def blacklist(request):
    q = request.params.get("q")

    try:
        page_num = int(request.params.get("page", 1))
    except ValueError:
        raise HTTPBadRequest("'page' must be an integer.") from None

    blacklist_query = request.db.query(BlacklistedProject).order_by(
        BlacklistedProject.name
    )

    if q:
        terms = shlex.split(q)

        filters = []
        for term in terms:
            filters.append(
                BlacklistedProject.name.ilike(func.normalize_pep426_name(term))
            )

        blacklist_query = blacklist_query.filter(or_(*filters))

    blacklist = SQLAlchemyORMPage(
        blacklist_query,
        page=page_num,
        items_per_page=25,
        url_maker=paginate_url_factory(request),
    )

    return {"blacklist": blacklist, "query": q}

 def __getitem__(self, project):
     try:
         return self.request.db.query(Project).filter(
             Project.normalized_name == func.normalize_pep426_name(project)
         ).one()
     except NoResultFound:
         raise KeyError from None

def release_urls(request, package_name, version):
    files = (
        request.db.query(File)
                  .join(Release, Project)
                  .filter((Project.normalized_name ==
                           func.normalize_pep426_name(package_name)) &
                          (Release.version == version))
                  .all()
    )

    return [
        {
            "filename": f.filename,
            "packagetype": f.packagetype,
            "python_version": f.python_version,
            "size": f.size,
            "md5_digest": f.md5_digest,
            "has_sig": f.has_signature,
            "upload_time": f.upload_time,
            "comment_text": f.comment_text,
            "downloads": f.downloads,
            "url": request.route_url("packaging.file", path=f.path),
        }
        for f in files
    ]

def release_urls(request, package_name: str, version: str):
    files = (
        request.db.query(File)
        .join(Release, Project)
        .filter(
            (Project.normalized_name == func.normalize_pep426_name(package_name))
            & (Release.version == version)
        )
        .all()
    )

    return [
        {
            "filename": f.filename,
            "packagetype": f.packagetype,
            "python_version": f.python_version,
            "size": f.size,
            "md5_digest": f.md5_digest,
            "sha256_digest": f.sha256_digest,
            "digests": {"md5": f.md5_digest, "sha256": f.sha256_digest},
            "has_sig": f.has_signature,
            "upload_time": f.upload_time.isoformat() + "Z",
            "comment_text": f.comment_text,
            # TODO: Remove this once we've had a long enough time with it
            #       here to consider it no longer in use.
            "downloads": -1,
            "path": f.path,
            "url": request.route_url("packaging.file", path=f.path),
        }
        for f in files
    ]

def release_data(request, package_name, version):
    try:
        release = (
            request.db.query(Release)
                      .options(orm.undefer("description"))
                      .join(Project)
                      .filter((Project.normalized_name ==
                               func.normalize_pep426_name(package_name)) &
                              (Release.version == version))
                      .one()
        )
    except NoResultFound:
        return {}

    stats_svc = request.find_service(IDownloadStatService)

    return {
        "name": release.project.name,
        "version": release.version,
        "stable_version": release.project.stable_version,
        "bugtrack_url": release.project.bugtrack_url,
        "package_url": request.route_url(
            "packaging.project",
            name=release.project.name,
        ),
        "release_url": request.route_url(
            "packaging.release",
            name=release.project.name,
            version=release.version,
        ),
        "docs_url": release.project.documentation_url,
        "home_page": release.home_page,
        "download_url": release.download_url,
        "project_url": list(release.project_urls),
        "author": release.author,
        "author_email": release.author_email,
        "maintainer": release.maintainer,
        "maintainer_email": release.maintainer_email,
        "summary": release.summary,
        "description": release.description,
        "license": release.license,
        "keywords": release.keywords,
        "platform": release.platform,
        "classifiers": list(release.classifiers),
        "requires": list(release.requires),
        "requires_dist": list(release.requires_dist),
        "provides": list(release.provides),
        "provides_dist": list(release.provides_dist),
        "obsoletes": list(release.obsoletes),
        "obsoletes_dist": list(release.obsoletes_dist),
        "requires_python": release.requires_python,
        "requires_external": list(release.requires_external),
        "_pypi_ordering": release._pypi_ordering,
        "_pypi_hidden": release._pypi_hidden,
        "downloads": {
            "last_day": stats_svc.get_daily_stats(release.project.name),
            "last_week": stats_svc.get_weekly_stats(release.project.name),
            "last_month": stats_svc.get_monthly_stats(release.project.name),
        },
    }

