Content Selector - Route Security - PyPI

Acceptance

• Publishing components to hosted repositories using HTTP POST to root of PyPi hosted repository (typical of PyPi tooling) are protected by "path" based content selectors matching against the final path name
• Single-artifact routes (put, get) are protected by content selector privileges
• If an asset request matches any content selector privileges, the user must have at least one of the associated permissions, or the request is disallowed with HTTP 403
• Selectors can refer to the "Nexus 3.1 Parity" attributes listed in https://docs.sonatype.com/display/Nexus/Nexus+3+Component+Selector+Normalized+Attributes

PyPi coordinates consist of:

• coordinate.name
• coordinate.version