Merge ~alfonsosanchezbeato/snappy-hwe-snaps/+git/jenkins-jobs:fix-team-permission into ~snappy-hwe-team/snappy-hwe-snaps/+git/jenkins-jobs:master

[Alfonso Sanchez-Beato]

Check for user belonging to project team

Check for user belonging to project team before triggering build.
Previously we were checking against a fixed team regardless of the
project.

[Simon Fels (morphis)]

LGTM! Thanks for fixing this!

review: Approve

[System Enablement Bot (system-enablement-ci-bot)]

PASSED: Continuous integration, rev:aca716e8f04d7bbbca728325add1aefc29c843cd
https://jenkins.canonical.com/system-enablement/job/generic-build-snap/1683/
Executed test runs:
    SUCCESS: https://jenkins.canonical.com/system-enablement/job/generic-build-snap-worker/2223
    None: https://jenkins.canonical.com/system-enablement/job/generic-update-snap-mp/1591/console
    SUCCESS: https://jenkins.canonical.com/system-enablement/job/generic-test-snap/2587

Click here to trigger a rebuild:
https://jenkins.canonical.com/system-enablement/job/generic-build-snap/1683/rebuild

review: Approve (continuous-integration)

diff --git a/jobs/snap/snap-trigger-ci.sh b/jobs/snap/snap-trigger-ci.sh
index c71d5df..b86724d 100644
--- a/jobs/snap/snap-trigger-ci.sh
+++ b/jobs/snap/snap-trigger-ci.sh
@@ -23,6 +23,7 @@ if [ "$TRIGGER_CI" = False ]; then
     exit 0
 fi
 
-exec $BUILD_SCRIPTS/tools/trigger-ci.py \
-    -p $LAUNCHPAD_PROJECT \
-    -j $SNAP_BUILD_JOB
+exec "$BUILD_SCRIPTS"/tools/trigger-ci.py \
+    -p "$LAUNCHPAD_PROJECT" \
+    -j "$SNAP_BUILD_JOB" \
+    -t "$LAUNCHPAD_TEAM"
diff --git a/tools/trigger-ci.py b/tools/trigger-ci.py
index 45e99af..d50c021 100755
--- a/tools/trigger-ci.py
+++ b/tools/trigger-ci.py
@@ -33,6 +33,8 @@ parser.add_argument('-p', '--project', required=True,
                     help="Launchpad project to check for new merge-proposals")
 parser.add_argument('-j', '--job', required=True,
                     help="Jenkins job to trigger")
+parser.add_argument('-t', '--team', required=True,
+                    help="Launchpad team for the project")
 
 args = vars(parser.parse_args())
 
@@ -42,6 +44,7 @@ credential_store_path = se_utils.get_config_option('credential_store_path')
 launchpad = se_utils.get_launchpad(None, credential_store_path, lp_app, lp_env)
 
 project = launchpad.projects[args['project']]
+team = args['team']
 
 proposals = project.getMergeProposals()
 
@@ -167,6 +170,52 @@ def testing_in_progress(mp, jenkins_job):
         print('Failed to check if MP is already building')
     return False
 
+# Copied over from lp:jenkins-launchpad-plugin
+def users_in_team(users, team):
+    """Determine whether any of these users are in the supplied team.
+
+    :param users: The users which may be members of the supplied team.
+    :param team: The team which users may be part of.
+    :return: True if any of the users are members of the team, otherwise
+        False.
+    """
+    for member in team.participants:
+        if member in users:
+            return True
+    else:
+        return False
+
+# Copied over from lp:jenkins-launchpad-plugin and slightly modified
+def users_allowed_to_trigger_jobs(lp_users, allowed_people):
+    """Returns if an of the given users is allowed to run jobs on jenkins.
+
+    This is to avoid random people to run jobs on our internal infrastructure.
+    A user is allowed if they are either directly in the ALLOWED_USERS list or
+    are member of a team in that list.
+
+    :param lp_users: launchpad user handles
+    """
+    if len(lp_users) == 0:
+        return False
+    for lp_user in lp_users:
+        if lp_user.name in allowed_people:
+            return True
+    lp = lp_users[0]._root
+    for allowed in allowed_people:
+        try:
+            allowed_person = lp.people[allowed]
+        except KeyError:
+            logger.warn('User {} from the allowed_users list is not in '
+                        'launchpad!'.format(allowed))
+            continue
+        if not allowed_person.is_team:
+            continue
+        if users_in_team(lp_users, allowed_person):
+            return True
+    logger.debug('Users "' + ', '.join(u.name for u in lp_users) +
+                 '" not allowed to trigger jobs')
+    return False
+
 project_blacklist = []
 
 for proposal in proposals:
@@ -186,7 +235,7 @@ for proposal in proposals:
         print "Ignoring %s" % proposal.web_link
         continue
 
-    if not launchpadutils.users_allowed_to_trigger_jobs([proposal.registrant]):
+    if not users_allowed_to_trigger_jobs([proposal.registrant], [team]):
         continue
 
     if latest_candidate_validated(launchpad_user, proposal):