def package_roles(request, package_name: str):
    roles = (
        request.db.query(Role)
        .join(User, Project)
        .filter(Project.normalized_name == func.normalize_pep426_name(package_name))
        .order_by(Role.role_name.desc(), User.username)
        .all()
    )
    return [(r.role_name, r.user.username) for r in roles]

def release_data(request, package_name: str, version: str):
    try:
        release = (
            request.db.query(Release)
            .options(orm.undefer("description"))
            .join(Project)
            .filter(
                (Project.normalized_name == func.normalize_pep426_name(package_name))
                & (Release.version == version)
            )
            .one()
        )
    except NoResultFound:
        return {}

    return {
        "name": release.project.name,
        "version": release.version,
        "stable_version": None,
        "bugtrack_url": None,
        "package_url": request.route_url(
            "packaging.project", name=release.project.name
        ),
        "release_url": request.route_url(
            "packaging.release", name=release.project.name, version=release.version
        ),
        "docs_url": _clean_for_xml(release.project.documentation_url),
        "home_page": _clean_for_xml(release.home_page),
        "download_url": _clean_for_xml(release.download_url),
        "project_url": [_clean_for_xml(url) for url in release.project_urls],
        "author": _clean_for_xml(release.author),
        "author_email": _clean_for_xml(release.author_email),
        "maintainer": _clean_for_xml(release.maintainer),
        "maintainer_email": _clean_for_xml(release.maintainer_email),
        "summary": _clean_for_xml(release.summary),
        "description": _clean_for_xml(release.description),
        "license": _clean_for_xml(release.license),
        "keywords": _clean_for_xml(release.keywords),
        "platform": release.platform,
        "classifiers": list(release.classifiers),
        "requires": list(release.requires),
        "requires_dist": list(release.requires_dist),
        "provides": list(release.provides),
        "provides_dist": list(release.provides_dist),
        "obsoletes": list(release.obsoletes),
        "obsoletes_dist": list(release.obsoletes_dist),
        "requires_python": release.requires_python,
        "requires_external": list(release.requires_external),
        "_pypi_ordering": release._pypi_ordering,
        "downloads": {"last_day": -1, "last_week": -1, "last_month": -1},
        "cheesecake_code_kwalitee_id": None,
        "cheesecake_documentation_id": None,
        "cheesecake_installability_id": None,
    }

def add_blacklist(request):
    project_name = request.POST.get("project")
    if project_name is None:
        raise HTTPBadRequest("Have a project to confirm.")
    comment = request.POST.get("comment", "")

    # Verify that the user has confirmed the request to blacklist.
    confirm = request.POST.get("confirm")
    if not confirm:
        request.session.flash("Confirm the blacklist request", queue="error")
        return HTTPSeeOther(request.current_route_path())
    elif canonicalize_name(confirm) != canonicalize_name(project_name):
        request.session.flash(
            f"{confirm!r} is not the same as {project_name!r}", queue="error"
        )
        return HTTPSeeOther(request.current_route_path())

    # Check to make sure the object doesn't already exist.
    if (
        request.db.query(literal(True))
        .filter(
            request.db.query(BlacklistedProject)
            .filter(BlacklistedProject.name == project_name)
            .exists()
        )
        .scalar()
    ):
        request.session.flash(
            f"{project_name!r} has already been blacklisted.", queue="error"
        )
        return HTTPSeeOther(request.route_path("admin.blacklist.list"))

    # Add our requested blacklist.
    request.db.add(
        BlacklistedProject(
            name=project_name, comment=comment, blacklisted_by=request.user
        )
    )

