Merge lp:~allenap/maas/notifications-api into lp:~maas-committers/maas/trunk

[Gavin Panella]

Web API support for notifications.

[Blake Rouse (blake-rouse)]

Looks good. Just a couple of comments.

review: Approve

[Gavin Panella (allenap)]

Thanks. I realised that this also needed some more robust testing for creating notifications, so I've added that. In particular it meant I was able to get rid of some minor JSON wrangling and let the form machinery do its weird stuff instead.

[MAAS Lander (maas-lander)]

The attempt to merge lp:~allenap/maas/notifications-api into lp:maas failed. Below is the output from the failed tests.

Get:1 http://security.ubuntu.com/ubuntu xenial-security InRelease [102 kB]
Hit:2 http://prodstack-zone-2.clouds.archive.ubuntu.com/ubuntu xenial InRelease
Get:3 http://prodstack-zone-2.clouds.archive.ubuntu.com/ubuntu xenial-updates InRelease [102 kB]
Get:4 http://prodstack-zone-2.clouds.archive.ubuntu.com/ubuntu xenial-backports InRelease [102 kB]
Get:5 http://prodstack-zone-2.clouds.archive.ubuntu.com/ubuntu xenial-updates/main Sources [231 kB]
Get:6 http://prodstack-zone-2.clouds.archive.ubuntu.com/ubuntu xenial-updates/main amd64 Packages [475 kB]
Get:7 http://prodstack-zone-2.clouds.archive.ubuntu.com/ubuntu xenial-updates/main Translation-en [188 kB]
Get:8 http://security.ubuntu.com/ubuntu xenial-security/main Sources [59.7 kB]
Get:9 http://security.ubuntu.com/ubuntu xenial-security/main amd64 Packages [212 kB]
Get:10 http://security.ubuntu.com/ubuntu xenial-security/main Translation-en [88.8 kB]
Fetched 1,559 kB in 0s (2,495 kB/s)
Reading package lists...
sudo DEBIAN_FRONTEND=noninteractive apt-get -y \
    --no-install-recommends install apache2 archdetect-deb authbind avahi-utils bash bind9 bind9utils build-essential bzr bzr-builddeb chromium-browser chromium-chromedriver curl daemontools debhelper dh-apport dh-systemd distro-info dnsutils firefox freeipmi-tools git gjs ipython isc-dhcp-common isc-dhcp-server libjs-angularjs libjs-jquery libjs-jquery-hotkeys libjs-yui3-full libjs-yui3-min libnss-wrapper libpq-dev make nodejs-legacy npm postgresql pxelinux python3-all python3-apt python3-attr python3-bson python3-convoy python3-crochet python3-cssselect python3-curtin python3-dev python3-distro-info python3-django python3-django-nose python3-django-piston3 python3-dnspython python3-docutils python3-formencode python3-hivex python3-httplib2 python3-jinja2 python3-jsonschema python3-lxml python3-netaddr python3-netifaces python3-novaclient python3-oauth python3-oauthlib python3-openssl python3-paramiko python3-petname python3-pexpect python3-psycopg2 python3-pyinotify python3-pyparsing python3-pyvmomi python3-requests python3-seamicroclient python3-setuptools python3-simplestreams python3-sphinx python3-tempita python3-twisted python3-txtftp python3-tz python3-yaml python3-zope.interface python-bson python-crochet python-django python-django-piston python-djorm-ext-pgarray python-formencode python-lxml python-netaddr python-netifaces python-pocket-lint python-psycopg2 python-simplejson python-tempita python-twisted python-yaml socat syslinux-common tgt ubuntu-cloudimage-keyring wget xvfb
Reading package lists...
Building dependency tree...
Reading state information...
authbind is already the newest version (2.1.1+nmu1).
avahi-utils is already the newest version (0.6.32~rc+dfsg-1ubuntu2).
build-essential is already the newest version (12.1ubuntu2).
debhelper is already the newest version (9.20160115ubuntu3).
distro-info is already the newest version (0.14build1).
git is already the newest version (1:2.7.4-0ubuntu1).
libjs-angularjs is already the newest version (1.2.28-1ubuntu2).
libjs-jquery is already the newest vers...

