Merge lp:~adeuring/launchpad/correct-permission-check-for-iproduct into lp:launchpad

[Abel Deuring]

Use access grants to check view permissions for IProduct

This is a follow-up branch for lp:~adeuring/launchpad/product-sharing-sec-adapter.

The previous branch changed the security adapters required to access attributes of IProduct but it did not include an important detail: If a user has a policy grant for the private product.

This branch fixes this problem.

tests:

./bin/test -vvt lp.registry.tests.test_product.TestProduct.test_userCanView_caches_known_users
./bin/test -vvt lp.registry.tests.test_product.TestProduct.test_access_launchpad_AnyAllowedPerson_proprietary_product
./bin/test -vvt lp.registry.tests.test_product.TestProduct.test_access_launchpad_View_.*_product

no lint

[Steve Kowalik (stevenk)]

33 + store = Store.of(self)
34 + grants_for_user = store.using(
35 + AccessPolicy,
36 + Join(
37 + AccessPolicyGrant,
38 + And(
39 + AccessPolicyGrant.policy_id == AccessPolicy.id,
40 + AccessPolicyGrant.grantee_id == user.id))).find(
41 + AccessPolicyGrant,
42 + AccessPolicy.product_id == self.id,
43 + AccessPolicy.type == self.information_type)
44 + if grants_for_user.is_empty():
45 + return False

This looks remarkably like IAccessPolicyGrant.find() ? Can you just call into that?

223 + owner = product.owner
227 + self.makeAccessPolicyGrant(policy, grantee=owner)

Surely you can just say grantee=product.owner?

review: Needs Fixing (code)

[Abel Deuring (adeuring)]

On 03.10.2012 08:10, Steve Kowalik wrote:
> Review: Needs Fixing code
>
> 33 + store = Store.of(self)
> 34 + grants_for_user = store.using(
> 35 + AccessPolicy,
> 36 + Join(
> 37 + AccessPolicyGrant,
> 38 + And(
> 39 + AccessPolicyGrant.policy_id == AccessPolicy.id,
> 40 + AccessPolicyGrant.grantee_id == user.id))).find(
> 41 + AccessPolicyGrant,
> 42 + AccessPolicy.product_id == self.id,
> 43 + AccessPolicy.type == self.information_type)
> 44 + if grants_for_user.is_empty():
> 45 + return False

Sure, done. I simply forgot that we we have some infrastructure to deal
with accesss grants...

>
> This looks remarkably like IAccessPolicyGrant.find() ? Can you just call into that?
>
> 223 + owner = product.owner
> 227 + self.makeAccessPolicyGrant(policy, grantee=owner)
>
> Surely you can just say grantee=product.owner?

Not directly:

            naked_product.information_type = information_type
            if information_type in PROPRIETARY_INFORMATION_TYPES:
                policy = self.makeAccessPolicy(product,
                                               information_type)
                self.makeAccessPolicyGrant(
                    policy, grantee=naked_product.owner)

The change of information_type in the first line above lets userCanView
check if the current user has a grant when the attribute "owner" of
product is retrieved in the last line. But najed_product works of course.

[Steve Kowalik (stevenk)]

review: Approve (code)

=== modified file 'lib/lp/answers/tests/test_question_webservice.py'
--- lib/lp/answers/tests/test_question_webservice.py	2012-01-01 02:58:52 +0000
+++ lib/lp/answers/tests/test_question_webservice.py	2012-10-04 10:27:37 +0000
@@ -10,6 +10,7 @@
 from simplejson import dumps
 import transaction
 from zope.component import getUtility
+from zope.security.proxy import removeSecurityProxy
 
 from lp.answers.errors import (
     AddAnswerContactError,
@@ -83,6 +84,7 @@
         with celebrity_logged_in('admin'):
             self.question = self.factory.makeQuestion(
                 title="This is a question")
+            self.target_name = self.question.target.name
 
         self.webservice = LaunchpadWebServiceCaller(
             'launchpad-library', 'salgado-change-anything')
@@ -105,7 +107,7 @@
     def test_GET_xhtml_representation(self):
         # A question's xhtml representation is available on the api.
         response = self.webservice.get(
-            '/%s/+question/%d' % (self.question.target.name,
+            '/%s/+question/%d' % (self.target_name,
                 self.question.id),
             'application/xhtml+xml')
         self.assertEqual(response.status, 200)
@@ -119,7 +121,7 @@
         new_title = "No, this is a question"
 
         question_json = self.webservice.get(
-            '/%s/+question/%d' % (self.question.target.name,
+            '/%s/+question/%d' % (self.target_name,
                 self.question.id)).jsonBody()
 
         response = self.webservice.patch(
@@ -156,7 +158,7 @@
         # End any open lplib instance.
         logout()
         lp = launchpadlib_for("test", user)
-        return ws_object(lp, self.question)
+        return ws_object(lp, removeSecurityProxy(self.question))
 
     def _set_visibility(self, question):
         """Method to set visibility; needed for assertRaises."""

=== modified file 'lib/lp/app/model/launchpad.py'
--- lib/lp/app/model/launchpad.py	2012-10-02 18:44:49 +0000
+++ lib/lp/app/model/launchpad.py	2012-10-04 10:27:37 +0000
@@ -43,7 +43,7 @@
 
 
 class InformationTypeMixin:
-    """"Common functionality for classes implementing IInformationType."""
+    """Common functionality for classes implementing IInformationType."""
 
     @property
     def private(self):

=== modified file 'lib/lp/blueprints/browser/tests/test_specification.py'
--- lib/lp/blueprints/browser/tests/test_specification.py	2012-09-25 18:57:52 +0000
+++ lib/lp/blueprints/browser/tests/test_specification.py	2012-10-04 10:27:37 +0000
@@ -40,6 +40,7 @@
     IProductSeries,
     )
 from lp.services.features.testing import FeatureFixture
+from lp.services.webapp.interaction import ANONYMOUS
 from lp.services.webapp.interfaces import BrowserNotificationLevel
 from lp.services.webapp.publisher import canonical_url
 from lp.testing import (
@@ -467,7 +468,11 @@
             control = browser.getControl(information_type.title)
             if not control.selected:
                 control.click()
-            return product.getSpecification(self.submitSpec(browser))
+            specification_name = self.submitSpec(browser)
+            # Using the browser terminated the interaction, but we need
+            # an interaction in order to access a product.
+            with person_logged_in(ANONYMOUS):
+                return product.getSpecification(specification_name)
 
     def test_supplied_information_types(self):
         """Creating honours information types."""
@@ -551,9 +556,11 @@
         Useful because we need to follow to product from a
         ProductSeries.
         """
-        if IProductSeries.providedBy(target):
-            return target.product.getSpecification(name)
-        return target.getSpecification(name)
+        # We need an interaction in order to access a product.
+        with person_logged_in(ANONYMOUS):
+            if IProductSeries.providedBy(target):
+                return target.product.getSpecification(name)
+            return target.getSpecification(name)
 
     def submitSpec(self, browser):
         """Submit a Specification via a browser."""

