Merge lp:~adeuring/launchpad/productseries-sec-adapter into lp:launchpad

[Abel Deuring]

privacy aware security adapter for IProductSeries

This branch adds a "sharing aware" security adapter for IProductSeries.

Serieses of private products are now only shown to persons
with policy grants for the product; the only exception are some
attributes that do not leak any "real" information: the database ID,
and the method userCanView().

Details of the change:

lp/registry/configure.zcml:

Access to most attributes and to "partial" interfaces that were public
now requires the permission launchpad.View; the permission
launchpad.AnyPerson is replaced with launchapd.AnyAllowedPerson.

(lp.services.webapp.authorization.LaunchpadSecurityPolicy.checkPermission()
has a "shortcut" for the permission launchpad.AnyPerson: no
dedicated security adapters are looked up for this permission,
so the new rule "data for serieses of private products should only
be visible for persons having a policy grant" cannot be implemented
with this permission.)

lp/security.py:

The existing class ViewProductSeries derived AnonymousAuthorization.
This does not make sense anymore, instead the class now derives
AuthorizationBase and calls the new method ProductSeries,userCanView()
for real authorization check.

The new class ChangeProductSeries does the authorization check for
the permission launchpad.AnyAllowedPerson.

lp/registry/interfaces/productseries.py

The existing interface IProductSeriesPublic now defines only the DB ID
and the method userCanView(), all other attributes are defined in
the new class IProductSeriesView.

lp/registry/model/productseries.py:

The new method userCanView(). The actual permission check is done
by IProduct.userCanView().

lp/registry/tests/test_productseries.py:

Tests for the permissions.

The test class properties expected_get_permissions and
expected_set_permissions are also intended to document which permissions
are acutally used for IProductSeries.

test:

./bin/test registry -vvt lp.registry.tests.test_productseries.ProductSeriesSecurityAdaperTestCase

no lint

Update:

I'm running an EC2 test for this branch; several failures are
fixed in r 10250.

The tests lp.registry.tests.test_packaging.TestCreatePackaging.test_createPackaging_refuses_EMBARGOED
and lp.registry.tests.test_packaging.TestCreatePackaging.test_createPackaging_refuses_PROPRIETARY
failed in lp.registry.packaging.PackagingUtil.createPackaging() because
productseries.product is no longer available. To fix these tests, I added
the interfaces IInformationType to IProduct.

The other failures were either Unauthorized execption, or, in browser
tests, "AttributeError: 'thread._local' object has no attribute 'interaction'".

WHen a borwser instance is created, an existing interaction in terminated,
so that thread._local.interaction is no longer available outside a
a browser call -- but the current user is stored as an attribute of
interaction, and the new security tests require a check if this user has
access rights. The most easy fix is to access some required attribute
the broswer object is created.

additional tests:

lp.registry.tests.test_productseries.TestProductSeriesInformationType
lp.code.browser.tests.test_branchlisting.TestProductSeriesTemplate.test_product_series_link
lp.registry.browser.tests.test_sourcepackage_views.TestSourcePackageChangeUpstreamView.test_error_on_proprietary_productseries
lp.registry.tests.test_packaging.TestCreatePackaging.test_createPackaging_refuses_EMBARGOED
lp.registry.tests.test_packaging.TestCreatePackaging.test_createPackaging_refuses_PROPRIETARY
lp.registry.tests.test_sourcepackage.TestSourcePackage.test_refuses_PROPRIETARY

[j.c.sackett (jcsackett)]

Looks alright. Thanks Abel.

review: Approve

[Deryck Hodge (deryck)]

Thanks for merging my work and using adaptation here. Looks good to me now!

review: Approve

=== modified file 'lib/lp/bugs/model/bug.py'
=== modified file 'lib/lp/code/browser/tests/test_branchlisting.py'
--- lib/lp/code/browser/tests/test_branchlisting.py	2012-10-08 07:15:07 +0000
+++ lib/lp/code/browser/tests/test_branchlisting.py	2012-10-19 08:28:25 +0000
@@ -596,10 +596,11 @@
         # series on the main site, not the code site.
         branch = self.factory.makeProductBranch()
         series = self.factory.makeProductSeries(product=branch.product)
+        series_name = series.name
         remove_security_proxy_and_shout_at_engineer(series).branch = branch
         browser = self.getUserBrowser(
             canonical_url(branch.product, rootsite='code'))
-        link = browser.getLink(re.compile('^' + series.name + '$'))
+        link = browser.getLink(re.compile('^' + series_name + '$'))
         self.assertEqual('launchpad.dev', URI(link.url).host)
 
