Merge lp:~cjwatson/launchpad/git-grantee-widgets into lp:launchpad

[Colin Watson]

Add widgets to display or select a Git access grantee.

This isn't hugely elegant, but it gets the job done. You can see it in context (with an as-yet-unpushed UI branch) here:

  https://people.canonical.com/~cjwatson/tmp/lp-git-ref-permissions.png

[William Grant (wgrant)]

review: Approve (code)

=== added file 'lib/lp/code/browser/widgets/gitgrantee.py'
--- lib/lp/code/browser/widgets/gitgrantee.py	1970-01-01 00:00:00 +0000
+++ lib/lp/code/browser/widgets/gitgrantee.py	2019-01-09 10:45:43 +0000
@@ -0,0 +1,245 @@
+# Copyright 2018 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+__metaclass__ = type
+__all__ = [
+    'GitGranteeDisplayWidget',
+    'GitGranteeField',
+    'GitGranteeWidget',
+    ]
+
+from lazr.enum import DBItem
+from lazr.restful.fields import Reference
+from z3c.ptcompat import ViewPageTemplateFile
+from zope.formlib.interfaces import (
+    ConversionError,
+    IDisplayWidget,
+    IInputWidget,
+    InputErrors,
+    MissingInputError,
+    WidgetInputError,
+    )
+from zope.formlib.utility import setUpWidget
+from zope.formlib.widget import (
+    BrowserWidget,
+    CustomWidgetFactory,
+    DisplayWidget,
+    InputWidget,
+    renderElement,
+    )
+from zope.interface import implementer
+from zope.schema import (
+    Choice,
+    Field,
+    )
+from zope.schema.interfaces import IField
+from zope.schema.vocabulary import getVocabularyRegistry
+from zope.security.proxy import isinstance as zope_isinstance
+
+from lp import _
+from lp.app.browser.tales import PersonFormatterAPI
+from lp.app.errors import UnexpectedFormData
+from lp.app.validators import LaunchpadValidationError
+from lp.app.widgets.popup import PersonPickerWidget
+from lp.code.enums import GitGranteeType
+from lp.code.interfaces.gitrule import IGitRule
+from lp.registry.interfaces.person import IPerson
+from lp.services.webapp.interfaces import (
+    IAlwaysSubmittedWidget,
+    IMultiLineWidgetLayout,
+    )
+
+
+class IGitGranteeField(IField):
+    """An interface for a Git access grantee field."""
+
+    rule = Reference(
+        title=_("Rule"), required=True, readonly=True, schema=IGitRule,
+        description=_("The rule that this grantee is for."))
+
+
+@implementer(IGitGranteeField)
+class GitGranteeField(Field):
+    """A field that holds a Git access grantee."""
+
+    def __init__(self, rule, *args, **kwargs):
+        super(GitGranteeField, self).__init__(*args, **kwargs)
+        self.rule = rule
+
+    def constraint(self, value):
+        """See `IField`."""
+        if zope_isinstance(value, DBItem) and value.enum == GitGranteeType:
+            return value != GitGranteeType.PERSON
+        else:
+            return value in getVocabularyRegistry().get(
+                None, "ValidPersonOrTeam")
+
+
+@implementer(IDisplayWidget)
+class GitGranteePersonDisplayWidget(BrowserWidget):
+
+    def __init__(self, context, vocabulary, request):
+        super(GitGranteePersonDisplayWidget, self).__init__(context, request)
+
+    def __call__(self):
+        if self._renderedValueSet():
+            return PersonFormatterAPI(self._data).link(None)
+        else:
+            return ""
+
+
+@implementer(IMultiLineWidgetLayout)
+class GitGranteeWidgetBase(BrowserWidget):
+
+    template = ViewPageTemplateFile("templates/gitgrantee.pt")
+    default_option = "person"
+    _widgets_set_up = False
+
+    def setUpSubWidgets(self):
+        if self._widgets_set_up:
+            return
+        fields = [
+            Choice(
+                __name__="person", title=u"Person",
+                required=False, vocabulary="ValidPersonOrTeam"),
+            ]
+        if self._read_only:
+            self.person_widget = CustomWidgetFactory(
+                GitGranteePersonDisplayWidget)
+        else:
+            self.person_widget = CustomWidgetFactory(
+                PersonPickerWidget,
+                # XXX cjwatson 2018-10-18: This is a little unfortunate, but
+                # otherwise there's no spacing at all between the
+                # (deliberately unlabelled) radio button and the text box.
+                style="margin-left: 4px;")
+        for field in fields:
+            setUpWidget(
+                self, field.__name__, field, self._sub_widget_interface,
+                prefix=self.name)
+        self._widgets_set_up = True
+
+    def setUpOptions(self):
+        """Set up options to be rendered."""
+        self.options = {}
+        for option in ("repository_owner", "person"):
+            attributes = {