=== added file 'src/maasserver/api/notification.py'
--- src/maasserver/api/notification.py	1970-01-01 00:00:00 +0000
+++ src/maasserver/api/notification.py	2017-02-15 20:56:35 +0000
@@ -0,0 +1,145 @@
+# Copyright 2017 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+__all__ = [
+    "NotificationHandler",
+    "NotificationsHandler",
+]
+
+from django.shortcuts import get_object_or_404
+from maasserver.api.support import (
+    admin_method,
+    operation,
+    OperationsHandler,
+)
+from maasserver.exceptions import (
+    MAASAPIForbidden,
+    MAASAPIValidationError,
+)
+from maasserver.forms.notification import NotificationForm
+from maasserver.models.notification import Notification
+from piston3.utils import rc
+
+# Notification fields exposed on the API.
+DISPLAYED_NOTIFICATION_FIELDS = frozenset((
+    'id',
+    'ident',
+    'user',
+    'users',
+    'admins',
+    'message',
+    'context',
+    'category',
+))
+
+
+class NotificationsHandler(OperationsHandler):
+    """Manage the collection of all the notifications in MAAS."""
+
+    api_doc_section_name = "Notifications"
+    update = delete = None
+
+    @classmethod
+    def resource_uri(cls, *args, **kwargs):
+        return ('notifications_handler', [])
+
+    def read(self, request):
+        """List notifications relevant to the invoking user.
+
+        Notifications that have been dismissed are *not* returned.
+        """
+        return Notification.objects.find_for_user(request.user).order_by('id')
+
+    @admin_method
+    def create(self, request):
+        """Create a notification.
+
+        This is available to admins *only*.
+
+        :param message: The message for this notification. May contain basic
+            HTML; this will be sanitised before display.
+        :param context: Optional JSON context. The root object *must* be an
+            object (i.e. a mapping). The values herein can be referenced by
+            `message` with Python's "format" (not %) codes.
+        :param category: Optional category. Choose from: error, warning,
+            success, or info. Defaults to info.
+
+        :param ident: Optional unique identifier for this notification.
+        :param user: Optional user ID this notification is intended for. By
+            default it will not be targeted to any individual user.
+        :param users: Optional boolean, true to notify all users, defaults to
+            false, i.e. not targeted to all users.
+        :param admins: Optional boolean, true to notify all admins, defaults to
+            false, i.e. not targeted to all admins.
+
+        Note: if neither user nor users nor admins is set, the notification
+        will not be seen by anyone.
+        """
+        form = NotificationForm(data=request.data)
+        if form.is_valid():
+            return form.save()
+        else:
+            raise MAASAPIValidationError(form.errors)
+
+
+class NotificationHandler(OperationsHandler):
+    """Manage an individual notification."""
+
+    api_doc_section_name = "Notification"
+
+    create = None
+    model = Notification
+    fields = DISPLAYED_NOTIFICATION_FIELDS
+
+    def read(self, request, id):
+        """Read a specific notification."""
+        notification = get_object_or_404(Notification, id=id)
+        if notification.is_relevant_to(request.user):
+            return notification
+        elif request.user.is_superuser:
+            return notification
+        else:
+            raise MAASAPIForbidden()
+
+    @admin_method
+    def update(self, request, id):
+        """Update a specific notification.
+
+        See `NotificationsHandler.create` for field information.
+        """
+        notification = get_object_or_404(Notification, id=id)
+        form = NotificationForm(
+            data=request.data, instance=notification)
+        if form.is_valid():
+            return form.save()
+        else:
+            raise MAASAPIValidationError(form.errors)
+
+    @admin_method
+    def delete(self, request, id):
+        """Delete a specific notification."""
+        notification = get_object_or_404(Notification, id=id)
+        notification.delete()
+        return rc.DELETED
+
+    @operation(idempotent=False)
+    def dismiss(self, request, id):
+        """Dismiss a specific notification.
+
+        Returns HTTP 403 FORBIDDEN if this notification is not relevant
+        (targeted) to the invoking user.
+
+        It is safe to call multiple times for the same notification.
+        """
+        notification = get_object_or_404(Notification, id=id)
+        if notification.is_relevant_to(request.user):
+            notification.dismiss(request.user)
+        else:
+            raise MAASAPIForbidden()
+
+    @classmethod
+    def resource_uri(cls, notification=None):
+        notification_id = "id"
+        if notification is not None:
+            notification_id = notification.id
+        return ('notification_handler', (notification_id,))

