Merge ~cjwatson/launchpad:bugs-admin-registry into launchpad:master

[Colin Watson]

Grant bugtracker/bugwatch admin to registry, not LP developers

Launchpad developers don't intrinsically need data admin access to
things like bugtrackers and bugwatches. It makes more sense for this to
be associated with registry experts, like most of our other
semi-privileged data admin operations.

[William Grant (wgrant)]

review: Approve (code)

diff --git a/lib/lp/bugs/security.py b/lib/lp/bugs/security.py
index e683ecb..4e22be0 100644
--- a/lib/lp/bugs/security.py
+++ b/lib/lp/bugs/security.py
@@ -290,7 +290,7 @@ class AdminBugTracker(AuthorizationBase):
         return (
             user.in_janitor or
             user.in_admin or
-            user.in_launchpad_developers)
+            user.in_registry_experts)
 
 
 class AdminBugWatch(AuthorizationBase):
@@ -298,8 +298,7 @@ class AdminBugWatch(AuthorizationBase):
     usedfor = IBugWatch
 
     def checkAuthenticated(self, user):
-        return (
-            user.in_admin or user.in_launchpad_developers)
+        return user.in_admin or user.in_registry_experts
 
 
 class EditStructuralSubscription(AuthorizationBase):
diff --git a/lib/lp/bugs/stories/bugtracker/xx-reschedule-all-watches.txt b/lib/lp/bugs/stories/bugtracker/xx-reschedule-all-watches.txt
index 9350107..9edc7b3 100644
--- a/lib/lp/bugs/stories/bugtracker/xx-reschedule-all-watches.txt
+++ b/lib/lp/bugs/stories/bugtracker/xx-reschedule-all-watches.txt
@@ -33,38 +33,28 @@ However, the reschedule button will appear to administrators.
     >>> admin_browser.getControl('Reschedule all watches')
     <SubmitControl...>
 
-It will also appear for non-admin members of the Launchpad Developers
-team.
+It will also appear for non-admin registry experts.
 
-    >>> from zope.component import getUtility
-    >>> from lp.app.interfaces.launchpad import ILaunchpadCelebrities
-    >>> from lp.registry.interfaces.person import IPersonSet
+    >>> from lp.testing import login_celebrity
 
-    >>> login(ADMIN_EMAIL)
-    >>> admin_user = getUtility(IPersonSet).getByEmail(ADMIN_EMAIL)
-    >>> new_lp_developer = factory.makePerson()
-    >>> launchpad_developers = getUtility(
-    ...     ILaunchpadCelebrities).launchpad_developers
-    >>> dev_added = launchpad_developers.addMember(
-    ...     new_lp_developer, admin_user)
-
-    >>> lp_dev_browser = setupBrowser(
-    ...     auth='Basic %s:test' % new_lp_developer.preferredemail.email)
+    >>> registry_expert = login_celebrity('registry_experts')
+    >>> registry_browser = setupBrowser(
+    ...     auth='Basic %s:test' % registry_expert.preferredemail.email)
     >>> logout()
 
-    >>> lp_dev_browser.open(bug_tracker_edit_url)
-    >>> reschedule_button = lp_dev_browser.getControl(
+    >>> registry_browser.open(bug_tracker_edit_url)
+    >>> reschedule_button = registry_browser.getControl(
     ...     'Reschedule all watches')
 
 Clicking the button will reschedule the watches for the bug tracker for
 checking at some future date.
 
     >>> reschedule_button.click()
-    >>> print(lp_dev_browser.url)
+    >>> print(registry_browser.url)
     http://bugs.launchpad.test/bugs/bugtrackers/our-bugtracker
 
     >>> for message in find_tags_by_class(
-    ...     lp_dev_browser.contents, 'informational message'):
+    ...         registry_browser.contents, 'informational message'):
     ...     print(extract_text(message))
     All bug watches on Our BugTracker have been rescheduled.
 
@@ -84,8 +74,8 @@ appear on the bugtracker page.
     >>> bug_watch.destroySelf()
     >>> logout()
 
-    >>> lp_dev_browser.open(bug_tracker_edit_url)
-    >>> reschedule_button = lp_dev_browser.getControl(
+    >>> registry_browser.open(bug_tracker_edit_url)
+    >>> reschedule_button = registry_browser.getControl(
     ...     'Reschedule all watches')
     Traceback (most recent call last):
       ...
diff --git a/lib/lp/bugs/stories/bugwatches/xx-edit-bugwatch.txt b/lib/lp/bugs/stories/bugwatches/xx-edit-bugwatch.txt
index 2d02bca..c21f6ed 100644
--- a/lib/lp/bugs/stories/bugwatches/xx-edit-bugwatch.txt
+++ b/lib/lp/bugs/stories/bugwatches/xx-edit-bugwatch.txt
@@ -287,32 +287,23 @@ The "Reset this watch" button will appear for administrators.
     >>> admin_browser.getControl('Reset this watch')
     <SubmitControl...>
 
-It also appears for Launchpad Developers.
+It also appears for registry experts.
 