+                "type": "radio", "name": self.name, "value": option,
+                "id": "%s.option.%s" % (self.name, option),
+                # XXX cjwatson 2018-10-18: Ugly, but it's worse without
+                # this, especially in a permissions table where this widget
+                # is normally used.
+                "style": "margin-left: 0;",
+                }
+            if self.request.form_ng.getOne(
+                    self.name, self.default_option) == option:
+                attributes["checked"] = "checked"
+            if self._read_only:
+                attributes["disabled"] = "disabled"
+            self.options[option] = renderElement("input", **attributes)
+
+    @property
+    def show_options(self):
+        return {
+            option: not self._read_only or self.default_option == option
+            for option in ("repository_owner", "person")}
+
+    def setRenderedValue(self, value):
+        """See `IWidget`."""
+        self.setUpSubWidgets()
+        if value == GitGranteeType.REPOSITORY_OWNER:
+            self.default_option = "repository_owner"
+            return
+        elif value is None or IPerson.providedBy(value):
+            self.default_option = "person"
+            self.person_widget.setRenderedValue(value)
+            return
+        else:
+            raise AssertionError("Not a valid value: %r" % value)
+
+    def __call__(self):
+        """See `zope.formlib.interfaces.IBrowserWidget`."""
+        self.setUpSubWidgets()
+        self.setUpOptions()
+        return self.template()
+
+
+@implementer(IDisplayWidget)
+class GitGranteeDisplayWidget(GitGranteeWidgetBase, DisplayWidget):
+    """Widget for displaying a Git access grantee."""
+
+    _sub_widget_interface = IDisplayWidget
+    _read_only = True
+
+
+@implementer(IAlwaysSubmittedWidget, IInputWidget)
+class GitGranteeWidget(GitGranteeWidgetBase, InputWidget):
+    """Widget for selecting a Git access grantee."""
+
+    _sub_widget_interface = IInputWidget
+    _read_only = False
+    _widgets_set_up = False
+
+    @property
+    def show_options(self):
+        show_options = super(GitGranteeWidget, self).show_options
+        # Hide options that indicate unique grantee_types (e.g.
+        # repository_owner) if they already exist for the context rule.
+        if (show_options["repository_owner"] and
+            not self.context.rule.repository.findRuleGrantsByGrantee(
+                GitGranteeType.REPOSITORY_OWNER,
+                ref_pattern=self.context.rule.ref_pattern,
+                include_transitive=False).is_empty()):
+            show_options["repository_owner"] = False
+        return show_options
+
+    def hasInput(self):
+        self.setUpSubWidgets()
+        form_value = self.request.form_ng.getOne(self.name)
+        if form_value is None:
+            return False
+        return form_value != "person" or self.person_widget.hasInput()
+
+    def hasValidInput(self):
+        """See `zope.formlib.interfaces.IInputWidget`."""
+        try:
+            self.getInputValue()
+            return True
+        except (InputErrors, UnexpectedFormData):
+            return False
+
+    def getInputValue(self):
+        """See `zope.formlib.interfaces.IInputWidget`."""
+        self.setUpSubWidgets()
+        form_value = self.request.form_ng.getOne(self.name)
+        if form_value == "repository_owner":
+            return GitGranteeType.REPOSITORY_OWNER
+        elif form_value == "person":
+            try:
+                return self.person_widget.getInputValue()
+            except MissingInputError:
+                raise WidgetInputError(
+                    self.name, self.label,
+                    LaunchpadValidationError(
+                        "Please enter a person or team name"))
+            except ConversionError:
+                entered_name = self.request.form_ng.getOne(
+                    "%s.person" % self.name)
+                raise WidgetInputError(
+                    self.name, self.label,
+                    LaunchpadValidationError(
+                        "There is no person or team named '%s' registered in "
+                        "Launchpad" % entered_name))
+        else:
+            raise UnexpectedFormData("No valid option was selected.")
+
+    def error(self):
+        """See `zope.formlib.interfaces.IBrowserWidget`."""
+        try:
+            if self.hasInput():
+                self.getInputValue()
+        except InputErrors as error:
+            self._error = error
+        return super(GitGranteeWidget, self).error()