 
 
=== modified file 'lib/lp/registry/browser/tests/test_productseries_views.py'
--- lib/lp/registry/browser/tests/test_productseries_views.py	2012-10-18 16:56:54 +0000
+++ lib/lp/registry/browser/tests/test_productseries_views.py	2012-10-19 08:28:25 +0000
@@ -26,6 +26,7 @@
 from lp.testing.views import create_initialized_view
 
 
+<<<<<<< TREE
 class TestProductSeries(BrowserTestCase):
 
     layer = DatabaseFunctionalLayer
@@ -73,6 +74,56 @@
             privacy_portlet_proprietary))
 
 
+=======
+class TestProductSeries(BrowserTestCase):
+
+    layer = DatabaseFunctionalLayer
+
+    def test_information_type_public(self):
+        # A ProductSeries view should include its information_type,
+        # which defaults to Public for new projects.
+        series = self.factory.makeProductSeries()
+        view = create_initialized_view(series, '+index')
+        self.assertEqual('Public', view.information_type)
+
+    def test_information_type_proprietary(self):
+        # A ProductSeries view should get its information_type
+        # from the related product even if the product is changed to
+        # PROPRIETARY.
+        owner = self.factory.makePerson()
+        information_type = InformationType.PROPRIETARY
+        product = self.factory.makeProduct(
+            owner=owner, information_type=information_type)
+        series = self.factory.makeProductSeries(product=product)
+        with person_logged_in(owner):
+            view = create_initialized_view(series, '+index')
+            self.assertEqual('Proprietary', view.information_type)
+
+    def test_privacy_portlet(self):
+        # A ProductSeries page should include a privacy portlet that
+        # accurately describes the information_type.
+        owner = self.factory.makePerson()
+        information_type = InformationType.PROPRIETARY
+        product = self.factory.makeProduct(
+            owner=owner, information_type=information_type)
+        series = self.factory.makeProductSeries(product=product)
+        privacy_portlet = soupmatchers.Tag(
+            'info-type-portlet', 'span',
+            attrs={'id': 'information-type-summary'})
+        privacy_portlet_proprietary = soupmatchers.Tag(
+            'info-type-text', 'strong', attrs={'id': 'information-type'},
+            text='Proprietary')
+        browser = self.getViewBrowser(series, '+index', user=owner)
+        # First, assert that the portlet exists.
+        self.assertThat(
+            browser.contents, soupmatchers.HTMLContains(privacy_portlet))
+        # Then, assert that the text displayed matches the information_type.
+        self.assertThat(
+            browser.contents, soupmatchers.HTMLContains(
+            privacy_portlet_proprietary))
+
+
+>>>>>>> MERGE-SOURCE
 class TestProductSeriesHelp(TestCaseWithFactory):
     layer = DatabaseFunctionalLayer
 
 
=== modified file 'lib/lp/registry/browser/tests/test_sourcepackage_views.py'
--- lib/lp/registry/browser/tests/test_sourcepackage_views.py	2012-10-15 15:35:32 +0000
+++ lib/lp/registry/browser/tests/test_sourcepackage_views.py	2012-10-19 08:28:25 +0000
@@ -319,6 +319,7 @@
         product = self.factory.makeProduct(
             name=product_name, owner=product_owner)
         series = self.factory.makeProductSeries(product=product)
+        series_displayname = series.displayname
         ubuntu_series = self.factory.makeUbuntuDistroSeries()
         sp = self.factory.makeSourcePackage(distroseries=ubuntu_series)
         browser = self.getViewBrowser(
@@ -327,7 +328,7 @@
         browser.getControl('Continue').click()
         with person_logged_in(product_owner):
             product.information_type = InformationType.PROPRIETARY
-        browser.getControl(series.displayname).selected = True
+        browser.getControl(series_displayname).selected = True
         browser.getControl('Change').click()
         self.assertIn(
             'Only Public projects can be packaged, not Proprietary.',
 