=== added file 'src/maasserver/api/tests/test_notification.py'
--- src/maasserver/api/tests/test_notification.py	1970-01-01 00:00:00 +0000
+++ src/maasserver/api/tests/test_notification.py	2017-02-15 20:56:35 +0000
@@ -0,0 +1,313 @@
+# Copyright 2017 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+"""Tests for Notification API."""
+
+__all__ = []
+
+import http.client
+import json
+import random
+
+from django.core.urlresolvers import reverse
+from maasserver.models.notification import (
+    Notification,
+    NotificationDismissal,
+)
+from maasserver.testing.api import APITestCase
+from maasserver.testing.factory import factory
+from maasserver.testing.matchers import HasStatusCode
+from maasserver.testing.testcase import MAASServerTestCase
+from maasserver.utils.converters import json_load_bytes
+from maasserver.utils.orm import reload_object
+from testtools.matchers import (
+    AfterPreprocessing,
+    ContainsDict,
+    Equals,
+    Is,
+    IsInstance,
+    MatchesDict,
+    MatchesSetwise,
+)
+
+
+def get_notifications_uri():
+    """Return a Notification's URI on the API."""
+    return reverse('notifications_handler', args=[])
+
+
+def get_notification_uri(notification):
+    """Return a Notification URI on the API."""
+    return reverse(
+        'notification_handler', args=[notification.id])
+
+
+class TestURIs(MAASServerTestCase):
+
+    def test_notifications_handler_path(self):
+        self.assertThat(
+            get_notifications_uri(),
+            Equals("/api/2.0/notifications/"))
+
+    def test_notification_handler_path(self):
+        notification = factory.make_Notification()
+        self.assertThat(
+            get_notification_uri(notification),
+            Equals("/api/2.0/notifications/%s/" % notification.id))
+
+
+def MatchesNotification(notification):
+    """Match the expected JSON rendering of `notification`."""
+    return MatchesDict({
+        "id": Equals(notification.id),
+        "ident": Equals(notification.ident),
+        "user": (
+            Is(None) if notification.user_id is None else ContainsDict({
+                "username": Equals(notification.user.username),
+            })
+        ),
+        "users": Is(notification.users),
+        "admins": Is(notification.admins),
+        "message": Equals(notification.message),
+        "context": Equals(notification.context),
+        "category": Equals(notification.category),
+        "resource_uri": Equals(get_notification_uri(notification)),
+    })
+
+
+def HasBeenDismissedBy(user):
+    """Match a notification that has been dismissed by the given user."""
+
+    def dismissal_exists(notification):
+        return NotificationDismissal.objects.filter(
+            notification=notification, user=user).exists()
+
+    return AfterPreprocessing(dismissal_exists, Is(True))
+
+
+class TestNotificationsAPI(APITestCase.ForUserAndAdmin):
+
+    def test_read(self):
+        notifications = [
+            factory.make_Notification(
+                user=self.user, users=False, admins=False),
+            factory.make_Notification(
+                user=None, users=True, admins=False),
+            factory.make_Notification(
+                user=None, users=False, admins=True),
+        ]
+        uri = get_notifications_uri()
+        response = self.client.get(uri)
+        self.assertThat(response, HasStatusCode(http.client.OK))
+        self.assertThat(
+            json_load_bytes(response.content),
+            MatchesSetwise(*(
+                MatchesNotification(notification)
+                for notification in notifications
+                if notification.is_relevant_to(self.user)
+            )),
+        )
+
+    def test_create_with_minimal_fields(self):
+        message = factory.make_name("message")
+        uri = get_notifications_uri()
+        response = self.client.post(uri, {"message": message})
+        if self.user.is_superuser:
+            self.assertThat(response, HasStatusCode(http.client.OK))
+            response = json_load_bytes(response.content)
+            self.assertThat(response, ContainsDict({"id": IsInstance(int)}))
+            notification = Notification.objects.get(id=response["id"])
+            self.assertThat(response, MatchesNotification(notification))