=== added file 'lib/lp/code/browser/widgets/templates/gitgrantee.pt'
--- lib/lp/code/browser/widgets/templates/gitgrantee.pt	1970-01-01 00:00:00 +0000
+++ lib/lp/code/browser/widgets/templates/gitgrantee.pt	2019-01-09 10:45:43 +0000
@@ -0,0 +1,27 @@
+<table>
+  <tr tal:condition="view/show_options/repository_owner">
+    <td colspan="2">
+      <label>
+        <input
+            type="radio" value="repository_owner"
+            tal:condition="not: context/readonly"
+            tal:replace="structure view/options/repository_owner" />
+        Repository owner
+      </label>
+    </td>
+  </tr>
+
+  <tr tal:condition="view/show_options/person">
+    <td>
+      <label>
+        <input
+            type="radio" value="person"
+            tal:condition="not: context/readonly"
+            tal:replace="structure view/options/person" />
+      </label>
+    </td>
+    <td>
+      <tal:person replace="structure view/person_widget" />
+    </td>
+  </tr>
+</table>

=== added file 'lib/lp/code/browser/widgets/tests/test_gitgrantee.py'
--- lib/lp/code/browser/widgets/tests/test_gitgrantee.py	1970-01-01 00:00:00 +0000
+++ lib/lp/code/browser/widgets/tests/test_gitgrantee.py	2019-01-09 10:45:43 +0000
@@ -0,0 +1,305 @@
+# Copyright 2018 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+__metaclass__ = type
+
+import re
+
+from zope.formlib.interfaces import (
+    IBrowserWidget,
+    IDisplayWidget,
+    IInputWidget,
+    WidgetInputError,
+    )
+
+from lp.app.validators import LaunchpadValidationError
+from lp.code.browser.widgets.gitgrantee import (
+    GitGranteeDisplayWidget,
+    GitGranteeField,
+    GitGranteeWidget,
+    )
+from lp.code.enums import GitGranteeType
+from lp.registry.vocabularies import ValidPersonOrTeamVocabulary
+from lp.services.beautifulsoup import BeautifulSoup
+from lp.services.webapp.escaping import html_escape
+from lp.services.webapp.publisher import canonical_url
+from lp.services.webapp.servers import LaunchpadTestRequest
+from lp.testing import (
+    TestCaseWithFactory,
+    verifyObject,
+    )
+from lp.testing.layers import DatabaseFunctionalLayer
+
+
+class TestGitGranteeWidgetBase:
+
+    layer = DatabaseFunctionalLayer
+
+    def setUp(self):
+        super(TestGitGranteeWidgetBase, self).setUp()
+        [self.ref] = self.factory.makeGitRefs()
+        self.rule = self.factory.makeGitRule(
+            repository=self.ref.repository, ref_pattern=self.ref.path)
+        self.field = GitGranteeField(__name__="grantee", rule=self.rule)
+        self.request = LaunchpadTestRequest()
+        self.widget = self.widget_factory(self.field, self.request)
+
+    def test_implements(self):
+        self.assertTrue(verifyObject(IBrowserWidget, self.widget))
+        self.assertTrue(
+            verifyObject(self.expected_widget_interface, self.widget))
+
+    def test_template(self):
+        # The render template is setup.
+        self.assertTrue(
+            self.widget.template.filename.endswith("gitgrantee.pt"),
+            "Template was not set up.")
+
+    def test_default_option(self):
+        # The person field is the default option.
+        self.assertEqual("person", self.widget.default_option)
+
+    def test_setUpSubWidgets_first_call(self):
+        # The subwidget is set up and a flag is set.
+        self.widget.setUpSubWidgets()
+        self.assertTrue(self.widget._widgets_set_up)
+        self.assertIsInstance(
+            self.widget.person_widget.context.vocabulary,
+            ValidPersonOrTeamVocabulary)
+
+    def test_setUpSubWidgets_second_call(self):