=== modified file 'lib/lp/registry/configure.zcml'
--- lib/lp/registry/configure.zcml	2012-10-17 20:18:20 +0000
+++ lib/lp/registry/configure.zcml	2012-10-19 08:28:25 +0000
@@ -1508,10 +1508,16 @@
         <allow
             interface="lp.registry.interfaces.productseries.IProductSeriesPublic"/>
         <require
+            permission="launchpad.View"
+            interface="lp.registry.interfaces.productseries.IProductSeriesView"/>
+        <require
             permission="launchpad.Edit"
             interface="lp.registry.interfaces.productseries.IProductSeriesEditRestricted"/>
-        <allow interface="lp.bugs.interfaces.bugsummary.IBugSummaryDimension"/>
-        <allow
+        <require
+            permission="launchpad.View"
+            interface="lp.bugs.interfaces.bugsummary.IBugSummaryDimension"/>
+        <require
+            permission="launchpad.View"
             interface="lp.bugs.interfaces.bugtarget.ISeriesBugTarget"/>
         <require
             permission="launchpad.Edit"
@@ -1522,16 +1528,17 @@
                             translations_branch status releasefileglob
                             translations_autoimport_mode"/>
         <require
-            permission="launchpad.AnyPerson"
+            permission="launchpad.AnyAllowedPerson"
             set_attributes="importstatus rcstype cvsroot cvsmodule
                             cvstarfileurl cvsbranch svnrepository"/>
 
         <!-- IStructuralSubscriptionTarget -->
 
-        <allow
+        <require
+            permission="launchpad.View"
             interface="lp.bugs.interfaces.structuralsubscription.IStructuralSubscriptionTargetRead" />
         <require
-            permission="launchpad.AnyPerson"
+            permission="launchpad.AnyAllowedPerson"
             interface="lp.bugs.interfaces.structuralsubscription.IStructuralSubscriptionTargetWrite" />
 
     </class>
 
=== modified file 'lib/lp/registry/interfaces/productseries.py'
--- lib/lp/registry/interfaces/productseries.py	2012-10-06 23:40:20 +0000
+++ lib/lp/registry/interfaces/productseries.py	2012-10-19 08:28:25 +0000
@@ -12,6 +12,7 @@
     'IProductSeriesEditRestricted',
     'IProductSeriesPublic',
     'IProductSeriesSet',
+    'IProductSeriesView',
     'NoSuchProductSeries',
     'ITimelineProductSeries',
     ]
@@ -129,13 +130,18 @@
         """Create a new milestone for this ProjectSeries."""
 
 
-class IProductSeriesPublic(
+class IProductSeriesPublic(Interface):
+    """Public IProductSeries properties."""
+    id = Int(title=_('ID'))
+
+    def userCanView(user):
+        """True if the given user has access to this product."""
+
+
+class IProductSeriesView(
     ISeriesMixin, IHasAppointedDriver, IHasOwner, IBugTarget,
     ISpecificationGoal, IHasMilestones, IHasOfficialBugTags, IHasExpirableBugs,
     IHasTranslationImports, IHasTranslationTemplates, IServiceUsage):
-    """Public IProductSeries properties."""
-    id = Int(title=_('ID'))
-
     product = exported(
         ReferenceChoice(title=_('Project'), required=True,
             vocabulary='Product', schema=Interface),  # really IProduct
@@ -330,7 +336,7 @@
 
 
 class IProductSeries(IProductSeriesEditRestricted, IProductSeriesPublic,
-                     IStructuralSubscriptionTarget):
+                     IProductSeriesView, IStructuralSubscriptionTarget):
     """A series of releases. For example '2.0' or '1.3' or 'dev'."""
     export_as_webservice_entry('project_series')
 
 
=== modified file 'lib/lp/registry/model/packaging.py'
--- lib/lp/registry/model/packaging.py	2012-10-12 19:37:30 +0000
+++ lib/lp/registry/model/packaging.py	2012-10-19 08:28:25 +0000
@@ -111,6 +111,10 @@
                 (sourcepackagename.name, distroseries.name))
         # XXX: AaronBentley: 2012-08-12 bug=1066063 Cannot adapt ProductSeries
         # to IInformationType.
+        # The line below causes a failure of
+        # lp.registry.tests.test_distroseries.TestDistroSeriesPackaging.
+        # test_getPrioritizedPackagings_bug_tracker because
+        # productseries.product loses all set permissions.
         # info_type = IInformationType(productseries).information_type
         info_type = productseries.product.information_type
         if info_type != InformationType.PUBLIC:
 
=== modified file 'lib/lp/registry/model/productseries.py'
--- lib/lp/registry/model/productseries.py	2012-10-11 15:01:49 +0000
+++ lib/lp/registry/model/productseries.py	2012-10-19 08:28:25 +0000
@@ -679,6 +679,11 @@
                 return OrderedBugTask(3, bugtask.id, bugtask)
         return weight_function
 
+    def userCanView(self, user):
+        """See `IproductSeriesPublic`."""
+        # Deleate the permission check to the parent product.
+        return self.product.userCanView(user)
+
 
 class TimelineProductSeries:
     """See `ITimelineProductSeries`."""
 