=== modified file 'lib/lp/blueprints/browser/tests/test_views.py'
--- lib/lp/blueprints/browser/tests/test_views.py	2012-06-04 16:13:51 +0000
+++ lib/lp/blueprints/browser/tests/test_views.py	2012-10-04 10:27:37 +0000
@@ -66,9 +66,9 @@
         collector = QueryCollector()
         collector.register()
         self.addCleanup(collector.unregister)
+        url = canonical_url(target) + "/+assignments"
         viewer = self.factory.makePerson()
         browser = self.getUserBrowser(user=viewer)
-        url = canonical_url(target) + "/+assignments"
         # Seed the cookie cache and any other cross-request state we may gain
         # in future.  See lp.services.webapp.serssion: _get_secret.
         browser.open(url)

=== modified file 'lib/lp/blueprints/tests/test_webservice.py'
--- lib/lp/blueprints/tests/test_webservice.py	2012-08-20 16:38:10 +0000
+++ lib/lp/blueprints/tests/test_webservice.py	2012-10-04 10:27:37 +0000
@@ -7,6 +7,7 @@
 
 import transaction
 from zope.security.management import endInteraction
+from zope.security.proxy import removeSecurityProxy
 
 from lp.blueprints.enums import SpecificationDefinitionStatus
 from lp.services.webapp.interaction import ANONYMOUS
@@ -42,8 +43,9 @@
         return result
 
     def getPillarOnWebservice(self, pillar_obj):
+        pillar_name = pillar_obj.name
         launchpadlib = self.getLaunchpadlib()
-        return launchpadlib.load(pillar_obj.name)
+        return launchpadlib.load(pillar_name)
 
 
 class SpecificationAttributeWebserviceTests(SpecificationWebserviceTestCase):
@@ -74,9 +76,9 @@
     def test_representation_contains_target(self):
         spec = self.factory.makeSpecification(
             product=self.factory.makeProduct())
-        spec_target = spec.target
+        spec_target_name = spec.target.name
         spec_webservice = self.getSpecOnWebservice(spec)
-        self.assertEqual(spec_target.name, spec_webservice.target.name)
+        self.assertEqual(spec_target_name, spec_webservice.target.name)
 
     def test_representation_contains_title(self):
         spec = self.factory.makeSpecification(title='Foo')
@@ -271,7 +273,7 @@
         # setup a new one.
         endInteraction()
         lplib = launchpadlib_for('lplib-test', person=None, version='devel')
-        ws_product = ws_object(lplib, product)
+        ws_product = ws_object(lplib, removeSecurityProxy(product))
         self.assertNamesOfSpecificationsAre(
             ["spec1", "spec2"], ws_product.all_specifications)
 

=== modified file 'lib/lp/bugs/browser/tests/test_bugtask.py'
--- lib/lp/bugs/browser/tests/test_bugtask.py	2012-10-02 23:45:24 +0000
+++ lib/lp/bugs/browser/tests/test_bugtask.py	2012-10-04 10:27:37 +0000
@@ -2005,8 +2005,10 @@
 
     def test_rendered_query_counts_constant_with_many_bugtasks(self):
         product = self.factory.makeProduct()
+        url = canonical_url(product, view_name='+bugs')
         bug = self.factory.makeBug(target=product)
         buggy_product = self.factory.makeProduct()
+        buggy_url = canonical_url(buggy_product, view_name='+bugs')
         for _ in range(10):
             self.factory.makeBug(target=buggy_product)
         recorder = QueryCollector()
@@ -2014,11 +2016,9 @@
         self.addCleanup(recorder.unregister)
         self.invalidate_caches(bug)
         # count with single task
-        url = canonical_url(product, view_name='+bugs')
         self.getUserBrowser(url)
         self.assertThat(recorder, HasQueryCount(LessThan(32)))
         # count with many tasks
-        buggy_url = canonical_url(buggy_product, view_name='+bugs')
         self.getUserBrowser(buggy_url)
         self.assertThat(recorder, HasQueryCount(LessThan(32)))
 

=== modified file 'lib/lp/bugs/stories/bug-also-affects/xx-bug-also-affects.txt'
--- lib/lp/bugs/stories/bug-also-affects/xx-bug-also-affects.txt	2012-09-18 18:36:09 +0000
+++ lib/lp/bugs/stories/bug-also-affects/xx-bug-also-affects.txt	2012-10-04 10:27:37 +0000
@@ -219,6 +219,7 @@
     >>> other_product = factory.makeProduct(
     ...     official_malone=True,
     ...     bug_sharing_policy=BugSharingPolicy.PROPRIETARY)
+    >>> other_product_name = other_product.name
     >>> params = CreateBugParams(
     ...     title="a test private bug",
     ...     comment="a description of the bug",
@@ -229,7 +230,7 @@
 
     >>> browser.open(canonical_url(private_bug, rootsite='bugs'))
     >>> browser.getLink(url='+choose-affected-product').click()
-    >>> browser.getControl(name='field.product').value = other_product.name
+    >>> browser.getControl(name='field.product').value = other_product_name
     >>> browser.getControl('Continue').click()
     >>> print browser.url
     http://bugs.launchpad.dev/proprietary-product/+bug/16/+choose-affected-product

=== modified file 'lib/lp/bugs/stories/bugs/xx-bug-personal-subscriptions-advanced-features.txt'
--- lib/lp/bugs/stories/bugs/xx-bug-personal-subscriptions-advanced-features.txt	2012-02-24 04:00:24 +0000
+++ lib/lp/bugs/stories/bugs/xx-bug-personal-subscriptions-advanced-features.txt	2012-10-04 10:27:37 +0000
@@ -9,8 +9,9 @@
     >>> login(USER_EMAIL)
     >>> bug = factory.makeBug()
     >>> task = bug.default_bugtask
+    >>> url = canonical_url(task, view_name='+subscribe')
     >>> logout()
-    >>> user_browser.open(canonical_url(task, view_name='+subscribe'))
+    >>> user_browser.open(url)
     >>> bug_notification_level_control = user_browser.getControl(
     ...     name='field.bug_notification_level')
     >>> for control in bug_notification_level_control.controls:

=== modified file 'lib/lp/bugs/stories/patches-view/patches-view.txt'
--- lib/lp/bugs/stories/patches-view/patches-view.txt	2012-08-08 11:48:29 +0000
+++ lib/lp/bugs/stories/patches-view/patches-view.txt	2012-10-04 10:27:37 +0000
@@ -255,9 +255,11 @@
     ...         bugtask.transitionToImportance(importance, ubuntu_distro.owner)
     ...     if status is not None:
     ...         bugtask.transitionToStatus(status, ubuntu_distro.owner)
+    >>> login(ANONYMOUS)
     >>> patchy_product_series = patchy_product.getSeries('trunk')
     >>> make_bugtask(bug=bug_a, target=patchy_product_series)
     >>> make_bugtask(bug=bug_c, target=patchy_product_series)
+    >>> logout()
     >>> anon_browser.open(
     ...     'https://bugs.launchpad.dev/patchy-product-1/trunk/+patches')
     >>> show_patches_view(anon_browser.contents)