    # Go through and delete the project and everything related to it so that
    # our blacklist actually blocks things and isn't ignored (since the
    # blacklist only takes effect on new project registration).
    project = (
        request.db.query(Project)
        .filter(Project.normalized_name == func.normalize_pep426_name(project_name))
        .first()
    )
    if project is not None:
        remove_project(project, request)

    request.session.flash(f"Blacklisted {project_name!r}", queue="success")

    return HTTPSeeOther(request.route_path("admin.blacklist.list"))

def package_hosting_mode(request, package_name):
    try:
        project = (
            request.db.query(Project)
                      .filter(Project.normalized_name ==
                              func.normalize_pep426_name(package_name))
                      .one()
        )
    except NoResultFound:
        return None
    else:
        return project.hosting_mode

def confirm_blacklist(request):
    project_name = request.GET.get("project")
    if project_name is None:
        raise HTTPBadRequest("Have a project to confirm.")

    comment = request.GET.get("comment", "")

    # We need to look up to see if there is an existing project, releases,
    # files, roles, etc for what we're attempting to blacklist. If there is we
    # need to warn that blacklisting will delete those.
    project = (
        request.db.query(Project)
        .filter(Project.normalized_name == func.normalize_pep426_name(project_name))
        .first()
    )
    if project is not None:
        releases = (
            request.db.query(Release)
            .join(Project)
            .filter(Release.project == project)
            .all()
        )
        files = (
            request.db.query(File)
            .join(Release)
            .join(Project)
            .filter(Release.project == project)
            .all()
        )
        roles = (
            request.db.query(Role)
            .join(User)
            .join(Project)
            .filter(Role.project == project)
            .distinct(User.username)
            .order_by(User.username)
            .all()
        )
    else:
        releases = []
        files = []
        roles = []

    return {
        "blacklist": {"project": project_name, "comment": comment},
        "existing": {
            "project": project,
            "releases": releases,
            "files": files,
            "roles": roles,
        },
    }

def package_releases(request, package_name, show_hidden=False):
    # This used to support the show_hidden parameter to determine if it should
    # show hidden releases or not. However, Warehouse doesn't support the
    # concept of hidden releases, so it is just no-opd now and left here for
    # compatibility's sake.
    versions = (
        request.db.query(Release.version)
                  .join(Project)
                  .filter(Project.normalized_name ==
                          func.normalize_pep426_name(package_name))
                  .order_by(Release._pypi_ordering)
                  .all()
    )
    return [v[0] for v in versions]

def package_releases(request, package_name: str, show_hidden: bool = False):
    try:
        project = (
            request.db.query(Project)
            .filter(Project.normalized_name == func.normalize_pep426_name(package_name))
            .one()
        )
    except NoResultFound:
        return []

    # This used to support the show_hidden parameter to determine if it should
    # show hidden releases or not. However, Warehouse doesn't support the
    # concept of hidden releases, so this parameter controls if the latest
    # version or all_versions are returned.
    if show_hidden:
        return [v.version for v in project.all_versions]
    else:
        latest_version = project.latest_version
        if latest_version is None:
            return []
        return [latest_version.version]

def file_upload(request):
    # Before we do anything, if there isn't an authenticated user with this
    # request, then we'll go ahead and bomb out.
    if request.authenticated_userid is None:
        raise _exc_with_message(
            HTTPForbidden,
            "Invalid or non-existent authentication information.",
        )

    # distutils "helpfully" substitutes unknown, but "required" values with the
    # string "UNKNOWN". This is basically never what anyone actually wants so
    # we'll just go ahead and delete anything whose value is UNKNOWN.
    for key in list(request.POST):
        if request.POST.get(key) == "UNKNOWN":
            del request.POST[key]

    # We require protocol_version 1, it's the only supported version however
    # passing a different version should raise an error.
    if request.POST.get("protocol_version", "1") != "1":
        raise _exc_with_message(HTTPBadRequest, "Unknown protocol version.")

