Add 2FA metrics task (#11626)

di · web-flow · commit 0c2ff6d74aa9 · 2022-06-22T20:25:30.000Z
* Add 2FA metrics task

* Include breakdown of totp vs webauthn
diff --git a/tests/unit/packaging/test_tasks.py b/tests/unit/packaging/test_tasks.py
@@ -20,10 +20,12 @@
 
 import warehouse.packaging.tasks
 
+from warehouse.accounts.models import WebAuthn
 from warehouse.cache.origin import IOriginCache
 from warehouse.packaging.models import Description, Project
 from warehouse.packaging.tasks import (
     compute_2fa_mandate,
+    compute_2fa_metrics,
     compute_trending,
     sync_bigquery_release_files,
     update_bigquery_release_files,
@@ -669,3 +671,59 @@ def find_service(iface=None, name=None):
         pretend.call(db_request, deploy_dependency_maintainer),
         pretend.call(db_request, new_critical_project_maintainer),
     }
+
+
+def test_compute_2fa_metrics(db_request, monkeypatch):
+    # A project declared to be critical
+    critical_project = ProjectFactory.create(
+        name="critical_project", pypi_mandates_2fa=True
+    )
+
+    # A critical maintainer without 2FA enabled
+    critical_project_maintainer = UserFactory.create(totp_secret=None, webauthn=[])
+    RoleFactory.create(user=critical_project_maintainer, project=critical_project)
+
+    # A critical maintainer with TOTP enabled
+    second_critical_project_maintainer = UserFactory.create(
+        totp_secret=b"foo", webauthn=[]
+    )
+    RoleFactory.create(
+        user=second_critical_project_maintainer, project=critical_project
+    )
+
+    # A critical maintainer with WebAuthn enabled
+    third_critical_project_maintainer = UserFactory.create()
+    RoleFactory.create(user=third_critical_project_maintainer, project=critical_project)
+    webauthn = WebAuthn(
+        user_id=third_critical_project_maintainer.id,
+        label="foo",
+        credential_id="foo",
+        public_key="foo",
+    )
+    db_request.db.add(webauthn)
+    third_critical_project_maintainer.webauthn = [webauthn]
+
+    # A regular project opted in to 2FA
+    non_critical_project = ProjectFactory.create(
+        name="non_critical_project", owners_require_2fa=True
+    )
+    non_critical_project_maintainer = UserFactory.create(totp_secret=b"foo")
+    RoleFactory.create(
+        user=non_critical_project_maintainer, project=non_critical_project
+    )
+
+    gauge = pretend.call_recorder(lambda metric, value: None)
+    db_request.find_service = lambda *a, **kw: pretend.stub(gauge=gauge)
+
+    compute_2fa_metrics(db_request)
+
+    assert gauge.calls == [
+        pretend.call("warehouse.2fa.total_critical_projects", 1),
+        pretend.call("warehouse.2fa.total_critical_maintainers", 3),
+        pretend.call("warehouse.2fa.total_critical_maintainers_with_2fa_enabled", 2),
+        pretend.call("warehouse.2fa.total_projects_with_2fa_opt_in", 1),
+        pretend.call("warehouse.2fa.total_projects_with_two_factor_required", 2),
+        pretend.call("warehouse.2fa.total_users_with_totp_enabled", 2),
+        pretend.call("warehouse.2fa.total_users_with_webauthn_enabled", 1),
+        pretend.call("warehouse.2fa.total_users_with_two_factor_enabled", 3),
+    ]
diff --git a/warehouse/accounts/models.py b/warehouse/accounts/models.py
@@ -27,6 +27,8 @@
     String,
     Text,
     UniqueConstraint,
+    and_,
+    or_,
     orm,
     select,
     sql,
@@ -134,10 +136,19 @@ def email(self):
             .scalar_subquery()
         )
 
-    @property
+    @hybrid_property
     def has_two_factor(self):
         return self.totp_secret is not None or len(self.webauthn) > 0
 