=== modified file 'lib/lp/bugs/stories/structural-subscriptions/xx-advanced-features.txt'
--- lib/lp/bugs/stories/structural-subscriptions/xx-advanced-features.txt	2011-12-24 17:49:30 +0000
+++ lib/lp/bugs/stories/structural-subscriptions/xx-advanced-features.txt	2012-10-04 10:27:37 +0000
@@ -8,8 +8,8 @@
     >>> from lp.testing.sampledata import USER_EMAIL
     >>> login(USER_EMAIL)
     >>> product = factory.makeProduct()
+    >>> url = canonical_url(product, view_name='+subscriptions')
     >>> logout()
-    >>> user_browser.open(
-    ...     canonical_url(product, view_name='+subscriptions'))
+    >>> user_browser.open(url)
     >>> user_browser.getLink("Add a subscription")
     <Link text='Add a subscription' url='.../+subscriptions#'>

=== modified file 'lib/lp/bugs/stories/webservice/xx-bug.txt'
--- lib/lp/bugs/stories/webservice/xx-bug.txt	2012-09-27 01:43:05 +0000
+++ lib/lp/bugs/stories/webservice/xx-bug.txt	2012-10-04 10:27:37 +0000
@@ -1463,13 +1463,14 @@
     >>> from lp.testing.sampledata import ADMIN_EMAIL
     >>> login(ADMIN_EMAIL)
     >>> target = factory.makeProduct()
+    >>> target_name = target.name
     >>> bug = factory.makeBug(target=target)
     >>> bug = removeSecurityProxy(bug)
     >>> date = bug.date_last_updated - timedelta(days=6)
     >>> logout()
 
     >>> pprint_collection(webservice.named_get(
-    ...     '/%s' % target.name, 'searchTasks',
+    ...     '/%s' % target_name, 'searchTasks',
     ...     modified_since=u'%s' % date ).jsonBody())
     start: 0
     total_size: 1
@@ -1481,12 +1482,13 @@
     >>> from lp.bugs.interfaces.bugtarget import IBugTarget
     >>> login(ADMIN_EMAIL)
     >>> target = IBugTarget(factory.makeProduct())
+    >>> target_name = target.name
     >>> task = factory.makeBugTask(target=target)
     >>> date = task.datecreated - timedelta(days=8)
     >>> logout()
 
     >>> pprint_collection(webservice.named_get(
-    ...     '/%s' % target.name, 'searchTasks',
+    ...     '/%s' % target_name, 'searchTasks',
     ...     created_since=u'%s' % date).jsonBody())
     start: 0
     total_size: 1
@@ -1497,7 +1499,7 @@
 
     >>> before_date = task.datecreated + timedelta(days=8)
     >>> pprint_collection(webservice.named_get(
-    ...     '/%s' % target.name, 'searchTasks',
+    ...     '/%s' % target_name, 'searchTasks',
     ...     created_before=u'%s' % before_date).jsonBody())
     start: 0
     total_size: 1

=== modified file 'lib/lp/bugs/tests/test_bugs_webservice.py'
--- lib/lp/bugs/tests/test_bugs_webservice.py	2012-09-19 01:19:35 +0000
+++ lib/lp/bugs/tests/test_bugs_webservice.py	2012-10-04 10:27:37 +0000
@@ -355,12 +355,13 @@
     def test_add_duplicate_bugtask_for_project_gives_bad_request(self):
         bug = self.factory.makeBug()
         product = self.factory.makeProduct()
+        product_url = api_url(product)
         self.factory.makeBugTask(bug=bug, target=product)
 
         launchpad = launchpadlib_for('test', bug.owner)
         lp_bug = launchpad.load(api_url(bug))
         self.assertRaises(
-            BadRequest, lp_bug.addTask, target=api_url(product))
+            BadRequest, lp_bug.addTask, target=product_url)
 
     def test_add_invalid_bugtask_to_proprietary_bug_gives_bad_request(self):
         # Test we get an error when we attempt to invalidly add a bug task to
@@ -371,6 +372,7 @@
             bug_sharing_policy=BugSharingPolicy.PROPRIETARY)
         product2 = self.factory.makeProduct(
             bug_sharing_policy=BugSharingPolicy.PROPRIETARY)
+        product2_url = api_url(product2)
         bug = self.factory.makeBug(
             target=product1, owner=owner,
             information_type=InformationType.PROPRIETARY)
@@ -379,7 +381,7 @@
         launchpad = launchpadlib_for('test', owner)
         lp_bug = launchpad.load(api_url(bug))
         self.assertRaises(
-            BadRequest, lp_bug.addTask, target=api_url(product2))
+            BadRequest, lp_bug.addTask, target=product2_url)
 
     def test_add_attachment_with_bad_filename_raises_exception(self):
         # Test that addAttachment raises BadRequest when the filename given
@@ -404,12 +406,13 @@
         # to the project's bugs are private by default rule.
         project = self.factory.makeLegacyProduct(
             licenses=[License.OTHER_PROPRIETARY])
+        target_url = api_url(project)
         with person_logged_in(project.owner):
             project.setPrivateBugs(True, project.owner)
         webservice = launchpadlib_for('test', 'salgado')
         bugs_collection = webservice.load('/bugs')
         bug = bugs_collection.createBug(
-            target=api_url(project), title='title', description='desc')
+            target=target_url, title='title', description='desc')
         self.assertEqual('Private', bug.information_type)
 
     def test_explicit_private_private_bugs_true(self):
@@ -418,12 +421,13 @@
         # user commands it.
         project = self.factory.makeLegacyProduct(
             licenses=[License.OTHER_PROPRIETARY])
+        target_url = api_url(project)
         with person_logged_in(project.owner):
             project.setPrivateBugs(True, project.owner)
         webservice = launchpadlib_for('test', 'salgado')
         bugs_collection = webservice.load('/bugs')
         bug = bugs_collection.createBug(
-            target=api_url(project), title='title', description='desc',
+            target=target_url, title='title', description='desc',
             private=True)
         self.assertEqual('Private', bug.information_type)
 
@@ -433,13 +437,14 @@
         # to the project's bug sharing policy.
         project = self.factory.makeProduct(
             licenses=[License.OTHER_PROPRIETARY])
+        target_url = api_url(project)
         with person_logged_in(project.owner):
             project.setBugSharingPolicy(
                 BugSharingPolicy.PROPRIETARY_OR_PUBLIC)
         webservice = launchpadlib_for('test', 'salgado')
         bugs_collection = webservice.load('/bugs')
         bug = bugs_collection.createBug(
-            target=api_url(project), title='title', description='desc')
+            target=target_url, title='title', description='desc')
         self.assertEqual('Proprietary', bug.information_type)
 
 
@@ -459,7 +464,7 @@
 
     def test_subscribe_does_not_update(self):
         # Calling subscribe over the API does not update date_last_updated.
-        (bug, owner, webservice)  = self.make_old_bug()
+        (bug, owner, webservice) = self.make_old_bug()
         subscriber = self.factory.makePerson()
         date_last_updated = bug.date_last_updated
         api_sub = api_url(subscriber)

