Merge lp:~jamalta/launchpad/515761-anonymrelease into lp:launchpad/db-devel

[Jamal Fanaian]

Created View classes for IMessage, IProductRelease, and IBugSubscription to allow anonymous API access to these interfaces. Fixed misspelling of 'permission' attribute for ViewProductSeries. Fixed security problem in test xx-product-package-pages with ubuntupkg.

[Jamal Fanaian (jamalta)]

= Summary =

Anonymous API Access to some collections returns nothing.

== Proposed fix ==

Create View classes in security.py for the interfaces that need anonymous access.

== Pre-implementation notes ==

Decision to make these collections available to everyone needs to be considered during review.

== Implementation details ==

Created ViewBugMessage, ViewProductRelease, and ViewBugSubscription in security.py with checkUnauthorized and checkAuthorized both returning True.

== Tests ==

% bin/test -vvct webservice/xx-bug.txt
% bin/test -vvct xx-project-registry

== Demo and Q/A ==

>>> from launchpadlib.launchpad import Launchpad
>>> launchpad = Launchpad.login('test', '', '', 'https://api.launchpad.dev/beta/')
>>> list(launchpad.projects['alsa-utils'].series)
[<project_series at https://api.launchpad.dev/beta/alsa-utils/trunk>]
>>> list(launchpad.bugs[1].messages)
[<message at https://api.launchpad.dev/beta/firefox/+bug/1/comments/0>, <message at https://api.launchpad.dev/beta/firefox/+bug/1/comments/1>]
>>> list(launchpad.bugs[1].subscriptions)
[<bug_subscription at https://api.launchpad.dev/beta/bugs/1/+subscription/stevea>, <bug_subscription at https://api.launchpad.dev/beta/bugs/1/+subscription/name12>]

== Launchpad lint ==

Checking for conflicts. and issues in doctests and templates.
Running jslint, xmllint, pyflakes, and pylint.
Using normal rules.

Linting changed files:
  lib/canonical/launchpad/security.py
  lib/canonical/launchpad/apidoc/wadl-testrunner.xml
  lib/lp/bugs/stories/webservice/xx-bug.txt
  lib/lp/registry/stories/webservice/xx-project-registry.txt

[Jamal Fanaian (jamalta)]

= Summary =

Anonymous API Access to some collections returns nothing.

== Proposed fix ==

Create View classes in security.py for the interfaces that need anonymous access.

== Pre-implementation notes ==

Decision to make these collections available to everyone needs to be considered during review.

== Implementation details ==

Created ViewBugMessage, ViewProductRelease, and ViewBugSubscription in security.py with checkUnauthorized and checkAuthorized both returning True. Also had to modify permissions for ubuntupkg which bac caught.

== Tests ==

 % bin/test -vvct webservice/xx-bug.txt
 % bin/test -vvct xx-project-registry
 % bin/test -vvct xx-product-package-pages.txt

== Demo and Q/A ==

>>> from launchpadlib.launchpad import Launchpad
>>> launchpad = Launchpad.login('test', '', '', 'https://api.launchpad.dev/beta/')
>>> list(launchpad.projects['alsa-utils'].series)
[<project_series at https://api.launchpad.dev/beta/alsa-utils/trunk>]
>>> list(launchpad.bugs[1].messages)
[<message at https://api.launchpad.dev/beta/firefox/+bug/1/comments/0>, <message at https://api.launchpad.dev/beta/firefox/+bug/1/comments/1>]
>>> list(launchpad.bugs[1].subscriptions)
[<bug_subscription at https://api.launchpad.dev/beta/bugs/1/+subscription/stevea>, <bug_subscription at https://api.launchpad.dev/beta/bugs/1/+subscription/name12>]

== Launchpad lint ==

Checking for conflicts. and issues in doctests and templates.
Running jslint, xmllint, pyflakes, and pylint.
Using normal rules.