+    @has_two_factor.expression  # type: ignore
+    def has_two_factor(self):
+        return select([True]).where(
+            or_(
+                WebAuthn.user_id == self.id,
+                and_(User.id == self.id, User.totp_secret.is_not(None)),
+            )
+        )
+
     @property
     def has_recovery_codes(self):
         return any(not code.burned for code in self.recovery_codes)
diff --git a/warehouse/packaging/__init__.py b/warehouse/packaging/__init__.py
@@ -21,6 +21,7 @@
 from warehouse.packaging.models import File, Project, Release, Role
 from warehouse.packaging.tasks import (  # sync_bigquery_release_files,
     compute_2fa_mandate,
+    compute_2fa_metrics,
     compute_trending,
     update_description_html,
 )
@@ -106,6 +107,9 @@ def includeme(config):
     if config.get_settings().get("warehouse.two_factor_mandate.available", False):
         config.add_periodic_task(crontab(minute=0, hour=3), compute_2fa_mandate)
 
+    # Add a periodic task to generate 2FA metrics
+    config.add_periodic_task(crontab(minute="*/5"), compute_2fa_metrics)
+
     # Add a periodic task to compute trending once a day, assuming we have
     # been configured to be able to access BigQuery.
     if config.get_settings().get("warehouse.trending_table"):
diff --git a/warehouse/packaging/tasks.py b/warehouse/packaging/tasks.py
@@ -19,9 +19,10 @@
 from google.cloud.bigquery import LoadJobConfig
 
 from warehouse import tasks
-from warehouse.accounts.models import User
+from warehouse.accounts.models import User, WebAuthn
 from warehouse.cache.origin import IOriginCache
 from warehouse.email import send_two_factor_mandate_email
+from warehouse.metrics import IMetricsService
 from warehouse.packaging.models import Description, File, Project, Release
 from warehouse.utils import readme
 
@@ -81,6 +82,66 @@ def compute_2fa_mandate(request):
     new_projects.update({Project.pypi_mandates_2fa: True})
 
 
+@tasks.task(ignore_result=True, acks_late=True)
+def compute_2fa_metrics(request):
+    metrics = request.find_service(IMetricsService, context=None)
+
+    critical_projects = request.db.query(Project).where(
+        Project.pypi_mandates_2fa.is_(True)
+    )
+    critical_maintainers = (
+        request.db.query(User).join(Project.users).join(critical_projects)
+    )
+
+    # Number of projects marked critical
+    metrics.gauge(
+        "warehouse.2fa.total_critical_projects",
+        critical_projects.count(),
+    )
+
+    # Number of critical project maintainers
+    metrics.gauge(
+        "warehouse.2fa.total_critical_maintainers",
+        critical_maintainers.count(),
+    )
+
+    # Number of critical project maintainers with 2FA enabled
+    metrics.gauge(
+        "warehouse.2fa.total_critical_maintainers_with_2fa_enabled",
+        critical_maintainers.where(User.has_two_factor).count(),
+    )
+
+    # Number of projects manually requiring 2FA
+    metrics.gauge(
+        "warehouse.2fa.total_projects_with_2fa_opt_in",
+        request.db.query(Project).where(Project.owners_require_2fa).count(),
+    )
+
+    # Total number of projects requiring 2FA
+    metrics.gauge(
+        "warehouse.2fa.total_projects_with_two_factor_required",
+        request.db.query(Project).where(Project.two_factor_required).count(),
+    )
+
+    # Total number of users with TOTP enabled
+    metrics.gauge(
+        "warehouse.2fa.total_users_with_totp_enabled",
+        request.db.query(User).where(User.totp_secret.is_not(None)).count(),
+    )
+
+    # Total number of users with WebAuthn enabled
+    metrics.gauge(
+        "warehouse.2fa.total_users_with_webauthn_enabled",
+        request.db.query(WebAuthn.user_id).group_by(WebAuthn.user_id).count(),
+    )
+
+    # Total number of users with 2FA enabled
+    metrics.gauge(
+        "warehouse.2fa.total_users_with_two_factor_enabled",
+        request.db.query(User).where(User.has_two_factor).count(),
+    )
+
+
 @tasks.task(ignore_result=True, acks_late=True)
 def compute_trending(request):
     bq = request.find_service(name="gcloud.bigquery")