=== modified file 'lib/lp/bugs/tests/test_searchtasks_webservice.py'
--- lib/lp/bugs/tests/test_searchtasks_webservice.py	2012-09-21 02:03:56 +0000
+++ lib/lp/bugs/tests/test_searchtasks_webservice.py	2012-10-04 10:27:37 +0000
@@ -54,6 +54,7 @@
         self.owner = self.factory.makePerson()
         with person_logged_in(self.owner):
             self.product = self.factory.makeProduct()
+        self.product_name = self.product.name
         self.bug = self.factory.makeBug(
             target=self.product,
             information_type=InformationType.PRIVATESECURITY)
@@ -62,7 +63,7 @@
 
     def search(self, api_version, **kwargs):
         return self.webservice.named_get(
-            '/%s' % self.product.name, 'searchTasks',
+            '/%s' % self.product_name, 'searchTasks',
             api_version=api_version, **kwargs).jsonBody()
 
     def test_linked_blueprints_in_devel(self):
@@ -102,7 +103,7 @@
     def test_search_with_wrong_orderby(self):
         # Calling searchTasks() with a wrong order_by is a Bad Request.
         response = self.webservice.named_get(
-            '/%s' % self.product.name, 'searchTasks',
+            '/%s' % self.product_name, 'searchTasks',
             api_version='devel', order_by='date_created')
         self.assertEqual(400, response.status)
         self.assertRaisesWithContent(

=== modified file 'lib/lp/code/browser/tests/test_branch.py'
--- lib/lp/code/browser/tests/test_branch.py	2012-09-20 21:26:42 +0000
+++ lib/lp/code/browser/tests/test_branch.py	2012-10-04 10:27:37 +0000
@@ -698,11 +698,11 @@
             base_url = canonical_url(branch, rootsite='code')
             product_url = canonical_url(product, rootsite='code')
         url = '%s/+subscription/%s' % (base_url, subscriber.name)
+        expected_title = "Code : %s" % product.displayname
         browser = self._getBrowser(user=subscriber)
         browser.open(url)
         browser.getControl('Unsubscribe').click()
         self.assertEqual(product_url, browser.url)
-        expected_title = "Code : %s" % product.displayname
         self.assertEqual(expected_title, browser.title)
 
 

=== modified file 'lib/lp/code/browser/tests/test_product.py'
--- lib/lp/code/browser/tests/test_product.py	2012-10-03 03:56:29 +0000
+++ lib/lp/code/browser/tests/test_product.py	2012-10-04 10:27:37 +0000
@@ -224,8 +224,9 @@
         login_person(product.owner)
         product.development_focus.branch = code_import.branch
         self.assertEqual(ServiceUsage.EXTERNAL, product.codehosting_usage)
+        product_url = canonical_url(product, rootsite='code')
         logout()
-        browser = self.getUserBrowser(canonical_url(product, rootsite='code'))
+        browser = self.getUserBrowser(product_url)
         login(ANONYMOUS)
         content = find_tag_by_id(browser.contents, 'external')
         text = extract_text(content)
@@ -383,6 +384,7 @@
 
     def test_is_public(self):
         product = self.factory.makeProduct()
+        product_displayname = product.displayname
         branch = self.factory.makeProductBranch(product=product)
         login_person(product.owner)
         product.development_focus.branch = branch
@@ -390,7 +392,7 @@
         text = extract_text(find_tag_by_id(browser.contents, 'privacy'))
         expected = (
             "New branches for %(name)s are Public.*"
-            % dict(name=product.displayname))
+            % dict(name=product_displayname))
         self.assertTextMatchesExpressionIgnoreWhitespace(expected, text)
 
 

=== modified file 'lib/lp/code/stories/branches/xx-product-branches.txt'
--- lib/lp/code/stories/branches/xx-product-branches.txt	2012-04-10 14:01:17 +0000
+++ lib/lp/code/stories/branches/xx-product-branches.txt	2012-10-04 10:27:37 +0000
@@ -181,10 +181,10 @@
     >>> factory = LaunchpadObjectFactory()
     >>> login(ANONYMOUS)
     >>> product = getUtility(IProductSet).getByName('firefox')
+    >>> owner = product.owner
     >>> old_branch = product.development_focus.branch
     >>> ignored = login_person(product.owner)
     >>> product.development_focus.branch = None
-    >>> logout()
     >>> def print_links(browser):
     ...     links = find_tag_by_id(browser.contents, 'involvement')
     ...     if links is None:
@@ -204,13 +204,16 @@
 
     >>> print product.codehosting_usage.name
     UNKNOWN
+    >>> logout()
     >>> admin_browser.open('http://code.launchpad.dev/firefox')
     >>> print_links(admin_browser)
     None
 
     >>> setup_code_hosting('firefox')
+    >>> login(ANONYMOUS)
     >>> print product.codehosting_usage.name
     LAUNCHPAD
+    >>> logout()
     >>> admin_browser.open('http://code.launchpad.dev/firefox')
     >>> print_links(admin_browser)
     Import a branch
@@ -235,7 +238,7 @@
 If the product specifies that it officially uses Launchpad code, then
 the 'Import a branch' button is still shown.
 
-    >>> ignored = login_person(product.owner)
+    >>> ignored = login_person(owner)
     >>> product.development_focus.branch = old_branch
     >>> logout()
     >>> browser.open('http://code.launchpad.dev/firefox')

=== modified file 'lib/lp/code/stories/webservice/xx-code-import.txt'
--- lib/lp/code/stories/webservice/xx-code-import.txt	2011-12-24 17:49:30 +0000
+++ lib/lp/code/stories/webservice/xx-code-import.txt	2012-10-04 10:27:37 +0000
@@ -17,6 +17,7 @@
     >>> other_person = factory.makePerson(name='other-person')
     >>> removeSecurityProxy(person).join(team)
     >>> product = factory.makeProduct(name='scruff')
+    >>> product_name = product.name
     >>> svn_branch_url = "http://svn.domain.com/source"
     >>> code_import = removeSecurityProxy(factory.makeProductCodeImport(
     ...    registrant=person, product=product, branch_name='import',
@@ -122,7 +123,7 @@
 
 We can create an import using the API by calling a method on the project.
 
-    >>> product_url = '/' + product.name
+    >>> product_url = '/' + product_name
     >>> new_remote_url = factory.getUniqueURL()
     >>> response = import_webservice.named_post(product_url, 'newCodeImport',
     ...    branch_name='new-import', rcs_type='Git',
@@ -149,7 +150,7 @@
 
 If we must we can create a CVS import.
 