+        # The setUpSubWidgets method exits early if a flag is set to
+        # indicate that the subwidget was set up.
+        self.widget._widgets_set_up = True
+        self.widget.setUpSubWidgets()
+        self.assertIsNone(getattr(self.widget, "person_widget", None))
+
+    def test_setUpOptions_default_person_checked(self):
+        # The radio button options are composed of the setup widgets with
+        # the person widget set as the default.
+        self.widget.setUpSubWidgets()
+        self.widget.setUpOptions()
+        self.assertEqual(
+            '<input class="radioType" style="margin-left: 0;" ' +
+            self.expected_disabled_attr +
+            'id="field.grantee.option.repository_owner" name="field.grantee" '
+            'type="radio" value="repository_owner" />',
+            self.widget.options["repository_owner"])
+        self.assertEqual(
+            '<input class="radioType" style="margin-left: 0;" ' +
+            'checked="checked" ' + self.expected_disabled_attr +
+            'id="field.grantee.option.person" name="field.grantee" '
+            'type="radio" value="person" />',
+            self.widget.options["person"])
+
+    def test_setUpOptions_repository_owner_checked(self):
+        # The repository owner radio button is selected when the form is
+        # submitted when the grantee field's value is 'repository_owner'.
+        form = {"field.grantee": "repository_owner"}
+        self.widget.request = LaunchpadTestRequest(form=form)
+        self.widget.setUpSubWidgets()
+        self.widget.setUpOptions()
+        self.assertEqual(
+            '<input class="radioType" style="margin-left: 0;" '
+            'checked="checked" ' + self.expected_disabled_attr +
+            'id="field.grantee.option.repository_owner" name="field.grantee" '
+            'type="radio" value="repository_owner" />',
+            self.widget.options["repository_owner"])
+        self.assertEqual(
+            '<input class="radioType" style="margin-left: 0;" ' +
+            self.expected_disabled_attr +
+            'id="field.grantee.option.person" name="field.grantee" '
+            'type="radio" value="person" />',
+            self.widget.options["person"])
+
+    def test_setUpOptions_person_checked(self):
+        # The person radio button is selected when the form is submitted
+        # when the grantee field's value is 'person'.
+        form = {"field.grantee": "person"}
+        self.widget.request = LaunchpadTestRequest(form=form)
+        self.widget.setUpSubWidgets()
+        self.widget.setUpOptions()
+        self.assertEqual(
+            '<input class="radioType" style="margin-left: 0;" ' +
+            self.expected_disabled_attr +
+            'id="field.grantee.option.repository_owner" name="field.grantee" '
+            'type="radio" value="repository_owner" />',
+            self.widget.options["repository_owner"])
+        self.assertEqual(
+            '<input class="radioType" style="margin-left: 0;" ' +
+            'checked="checked" ' + self.expected_disabled_attr +
+            'id="field.grantee.option.person" name="field.grantee" '
+            'type="radio" value="person" />',
+            self.widget.options["person"])
+
+    def test_setRenderedValue_repository_owner(self):
+        # Passing GitGranteeType.REPOSITORY_OWNER will set the widget's
+        # render state to "repository_owner".
+        self.widget.setUpSubWidgets()
+        self.widget.setRenderedValue(GitGranteeType.REPOSITORY_OWNER)
+        self.assertEqual("repository_owner", self.widget.default_option)