Linting changed files:
  lib/canonical/launchpad/security.py
  lib/canonical/launchpad/apidoc/wadl-testrunner.xml
  lib/lp/bugs/stories/webservice/xx-bug.txt
  lib/lp/registry/stories/webservice/xx-project-registry.txt

[Paul Hummer (rockstar)]

<rockstar> jamalta, hm, maybe you should have a single class that inherits from AuthorizationBase that deals with checkAuthenticated and checkUnauthenticated - There's a lot of repetitive code here.
<jamalta> rockstar: i was thinking of doing that but no other class does that
<rockstar> jamalta, well, that may be for hysterical reasons. I don't see why new code should be like that.
<jamalta> and then there's the message on launchpad-dev from henning talking about refactoring security.py altogether
<jamalta> rockstar: i could do that if you would prefer though
<rockstar> jamalta, I say do it. Talk on a mailing list gets trumped by actual code.
<jamalta> rockstar: haha, sounds good :)
<jamalta> ViewByAnyUser a good name?
<rockstar> jamalta, AnonymousAuthorization ?
<jamalta> rockstar: even better

review: Needs Fixing (code)

[Jamal Fanaian (jamalta)]

=== modified file 'lib/canonical/launchpad/security.py'
--- lib/canonical/launchpad/security.py 2010-02-04 22:39:09 +0000
+++ lib/canonical/launchpad/security.py 2010-02-04 23:14:01 +0000
@@ -172,6 +172,19 @@
         return True

+class AnonymousAuthorization(AuthorizationBase):
+ """Allow any authenticated and unauthenticated user access."""
+ permission = 'launchpad.View'
+
+ def checkUnauthenticated(self):
+ """Any unauthorized user can see this object."""
+ return True
+
+ def checkAuthenticated(self, user):
+ """Any authorized user can see this object."""
+ return True
+
+
 class AdminByAdminsTeam(AuthorizationBase):
     permission = 'launchpad.Admin'
     usedfor = Interface
@@ -815,24 +828,9 @@
                 user.in_admin)

-class ViewProductSeries(AuthorizationBase):
+class ViewProductSeries(AnonymousAuthorization):

     usedfor = IProductSeries
- permission = 'launchpad.View'
-
- def checkUnauthenticated(self):
- """See `IAuthorization.checkUnauthenticated`.
-
- :return: True or False.
- """
- return True
-
- def checkAuthenticated(self, user):
- """See `IAuthorization.checkAuthenticated`.
-
- :return: True or False.
- """
- return True

 class EditProductSeries(EditByOwnersOrAdmins):
@@ -980,44 +978,14 @@
             self, bugattachment.bug)

-class ViewBugSubscription(AuthorizationBase):
+class ViewBugSubscription(AnonymousAuthorization):

     usedfor = IBugSubscription
- permission = 'launchpad.View'
-
- def checkUnauthenticated(self):
- """See `IAuthorization.checkUnauthenticated`.
-
- :return: True or False.
- """
- return True
-
- def checkAuthenticated(self, user):
- """See `IAuthorization.checkAuthenticated`.
-
- :return: True or False.
- """
- return True
-
-
-class ViewBugMessage(AuthorizationBase):
+
+
+class ViewBugMessage(AnonymousAuthorization):

     usedfor = IMessage
- permission = 'launchpad.View'
-
- def checkUnauthenticated(self):
- """See `IAuthorization.checkUnauthenticated`.
-
- :return: True or False.
- """
- return True
-
- def checkAuthenticated(self, user):
- """See `IAuthorization.checkAuthenticated`.
-
- :return: True or False.
- """
- return True

 class ViewAnnouncement(AuthorizationBase):
@@ -1323,24 +1291,9 @@
             self, user)

-class ViewProductRelease(AuthorizationBase):
+class ViewProductRelease(AnonymousAuthorization):

     usedfor = IProductRelease
- permission = 'launchpad.View'
-
- def checkUnauthenticated(self):
- """See `IAuthorization.checkUnauthenticated`.
-
- :return: True or False.
- """
- return True
-
- def checkAuthenticated(self, user):
- """See `IAuthorization.checkAuthenticated`.
-
- :return: True or False.
- """
- return True

 class AdminTranslationImportQueueEntry(AuthorizationBase):

[Jamal Fanaian (jamalta)]

Paul,

That was the diff for the last changes you requested. Based on salgado's recommendation I posted a message to launchpad-dev to confirm any security concerns with these changes.