-    >>> product_url = '/' + product.name
+    >>> product_url = '/' + product_name
     >>> new_remote_url = factory.getUniqueURL()
     >>> response = import_webservice.named_post(product_url, 'newCodeImport',
     ...    branch_name='cvs-import', rcs_type='Concurrent Versions System',

=== modified file 'lib/lp/registry/browser/tests/test_milestone.py'
--- lib/lp/registry/browser/tests/test_milestone.py	2012-09-28 02:42:20 +0000
+++ lib/lp/registry/browser/tests/test_milestone.py	2012-10-04 10:27:37 +0000
@@ -234,12 +234,13 @@
         super(TestProjectMilestoneIndexQueryCount, self).setUp()
         self.owner = self.factory.makePerson(name='product-owner')
         self.product = self.factory.makeProduct(owner=self.owner)
+        self.product_owner = self.product.owner
         login_person(self.product.owner)
         self.milestone = self.factory.makeMilestone(
             productseries=self.product.development_focus)
 
     def add_bug(self, count):
-        login_person(self.product.owner)
+        login_person(self.product_owner)
         for i in range(count):
             bug = self.factory.makeBug(target=self.product)
             bug.bugtasks[0].transitionToMilestone(
@@ -284,6 +285,7 @@
         # increasing the cap.
         page_query_limit = 37
         product = self.factory.makeProduct()
+        product_owner = product.owner
         login_person(product.owner)
         milestone = self.factory.makeMilestone(
             productseries=product.development_focus)
@@ -316,7 +318,7 @@
         with_1_private_bug = collector.count
         with_1_queries = ["%s: %s" % (pos, stmt[3]) for (pos, stmt) in
             enumerate(collector.queries)]
-        login_person(product.owner)
+        login_person(product_owner)
         bug2 = self.factory.makeBug(
             target=product, information_type=InformationType.USERDATA,
             owner=product.owner)

=== modified file 'lib/lp/registry/browser/tests/test_pillar_sharing.py'
--- lib/lp/registry/browser/tests/test_pillar_sharing.py	2012-09-18 19:41:02 +0000
+++ lib/lp/registry/browser/tests/test_pillar_sharing.py	2012-10-04 10:27:37 +0000
@@ -243,10 +243,10 @@
 
     def test_sharing_menu(self):
         url = canonical_url(self.pillar)
-        browser = setupBrowserForUser(user=self.driver)
-        browser.open(url)
-        soup = BeautifulSoup(browser.contents)
         sharing_url = canonical_url(self.pillar, view_name='+sharing')
+        browser = setupBrowserForUser(user=self.driver)
+        browser.open(url)
+        soup = BeautifulSoup(browser.contents)
         sharing_menu = soup.find('a', {'href': sharing_url})
         self.assertIsNotNone(sharing_menu)
 

=== modified file 'lib/lp/registry/browser/tests/test_product.py'
--- lib/lp/registry/browser/tests/test_product.py	2012-09-10 13:24:03 +0000
+++ lib/lp/registry/browser/tests/test_product.py	2012-10-04 10:27:37 +0000
@@ -449,8 +449,8 @@
     def test_headers(self):
         """The headers for the RDF view of a product should be as expected."""
         product = self.factory.makeProduct()
+        content_disposition = 'attachment; filename="%s.rdf"' % product.name
         browser = self.getViewBrowser(product, view_name='+rdf')
-        content_disposition = 'attachment; filename="%s.rdf"' % product.name
         self.assertEqual(
             content_disposition, browser.headers['Content-disposition'])
         self.assertEqual(

=== modified file 'lib/lp/registry/configure.zcml'
--- lib/lp/registry/configure.zcml	2012-10-04 10:27:37 +0000
+++ lib/lp/registry/configure.zcml	2012-10-04 10:27:37 +0000
@@ -1229,6 +1229,8 @@
         class="lp.registry.model.product.Product">
         <allow
             interface="lp.registry.interfaces.product.IProductPublic"/>
+        <allow
+            interface="lp.registry.interfaces.pillar.IPillar"/>
         <require
             permission="launchpad.View"
             interface="lp.registry.interfaces.product.IProductLimitedView"/>

=== modified file 'lib/lp/registry/interfaces/product.py'
--- lib/lp/registry/interfaces/product.py	2012-10-04 10:27:37 +0000
+++ lib/lp/registry/interfaces/product.py	2012-10-04 10:27:37 +0000
@@ -426,13 +426,6 @@
 
     id = Int(title=_('The Project ID'))
 
-    information_type = exported(
-        Choice(
-            title=_('Information Type'), vocabulary=InformationType,
-            required=True, readonly=True,
-            description=_(
-                'The type of of data contained in this project.')))
-
     def userCanView(user):
         """True if the given user has access to this product."""
 
@@ -443,7 +436,7 @@
     IHasLogo, IHasMergeProposals, IHasMilestones,
     IHasMugshot, IHasOwner, IHasSprints, IHasTranslationImports,
     ITranslationPolicy, IKarmaContext, ILaunchpadUsage, IMakesAnnouncements,
-    IOfficialBugTagTargetPublic, IHasOOPSReferences, IPillar,
+    IOfficialBugTagTargetPublic, IHasOOPSReferences,
     ISpecificationTarget, IHasRecipes, IHasCodeImports, IServiceUsage):
     """Public IProduct properties."""
 
@@ -938,13 +931,8 @@
 class IProduct(
     IHasBugSupervisor, IProductEditRestricted,
     IProductModerateRestricted, IProductDriverRestricted,
-<<<<<<< TREE
-    IProductPublic, IQuestionTarget, IRootContext,
-    IStructuralSubscriptionTarget, IInformationType):
-=======
     IProductLimitedView, IProductPublic, IQuestionTarget, IRootContext,
-    IStructuralSubscriptionTarget):
->>>>>>> MERGE-SOURCE
+    IStructuralSubscriptionTarget, IInformationType, IPillar):
     """A Product.
 
     The Launchpad Registry describes the open source world as ProjectGroups

=== modified file 'lib/lp/registry/model/product.py'
--- lib/lp/registry/model/product.py	2012-10-04 10:27:37 +0000
+++ lib/lp/registry/model/product.py	2012-10-04 10:27:37 +0000
@@ -69,12 +69,9 @@
     FREE_INFORMATION_TYPES,
     InformationType,
     PRIVATE_INFORMATION_TYPES,
-<<<<<<< TREE
+    PUBLIC_INFORMATION_TYPES,
     PUBLIC_PROPRIETARY_INFORMATION_TYPES,
     PROPRIETARY_INFORMATION_TYPES,
-=======
-    PUBLIC_INFORMATION_TYPES,
->>>>>>> MERGE-SOURCE
     service_uses_launchpad,
     ServiceUsage,
     )
@@ -424,7 +421,6 @@
         """
         pass
 
-<<<<<<< TREE
     def _valid_product_information_type(self, attr, value):
         if value not in PUBLIC_PROPRIETARY_INFORMATION_TYPES:
             raise CannotChangeInformationType('Not supported for Projects.')
@@ -438,22 +434,18 @@
                 ' Projects.')
         return value
 
-    information_type = EnumCol(
+    _information_type = EnumCol(
         enum=InformationType, default=InformationType.PUBLIC,
+        dbName='information_type',
         storm_validator=_valid_product_information_type)
-=======
-    # Place holder for a db column.
-    # XXX: rharding 2012-09-10 bug=1048720: Waiting on db patch to connect
-    # into place.
+
     def _get_information_type(self):
-        return getattr(
-            self, '_information_type', InformationType.PUBLIC)
+        return self._information_type or InformationType.PUBLIC
 
     def _set_information_type(self, value):
         self._information_type = value
 
     information_type = property(_get_information_type, _set_information_type)
->>>>>>> MERGE-SOURCE
 
     security_contact = None
 
@@ -1550,11 +1542,30 @@
 
         return weight_function
 
+    @cachedproperty
+    def _known_viewers(self):
+        """A set of known persons able to view this product."""
+        return set()
+
     def userCanView(self, user):
         """See `IProductPublic`."""
         if self.information_type in PUBLIC_INFORMATION_TYPES:
             return True
-        return user.inTeam(self.owner)
+        if user is None:
+            return False
+        if user.id in self._known_viewers:
+            return True
+        # We want an actual Storm Person.
+        if IPersonRoles.providedBy(user):
+            user = user.person
+        policy = getUtility(IAccessPolicySource).find(
+            [(self, self.information_type)]).one()
+        grants_for_user = getUtility(IAccessPolicyGrantSource).find(
+            [(policy, user)])
+        if grants_for_user.is_empty():
+            return False
+        self._known_viewers.add(user.id)
+        return True
 
 
 class ProductSet:

=== modified file 'lib/lp/registry/services/tests/test_sharingservice.py'
--- lib/lp/registry/services/tests/test_sharingservice.py	2012-09-27 01:30:56 +0000
+++ lib/lp/registry/services/tests/test_sharingservice.py	2012-10-04 10:27:37 +0000
@@ -1838,12 +1838,14 @@
             api_method, api_version='devel', **kwargs).jsonBody()
 
     def _getPillarGranteeData(self):
-        pillar_uri = canonical_url(self.pillar, force_local_path=True)
+        pillar_uri = canonical_url(
+            removeSecurityProxy(self.pillar), force_local_path=True)
         return self._named_get(
             'getPillarGranteeData', pillar=pillar_uri)
 
     def _sharePillarInformation(self, pillar):
-        pillar_uri = canonical_url(pillar, force_local_path=True)
+        pillar_uri = canonical_url(
+            removeSecurityProxy(pillar), force_local_path=True)
         return self._named_post(
             'sharePillarInformation', pillar=pillar_uri,
             grantee=self.grantee_uri,

=== modified file 'lib/lp/registry/stories/webservice/xx-project-registry.txt'
--- lib/lp/registry/stories/webservice/xx-project-registry.txt	2012-09-25 16:52:09 +0000
+++ lib/lp/registry/stories/webservice/xx-project-registry.txt	2012-10-04 10:27:37 +0000
@@ -168,7 +168,7 @@
     freshmeat_project: None
     homepage_url: None
     icon_link: u'http://.../firefox/icon'
-    information_type: None
+    information_type: u'Public'
     is_permitted: True
     license_approved: False
     license_info: None

=== modified file 'lib/lp/registry/tests/test_pillaraffiliation.py'
--- lib/lp/registry/tests/test_pillaraffiliation.py	2012-09-10 13:24:03 +0000
+++ lib/lp/registry/tests/test_pillaraffiliation.py	2012-10-04 10:27:37 +0000
@@ -150,7 +150,7 @@
         Store.of(product).invalidate()
         with StormStatementRecorder() as recorder:
             IHasAffiliation(product).getAffiliationBadges([person])
-        self.assertThat(recorder, HasQueryCount(Equals(5)))
+        self.assertThat(recorder, HasQueryCount(Equals(4)))
 
     def test_distro_affiliation_query_count(self):
         # Only 2 business queries are expected, selects from:

=== modified file 'lib/lp/registry/tests/test_product.py'
--- lib/lp/registry/tests/test_product.py	2012-10-04 10:27:37 +0000
+++ lib/lp/registry/tests/test_product.py	2012-10-04 10:27:37 +0000
@@ -45,6 +45,7 @@
     BugSharingPolicy,
     EXCLUSIVE_TEAM_POLICY,
     INCLUSIVE_TEAM_POLICY,
+    SharingPermission,
     SpecificationSharingPolicy,
     )
 from lp.registry.errors import (
@@ -73,6 +74,7 @@
     celebrity_logged_in,
     login,
     person_logged_in,
+    StormStatementRecorder,
     TestCase,
     TestCaseWithFactory,
     WebServiceTestCase,
@@ -401,7 +403,6 @@
         expected = [InformationType.PROPRIETARY]
         self.assertContentEqual(expected, [policy.type for policy in aps])
 
-<<<<<<< TREE
     def createProduct(self, information_type=None, license=None):
         # convenience method for testing IProductSet.createProduct rather than
         # self.factory.makeProduct
@@ -423,7 +424,7 @@
             license=License.OTHER_PROPRIETARY)
         self.assertEqual(InformationType.EMBARGOED, product.information_type)
         # Owner can set information_type
-        with person_logged_in(product.owner):
+        with person_logged_in(removeSecurityProxy(product).owner):
             product.information_type = InformationType.PROPRIETARY
         self.assertEqual(InformationType.PROPRIETARY, product.information_type)
         # Database persists information_type value
@@ -435,7 +436,9 @@
 
     def test_product_information_type_default(self):
         # Default information_type is PUBLIC
-        product = self.createProduct()
+        owner = self.factory.makePerson()
+        product = getUtility(IProductSet).createProduct(
+            owner, 'fnord', 'Fnord', 'Fnord', 'test 1', 'test 2')
         self.assertEqual(InformationType.PUBLIC, product.information_type)
 
     invalid_information_types = [info_type for info_type in
@@ -487,7 +490,6 @@
             product = self.createProduct(info_type, License.OTHER_PROPRIETARY)
             self.assertEqual(info_type, product.information_type)
 
-=======
     def check_permissions(self, expected_permissions, used_permissions,
                           type_):
         expected = set(expected_permissions.keys())
@@ -511,10 +513,13 @@
                         expected_permissions[permission] - attribute_names)))
 