+
+    def test_setRenderedValue_person(self):
+        # Passing a person will set the widget's render state to "person".
+        self.widget.setUpSubWidgets()
+        person = self.factory.makePerson()
+        self.widget.setRenderedValue(person)
+        self.assertEqual("person", self.widget.default_option)
+        self.assertEqual(person, self.widget.person_widget._data)
+
+    def test_call(self):
+        # The __call__ method sets up the widgets and the options.
+        markup = self.widget()
+        self.assertIsNotNone(self.widget.person_widget)
+        self.assertIn("repository_owner", self.widget.options)
+        self.assertIn("person", self.widget.options)
+        soup = BeautifulSoup(markup)
+        fields = soup.findAll(["input", "select"], {"id": re.compile(".*")})
+        ids = [field["id"] for field in fields]
+        self.assertContentEqual(self.expected_ids, ids)
+
+
+class TestGitGranteeDisplayWidget(
+        TestGitGranteeWidgetBase, TestCaseWithFactory):
+    """Test the GitGranteeDisplayWidget class."""
+
+    widget_factory = GitGranteeDisplayWidget
+    expected_widget_interface = IDisplayWidget
+    expected_disabled_attr = 'disabled="disabled" '
+    expected_ids = ["field.grantee.option.person"]
+
+    def test_setRenderedValue_person_display_widget(self):
+        # If the widget's render state is "person", a customised display
+        # widget is used.
+        self.widget.setUpSubWidgets()
+        person = self.factory.makePerson()
+        self.widget.setRenderedValue(person)
+        person_url = canonical_url(person)
+        self.assertEqual(
+            '<a href="%s">'
+            '<img style="padding-bottom: 2px" alt="" src="/@@/person" /> '
+            '%s</a>' % (person_url, html_escape(person.display_name)),
+            self.widget.person_widget())
+
+
+class TestGitGranteeWidget(TestGitGranteeWidgetBase, TestCaseWithFactory):
+    """Test the GitGranteeWidget class."""
+
+    widget_factory = GitGranteeWidget
+    expected_widget_interface = IInputWidget
+    expected_disabled_attr = ""
+    expected_ids = [
+        "field.grantee.option.repository_owner",
+        "field.grantee.option.person",
+        "field.grantee.person",
+        ]
+
+    def setUp(self):
+        super(TestGitGranteeWidget, self).setUp()
+        self.person = self.factory.makePerson()
+
+    def test_show_options_repository_owner_grant_already_exists(self):
+        # If the rule already has a repository owner grant, the input widget
+        # doesn't offer that option.
+        self.factory.makeGitRuleGrant(
+            rule=self.rule, grantee=GitGranteeType.REPOSITORY_OWNER)
+        self.assertEqual(
+            {"repository_owner": False, "person": True},
+            self.widget.show_options)
+
+    def test_show_options_repository_owner_grant_does_not_exist(self):
+        # If the rule doesn't have a repository owner grant, the input
+        # widget offers that option.
+        self.factory.makeGitRuleGrant(rule=self.rule)
+        self.assertEqual(
+            {"repository_owner": True, "person": True},
+            self.widget.show_options)
+
+    @property
+    def form(self):
+        return {
+            "field.grantee": "person",
+            "field.grantee.person": self.person.name,
+            }
+
+    def test_hasInput_not_in_form(self):
+        # hasInput is false when the widget's name is not in the form data.
+        self.widget.request = LaunchpadTestRequest(form={})
+        self.assertEqual("field.grantee", self.widget.name)
+        self.assertFalse(self.widget.hasInput())