=== modified file 'lib/lp/registry/tests/test_packaging.py'
--- lib/lp/registry/tests/test_packaging.py	2012-10-11 16:06:49 +0000
+++ lib/lp/registry/tests/test_packaging.py	2012-10-19 08:28:25 +0000
@@ -174,25 +174,33 @@
 
     def test_createPackaging_refuses_PROPRIETARY(self):
         """Packaging cannot be created for PROPRIETARY productseries"""
+        owner = self.factory.makePerson()
         product = self.factory.makeProduct(
+            owner=owner,
             information_type=InformationType.PROPRIETARY)
         series = self.factory.makeProductSeries(product=product)
-        with ExpectedException(CannotPackageProprietaryProduct,
-            'Only Public project series can be packaged, not Proprietary.'):
-            self.packaging_util.createPackaging(
-                series, self.sourcepackagename, self.distroseries,
-                PackagingType.PRIME, owner=self.owner)
+        expected_message = (
+            'Only Public project series can be packaged, not Proprietary.')
+        with person_logged_in(owner):
+            with ExpectedException(CannotPackageProprietaryProduct,
+                                   expected_message):
+                self.packaging_util.createPackaging(
+                    series, self.sourcepackagename, self.distroseries,
+                    PackagingType.PRIME, owner=self.owner)
 
     def test_createPackaging_refuses_EMBARGOED(self):
         """Packaging cannot be created for EMBARGOED productseries"""
+        owner = self.factory.makePerson()
         product = self.factory.makeProduct(
+            owner=owner,
             information_type=InformationType.EMBARGOED)
         series = self.factory.makeProductSeries(product=product)
-        with ExpectedException(CannotPackageProprietaryProduct,
-            'Only Public project series can be packaged, not Embargoed.'):
-            self.packaging_util.createPackaging(
-                series, self.sourcepackagename, self.distroseries,
-                PackagingType.PRIME, owner=self.owner)
+        with person_logged_in(owner):
+            with ExpectedException(CannotPackageProprietaryProduct,
+                'Only Public project series can be packaged, not Embargoed.'):
+                self.packaging_util.createPackaging(
+                    series, self.sourcepackagename, self.distroseries,
+                    PackagingType.PRIME, owner=self.owner)
 
 
 class TestPackagingEntryExists(PackagingUtilMixin, TestCaseWithFactory):
 
=== modified file 'lib/lp/registry/tests/test_productseries.py'
--- lib/lp/registry/tests/test_productseries.py	2012-10-16 15:12:09 +0000
+++ lib/lp/registry/tests/test_productseries.py	2012-10-19 08:28:25 +0000
@@ -5,13 +5,25 @@
 
 __metaclass__ = type
 
+from storm.exceptions import NoneError
 from testtools.testcase import ExpectedException
 import transaction
+from zope.security.checker import (
+    CheckerPublic,
+    getChecker,
+    )
 from zope.component import getUtility
+from zope.security.interfaces import Unauthorized
 from zope.security.proxy import removeSecurityProxy
 
 from lp.app.enums import InformationType
-from lp.app.interfaces.informationtype import IInformationType
+<<<<<<< TREE
+from lp.app.interfaces.informationtype import IInformationType
+=======
+from lp.app.interfaces.informationtype import IInformationType
+from lp.app.interfaces.services import IService
+from lp.registry.enums import SharingPermission
+>>>>>>> MERGE-SOURCE
 from lp.registry.errors import CannotPackageProprietaryProduct
 from lp.registry.interfaces.distribution import IDistributionSet
 from lp.registry.interfaces.distroseries import IDistroSeriesSet
@@ -22,7 +34,10 @@
 from lp.registry.interfaces.series import SeriesStatus
 from lp.services.database.lpstorm import IStore
 from lp.testing import (
+    ANONYMOUS,
+    celebrity_logged_in,
     login,
+    person_logged_in,
     TestCaseWithFactory,
     WebServiceTestCase,
     )
@@ -37,6 +52,7 @@
     )
 