     expected_get_permissions = {
-        CheckerPublic: set(('id', 'information_type', 'userCanView',)),
+        CheckerPublic: set((
+            'active', 'id', 'information_type', 'pillar_category', 'private',
+            'userCanView',)),
         'launchpad.View': set((
-            '_getOfficialTagClause', 'active', 'active_or_packaged_series',
-            'aliases', 'all_milestones', 'all_specifications',
+            '_getOfficialTagClause', '_all_specifications',
+            '_valid_specifications', 'active_or_packaged_series',
+            'aliases', 'all_milestones',
             'allowsTranslationEdits', 'allowsTranslationSuggestions',
             'announce', 'answer_contacts', 'answers_usage', 'autoupdate',
             'blueprints_usage', 'branch_sharing_policy',
@@ -551,13 +556,12 @@
             'getTopContributors', 'getTopContributorsGroupedByCategory',
             'getTranslationGroups', 'getTranslationImportQueueEntries',
             'getTranslators', 'getUsedBugTagsWithOpenCounts',
-            'getVersionSortedSeries', 'has_any_specifications',
+            'getVersionSortedSeries',
             'has_current_commercial_subscription',
             'has_custom_language_codes', 'has_milestones', 'homepage_content',
             'homepageurl', 'icon', 'invitesTranslationEdits',
             'invitesTranslationSuggestions',
             'isUsingInheritedBranchVisibilityPolicy',
-            'latest_completed_specifications', 'latest_specifications',
             'license_info', 'license_status', 'licenses', 'logo', 'milestones',
             'mugshot', 'name', 'name_with_project', 'newCodeImport',
             'obsolete_translatable_series', 'official_answers',
@@ -565,7 +569,7 @@
             'official_codehosting', 'official_malone', 'owner',
             'parent_subscription_target', 'packagedInDistros', 'packagings',
             'past_sprints', 'personHasDriverRights', 'pillar',
-            'pillar_category', 'primary_translatable', 'private_bugs',
+            'primary_translatable', 'private_bugs',
             'programminglang', 'project', 'qualifies_for_free_hosting',
             'recipes', 'redeemSubscriptionVoucher', 'registrant', 'releases',
             'remote_product', 'removeCustomLanguageCode',
@@ -580,7 +584,7 @@
             'translationpermission', 'translations_usage', 'ubuntu_packages',
             'userCanAlterBugSubscription', 'userCanAlterSubscription',
             'userCanEdit', 'userHasBugSubscriptions', 'uses_launchpad',
-            'valid_specifications', 'wikiurl')),
+            'wikiurl')),
         'launchpad.AnyAllowedPerson': set((
             'addAnswerContact', 'addBugSubscription',
             'addBugSubscriptionFilter', 'addSubscription',
@@ -615,9 +619,10 @@
                 'bug_tracking_usage', 'codehosting_usage',
                 'commercial_subscription', 'description', 'development_focus',
                 'displayname', 'downloadurl', 'driver', 'freshmeatproject',
-                'homepage_content', 'homepageurl', 'icon', 'license_info',
-                'licenses', 'logo', 'mugshot', 'official_answers',
-                'official_blueprints', 'official_codehosting', 'owner',
+                'homepage_content', 'homepageurl', 'icon', 'information_type',
+                'license_info', 'licenses', 'logo', 'mugshot',
+                'official_answers', 'official_blueprints',
+                'official_codehosting', 'owner', 'private',
                 'programminglang', 'project', 'redeemSubscriptionVoucher',
                 'releaseroot', 'screenshotsurl', 'sourceforgeproject',
                 'summary', 'title', 'uses_launchpad', 'wikiurl')),
@@ -655,8 +660,10 @@
     def test_access_launchpad_View_proprietary_product(self):
         # Only people with grants for a private product can access
         # attributes protected by the permission launchpad.View.
-        product = self.factory.makeProduct(
-            information_type=InformationType.PROPRIETARY)
+        product = self.createProduct(
+            information_type=InformationType.PROPRIETARY,
+            license=License.OTHER_PROPRIETARY)
+        owner = removeSecurityProxy(product).owner
         names = self.expected_get_permissions['launchpad.View']
         with person_logged_in(None):
             for attribute_name in names:
@@ -667,7 +674,16 @@
             for attribute_name in names:
                 self.assertRaises(
                     Unauthorized, getattr, product, attribute_name)
-        with person_logged_in(removeSecurityProxy(product).owner):
+        with person_logged_in(owner):
+            for attribute_name in names:
+                getattr(product, attribute_name)
+        # A user with a policy grant for the product can access attributes
+        # of a private product.
+        with person_logged_in(owner):
+            getUtility(IService, 'sharing').sharePillarInformation(
+                product, ordinary_user, owner,
+                {InformationType.PROPRIETARY: SharingPermission.ALL})
+        with person_logged_in(ordinary_user):
             for attribute_name in names:
                 getattr(product, attribute_name)
 
@@ -691,8 +707,10 @@
     def test_access_launchpad_AnyAllowedPerson_proprietary_product(self):
         # Only people with grants for a private product can access
         # attributes protected by the permission launchpad.AnyAllowedPerson.
-        product = self.factory.makeProduct(
-            information_type=InformationType.PROPRIETARY)
+        product = self.createProduct(
+            information_type=InformationType.PROPRIETARY,
+            license=License.OTHER_PROPRIETARY)
+        owner = removeSecurityProxy(product).owner
         names = self.expected_get_permissions['launchpad.AnyAllowedPerson']
         with person_logged_in(None):
             for attribute_name in names:
@@ -703,7 +721,16 @@
             for attribute_name in names:
                 self.assertRaises(
                     Unauthorized, getattr, product, attribute_name)
-        with person_logged_in(removeSecurityProxy(product).owner):
+        with person_logged_in(owner):
+            for attribute_name in names:
+                getattr(product, attribute_name)
+        # A user with a policy grant for the product can access attributes
+        # of a private product.
+        with person_logged_in(owner):
+            getUtility(IService, 'sharing').sharePillarInformation(
+                product, ordinary_user, owner,
+                {InformationType.PROPRIETARY: SharingPermission.ALL})
+        with person_logged_in(ordinary_user):
             for attribute_name in names:
                 getattr(product, attribute_name)
 
@@ -724,8 +751,10 @@
     def test_set_launchpad_AnyAllowedPerson_proprietary_product(self):
         # Only people with grants for a private product can set
         # attributes protected by the permission launchpad.AnyAllowedPerson.
-        product = self.factory.makeProduct(
-            information_type=InformationType.PROPRIETARY)
+        product = self.createProduct(
+            information_type=InformationType.PROPRIETARY,
+            license=License.OTHER_PROPRIETARY)
+        owner = removeSecurityProxy(product).owner
         with person_logged_in(None):
             self.assertRaises(
                 Unauthorized, setattr, product, 'date_next_suggest_packaging',
@@ -735,10 +764,40 @@
             self.assertRaises(
                 Unauthorized, setattr, product, 'date_next_suggest_packaging',
                 'foo')
-        with person_logged_in(removeSecurityProxy(product).owner):
-            setattr(product, 'date_next_suggest_packaging', 'foo')
-
->>>>>>> MERGE-SOURCE
+        with person_logged_in(owner):
+            setattr(product, 'date_next_suggest_packaging', 'foo')
+        # A user with a policy grant for the product can access attributes
+        # of a private product.
+        with person_logged_in(owner):
+            getUtility(IService, 'sharing').sharePillarInformation(
+                product, ordinary_user, owner,
+                {InformationType.PROPRIETARY: SharingPermission.ALL})
+        with person_logged_in(ordinary_user):
+            setattr(product, 'date_next_suggest_packaging', 'foo')
+
+    def test_userCanView_caches_known_users(self):
+        # userCanView() maintains a cache of users known to have the
+        # permission to access a product.
+        product = self.createProduct(
+            information_type=InformationType.PROPRIETARY,
+            license=License.OTHER_PROPRIETARY)
+        owner = removeSecurityProxy(product).owner
+        user = self.factory.makePerson()
+        with person_logged_in(owner):
+            getUtility(IService, 'sharing').sharePillarInformation(
+                product, user, owner,
+                {InformationType.PROPRIETARY: SharingPermission.ALL})
+        with person_logged_in(user):
+            with StormStatementRecorder() as recorder:
+                # The first access to a property of the product from
+                # a user requires a DB query.
+                product.homepageurl
+                queries_for_first_user_access = len(recorder.queries)
+                # The second access does not require another query.
+                product.description
+                self.assertEqual(
+                queries_for_first_user_access, len(recorder.queries))
+
 
 class TestProductBugInformationTypes(TestCaseWithFactory):
 

=== modified file 'lib/lp/registry/tests/test_subscribers.py'
--- lib/lp/registry/tests/test_subscribers.py	2012-05-25 21:16:11 +0000
+++ lib/lp/registry/tests/test_subscribers.py	2012-10-04 10:27:37 +0000
@@ -170,7 +170,10 @@
         # If there is no request, there is no reason to show a message in
         # the browser.
         product, user = self.make_product_user([License.GNU_GPL_V2])
-        notification = LicenseNotification(product, user)
+        # Using the proxied product leads to an exeception when
+        # notification.display() below is called because the permission
+        # checks product require an interaction.
+        notification = LicenseNotification(removeSecurityProxy(product), user)
         logout()
         result = notification.display()
         self.assertIs(False, result)

