Merge lp:~jpds/launchpad/fix_520469 into lp:launchpad

[Jonathan Davies]

Declare ViewDistributionMirror in security.py so that distribution mirror collections are anonymously accessible via the API.

[Jonathan Davies (jpds)]

= Summary =

security.py needs an explicit declaration for viewing IDistributionMirror's via the API, this branch adds this.

[Curtis Hovey (sinzui)]

Thanks for addressing this issue. This is good to land.

review: Approve (code)

=== modified file 'lib/canonical/launchpad/security.py'
--- lib/canonical/launchpad/security.py	2010-02-19 16:33:29 +0000
+++ lib/canonical/launchpad/security.py	2010-02-22 17:54:20 +0000
@@ -359,6 +359,11 @@
                 user.inTeam(self.obj.distribution.mirror_admin))
 
 
+class ViewDistributionMirror(AnonymousAuthorization):
+    """Anyone can view an IDistributionMirror."""
+    usedfor = IDistributionMirror
+
+
 class EditSpecificationBranch(AuthorizationBase):
 
     usedfor = ISpecificationBranch

=== modified file 'lib/lp/registry/stories/webservice/xx-distribution-mirror.txt'
--- lib/lp/registry/stories/webservice/xx-distribution-mirror.txt	2010-02-08 13:04:03 +0000
+++ lib/lp/registry/stories/webservice/xx-distribution-mirror.txt	2010-02-22 17:54:20 +0000
@@ -78,10 +78,20 @@
     >>> no_priv_webservice = webservice_for_person(no_priv_db,
     ...     permission=OAuthPermission.READ_PUBLIC)
     >>> logout()
-    >>> karl = webservice.get("/~karl").jsonBody()
-    >>> patch = {
-    ...     u'owner_link': karl['self_link']
-    ... }
+
+Ensure that anonymous API sessions can view mirror listings; archive/releases.
+
+    >>> archive_response = anon_webservice.get(
+    ...     ubuntu['archive_mirrors_collection_link'])
+    >>> anon_archive_mirrors = archive_response.jsonBody()
+    >>> print anon_archive_mirrors['total_size']
+    4
+
+    >>> cd_response = anon_webservice.get(
+    ...     ubuntu['cdimage_mirrors_collection_link'])
+    >>> anon_cd_mirrors = cd_response.jsonBody()
+    >>> print anon_cd_mirrors['total_size']
+    4
 
 One must have special permissions to access certain attributes:
 
@@ -137,6 +147,10 @@
 
 Now trying to set the owner using Sample Person's webservice is not authorized.
 
+    >>> karl = webservice.get("/~karl").jsonBody()
+    >>> patch = {
+    ...     u'owner_link': karl['self_link']
+    ... }
     >>> response = test_webservice.patch(
     ...     canonical_archive['self_link'], 'application/json', dumps(patch))
     >>> print response.getheader('status')