Thanks again for reviewing this.

[Paul Hummer (rockstar)]

Thanks for making the changes I asked for.

review: Approve (code)

=== modified file 'lib/canonical/launchpad/security.py'
--- lib/canonical/launchpad/security.py	2010-02-04 00:01:23 +0000
+++ lib/canonical/launchpad/security.py	2010-02-08 14:16:33 +0000
@@ -29,6 +29,7 @@
 from lp.bugs.interfaces.bugattachment import IBugAttachment
 from lp.bugs.interfaces.bugbranch import IBugBranch
 from lp.bugs.interfaces.bugnomination import IBugNomination
+from lp.bugs.interfaces.bugsubscription import IBugSubscription
 from lp.bugs.interfaces.bugtracker import IBugTracker
 from lp.soyuz.interfaces.build import IBuild
 from lp.buildmaster.interfaces.builder import IBuilder, IBuilderSet
@@ -63,6 +64,7 @@
 from lp.registry.interfaces.mailinglist import IMailingListSet
 from lp.registry.interfaces.milestone import (
     IMilestone, IProjectMilestone)
+from canonical.launchpad.interfaces.message import IMessage
 from canonical.launchpad.interfaces.oauth import (
     IOAuthAccessToken, IOAuthRequestToken)
 from lp.soyuz.interfaces.packageset import IPackageset, IPackagesetSet
@@ -170,6 +172,19 @@
         return True
 
 
+class AnonymousAuthorization(AuthorizationBase):
+    """Allow any authenticated and unauthenticated user access."""
+    permission = 'launchpad.View'
+
+    def checkUnauthenticated(self):
+        """Any unauthorized user can see this object."""
+        return True
+
+    def checkAuthenticated(self, user):
+        """Any authorized user can see this object."""
+        return True
+
+
 class AdminByAdminsTeam(AuthorizationBase):
     permission = 'launchpad.Admin'
     usedfor = Interface
@@ -813,24 +828,9 @@
                 user.in_admin)
 
 
-class ViewProductSeries(AuthorizationBase):
+class ViewProductSeries(AnonymousAuthorization):
 
     usedfor = IProductSeries
-    permision = 'launchpad.View'
-
-    def checkUnauthenticated(self):
-        """See `IAuthorization.checkUnauthenticated`.
-
-        :return: True or False.
-        """
-        return True
-
-    def checkAuthenticated(self, user):
-        """See `IAuthorization.checkAuthenticated`.
-
-        :return: True or False.
-        """
-        return True
 
 
 class EditProductSeries(EditByOwnersOrAdmins):
@@ -978,6 +978,16 @@
             self, bugattachment.bug)
 
 
+class ViewBugSubscription(AnonymousAuthorization):
+
+    usedfor = IBugSubscription
+
+
+class ViewBugMessage(AnonymousAuthorization):
+
+    usedfor = IMessage
+
+
 class ViewAnnouncement(AuthorizationBase):
     permission = 'launchpad.View'
     usedfor = IAnnouncement
@@ -1281,7 +1291,16 @@
             self, user)
 
 
-class AdminTranslationImportQueueEntry(AuthorizationBase):
+<<<<<<< TREE
+class AdminTranslationImportQueueEntry(AuthorizationBase):
+=======
+class ViewProductRelease(AnonymousAuthorization):
+
+    usedfor = IProductRelease
+
+
+class AdminTranslationImportQueueEntry(AuthorizationBase):
+>>>>>>> MERGE-SOURCE
     permission = 'launchpad.Admin'
     usedfor = ITranslationImportQueueEntry
 