 
+<<<<<<< TREE
 
 class TestProductSeries(TestCaseWithFactory):
     """Tests for ProductSeries."""
@@ -54,6 +70,25 @@
             IInformationType(series).information_type, information_type)
 
 
+=======
+class TestProductSeries(TestCaseWithFactory):
+    """Tests for ProductSeries."""
+
+    layer = DatabaseFunctionalLayer
+
+    def test_information_type_from_product(self):
+        # ProductSeries should inherit information_type from its product."""
+        owner = self.factory.makePerson()
+        information_type = InformationType.PROPRIETARY
+        product = self.factory.makeProduct(
+            owner=owner, information_type=information_type)
+        series = self.factory.makeProductSeries(product=product)
+        with person_logged_in(owner):
+            self.assertEqual(
+                IInformationType(series).information_type, information_type)
+
+
+>>>>>>> MERGE-SOURCE
 class ProductSeriesReleasesTestCase(TestCaseWithFactory):
     """Test for ProductSeries.release property."""
 
@@ -570,3 +605,293 @@
         mode = TranslationsBranchImportMode.IMPORT_TRANSLATIONS
         ws_series.translations_autoimport_mode = mode.title
         ws_series.lp_save()
+
+
+class ProductSeriesSecurityAdaperTestCase(TestCaseWithFactory):
+    """Test for permissions of IProductSeries."""
+
+    layer = DatabaseFunctionalLayer
+
+    def setUp(self):
+        super(ProductSeriesSecurityAdaperTestCase, self).setUp()
+        self.public_product = self.factory.makeProduct()
+        self.public_series = self.factory.makeProductSeries(
+            product=self.public_product)
+        self.proprietary_product_owner = self.factory.makePerson()
+        self.proprietary_product = self.factory.makeProduct(
+            owner=self.proprietary_product_owner,
+            information_type=InformationType.PROPRIETARY)
+        self.proprietary_series = self.factory.makeProductSeries(
+            product=self.proprietary_product)
+
+    expected_get_permissions = {
+        CheckerPublic: set((
+            'id', 'userCanView',
+            )),
+        'launchpad.AnyAllowedPerson': set((
+            'addBugSubscription', 'addBugSubscriptionFilter',
+            'addSubscription', 'removeBugSubscription',
+            )),
+        'launchpad.Edit': set(('newMilestone', )),
+        'launchpad.View': set((
+            '_all_specifications', '_getOfficialTagClause',
+            '_valid_specifications', 'active', 'all_milestones',
+            'answers_usage', 'blueprints_usage', 'branch',
+            'bug_reported_acknowledgement', 'bug_reporting_guidelines',
+            'bug_subscriptions', 'bug_supervisor', 'bug_tracking_usage',
+            'bugtargetdisplayname', 'bugtarget_parent', 'bugtargetname',
+            'codehosting_usage', 'createBug', 'datecreated', 'displayname',
+            'driver', 'drivers', 'enable_bugfiling_duplicate_search',
+            'getAllowedSpecificationInformationTypes',
+            'getBugSummaryContextWhereClause',
+            'getBugTaskWeightFunction', 'getCachedReleases',
+            'getCurrentTemplatesCollection', 'getCurrentTranslationFiles',
+            'getCurrentTranslationTemplates',
+            'getDefaultSpecificationInformationType',
+            'getFirstEntryToImport', 'getLatestRelease', 'getPOTemplate',
+            'getPackage', 'getPackagingInDistribution', 'getRelease',
+            'getSharingPartner', 'getSpecification', 'getSubscription',
+            'getSubscriptions', 'getTemplatesAndLanguageCounts',
+            'getTemplatesCollection', 'getTimeline',
+            'getTranslationImportQueueEntries',
+            'getTranslationTemplateByName', 'getTranslationTemplateFormats',
+            'getTranslationTemplates', 'getUbuntuTranslationFocusPackage',
+            'getUsedBugTagsWithOpenCounts',
+            'has_current_translation_templates', 'has_milestones',
+            'has_obsolete_translation_templates',
+            'has_sharing_translation_templates', 'has_translation_files',
+            'has_translation_templates', 'is_development_focus', 'milestones',
+            'name', 'official_bug_tags', 'owner', 'packagings', 'parent',
+            'parent_subscription_target',
+            'personHasDriverRights', 'pillar', 'potemplate_count', 'product',
+            'productID', 'productserieslanguages', 'release_files',
+            'releasefileglob', 'releases', 'releaseverstyle', 'searchTasks',
+            'series', 'setPackaging', 'sourcepackages', 'specifications',
+            'status', 'summary', 'target_type_display', 'title',
+            'translations_autoimport_mode', 'userCanAlterBugSubscription',
+            'userCanAlterSubscription', 'userHasBugSubscriptions',
+            'translations_branch', 'translations_usage', 'uses_launchpad',
+            )),
+        }
+
+    def test_get_permissions(self):
+        checker = getChecker(self.public_series)
+        self.checkPermissions(
+            self.expected_get_permissions, checker.get_permissions, 'get')
+
+    expected_set_permissions = {
+        'launchpad.Edit': set((
+            'answers_usage', 'blueprints_usage', 'branch',
+            'bug_tracking_usage', 'codehosting_usage', 'driver', 'name',