+        else:
+            self.assertThat(response, HasStatusCode(http.client.FORBIDDEN))
+
+    def test_create_with_all_fields(self):
+        context = {factory.make_name("key"): factory.make_name("value")}
+        data = {
+            "ident": factory.make_name("ident"),
+            "user": str(self.user.id),
+            "users": random.choice(["true", "false"]),
+            "admins": random.choice(["true", "false"]),
+            "message": factory.make_name("message"),
+            "context": json.dumps(context),
+            "category": random.choice(("info", "success", "warning", "error")),
+        }
+        uri = get_notifications_uri()
+        response = self.client.post(uri, data)
+        if self.user.is_superuser:
+            self.assertThat(response, HasStatusCode(http.client.OK))
+            self.assertThat(
+                json_load_bytes(response.content),
+                ContainsDict({
+                    "id": IsInstance(int),
+                    "ident": Equals(data["ident"]),
+                    "user": ContainsDict({
+                        "username": Equals(self.user.username),
+                    }),
+                    "users": Is(data["users"] == "true"),
+                    "admins": Is(data["admins"] == "true"),
+                    "message": Equals(data["message"]),
+                    "context": Equals(context),
+                    "category": Equals(data["category"]),
+                }),
+            )
+        else:
+            self.assertThat(response, HasStatusCode(http.client.FORBIDDEN))
+
+
+class TestNotificationsAPI_Anonymous(APITestCase.ForAnonymous):
+
+    def test_read(self):
+        uri = get_notifications_uri()
+        response = self.client.get(uri)
+        self.assertThat(response, HasStatusCode(http.client.UNAUTHORIZED))
+
+    def test_create(self):
+        uri = get_notifications_uri()
+        response = self.client.post(uri, {"message": factory.make_name()})
+        self.assertThat(response, HasStatusCode(http.client.UNAUTHORIZED))
+
+
+class TestNotificationAPI(APITestCase.ForUserAndAdmin):
+
+    def test_read_notification_for_self(self):
+        notification = factory.make_Notification(user=self.user)
+        uri = get_notification_uri(notification)
+        response = self.client.get(uri)
+        self.assertThat(response, HasStatusCode(http.client.OK))
+        self.assertThat(
+            json_load_bytes(response.content),
+            MatchesNotification(notification),
+        )
+
+    def test_read_notification_for_other(self):
+        other = factory.make_User()
+        notification = factory.make_Notification(user=other)
+        uri = get_notification_uri(notification)
+        response = self.client.get(uri)
+        if self.user.is_superuser:
+            self.assertThat(response, HasStatusCode(http.client.OK))
+            self.assertThat(
+                json_load_bytes(response.content),
+                MatchesNotification(notification),
+            )
+        else:
+            self.assertThat(response, HasStatusCode(http.client.FORBIDDEN))
+
+    def test_read_notification_for_users(self):
+        notification = factory.make_Notification(users=True)
+        uri = get_notification_uri(notification)
+        response = self.client.get(uri)
+        self.assertThat(response, HasStatusCode(http.client.OK))
+        self.assertThat(
+            json_load_bytes(response.content),
+            MatchesNotification(notification),
+        )
+
+    def test_read_notification_for_admins(self):
+        notification = factory.make_Notification(admins=True)
+        uri = get_notification_uri(notification)
+        response = self.client.get(uri)
+        if self.user.is_superuser:
+            self.assertThat(response, HasStatusCode(http.client.OK))
+            self.assertThat(
+                json_load_bytes(response.content),
+                MatchesNotification(notification),
+            )
+        else:
+            self.assertThat(response, HasStatusCode(http.client.FORBIDDEN))
+
+    def test_update_is_for_admins_only(self):
+        notification = factory.make_Notification()
+        message_new = factory.make_name("message")
+        uri = get_notification_uri(notification)
