Merge lp:~dooferlad/linaro-license-protection/logout-link-on-openid-denied into lp:~linaro-automation/linaro-license-protection/trunk

[James Tunnicliffe]

Add a custom HTTP response forbidden page when we fail to be part of the correct Launchpad team to allow access to a file. The page lists the teams that you need to be a member of and allows you to log in again to give you the opportunity to make sure that you share the right team membership to give you file access (if you have it).

[Stevan Radaković (stevanr)]

Since you're using template, I'd rather you just pass the openid_teams as an array to the template and construct the teams string over there... Does this sound viable?

review: Needs Fixing

[Stevan Radaković (stevanr)]

Approving, as agreed in the infra hangout.

review: Approve

[James Tunnicliffe (dooferlad)]

As discussed a moment ago, it may be possible, but in terms of what I can do quickly and us wanting to release soon, I think it is reasonable to mark that as possible future work.

=== modified file 'license_protected_downloads/openid_auth.py'
--- license_protected_downloads/openid_auth.py	2012-07-11 13:13:56 +0000
+++ license_protected_downloads/openid_auth.py	2012-08-23 13:40:54 +0000
@@ -1,8 +1,7 @@
 from django.conf import settings
-from django.shortcuts import redirect
-
-from django.http import HttpResponseForbidden
+from django.shortcuts import redirect, render_to_response
 from django.contrib.auth.models import Group
+import bzr_version
 
 
 class OpenIDAuth:
@@ -24,4 +23,24 @@
             if group.name in openid_teams:
                 return None
 
-        return HttpResponseForbidden("Not Authorized")
+        # Construct a nice string of openid teams that will allow access to
+        # the requested file
+        if len(openid_teams) > 1:
+            teams_string = "one of the " + openid_teams.pop(0) + " "
+            if len(openid_teams) > 1:
+                teams_string += ", ".join(openid_teams[0:-1])
+
+            teams_string += " or " + openid_teams[-1] + " teams"
+        else:
+            teams_string = "the " + openid_teams[0] + " team"
+
+        response = render_to_response(
+            'openid_forbidden_template.html',
+            {'login': settings.LOGIN_URL + "?next=" + request.path,
+             'authenticated': request.user.is_authenticated(),
+             'openid_teams': teams_string,
+             'revno': bzr_version.get_my_bzr_revno(),
+             })
+
+        response.status_code = 403
+        return response

=== modified file 'license_protected_downloads/tests/test_openid_auth.py'
--- license_protected_downloads/tests/test_openid_auth.py	2012-07-11 13:13:56 +0000
+++ license_protected_downloads/tests/test_openid_auth.py	2012-08-23 13:40:54 +0000
@@ -57,7 +57,23 @@
         response = OpenIDAuth.process_openid_auth(mock_request, openid_teams)
         self.assertIsNotNone(response)
         self.assertTrue(isinstance(response, HttpResponse))
-        self.assertEquals(403, response.status_code)
+        self.assertContains(response,
+            "You need to be the member of the linaro team in Launchpad.",
+            status_code=403)
+
+    def test_check_no_team_membership_authed_multi_teams(self):
+        mock_request = self.make_mock_request()
+        mock_request.user.is_authenticated.return_value = True
+        mock_request.user.groups.all.return_value = [
+            self.make_mock_group("another-group")]
+        openid_teams = ["linaro", "batman", "catwoman", "joker"]
+        response = OpenIDAuth.process_openid_auth(mock_request, openid_teams)
+        self.assertIsNotNone(response)
+        self.assertTrue(isinstance(response, HttpResponse))
+        self.assertContains(response,
+            "You need to be the member of one of the linaro batman, catwoman "
+            "or joker teams in Launchpad.",
+            status_code=403)
 
     @patch("django.contrib.auth.models.Group.objects.get_or_create")
     def test_auto_adding_groups(self, get_or_create_mock):

=== added file 'templates/openid_forbidden_template.html'
--- templates/openid_forbidden_template.html	1970-01-01 00:00:00 +0000
+++ templates/openid_forbidden_template.html	2012-08-23 13:40:54 +0000
@@ -0,0 +1,17 @@
+{% extends "header.html" %}
+
+{% block content %}
+  <h1>Forbidden</h1>
+  <p>
+    You do not have the correct group membership to access this file.
+
+    You need to be the member of {{ openid_teams }} in Launchpad.
+
+    If you think you should have access, you can try logging in again and check that
+    one of the required group memberships are selected.
+  </p>
+  <p>
+    <a href="{{ login }}">Login again</a>
+  </p>
+</table>
+{% endblock %}