    # Look up all of the valid classifiers
    all_classifiers = request.db.query(Classifier).all()

    # Validate and process the incoming metadata.
    form = MetadataForm(request.POST)
    form.classifiers.choices = [
        (c.classifier, c.classifier) for c in all_classifiers
    ]
    if not form.validate():
        for field_name in _error_message_order:
            if field_name in form.errors:
                break
        else:
            field_name = sorted(form.errors.keys())[0]

        raise _exc_with_message(
            HTTPBadRequest,
            "{field}: {msgs[0]}".format(
                field=field_name,
                msgs=form.errors[field_name],
            ),
        )

    # TODO: We need a better method of blocking names rather than just
    #       hardcoding some names into source control.
    if form.name.data.lower() in {"requirements.txt", "rrequirements.txt"}:
        raise _exc_with_message(
            HTTPBadRequest,
            "The name {!r} is not allowed.".format(form.name.data),
        )

    # Ensure that we have file data in the request.
    if "content" not in request.POST:
        raise _exc_with_message(
            HTTPBadRequest,
            "Upload payload does not have a file.",
        )

    # Look up the project first before doing anything else, this is so we can
    # automatically register it if we need to and can check permissions before
    # going any further.
    try:
        project = (
            request.db.query(Project)
                      .filter(
                          Project.normalized_name ==
                          func.normalize_pep426_name(form.name.data)).one()
        )
    except NoResultFound:
        # The project doesn't exist in our database, so we'll add it along with
        # a role setting the current user as the "Owner" of the project.
        project = Project(name=form.name.data)
        request.db.add(project)
        request.db.add(
            Role(user=request.user, project=project, role_name="Owner")
        )
        # TODO: This should be handled by some sort of database trigger or a
        #       SQLAlchemy hook or the like instead of doing it inline in this
        #       view.
        request.db.add(
            JournalEntry(
                name=project.name,
                action="create",
                submitted_by=request.user,
                submitted_from=request.client_addr,
            ),
        )
        request.db.add(
            JournalEntry(
                name=project.name,
                action="add Owner {}".format(request.user.username),
                submitted_by=request.user,
                submitted_from=request.client_addr,
            ),
        )

    # Check that the user has permission to do things to this project, if this
    # is a new project this will act as a sanity check for the role we just
    # added above.
#.........这里部分代码省略.........

def file_upload(request):
    # Before we do anything, if their isn't an authenticated user with this
    # request, then we'll go ahead and bomb out.
    if request.authenticated_userid is None:
        raise _exc_with_message(HTTPForbidden, "Invalid or non-existent authentication information.")

    # distutils "helpfully" substitutes unknown, but "required" values with the
    # string "UNKNOWN". This is basically never what anyone actually wants so
    # we'll just go ahead and delete anything whose value is UNKNOWN.
    for key in list(request.POST):
        if request.POST.get(key) == "UNKNOWN":
            del request.POST[key]

    # We require protocol_version 1, it's the only supported version however
    # passing a different version should raise an error.
    if request.POST.get("protocol_version", "1") != "1":
        raise _exc_with_message(HTTPBadRequest, "Unknown protocol version.")

    # Look up all of the valid classifiers
    all_classifiers = request.db.query(Classifier).all()

    # Validate and process the incoming metadata.
    form = MetadataForm(request.POST)
    form.classifiers.choices = [(c.classifier, c.classifier) for c in all_classifiers]
    if not form.validate():
        for field_name in _error_message_order:
            if field_name in form.errors:
                break
        else:
            field_name = sorted(form.errors.keys())[0]

        raise _exc_with_message(
            HTTPBadRequest, "{field}: {msgs[0]}".format(field=field_name, msgs=form.errors[field_name])
        )

    # TODO: We need a better method of blocking names rather than jsut
    #       hardcoding some names into source control.
    if form.name.data.lower() in {"requirements.txt", "rrequirements.txt"}:
        raise _exc_with_message(HTTPBadRequest, "The name {!r} is not allowed.".format(form.name.data))

    # Ensure that we have file data in the request.
    if "content" not in request.POST:
        raise _exc_with_message(HTTPBadRequest, "Upload payload does not have a file.")