+        response = self.client.put(uri, {"message": message_new})
+        if self.user.is_superuser:
+            self.assertThat(response, HasStatusCode(http.client.OK))
+            notification = reload_object(notification)
+            self.assertThat(notification.message, Equals(message_new))
+            self.assertThat(
+                json_load_bytes(response.content),
+                MatchesNotification(notification),
+            )
+        else:
+            self.assertThat(response, HasStatusCode(http.client.FORBIDDEN))
+
+    def test_delete_is_for_admins_only(self):
+        notification = factory.make_Notification()
+        uri = get_notification_uri(notification)
+        response = self.client.delete(uri)
+        if self.user.is_superuser:
+            self.assertThat(response, HasStatusCode(http.client.NO_CONTENT))
+            self.assertThat(reload_object(notification), Is(None))
+        else:
+            self.assertThat(response, HasStatusCode(http.client.FORBIDDEN))
+
+    def test_dismiss_notification_for_self(self):
+        notification = factory.make_Notification(user=self.user)
+        uri = get_notification_uri(notification)
+        response = self.client.post(uri, {"op": "dismiss"})
+        self.assertThat(response, HasStatusCode(http.client.OK))
+        self.assertThat(notification, HasBeenDismissedBy(self.user))
+
+    def test_dismiss_notification_for_other(self):
+        other = factory.make_User()
+        notification = factory.make_Notification(user=other)
+        uri = get_notification_uri(notification)
+        response = self.client.post(uri, {"op": "dismiss"})
+        self.assertThat(response, HasStatusCode(http.client.FORBIDDEN))
+
+    def test_dismiss_notification_for_users(self):
+        notification = factory.make_Notification(users=True)
+        uri = get_notification_uri(notification)
+        response = self.client.post(uri, {"op": "dismiss"})
+        if notification.is_relevant_to(self.user):
+            self.assertThat(response, HasStatusCode(http.client.OK))
+            self.assertThat(notification, HasBeenDismissedBy(self.user))
+        else:
+            self.assertThat(response, HasStatusCode(http.client.FORBIDDEN))
+
+    def test_dismiss_notification_for_admins(self):
+        notification = factory.make_Notification(admins=True)
+        uri = get_notification_uri(notification)
+        response = self.client.post(uri, {"op": "dismiss"})
+        if notification.is_relevant_to(self.user):
+            self.assertThat(response, HasStatusCode(http.client.OK))
+            self.assertThat(notification, HasBeenDismissedBy(self.user))
+        else:
+            self.assertThat(response, HasStatusCode(http.client.FORBIDDEN))
+
+
+class TestNotificationAPI_Anonymous(APITestCase.ForAnonymous):
+
+    def test_read_notification_for_other(self):
+        other = factory.make_User()
+        notification = factory.make_Notification(user=other)
+        uri = get_notification_uri(notification)
+        response = self.client.get(uri)
+        self.assertThat(response, HasStatusCode(http.client.UNAUTHORIZED))
+
+    def test_read_notification_for_users(self):
+        notification = factory.make_Notification(users=True)
+        uri = get_notification_uri(notification)
+        response = self.client.get(uri)
+        self.assertThat(response, HasStatusCode(http.client.UNAUTHORIZED))
+
+    def test_read_notification_for_admins(self):
+        notification = factory.make_Notification(admins=True)
+        uri = get_notification_uri(notification)
+        response = self.client.get(uri)
+        self.assertThat(response, HasStatusCode(http.client.UNAUTHORIZED))
+
+    def test_update_is_for_admins_only(self):
+        notification = factory.make_Notification()
+        message_new = factory.make_name("message")
+        uri = get_notification_uri(notification)
+        response = self.client.put(uri, {"message": message_new})
+        self.assertThat(response, HasStatusCode(http.client.UNAUTHORIZED))
+
+    def test_delete_is_for_admins_only(self):
+        notification = factory.make_Notification()
+        uri = get_notification_uri(notification)
+        response = self.client.delete(uri)
+        self.assertThat(response, HasStatusCode(http.client.UNAUTHORIZED))

