Add owner scope to API keys

src/NuGetGallery.Core/Entities/EntitiesContext.cs

@@ -91,6 +91,12 @@ protected override void OnModelCreating(DbModelBuilder modelBuilder)
             modelBuilder.Entity<Scope>()
                 .HasKey(c => c.Key);
 
+            modelBuilder.Entity<Scope>()
+                .HasOptional(sc => sc.Owner)
+                .WithMany()
+                .HasForeignKey(sc => sc.OwnerKey)
+                .WillCascadeOnDelete(false);
+
             modelBuilder.Entity<Scope>()
                 .HasRequired<Credential>(sc => sc.Credential)
                 .WithMany(cr => cr.Scopes)

src/NuGetGallery.Core/Entities/Scope.cs

@@ -1,7 +1,6 @@
 // Copyright (c) .NET Foundation. All rights reserved.
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
-using System.Collections.Generic;
 using System.ComponentModel.DataAnnotations;
 using Newtonsoft.Json;
 
@@ -16,6 +15,20 @@ public class Scope
         [JsonIgnore]
         public int CredentialKey { get; set; }
 
+        /// <summary>
+        /// Package owner (user or organization) scoping.
+        /// </summary>
+        [JsonProperty("o")]
+        public int? OwnerKey { get; set; }
+
+        /// <summary>
+        /// Package owner (user or organization) scoping.
+        /// </summary>
+        public User Owner { get; set; }
+
+        /// <summary>
+        /// Packages glob pattern.
+        /// </summary>
         [JsonProperty("s")]
         public string Subject { get; set; }
 
@@ -30,6 +43,14 @@ public Scope()
         {
         }
 
+        public Scope(User owner, string subject, string allowedAction)
+        {
+            Owner = owner;
+            Subject = subject;
+            AllowedAction = allowedAction;
+        }
+
+        // Deprecated: Should be removed once ApiKeys.cshtml is updated to support owner scope.
         public Scope(string subject, string allowedAction)
         {
             Subject = subject;

src/NuGetGallery/Controllers/ApiController.cs

@@ -235,9 +235,9 @@ public async virtual Task<ActionResult> CreatePackageVerificationKeyAsync(string
             // symbols and the VerifyPackageKey callback returns the appropriate response. For this reason, we
             // always create a temp key scoped to the unverified package ID here and defer package and owner
             // validation until the VerifyPackageKey call.
+            var user = GetCurrentUser();
             var credential = CredentialBuilder.CreatePackageVerificationApiKey(id);
 
-            var user = GetCurrentUser();
             await AuthenticationService.AddCredential(user, credential);
 
             TelemetryService.TrackCreatePackageVerificationKeyEvent(id, version, user, User.Identity);

src/NuGetGallery/Migrations/201711021733062_ApiKeyOwnerScope.cs

@@ -0,0 +1,22 @@
+namespace NuGetGallery.Migrations
+{
+    using System;
+    using System.Data.Entity.Migrations;
+
+    public partial class ApiKeyOwnerScope : DbMigration
+    {
+        public override void Up()
+        {
+            AddColumn("dbo.Scopes", "OwnerKey", c => c.Int());
+            CreateIndex("dbo.Scopes", "OwnerKey");
+            AddForeignKey("dbo.Scopes", "OwnerKey", "dbo.Users", "Key");
+        }
+
+        public override void Down()
+        {
+            DropForeignKey("dbo.Scopes", "OwnerKey", "dbo.Users");
+            DropIndex("dbo.Scopes", new[] { "OwnerKey" });
+            DropColumn("dbo.Scopes", "OwnerKey");
+        }
+    }
+}

src/NuGetGallery/NuGetGallery.csproj

@@ -784,6 +784,10 @@
     <Compile Include="Migrations\201710301857232_Organizations.Designer.cs">
       <DependentUpon>201710301857232_Organizations.cs</DependentUpon>
     </Compile>
+    <Compile Include="Migrations\201711021733062_ApiKeyOwnerScope.cs" />
+    <Compile Include="Migrations\201711021733062_ApiKeyOwnerScope.Designer.cs">
+      <DependentUpon>201711021733062_ApiKeyOwnerScope.cs</DependentUpon>
+    </Compile>
     <Compile Include="Services\AsynchronousPackageValidationInitiator.cs" />
     <Compile Include="Services\CloudBlobFileStorageService.cs" />
     <Compile Include="Services\IFileStorageService.cs" />
@@ -1866,6 +1870,9 @@
     <EmbeddedResource Include="Migrations\201710301857232_Organizations.resx">
       <DependentUpon>201710301857232_Organizations.cs</DependentUpon>
     </EmbeddedResource>
+    <EmbeddedResource Include="Migrations\201711021733062_ApiKeyOwnerScope.resx">
+      <DependentUpon>201711021733062_ApiKeyOwnerScope.cs</DependentUpon>
+    </EmbeddedResource>
     <EmbeddedResource Include="OData\QueryAllowed\Data\apiv1packages.json" />
     <EmbeddedResource Include="OData\QueryAllowed\Data\apiv1search.json" />
     <EmbeddedResource Include="OData\QueryAllowed\Data\apiv2getupdates.json" />
@@ -2296,4 +2303,4 @@
       copy "$(ProjectDir)..\Bootstrap\dist\js\bootstrap.js" "$(ProjectDir)Scripts\gallery" &gt;NUL
 </PreBuildEvent>
   </PropertyGroup>
-</Project>
+</Project>