+
+    def test_hasInput_no_person(self):
+        # hasInput is false when the person radio button is selected and the
+        # person widget's name is not in the form data.
+        self.widget.request = LaunchpadTestRequest(
+            form={"field.grantee": "person"})
+        self.assertEqual("field.grantee", self.widget.name)
+        self.assertFalse(self.widget.hasInput())
+
+    def test_hasInput_repository_owner(self):
+        # hasInput is true when the repository owner radio button is selected.
+        self.widget.request = LaunchpadTestRequest(
+            form={"field.grantee": "repository_owner"})
+        self.assertEqual("field.grantee", self.widget.name)
+        self.assertTrue(self.widget.hasInput())
+
+    def test_hasInput_person(self):
+        # hasInput is true when the person radio button is selected and the
+        # person widget's name is in the form data.
+        self.widget.request = LaunchpadTestRequest(form=self.form)
+        self.assertEqual("field.grantee", self.widget.name)
+        self.assertTrue(self.widget.hasInput())
+
+    def test_hasValidInput_true(self):
+        # The field input is valid when all submitted parts are valid.
+        self.widget.request = LaunchpadTestRequest(form=self.form)
+        self.assertTrue(self.widget.hasValidInput())
+
+    def test_hasValidInput_false(self):
+        # The field input is invalid if any of the submitted parts are invalid.
+        form = self.form
+        form["field.grantee.person"] = "non-existent"
+        self.widget.request = LaunchpadTestRequest(form=form)
+        self.assertFalse(self.widget.hasValidInput())
+
+    def test_getInputValue_repository_owner(self):
+        # The field value is GitGranteeType.REPOSITORY_OWNER when the
+        # repository owner radio button is selected.
+        form = self.form
+        form["field.grantee"] = "repository_owner"
+        self.widget.request = LaunchpadTestRequest(form=form)
+        self.assertEqual(
+            GitGranteeType.REPOSITORY_OWNER, self.widget.getInputValue())
+
+    def test_getInputValue_person(self):
+        # The field value is the person when the person radio button is
+        # selected and the person sub field is valid.
+        form = self.form
+        form["field.grantee"] = "person"
+        self.widget.request = LaunchpadTestRequest(form=form)
+        self.assertEqual(self.person, self.widget.getInputValue())
+
+    def test_getInputValue_person_missing(self):
+        # An error is raised when the person field is missing.
+        form = self.form
+        form["field.grantee"] = "person"
+        del form["field.grantee.person"]
+        self.widget.request = LaunchpadTestRequest(form=form)
+        message = "Please enter a person or team name"
+        e = self.assertRaises(WidgetInputError, self.widget.getInputValue)
+        self.assertEqual(LaunchpadValidationError(message), e.errors)
+
+    def test_getInputValue_person_invalid(self):
+        # An error is raised when the person is not valid.
+        form = self.form
+        form["field.grantee"] = "person"
+        form["field.grantee.person"] = "non-existent"
+        self.widget.request = LaunchpadTestRequest(form=form)
+        message = (
+            "There is no person or team named 'non-existent' registered in "
+            "Launchpad")
+        e = self.assertRaises(WidgetInputError, self.widget.getInputValue)
+        self.assertEqual(LaunchpadValidationError(message), e.errors)
+        self.assertEqual(html_escape(message), self.widget.error())