=== modified file 'src/maasserver/fields.py'
--- src/maasserver/fields.py	2017-01-27 19:44:19 +0000
+++ src/maasserver/fields.py	2017-02-15 20:56:35 +0000
@@ -308,6 +308,19 @@
         return super(JSONObjectField, self).get_prep_lookup(
             lookup_type, value)
 
+    def formfield(self, form_class=None, **kwargs):
+        """Return a plain `forms.Field` here to avoid "helpful" conversions.
+
+        Django's base model field defaults to returning a `CharField`, which
+        means that anything that's not character data gets smooshed to text by
+        `CharField.to_pytnon` in forms (via the woefully named `smart_text`).
+        This is not helpful.
+        """
+        if form_class is None:
+            form_class = forms.Field
+        return super().formfield(
+            form_class=form_class, **kwargs)
+
 
 class XMLField(Field):
     """A field for storing xml natively.

=== modified file 'src/maasserver/forms/notification.py'
--- src/maasserver/forms/notification.py	2017-02-13 12:15:57 +0000
+++ src/maasserver/forms/notification.py	2017-02-15 20:56:35 +0000
@@ -7,8 +7,6 @@
     "NotificationForm",
 ]
 
-import json
-
 from maasserver.forms import MAASModelForm
 from maasserver.models.notification import Notification
 
@@ -30,7 +28,12 @@
 
     def clean_context(self):
         data = self.cleaned_data.get("context")
-        if data is None or len(data) == 0 or data.isspace():
-            return {}  # Default to an empty dict when in doubt.
+        if data is None:
+            return {}
+        elif isinstance(data, str):
+            if len(data) == 0 or data.isspace():
+                return {}
+            else:
+                return data
         else:
-            return json.loads(data)
+            return data

=== modified file 'src/maasserver/forms/tests/test_notification.py'
--- src/maasserver/forms/tests/test_notification.py	2017-02-13 12:15:57 +0000
+++ src/maasserver/forms/tests/test_notification.py	2017-02-15 20:56:35 +0000
@@ -34,6 +34,24 @@
             admins=False, category="info", context={},
         ))
 
+    def test__notification_can_be_created_with_empty_fields(self):
+        notification_message = factory.make_name("message")
+        form = NotificationForm({
+            "ident": "",
+            "user": "",
+            "users": "",
+            "admins": "",
+            "message": notification_message,
+            "context": "",
+            "category": "",
+        })
+        self.assertTrue(form.is_valid(), form.errors)
+        notification = form.save()
+        self.assertThat(notification, MatchesStructure.byEquality(
+            ident=None, message=notification_message, user=None, users=False,
+            admins=False, category="info", context={},
+        ))
+
     def test__notification_can_be_created_with_all_fields(self):
         user = factory.make_User()
         data = {

=== modified file 'src/maasserver/testing/matchers.py'
--- src/maasserver/testing/matchers.py	2016-12-21 20:08:42 +0000
+++ src/maasserver/testing/matchers.py	2017-02-15 20:56:35 +0000
@@ -7,6 +7,8 @@
     'HasStatusCode',
 ]
 
+from http import HTTPStatus
+
 from testtools.content import (
     Content,
     UTF8_TEXT,
@@ -18,6 +20,16 @@
 )
 
 
+def describe_http_status(code):
+    """Return a string describing the given HTTP status code."""
+    try:
+        code = HTTPStatus(code)
+    except ValueError:
+        return "HTTP {code}".format(code=code)
+    else:
+        return "HTTP {code.value:d} {code.name}".format(code=code)
+
+
 class HasStatusCode(Matcher):
     """Match if the given response has the expected HTTP status.
 