+            'owner', 'product', 'releasefileglob', 'status', 'summary',
+            'translations_autoimport_mode', 'translations_branch',
+            'translations_usage', 'uses_launchpad',
+            )),
+        'launchpad.AnyAllowedPerson': set((
+            'cvsbranch', 'cvsmodule', 'cvsroot', 'cvstarfileurl',
+            'importstatus', 'rcstype', 'svnrepository',
+            )),
+        }
+
+    def test_set_permissions(self):
+        checker = getChecker(self.public_series)
+        self.checkPermissions(
+            self.expected_set_permissions, checker.set_permissions, 'set')
+
+    def assertAccessAuthorized(self, attribute_names, obj):
+        # Try to access the given attributes of obj. No exception
+        # should be raised.
+        for name in attribute_names:
+            getattr(obj, name)
+
+    def assertAccessUnauthorized(self, attribute_names, obj):
+        # Try to access the given attributes of obj. Unauthorized
+        # should be raised.
+        for name in attribute_names:
+            self.assertRaises(Unauthorized, getattr, obj, name)
+
+    def assertChangeAuthorized(self, attribute_names, obj):
+        # Try to changes the given attributes of obj. Unauthorized
+        # should not be raised.
+        for name in attribute_names:
+            # Not all attributes declared in configure.zcml to be
+            # settable actually exist or are settable. Attempts to set
+            # them raise an AttributeError. Similary, the naive attempt
+            # to set an attribute to None may raise a NoneError
+            #
+            # Both errors can be ignored here: This method intends only
+            # to prove that Unauthorized is not raised.
+            try:
+                setattr(obj, name, None)
+            except (AttributeError, NoneError):
+                pass
+
+    def assertChangeUnauthorized(self, attribute_names, obj):
+        # Try to changes the given attributes of obj. Unauthorized
+        # should be raised.
+        for name in attribute_names:
+            self.assertRaises(Unauthorized, setattr, obj, name, None)
+
+    def test_access_for_anonymous(self):
+        # Anonymous users have access to public attributes of
+        # a series for a private or public product.
+        with person_logged_in(ANONYMOUS):
+            self.assertAccessAuthorized(
+                self.expected_get_permissions[CheckerPublic],
+                self.public_series)
+            self.assertAccessAuthorized(
+                self.expected_get_permissions[CheckerPublic],
+                self.proprietary_series)
+
+            # They have access to attributes requiring the permission
+            # launchpad.View of a series for a public product...
+            self.assertAccessAuthorized(
+                self.expected_get_permissions['launchpad.View'],
+                self.public_series)
+
+            # ...but not to the same attributes of a series for s private
+            # product.
+            self.assertAccessUnauthorized(
+                self.expected_get_permissions['launchpad.View'],
+                self.proprietary_series)
+
+            # The cannot access other attributes of a series for
+            # public and private products.
+            for permission, names in self.expected_get_permissions.items():
+                if permission in (CheckerPublic, 'launchpad.View'):
+                    continue
+                self.assertAccessUnauthorized(names, self.public_series)
+                self.assertAccessUnauthorized(names, self.proprietary_series)
+
+            # They cannot change any attributes.
+            for permission, names in self.expected_set_permissions.items():
+                self.assertChangeUnauthorized(names, self.public_series)
+                self.assertChangeUnauthorized(names, self.proprietary_series)
+
+    def test_access_for_regular_user(self):
+        # Regular users have access to public attributes of
+        # a series for a private or public product.
+        user = self.factory.makePerson()
+        with person_logged_in(user):
+            self.assertAccessAuthorized(
+                self.expected_get_permissions[CheckerPublic],
+                self.public_series)
+            self.assertAccessAuthorized(
+                self.expected_get_permissions[CheckerPublic],
+                self.proprietary_series)
+
+            # They have access to attributes requiring the permissions
+            # launchpad.View and launchpadAnyAllowedPerson of a series
+            # for a public product...
+            self.assertAccessAuthorized(
+                self.expected_get_permissions['launchpad.View'],
+                self.public_series)
+            self.assertAccessAuthorized(
+                self.expected_get_permissions['launchpad.AnyAllowedPerson'],
+                self.public_series)
+
+            # ...but not to the same attributes of a series for s private
+            # product.
+            self.assertAccessUnauthorized(
+                self.expected_get_permissions['launchpad.View'],
+                self.proprietary_series)
+            self.assertAccessUnauthorized(
+                self.expected_get_permissions['launchpad.AnyAllowedPerson'],