=== modified file 'lib/lp/bugs/browser/configure.zcml'
=== modified file 'lib/lp/bugs/interfaces/bugtask.py'
--- lib/lp/bugs/interfaces/bugtask.py	2010-02-06 12:23:17 +0000
+++ lib/lp/bugs/interfaces/bugtask.py	2010-02-08 14:16:33 +0000
@@ -474,11 +474,9 @@
                    description=_("The age of this task, expressed as the "
                                  "length of time between the creation date "
                                  "and now."))
-    task_age = exported(
-        Int(title=_("Age of the bug task"),
+    task_age = Int(title=_("Age of the bug task"),
             description=_("The age of this task in seconds, a delta between "
-                         "now and the date the bug task was created."),
-            readonly=True))
+                         "now and the date the bug task was created."))
     owner = exported(
         Reference(title=_("The owner"), schema=IPerson, readonly=True))
     target = exported(Reference(

=== modified file 'lib/lp/bugs/stories/webservice/xx-bug.txt'
--- lib/lp/bugs/stories/webservice/xx-bug.txt	2010-02-03 18:57:40 +0000
+++ lib/lp/bugs/stories/webservice/xx-bug.txt	2010-02-08 14:16:33 +0000
@@ -255,6 +255,12 @@
   >>> webservice.get("/messages").status
   404
 
+Bug messages can be accessed anonymously.
+
+  >>> messages = anon_webservice.get("/bugs/5/messages").jsonBody()['entries']
+  >>> print messages[0]['self_link']
+  http://.../firefox/+bug/5/comments/0
+
 We can add a new message to a bug by calling the newMessage method.
 
   >>> print webservice.named_post(
@@ -332,15 +338,8 @@
   self_link: u'http://api.../debian/+source/mozilla-firefox/+bug/1'
   status: u'Confirmed'
   target_link: u'http://api.../debian/+source/mozilla-firefox'
-  task_age: ...
   title: u'Bug #1 in mozilla-firefox (Debian): "Firefox does not support SVG"'
 
-Because task age is a dynamic calculation between now and the date_created
-we will just verify that an integer is returned.
-
-  >>> print type(bug_one_bugtasks[0]['task_age'])
-  <type 'int'>
-
 The collection of bug tasks is not exposed as a resource:
 
   >>> webservice.get("/bug_tasks").status
@@ -869,6 +868,12 @@
   self_link: u'http://.../bugs/1/+subscription/stevea'
   subscribed_by_link: u'http://.../~janitor'
 
+Subscriptions can also be accessed anonymously.
+
+  >>> subscriptions = anon_webservice.get(bug_one_subscriptions_url).jsonBody()
+  >>> print subscriptions['entries'][0]['self_link']
+  http://.../bugs/1/+subscription/stevea
+
 We can also create new subscriptions.
 
     >>> new_subscription = webservice.named_post(

=== modified file 'lib/lp/code/model/branchmergeproposaljob.py'
=== modified file 'lib/lp/registry/browser/configure.zcml'
--- lib/lp/registry/browser/configure.zcml	2010-01-30 18:15:36 +0000
+++ lib/lp/registry/browser/configure.zcml	2010-02-08 14:16:33 +0000
@@ -1606,7 +1606,7 @@
         template="../templates/productseries-ubuntupkg.pt"
         for="lp.registry.interfaces.productseries.IProductSeries"
         class="lp.registry.browser.productseries.ProductSeriesUbuntuPackagingView"
-        permission="launchpad.View"/>
+        permission="launchpad.AnyPerson"/>
     <browser:pages
         for="lp.registry.interfaces.productseries.IProductSeries"
         class="lp.registry.browser.productseries.ProductSeriesView"

=== modified file 'lib/lp/registry/browser/productseries.py'
--- lib/lp/registry/browser/productseries.py	2010-01-22 16:44:39 +0000
+++ lib/lp/registry/browser/productseries.py	2010-02-08 14:16:33 +0000
@@ -205,7 +205,7 @@
         summary = "Register a new Bazaar branch for this series' project"
         return Link('+addbranch', text, summary, icon='add')
 