@@ -40,8 +52,10 @@
                 response_dump = response_dump.decode(response.charset)
                 response_dump = response_dump.encode("utf-8", "replace")
 
-            description = "Expected HTTP %s, got %s" % (
-                self.status_code, response.status_code)
+            description = "Expected %s, got %s" % (
+                describe_http_status(self.status_code),
+                describe_http_status(response.status_code),
+            )
             details = {
                 "Unexpected HTTP response": Content(
                     UTF8_TEXT, lambda: [response_dump]),

=== modified file 'src/maasserver/tests/test_fields.py'
--- src/maasserver/tests/test_fields.py	2016-12-12 10:06:16 +0000
+++ src/maasserver/tests/test_fields.py	2017-02-15 20:56:35 +0000
@@ -9,6 +9,7 @@
 from random import randint
 import re
 
+from django import forms
 from django.core import serializers
 from django.core.exceptions import ValidationError
 from django.db import (
@@ -21,6 +22,7 @@
     EditableBinaryField,
     HostListFormField,
     IPListFormField,
+    JSONObjectField,
     LargeObjectField,
     LargeObjectFile,
     MAC,
@@ -57,7 +59,11 @@
 from psycopg2 import OperationalError
 from psycopg2.extensions import ISQLQuote
 from testtools import ExpectedException
-from testtools.matchers import Equals
+from testtools.matchers import (
+    AfterPreprocessing,
+    Equals,
+    Is,
+)
 
 
 class TestMAC(MAASServerTestCase):
@@ -299,6 +305,11 @@
         # Others lookups are not allowed.
         self.assertRaises(TypeError, JSONFieldModel.objects.get, value__gte=3)
 
+    def test_form_field_is_a_plain_field(self):
+        self.assertThat(
+            JSONObjectField().formfield(),
+            AfterPreprocessing(type, Is(forms.Field)))
+
 
 class TestXMLField(MAASLegacyServerTestCase):
 

=== modified file 'src/maasserver/urls_api.py'
--- src/maasserver/urls_api.py	2017-01-23 19:55:12 +0000
+++ src/maasserver/urls_api.py	2017-02-15 20:56:35 +0000
@@ -108,6 +108,10 @@
     NodesHandler,
 )
 from maasserver.api.not_found import not_found_handler
+from maasserver.api.notification import (
+    NotificationHandler,
+    NotificationsHandler,
+)
 from maasserver.api.packagerepositories import (
     PackageRepositoriesHandler,
     PackageRepositoryHandler,
@@ -293,6 +297,10 @@
     StaticRouteHandler, authentication=api_auth)
 staticroutes_handler = RestrictedResource(
     StaticRoutesHandler, authentication=api_auth)
+notification_handler = RestrictedResource(
+    NotificationHandler, authentication=api_auth)
+notifications_handler = RestrictedResource(
+    NotificationsHandler, authentication=api_auth)
 
 
 # Admin handlers.
@@ -313,6 +321,7 @@
 license_keys_handler = AdminRestrictedResource(
     LicenseKeysHandler, authentication=api_auth)
 
+
 # API URLs accessible to anonymous users.
 urlpatterns = patterns(
     '',
@@ -501,6 +510,12 @@
     url(
         r'^dhcp-snippets/(?P<id>[^/]+)/$',
         dhcp_snippet_handler, name='dhcp_snippet_handler'),
+    url(
+        r'^notifications/$',
+        notifications_handler, name='notifications_handler'),
+    url(
+        r'^notifications/(?P<id>[^/]+)/$',
+        notification_handler, name='notification_handler'),
 )