=== modified file 'lib/lp/scripts/garbo.py'
--- lib/lp/scripts/garbo.py	2012-10-02 19:25:44 +0000
+++ lib/lp/scripts/garbo.py	2012-10-04 10:27:37 +0000
@@ -928,10 +928,10 @@
     def __call__(self, chunk_size):
         """See `TunableLoop`."""
         subselect = Select(
-            Product.id, Product.information_type == None,
+            Product.id, Product._information_type == None,
             limit=chunk_size)
         result = self.store.execute(
-            Update({Product.information_type: 1},
+            Update({Product._information_type: 1},
             Product.id.is_in(subselect)))
         transaction.commit()
         self.rows_updated = result.rowcount

=== modified file 'lib/lp/scripts/tests/test_garbo.py'
--- lib/lp/scripts/tests/test_garbo.py	2012-10-03 17:41:00 +0000
+++ lib/lp/scripts/tests/test_garbo.py	2012-10-04 10:27:37 +0000
@@ -1064,18 +1064,18 @@
         # Set all existing projects to something other than None or 1.
         store = IMasterStore(Product)
         store.execute(Update(
-            {Product.information_type: 2}))
+            {Product._information_type: 2}))
         store.flush()
         # Make a new product without an information_type.
         product = self.factory.makeProduct()
         store.execute(Update(
-            {Product.information_type: None}, Product.id == product.id))
+            {Product._information_type: None}, Product.id == product.id))
         store.flush()
         self.assertEqual(1, store.find(Product,
-            Product.information_type == None).count())
+            Product._information_type == None).count())
         self.runDaily()
         self.assertEqual(0, store.find(Product,
-            Product.information_type == None).count())
+            Product._information_type == None).count())
 
 
 class TestGarboTasks(TestCaseWithFactory):

=== modified file 'lib/lp/security.py'
--- lib/lp/security.py	2012-10-04 10:27:37 +0000
+++ lib/lp/security.py	2012-10-04 10:27:37 +0000
@@ -431,15 +431,19 @@
         return user.isOwner(self.obj) or user.in_admin
 
 
-class ViewProduct(AuthorizationBase):
+class ViewProduct(ViewPillar):
     permission = 'launchpad.View'
     usedfor = IProduct
 
     def checkAuthenticated(self, user):
-        return self.obj.userCanView(user)
+        return (
+            super(ViewProduct, self).checkAuthenticated(user) and
+            self.obj.userCanView(user))
 
     def checkUnauthenticated(self):
-        return self.obj.information_type in PUBLIC_INFORMATION_TYPES
+        return (
+            self.obj.information_type in PUBLIC_INFORMATION_TYPES and
+            super(ViewProduct, self).checkUnauthenticated())
 
 
 class ChangeProduct(ViewProduct):

=== modified file 'lib/lp/testing/factory.py'
--- lib/lp/testing/factory.py	2012-10-04 10:27:37 +0000
+++ lib/lp/testing/factory.py	2012-10-04 10:27:37 +0000
@@ -64,6 +64,7 @@
 
 from lp.app.enums import (
     InformationType,
+    PROPRIETARY_INFORMATION_TYPES,
     PUBLIC_INFORMATION_TYPES,
     ServiceUsage,
     )
@@ -1024,6 +1025,10 @@
                 specification_sharing_policy)
         if information_type is not None:
             naked_product.information_type = information_type
+            if information_type in PROPRIETARY_INFORMATION_TYPES:
+                policy = self.makeAccessPolicy(product, information_type)
+                self.makeAccessPolicyGrant(
+                    policy, grantee=naked_product.owner)
 
         return product
 
@@ -1057,7 +1062,7 @@
         if product is None:
             product = self.makeProduct()
         if owner is None:
-            owner = product.owner
+            owner = removeSecurityProxy(product).owner
         if name is None:
             name = self.getUniqueString()
         if summary is None:
@@ -1834,7 +1839,8 @@
 
         if owner is None:
             owner = self.makePerson()
-        return removeSecurityProxy(bug).addTask(owner, target)
+        return removeSecurityProxy(bug).addTask(
+            owner, removeSecurityProxy(target))
 
     def makeBugNomination(self, bug=None, target=None):
         """Create and return a BugNomination.

=== modified file 'lib/lp/translations/browser/tests/test_noindex.py'
--- lib/lp/translations/browser/tests/test_noindex.py	2012-01-01 02:58:52 +0000
+++ lib/lp/translations/browser/tests/test_noindex.py	2012-10-04 10:27:37 +0000
@@ -46,7 +46,12 @@
         # Using create_initialized_view for distroseries causes an error when
         # rendering the view due to the way the view is registered and menus
         # are adapted.  Getting the contents via a browser does work.
-        self.user_browser.open(self.url)
+        #
+        # Retrieve the URL before the user_browser is created. Products
+        # can only be access with an active interaction, and getUserBrowser()
+        # closes the current interaction.
+        url = self.url
+        self.user_browser.open(url)
         return self.user_browser.contents
 
     def getRobotsDirective(self):

=== modified file 'lib/lp/translations/stories/importqueue/xx-entry-details.txt'
--- lib/lp/translations/stories/importqueue/xx-entry-details.txt	2012-05-24 20:25:54 +0000
+++ lib/lp/translations/stories/importqueue/xx-entry-details.txt	2012-10-04 10:27:37 +0000
@@ -15,6 +15,7 @@
     >>> queue = TranslationImportQueue()
     >>> product = factory.makeProduct(
     ...     translations_usage=ServiceUsage.LAUNCHPAD)
+    >>> product_displayname = product.displayname
     >>> trunk = product.getSeries('trunk')
     >>> uploader = factory.makePerson()
     >>> entry = queue.addOrUpdateEntry(
@@ -34,7 +35,7 @@
 
 The details include the project the entry is for, and who uploaded it.
 
-    >>> product.displayname in details_text
+    >>> product_displayname in details_text
     True
 
     # Must remove the security proxy because IPerson.displayname is protected.

=== modified file 'lib/lp/translations/stories/webservice/xx-potemplate.txt'
--- lib/lp/translations/stories/webservice/xx-potemplate.txt	2011-05-27 19:53:20 +0000
+++ lib/lp/translations/stories/webservice/xx-potemplate.txt	2012-10-04 10:27:37 +0000
@@ -71,13 +71,14 @@
 
     >>> login('[e-mail]')
     >>> productseries = factory.makeProductSeries()
+    >>> product_name = productseries.product.name
     >>> potemplate_1 = factory.makePOTemplate(productseries=productseries)
     >>> potemplate_2 = factory.makePOTemplate(productseries=productseries)
     >>> potemplate_count = 2
     >>> logout()
     >>> all_translation_templates = anon_webservice.named_get(
     ...     '/%s/%s' % (
-    ...         productseries.product.name,
+    ...         product_name,
     ...         productseries.name),
     ...     'getTranslationTemplates'
     ...     ).jsonBody()