=== modified file 'lib/lp/code/interfaces/gitrepository.py'
--- lib/lp/code/interfaces/gitrepository.py	2018-11-21 00:54:42 +0000
+++ lib/lp/code/interfaces/gitrepository.py	2019-01-09 10:45:43 +0000
@@ -766,12 +766,18 @@
         :param user: The `IPerson` who is moving the rule.
         """
 
-    def findRuleGrantsByGrantee(grantee):
+    def findRuleGrantsByGrantee(grantee, include_transitive=True,
+                                ref_pattern=None):
         """Find the grants for a grantee applied to this repository.
 
         :param grantee: The `IPerson` to search for, or an item of
             `GitGranteeType` other than `GitGranteeType.PERSON` to search
             for some other kind of entity.
+        :param include_transitive: If False, match `grantee` exactly; if
+            True (the default), also accept teams of which `grantee` is a
+            member.
+        :param ref_pattern: If not None, only return grants for rules with
+            this ref_pattern.
         """
 
     @export_read_operation()

=== modified file 'lib/lp/code/model/gitrepository.py'
--- lib/lp/code/model/gitrepository.py	2018-12-10 13:54:34 +0000
+++ lib/lp/code/model/gitrepository.py	2019-01-09 10:45:43 +0000
@@ -1224,7 +1224,8 @@
         return Store.of(self).find(
             GitRuleGrant, GitRuleGrant.repository_id == self.id)
 
-    def findRuleGrantsByGrantee(self, grantee):
+    def findRuleGrantsByGrantee(self, grantee, include_transitive=True,
+                                ref_pattern=None):
         """See `IGitRepository`."""
         if isinstance(grantee, DBItem) and grantee.enum == GitGranteeType:
             if grantee == GitGranteeType.PERSON:
@@ -1232,12 +1233,22 @@
                     "grantee may not be GitGranteeType.PERSON; pass a person "
                     "object instead")
             clauses = [GitRuleGrant.grantee_type == grantee]
+        elif not include_transitive:
+            clauses = [
+                GitRuleGrant.grantee_type == GitGranteeType.PERSON,
+                GitRuleGrant.grantee == grantee,
+                ]
         else:
             clauses = [
                 GitRuleGrant.grantee_type == GitGranteeType.PERSON,
                 TeamParticipation.person == grantee,
                 GitRuleGrant.grantee == TeamParticipation.teamID
                 ]
+        if ref_pattern is not None:
+            clauses.extend([
+                GitRuleGrant.rule_id == GitRule.id,
+                GitRule.ref_pattern == ref_pattern,
+                ])
         return self.grants.find(*clauses).config(distinct=True)
 
     def getRules(self):

=== modified file 'lib/lp/code/model/tests/test_gitrepository.py'
--- lib/lp/code/model/tests/test_gitrepository.py	2018-11-22 16:35:28 +0000
+++ lib/lp/code/model/tests/test_gitrepository.py	2019-01-09 10:45:43 +0000
@@ -265,7 +265,7 @@
         grant = self.factory.makeGitRuleGrant(
             rule=rule, grantee=requester, can_push=True, can_create=True)
 
-        results = repository.findRuleGrantsByGrantee(requester)
+        results = repository.findRuleGrantsByGrantee(member)
         self.assertEqual([grant], list(results))
 
     def test_findRuleGrantsByGrantee_team_in_team(self):
@@ -357,6 +357,117 @@
         results = repository.findRuleGrantsByGrantee(requester)
         self.assertEqual([owner_grant], list(results))
 