-    @enabled_with_permission('launchpad.View')
+    @enabled_with_permission('launchpad.AnyPerson')
     def ubuntupkg(self):
         """Return a link to link this series to an ubuntu sourcepackage."""
         text = 'Link to Ubuntu package'

=== modified file 'lib/lp/registry/stories/webservice/xx-project-registry.txt'
--- lib/lp/registry/stories/webservice/xx-project-registry.txt	2010-01-27 19:12:10 +0000
+++ lib/lp/registry/stories/webservice/xx-project-registry.txt	2010-02-08 14:16:33 +0000
@@ -282,6 +282,13 @@
     >>> print series_1_0['self_link']
     http://.../firefox/1.0
 
+Series can also be accessed anonymously.
+
+    >>> response = anon_webservice.get(firefox['series_collection_link'])
+    >>> series = response.jsonBody()
+    >>> print series['total_size']
+    2
+
 A list of releases can be accessed through the releases_collection_link.
 
     >>> response = webservice.get(firefox['releases_collection_link'])
@@ -302,6 +309,13 @@
     >>> print release_0_9_1['self_link']
     http://.../firefox/trunk/0.9.1
 
+Releases can also be accessed anonymously.
+
+    >>> response = anon_webservice.get(firefox['releases_collection_link'])
+    >>> releases = response.jsonBody()
+    >>> print releases['total_size']
+    4
+
 The development focus series can be accessed through the
 development_focus_link.
 

=== modified file 'lib/lp/services/job/runner.py'
=== modified file 'lib/lp/testing/factory.py'
--- lib/lp/testing/factory.py	2010-02-06 12:23:17 +0000
+++ lib/lp/testing/factory.py	2010-02-08 14:16:33 +0000
@@ -36,8 +36,22 @@
 from canonical.autodecorate import AutoDecorate
 from canonical.config import config
 from canonical.database.constants import UTC_NOW
+<<<<<<< TREE
+=======
+from lp.code.interfaces.sourcepackagerecipe import ISourcePackageRecipeSource
+from lp.code.interfaces.sourcepackagerecipebuild import (
+    ISourcePackageRecipeBuildSource,
+    )
+from lp.codehosting.codeimport.worker import CodeImportSourceDetails
+>>>>>>> MERGE-SOURCE
 from canonical.database.sqlbase import flush_database_updates
+<<<<<<< TREE
 
+=======
+from lp.soyuz.adapters.packagelocation import PackageLocation
+from lp.soyuz.interfaces.publishing import PackagePublishingStatus
+from lp.soyuz.interfaces.section import ISectionSet
+>>>>>>> MERGE-SOURCE
 from canonical.launchpad.database.account import Account
 from canonical.launchpad.database.emailaddress import EmailAddress
 from canonical.launchpad.database.message import Message, MessageChunk
@@ -83,6 +97,7 @@
 from lp.code.interfaces.codeimportmachine import ICodeImportMachineSet
 from lp.code.interfaces.codeimportresult import ICodeImportResultSet
 from lp.code.interfaces.revision import IRevisionSet
+<<<<<<< TREE
 from lp.code.interfaces.sourcepackagerecipe import ISourcePackageRecipeSource
 from lp.code.interfaces.sourcepackagerecipebuild import (
     ISourcePackageRecipeBuildSource,
@@ -91,6 +106,9 @@
 from lp.codehosting.codeimport.worker import CodeImportSourceDetails
 
 from lp.registry.interfaces.distribution import IDistributionSet
+=======
+from lp.code.model.diff import Diff, PreviewDiff
+>>>>>>> MERGE-SOURCE
 from lp.registry.model.distributionsourcepackage import (
     DistributionSourcePackage)
 from lp.registry.interfaces.distroseries import IDistroSeries