-    >>> from zope.component import getUtility
-    >>> from lp.app.interfaces.launchpad import ILaunchpadCelebrities
-    >>> from lp.registry.interfaces.person import IPersonSet
+    >>> from lp.testing import login_celebrity
 
-    >>> login(ADMIN_EMAIL)
-    >>> admin_user = getUtility(IPersonSet).getByEmail(ADMIN_EMAIL)
-    >>> new_lp_developer = factory.makePerson()
-    >>> launchpad_developers = getUtility(
-    ...     ILaunchpadCelebrities).launchpad_developers
-    >>> dev_added = launchpad_developers.addMember(
-    ...     new_lp_developer, admin_user)
-
-    >>> lp_dev_browser = setupBrowser(
-    ...     auth='Basic %s:test' % new_lp_developer.preferredemail.email)
+    >>> registry_expert = login_celebrity('registry_experts')
+    >>> registry_browser = setupBrowser(
+    ...     auth='Basic %s:test' % registry_expert.preferredemail.email)
     >>> logout()
 
-    >>> lp_dev_browser.open(watch_url)
-    >>> reset_button = lp_dev_browser.getControl('Reset this watch')
+    >>> registry_browser.open(watch_url)
+    >>> reset_button = registry_browser.getControl('Reset this watch')
 
 Clicking the button will reset the watch completely.
 
     >>> reset_button.click()
     >>> for message in find_tags_by_class(
-    ...     lp_dev_browser.contents, 'informational message'):
+    ...         registry_browser.contents, 'informational message'):
     ...     print(extract_text(message))
     The ... bug watch has been reset.
 
diff --git a/lib/lp/bugs/tests/test_bugtracker.py b/lib/lp/bugs/tests/test_bugtracker.py
index 2c4cbde..da07fe6 100644
--- a/lib/lp/bugs/tests/test_bugtracker.py
+++ b/lib/lp/bugs/tests/test_bugtracker.py
@@ -256,15 +256,9 @@ class BugTrackerTestCase(TestCaseWithFactory):
         self.bug_tracker.resetWatches()
         self._assertBugWatchesAreCheckedInTheFuture()
 
-    def test_lp_dev_can_reset_watches(self):
-        # Launchpad developers can reset the watches on a bugtracker.
-        login(ADMIN_EMAIL)
-        admin = getUtility(IPersonSet).getByEmail(ADMIN_EMAIL)
-        launchpad_developers = getUtility(
-            ILaunchpadCelebrities).launchpad_developers
-        lp_dev = self.factory.makePerson()
-        launchpad_developers.addMember(lp_dev, admin)
-        login_person(lp_dev)
+    def test_registry_can_reset_watches(self):
+        # Registry experts can reset the watches on a bugtracker.
+        login_celebrity("registry_experts")
         self.bug_tracker.resetWatches()
         self._assertBugWatchesAreCheckedInTheFuture()
 
diff --git a/lib/lp/bugs/tests/test_bugwatch.py b/lib/lp/bugs/tests/test_bugwatch.py
index 30d9621..7dd061f 100644
--- a/lib/lp/bugs/tests/test_bugwatch.py
+++ b/lib/lp/bugs/tests/test_bugwatch.py
@@ -24,7 +24,6 @@ from zope.component import getUtility
 from zope.security.interfaces import Unauthorized
 from zope.security.proxy import removeSecurityProxy
 
-from lp.app.interfaces.launchpad import ILaunchpadCelebrities
 from lp.bugs.interfaces.bugtask import (
     BugTaskImportance,
     BugTaskStatus,
@@ -52,6 +51,7 @@ from lp.services.webapp import urlsplit
 from lp.testing import (
     ANONYMOUS,
     login,
+    login_celebrity,
     login_person,
     TestCase,
     TestCaseWithFactory,
@@ -717,14 +717,9 @@ class TestBugWatchResetting(TestCaseWithFactory):
         login_person(unprivileged_user)
         self.assertRaises(Unauthorized, getattr, self.bug_watch, 'reset')
 
-    def test_lp_developer_can_reset_watches(self):
-        # A Launchpad developer can call the reset() method on a bug
-        # watch.
-        admin_user = getUtility(IPersonSet).getByEmail(ADMIN_EMAIL)
-        lp_developers = getUtility(ILaunchpadCelebrities).launchpad_developers
-        lp_dev = self.factory.makePerson()
-        lp_developers.addMember(lp_dev, admin_user)
-        login_person(lp_dev)
+    def test_registry_expert_can_reset_watches(self):
+        # A registry expert can call the reset() method on a bug watch.
+        login_celebrity("registry_experts")
         self.bug_watch.reset()
         self._assertBugWatchHasBeenChanged()