+    def test_findRuleGrantsByGrantee_ref_pattern(self):
+        requester = self.factory.makePerson()
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(owner=requester))
+        [ref] = self.factory.makeGitRefs(repository=repository)
+
+        exact_grant = self.factory.makeGitRuleGrant(
+            repository=repository, ref_pattern=ref.path, grantee=requester)
+        self.factory.makeGitRuleGrant(
+            repository=repository, ref_pattern="refs/heads/*",
+            grantee=requester)
+
+        results = repository.findRuleGrantsByGrantee(
+            requester, ref_pattern=ref.path)
+        self.assertEqual([exact_grant], list(results))
+
+    def test_findRuleGrantsByGrantee_exclude_transitive_person(self):
+        requester = self.factory.makePerson()
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(owner=requester))
+
+        rule = self.factory.makeGitRule(repository)
+        grant = self.factory.makeGitRuleGrant(rule=rule, grantee=requester)
+
+        results = repository.findRuleGrantsByGrantee(
+            requester, include_transitive=False)
+        self.assertEqual([grant], list(results))
+
+    def test_findRuleGrantsByGrantee_exclude_transitive_team(self):
+        team = self.factory.makeTeam()
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(owner=team))
+
+        rule = self.factory.makeGitRule(repository)
+        grant = self.factory.makeGitRuleGrant(rule=rule, grantee=team)
+
+        results = repository.findRuleGrantsByGrantee(
+            team, include_transitive=False)
+        self.assertEqual([grant], list(results))
+
+    def test_findRuleGrantsByGrantee_exclude_transitive_member_of_team(self):
+        member = self.factory.makePerson()
+        team = self.factory.makeTeam(members=[member])
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(owner=team))
+
+        rule = self.factory.makeGitRule(repository)
+        self.factory.makeGitRuleGrant(rule=rule, grantee=team)
+
+        results = repository.findRuleGrantsByGrantee(
+            member, include_transitive=False)
+        self.assertEqual([], list(results))
+
+    def test_findRuleGrantsByGrantee_no_owner_grant(self):
+        repository = removeSecurityProxy(self.factory.makeGitRepository())
+
+        rule = self.factory.makeGitRule(repository=repository)
+        self.factory.makeGitRuleGrant(rule=rule)
+
+        results = repository.findRuleGrantsByGrantee(
+            GitGranteeType.REPOSITORY_OWNER)
+        self.assertEqual([], list(results))
+
+    def test_findRuleGrantsByGrantee_owner_grant(self):
+        repository = removeSecurityProxy(self.factory.makeGitRepository())
+
+        rule = self.factory.makeGitRule(repository=repository)
+        grant = self.factory.makeGitRuleGrant(
+            rule=rule, grantee=GitGranteeType.REPOSITORY_OWNER)
+        self.factory.makeGitRuleGrant(rule=rule)
+
+        results = repository.findRuleGrantsByGrantee(
+            GitGranteeType.REPOSITORY_OWNER)
+        self.assertEqual([grant], list(results))
+
+    def test_findRuleGrantsByGrantee_owner_ref_pattern(self):
+        repository = removeSecurityProxy(self.factory.makeGitRepository())
+        [ref] = self.factory.makeGitRefs(repository=repository)
+
+        exact_grant = self.factory.makeGitRuleGrant(
+            repository=repository, ref_pattern=ref.path,
+            grantee=GitGranteeType.REPOSITORY_OWNER)
+        self.factory.makeGitRuleGrant(
+            repository=repository, ref_pattern="refs/heads/*",
+            grantee=GitGranteeType.REPOSITORY_OWNER)
+
+        results = ref.repository.findRuleGrantsByGrantee(
+            GitGranteeType.REPOSITORY_OWNER, ref_pattern=ref.path)
+        self.assertEqual([exact_grant], list(results))
+
+    def test_findRuleGrantsByGrantee_owner_exclude_transitive(self):
+        repository = removeSecurityProxy(self.factory.makeGitRepository())
+        [ref] = self.factory.makeGitRefs(repository=repository)
+
+        exact_grant = self.factory.makeGitRuleGrant(
+            repository=repository, ref_pattern=ref.path,
+            grantee=GitGranteeType.REPOSITORY_OWNER)
+        self.factory.makeGitRuleGrant(
+            rule=exact_grant.rule, grantee=repository.owner)
+        wildcard_grant = self.factory.makeGitRuleGrant(
+            repository=repository, ref_pattern="refs/heads/*",
+            grantee=GitGranteeType.REPOSITORY_OWNER)
+
+        results = ref.repository.findRuleGrantsByGrantee(
+            GitGranteeType.REPOSITORY_OWNER, include_transitive=False)
+        self.assertItemsEqual([exact_grant, wildcard_grant], list(results))
+        results = ref.repository.findRuleGrantsByGrantee(
+            GitGranteeType.REPOSITORY_OWNER, ref_pattern=ref.path,
+            include_transitive=False)
+        self.assertEqual([exact_grant], list(results))
+
 
 class TestGitIdentityMixin(TestCaseWithFactory):
     """Test the defaults and identities provided by GitIdentityMixin."""