+                self.proprietary_series)
+
+            # The cannot access other attributes of a series for
+            # public and private products.
+            for permission, names in self.expected_get_permissions.items():
+                if permission in (CheckerPublic, 'launchpad.View',
+                                  'launchpad.AnyAllowedPerson'):
+                    continue
+                self.assertAccessUnauthorized(names, self.public_series)
+                self.assertAccessUnauthorized(names, self.proprietary_series)
+
+            # They can change attributes requiring the permission
+            # launchpad.AnyAllowedPerson of a series for a public project...
+            self.assertChangeAuthorized(
+                self.expected_set_permissions['launchpad.AnyAllowedPerson'],
+                self.public_series)
+            #... but not for a private project.
+            self.assertChangeUnauthorized(
+                self.expected_set_permissions['launchpad.AnyAllowedPerson'],
+                self.proprietary_series)
+
+            # They cannot change any attributes that require another
+            # permission than launchpad.AnyALlowedPerson.
+            for permission, names in self.expected_set_permissions.items():
+                if permission == 'launchpad.AnyAllowedPerson':
+                    continue
+                self.assertChangeUnauthorized(names, self.public_series)
+                self.assertChangeUnauthorized(names, self.proprietary_series)
+
+    def test_access_for_user_with_policy_grant(self):
+        # Users with a policy grant for the parent product can access
+        # properties requring the permission lanchpad.View or
+        # launchpad.ANyALlowedPerson of a series.
+        user = self.factory.makePerson()
+        with person_logged_in(self.proprietary_product_owner):
+            getUtility(IService, 'sharing').sharePillarInformation(
+                self.proprietary_product, user, self.proprietary_product_owner,
+                {InformationType.PROPRIETARY: SharingPermission.ALL})
+        with person_logged_in(user):
+            self.assertAccessAuthorized(
+                self.expected_get_permissions['launchpad.View'],
+                self.proprietary_series)
+            self.assertAccessAuthorized(
+                self.expected_get_permissions['launchpad.AnyAllowedPerson'],
+                self.proprietary_series)
+
+            # The cannot access other attributes of a series for
+            # private products.
+            for permission, names in self.expected_get_permissions.items():
+                if permission in (CheckerPublic, 'launchpad.View',
+                                  'launchpad.AnyAllowedPerson'):
+                    continue
+                self.assertAccessUnauthorized(names, self.proprietary_series)
+
+            # They can change attributes requiring the permission
+            # launchpad.AnyAllowedPerson of a series for a provate project...
+            self.assertChangeAuthorized(
+                self.expected_set_permissions['launchpad.AnyAllowedPerson'],
+                self.proprietary_series)
+
+            # They cannot change any attributes that require another
+            # permission than launchpad.AnyALlowedPerson.
+            for permission, names in self.expected_set_permissions.items():
+                if permission == 'launchpad.AnyAllowedPerson':
+                    continue
+                self.assertChangeUnauthorized(names, self.proprietary_series)
+
+    def test_access_for_product_owner(self):
+        # The owner of a project has access to all attributes of
+        # a product series.
+        with person_logged_in(self.proprietary_product_owner):
+            for permission, names in self.expected_get_permissions.items():
+                self.assertAccessAuthorized(names, self.proprietary_series)
+
+            # They can change all attributes.
+            for permission, names in self.expected_set_permissions.items():
+                self.assertChangeAuthorized(names, self.proprietary_series)
+
+        with person_logged_in(self.public_product.owner):
+            for permission, names in self.expected_get_permissions.items():
+                self.assertAccessAuthorized(names, self.public_series)
+
+            # They can change all attributes.
+            for permission, names in self.expected_set_permissions.items():
+                self.assertChangeAuthorized(names, self.public_series)
+
+    def test_access_for_lp_admins(self):
+        # Launchpad admins can access and change any attribute of a series
+        # of public and private product.
+        with celebrity_logged_in('admin'):
+            for permission, names in self.expected_get_permissions.items():
+                self.assertAccessAuthorized(names, self.public_series)
+                self.assertAccessAuthorized(names, self.proprietary_series)
+
+            # They can change all attributes.
+            for permission, names in self.expected_set_permissions.items():
+                self.assertChangeAuthorized(names, self.public_series)
+                self.assertChangeAuthorized(names, self.proprietary_series)
 
