, unusable token
  • GET /api/-/trusted-publishing/status — anonymous access, feature disabled, missing publisher agreement, provider listing, error mapping

Noted while writing the tests — since fixed

In createTrustedPublisher, eclipseService.checkPublisherAgreement(user) was called outside the try/catch, and no @ControllerAdvice handles ErrorResultException. A user without a signed publisher agreement therefore got a 500 with an empty body instead of the 403 and the {"error": "..."} message the exception carries. Fixed in 39416689d.

See the comments below for the changes that followed.

🤖 Generated with Claude Code

[netomi]

Configurable GitLab instances (63c03568b, 4a1fdb862)

EclipseGitLabTrustedPublishingProvider carried nothing but four constants — every GitLab instance behaves identically and differs only in id, name, URL and OIDC issuer. So instances are configuration now, not code:

ovsx:
  trusted-publishing:
    active-providers: github,eclipse-gitlab
    gitlab:
      eclipse-gitlab:
        name: Eclipse GitLab
        url: https://gitlab.eclipse.org
        issuer: https://gitlab.eclipse.org   # optional, defaults to the URL

• GitLabTrustedPublishingProviderSupport and its two subclasses collapse into a single concrete GitLabTrustedPublishingProvider.
• New TrustedPublishingProperties (@ConfigurationProperties("ovsx.trusted-publishing"), same pattern as RemoteScannerProperties). Only the public gitlab instance is configured out of the box — an instance this registry does not itself use does not belong in the built-in defaults.
• active-providers is unchanged: it still decides what is actually usable.
• TrustedPublishingService builds GitHub plus one provider per configured instance, instead of the hardcoded Map.of(...).

Two behavioural details worth a look

• Redefining an instance replaces it wholly. Spring's map binder builds a fresh GitLabInstance per key rather than patching the default, so gitlab.gitlab.url: … on its own would silently drop the name. Startup now rejects an instance with no name or URL, and redefiningTheDefaultInstanceReplacesItAsAWhole pins that down.
• ci_config_ref_uri is derived from host and path. It used URI.create(providerUrl).getHost() only, so an instance served under a relative URL root (https://acme.example/gitlab) registered a claim that could never match. Output is identical for normal installs.

Startup also fails on a malformed instance URL or an instance taking the github id, and logs a warning for active-providers entries that no provider is configured for — previously those were silently inert.

Deployment note: open-vsx.org serves eclipse-gitlab today, and existing trusted_publisher rows carry that provider id. It needs the config block above once this ships, or those registrations stop being listed. The id itself is unchanged, so they reappear as soon as it is configured.

Tests: 7 new in TrustedPublishingPropertiesTest (defaults, adding an instance, whole-instance replacement, the three validation failures), 3 new in GitLabTrustedPublishingProviderTest (self-hosted instance, relative URL root, malformed URL). Full unit suite: 998 passing. Six unrelated test files needed a one-line update for the new TrustedPublishingConfig constructor.

Not addressed: the webui infers the provider kind from the id (providerId.includes('gitlab') in registration-fields.ts), so a custom instance whose id lacks "gitlab" falls back to the generic icon. Having the server send the kind would be the proper fix.

[netomi]

Publisher agreement error is a 403 again (39416689d)

Addresses the note in the description. createTrustedPublisher called eclipseService.checkPublisherAgreement(user) before its try, so the ErrorResultException it throws escaped the controller. Nothing else handles that type — ServerExceptionResolver extends DefaultHandlerExceptionResolver and ValidationExceptionHandler only covers ConstraintViolationException — so a user without a signed agreement got a 500 with an empty body instead of the 403 and the message the exception carries ("You must sign a Publisher Agreement with the Eclipse Foundation before publishing any extension.").

The check now runs inside the existing try, ahead of the field validation exactly as before, so the ordering of errors is unchanged and the existing catch (ErrorResultException) maps it through toResponseEntity(TrustedPublisherJson.class) like every other failure on this endpoint.

createTrustedPublisher_returns403_whenPublisherAgreementIsMissing covers it, and asserts the registration is not attempted. Verified it fails (500 ≠ 403) against the previous code.

Scope note: the underlying gap — an ErrorResultException that escapes any controller becomes a 500 — is repo-wide, since every controller catches it locally. A @RestControllerAdvice mapping it to its status and {"error": …} would be a safety net against this recurring, but that changes behaviour beyond trusted publishing, so I left it alone. Happy to add it if you want it.