chore: remove most of basic auth code

[miketheman]

Now that the active policies are Session (for web) and Macaroon (for upload), remove the bulk of the BasicAuth policy.

Move the logic farther up the chain, so that there's no extra work put in before telling the user that they should migrate to API Tokens.

Resolves #13770

[miketheman]

P.S. We can potentially also remove commit_veto, since nothing can raise the BasicAuth errors any longer.

warehouse/warehouse/config.py

Lines 101 to 111 in 5261657

	def commit_veto(request, response):
	# By default pyramid_tm will veto the commit anytime request.exc_info is not None,
	# we are going to copy that logic with one difference, we are still going to commit
	# if the exception was for a BasicAuthFailedPassword or BreachedPassword.
	# TODO: We should probably use a registry or something instead of hardcoded.
	allowed_types = (BasicAuthBreachedPassword, BasicAuthFailedPassword)
	try:
	return not isinstance(request.exc_info[1], allowed_types)
	except (AttributeError, TypeError):
	return False

I elected to defer until this is reviewed and approved, in case there's some other tricky reason to keep the commit_veto.

[miketheman]

P.P.S. There's also some basic auth email sending code in the legacy upload endpoint that would be another deferral.

[woodruffw]

LGTM! Negative diffs are the best diffs 🙂

[di]

I think we can also remove this:

warehouse/warehouse/forklift/legacy.py

Lines 996 to 1013 in 74d8013

	# Check if the user has 2FA and used basic auth
	# NOTE: We don't need to guard request.user here because basic auth
	# can only be used with user identities.
	if (
	request.authentication_method == AuthenticationMethod.BASIC_AUTH
	and request.user.has_two_factor
	):
	send_basic_auth_with_two_factor_email(
	request, request.user, project_name=project.name
	)
	raise _exc_with_message(
	BasicAuthTwoFactorEnabled,
	(
	f"User { request.user.username } has two factor auth enabled, "
	"an API Token or Trusted Publisher must be used to upload "
	"in place of password."
	),
	)

[miketheman]

I think we can also remove this:

Agreed - I noted that I'm deferring that #15182 (comment)

[di]

Sorry, missed your P.P.S. 😂