=== modified file 'lib/lp/registry/tests/test_sourcepackage.py'
--- lib/lp/registry/tests/test_sourcepackage.py	2012-10-11 18:32:36 +0000
+++ lib/lp/registry/tests/test_sourcepackage.py	2012-10-19 08:28:25 +0000
@@ -327,14 +327,19 @@
 
     def test_refuses_PROPRIETARY(self):
         """Packaging cannot be created for PROPRIETARY productseries"""
+        owner = self.factory.makePerson()
         product = self.factory.makeProduct(
+            owner=owner,
             information_type=InformationType.PROPRIETARY)
         series = self.factory.makeProductSeries(product=product)
         ubuntu_series = self.factory.makeUbuntuDistroSeries()
         sp = self.factory.makeSourcePackage(distroseries=ubuntu_series)
-        with ExpectedException(CannotPackageProprietaryProduct,
-            'Only Public project series can be packaged, not Proprietary.'):
-            sp.setPackaging(series, series.owner)
+        with person_logged_in(owner):
+            with ExpectedException(
+                CannotPackageProprietaryProduct,
+                'Only Public project series can be packaged, not '
+                'Proprietary.'):
+                sp.setPackaging(series, owner)
 
     def test_setPackagingReturnSharingDetailPermissions__ordinary_user(self):
         """An ordinary user can create a packaging link but he cannot
 
=== modified file 'lib/lp/security.py'
--- lib/lp/security.py	2012-10-18 14:43:24 +0000
+++ lib/lp/security.py	2012-10-19 08:28:25 +0000
@@ -154,6 +154,7 @@
     )
 from lp.registry.interfaces.productseries import (
     IProductSeries,
+    IProductSeriesView,
     ITimelineProductSeries,
     )
 from lp.registry.interfaces.projectgroup import (
@@ -1285,9 +1286,26 @@
             or False)
 
 
-class ViewProductSeries(AnonymousAuthorization):
-
-    usedfor = IProductSeries
+class ViewProductSeries(AuthorizationBase):
+    permission = 'launchpad.View'
+    usedfor = IProductSeriesView
+
+    def checkAuthenticated(self, user):
+        return self.obj.userCanView(user)
+
+    def checkUnauthenticated(self):
+        return self.obj.userCanView(None)
+
+
+class ChangeProductSeries(ViewProductSeries):
+    permission = 'launchpad.AnyAllowedPerson'
+    usedfor = IProductSeriesView
+
+    def checkAuthenticated(self, user):
+        return self.obj.userCanView(user)
+
+    def checkUnauthenticated(self):
+        return False
 
 
 class EditProductSeries(EditByOwnersOrAdmins):
 
=== modified file 'lib/lp/services/features/flags.py'
=== modified file 'lib/lp/translations/stories/webservice/xx-potemplate.txt'
--- lib/lp/translations/stories/webservice/xx-potemplate.txt	2012-10-09 10:28:02 +0000
+++ lib/lp/translations/stories/webservice/xx-potemplate.txt	2012-10-19 08:28:25 +0000
@@ -71,6 +71,7 @@
 
     >>> login('[e-mail]')
     >>> productseries = factory.makeProductSeries()
+    >>> productseries_name = productseries.name
     >>> product_name = productseries.product.name
     >>> potemplate_1 = factory.makePOTemplate(productseries=productseries)
     >>> potemplate_2 = factory.makePOTemplate(productseries=productseries)
@@ -79,7 +80,7 @@
     >>> all_translation_templates = anon_webservice.named_get(
     ...     '/%s/%s' % (
     ...         product_name,
-    ...         productseries.name),
+    ...         productseries_name),
     ...     'getTranslationTemplates'
     ...     ).jsonBody()
     >>> api_count = all_translation_templates['total_size']