    # Look up the project first before doing anything else, this is so we can
    # automatically register it if we need to and can check permissions before
    # going any further.
    try:
        project = (
            request.db.query(Project)
            .filter(Project.normalized_name == func.normalize_pep426_name(form.name.data))
            .one()
        )
    except NoResultFound:
        # The project doesn't exist in our database, so we'll add it along with
        # a role setting the current user as the "Owner" of the project.
        project = Project(name=form.name.data)
        request.db.add(project)
        request.db.add(Role(user=request.user, project=project, role_name="Owner"))

    # Check that the user has permission to do things to this project, if this
    # is a new project this will act as a sanity check for the role we just
    # added above.
    if not request.has_permission("upload", project):
        raise _exc_with_message(HTTPForbidden, "You are not allowed to upload to {!r}.".format(project.name))

    try:
        release = (
            request.db.query(Release)
            .filter((Release.project == project) & (Release.version == form.version.data))
            .one()
        )
    except NoResultFound:
        release = Release(
            project=project,
            _classifiers=[c for c in all_classifiers if c.classifier in form.classifiers.data],
            dependencies=list(
                _construct_dependencies(
                    form,
                    {
                        "requires": DependencyKind.requires,
                        "provides": DependencyKind.provides,
                        "obsoletes": DependencyKind.obsoletes,
                        "requires_dist": DependencyKind.requires_dist,
                        "provides_dist": DependencyKind.provides_dist,
                        "obsoletes_dist": DependencyKind.obsoletes_dist,
                        "requires_external": DependencyKind.requires_external,
                        "project_urls": DependencyKind.project_url,
                    },
                )
            ),
            **{
                k: getattr(form, k).data
                for k in {
                    # This is a list of all the fields in the form that we
                    # should pull off and insert into our new release.
                    "version",
                    "summary",
                    "description",
                    "license",
#.........这里部分代码省略.........

#.........这里部分代码省略.........
            field_name = sorted(form.errors.keys())[0]

        if field_name in form:
            field = form[field_name]
            if field.description and isinstance(field, wtforms.StringField):
                error_message = (
                    "{value!r} is an invalid value for {field}. ".format(
                        value=field.data, field=field.description
                    )
                    + "Error: {} ".format(form.errors[field_name][0])
                    + "See "
                    "https://packaging.python.org/specifications/core-metadata"
                )
            else:
                error_message = "Invalid value for {field}. Error: {msgs[0]}".format(
                    field=field_name, msgs=form.errors[field_name]
                )
        else:
            error_message = "Error: {}".format(form.errors[field_name][0])

        raise _exc_with_message(HTTPBadRequest, error_message)

    # Ensure that we have file data in the request.
    if "content" not in request.POST:
        raise _exc_with_message(HTTPBadRequest, "Upload payload does not have a file.")

    # Look up the project first before doing anything else, this is so we can
    # automatically register it if we need to and can check permissions before
    # going any further.
    try:
        project = (
            request.db.query(Project)
            .filter(
                Project.normalized_name == func.normalize_pep426_name(form.name.data)
            )
            .one()
        )
    except NoResultFound:
        # Check for AdminFlag set by a PyPI Administrator disabling new project
        # registration, reasons for this include Spammers, security
        # vulnerabilities, or just wanting to be lazy and not worry ;)
        if request.flags.enabled("disallow-new-project-registration"):
            raise _exc_with_message(
                HTTPForbidden,
                (
                    "New project registration temporarily disabled. "
                    "See {projecthelp} for details"
                ).format(projecthelp=request.help_url(_anchor="admin-intervention")),
            ) from None

        # Before we create the project, we're going to check our blacklist to
        # see if this project is even allowed to be registered. If it is not,
        # then we're going to deny the request to create this project.
        if request.db.query(
            exists().where(
                BlacklistedProject.name == func.normalize_pep426_name(form.name.data)
            )
        ).scalar():
            raise _exc_with_message(
                HTTPBadRequest,
                (
                    "The name {name!r} isn't allowed. "
                    "See {projecthelp} "
                    "for more information."
                ).format(
                    name=form.name.data,