> Hi Edwin.
> 
> There are some dangerous changes in the code and the test does is not what is
> happening in production.
> 
> We need to revert the permissions on the view. It must be admin because we do
> not want every team owner/admin permission to merge their team with *any*
> other team. Delete restricts the operation to the context team and ~registry.


Hi Sinzui,

Thanks for the review. As discussed on IRC, the permissions for the view and for the +adminmergeteam link are fine since it uses launchpad.Moderate on IPersonSet, which does not include admins of any team.


> > Demo and Q/A
> > ------------
> >
> > * Add ~no-priv to the ~registry team.
> > * Login as ~no-priv.
> > * Open http://launchpad.dev/people/+newteam
> >   * Add a team with a contact email address.
> >   * You will need to verify the email address with the token it emails you.
> > (On launchpad.dev, you can just look in the logintoken table and paste the
> > token into https://launchpad.dev/token/$token)
> > * Open http://launchpad.dev/people/
> >   * Click on "Merge teams"
> >   * Enter you new team for the first team.
> >   * Enter "ubuntu-team" for the second team.
> >   * Click "Merge"
> >   * When you get a warning message, click "Deactivate members and merge".
> 
> This story is wrong. The delete team scenario is a very restricted merge
> operation that registry administators may perform. Admins can do unrestricted
> merges.
>     * As registry expert.
>     * Visit https://edge.launchpad.net/~consulvision
>       * This team has an email address in NEW status
>       * team email addresses are not shown in the UI
>       * only the team owner can access the address.
>     * Choose Delete team.
>     * Verify the team is gone.
> 
> The code change is the the view, so we want a test that verifies the view
> handles the real conditions. The test should be in lp/registry/tests
> /peoplemerge-views.txt. You can update the the Delete team section to cover
> this story
>     * Create a team with an email address.
>     * deletable_.setContactAddress(None)
>     * login_person(registry_experts.teamowner)
>     * form = {'field.actions.delete': 'Delete'}
>     * view = create_initialized_view(deletable_team, '+delete', form=form)
>     * view.errors
>       []
>     * for notification in view.request.response.notifications:
>          print notification.message
>       Team deleted.

I have added this test. I also changed other parts of the test that was using the owner of the registry team, which is mark. Since mark is also in the admin team, I don't think it is a very effective test of the registry experts abilities to use him.

-Edwin

Incremental diff:
{{{
=== modified file 'lib/lp/registry/browser/tests/peoplemerge-views.txt'
--- lib/lp/registry/browser/tests/peoplemerge-views.txt	2010-01-06 17:52:45 +0000
+++ lib/lp/registry/browser/tests/peoplemerge-views.txt	2010-01-19 23:53:42 +0000
@@ -6,9 +6,17 @@
 Team Merges
 -----------
 
+Create a member of the registry team that is not a member of the admins
+team.
+
     >>> from lp.registry.interfaces.person import IPersonSet
+    >>> from canonical.launchpad.interfaces import ILaunchpadCelebrities
+    >>> registry_experts = getUtility(ILaunchpadCelebrities).registry_experts
     >>> person_set = getUtility(IPersonSet)
-    >>> registry_expert = person_set.getByName('mark')
+    >>> registry_expert = factory.makePerson()
+    >>> login_person(registry_experts.teamowner)
+    >>> ignored = registry_experts.addMember(
+    ...     registry_expert, registry_experts.teamowner)
     >>> login_person(registry_expert)
 
 A team (name21) can be merged into another (ubuntu-team).
@@ -39,6 +47,7 @@
     >>> parent_team = factory.makeTeam()
     >>> child_team = factory.makeTeam(name='child-team')
     >>> random_team = factory.makeTeam()
+    >>> login('<email address hidden>')
     >>> ignored = parent_team.addMember(
     ...     child_team, reviewer=parent_team.teamowner, force_team_add=True)
     >>> form = {'field.dupe_person': child_team.name,
@@ -112,10 +121,8 @@
 Users with launchpad.Moderate such as team admins and registry experts
 can delete teams.
 
-    >>> from canonical.launchpad.interfaces import ILaunchpadCelebrities
     >>> from canonical.launchpad.webapp.authorization import check_permission
 
-    >>> registry_experts = getUtility(ILaunchpadCelebrities).registry_experts
     >>> team_owner = factory.makePerson()
     >>> team_member = factory.makePerson()
     >>> deletable_team = factory.makeTeam(owner=team_owner, name='deletable')
@@ -127,7 +134,7 @@
     >>> check_permission('launchpad.Moderate', view)
     False
 
-    >>> login_person(registry_experts.teamowner)
+    >>> login_person(registry_expert)
     >>> check_permission('launchpad.Moderate', view)
     True
 
@@ -241,3 +248,26 @@
 
     >>> print find_tag_by_id(content, 'field.actions.delete')
     None
+
+The registry experts should be able to delete a team with an
+validated email address, which will be invisible, since only
+preferred email addresses are shown for teams.
+
+    >>> from canonical.launchpad.interfaces.emailaddress import (
+    ...     IEmailAddressSet)
+    >>> login_person(registry_expert)
+    >>> admin = getUtility(ILaunchpadCelebrities).admin
+    >>> registry_expert.inTeam(admin)
+    False
+    >>> deletable_team = factory.makeTeam(<email address hidden>")
+    >>> deletable_team.setContactAddress(None)
+    >>> for email in getUtility(IEmailAddressSet).getByPerson(deletable_team):
+    ...     print email.email, email.status.title
+    <email address hidden> Validated Email Address
+    >>> form = {'field.actions.delete': 'Delete'}
+    >>> view = create_initialized_view(deletable_team, '+delete', form=form)
+    >>> view.errors
+    []
+    >>> for notification in view.request.response.notifications:
+    ...     print notification.message
+    Team deleted.

}}}