Merge ~pappacena/launchpad:oci-api-create-recipe into launchpad:master

[Thiago F. Pappacena]

API operation to create a new OCIRecipe from an existing OCIProject.

The feature is only enabled if we turn on the 'oci.recipe.create.enabled' feature flag.

This MP includes code from https://code.launchpad.net/~pappacena/launchpad/+git/launchpad/+merge/380909. So, it's important to hold merges until the previous one is accepted and merged.

4171065... by Thiago F. Pappacena on 2020-03-25

Merge branch 'master' into oci-api-create-recipe

[Colin Watson (cjwatson)]

review: Approve

719b074... by Thiago F. Pappacena on 2020-03-31

Refactoring tests

222602a... by Thiago F. Pappacena on 2020-03-31

Removing unused parameter

d14a4c6... by Thiago F. Pappacena on 2020-03-31

Moving OCI_RECIPE_ALLOW_CREATE feature flag to OCIRecipe.__init__ and its view initializer

75e9047... by Thiago F. Pappacena on 2020-03-31

Renaming IOCIProjectPublicActions interface to IOCIProjectLegitimate

c979846... by Thiago F. Pappacena on 2020-03-31

OCIRecipe owner should be provided on creation when using API

5bc0691... by Thiago F. Pappacena on 2020-03-31

Adding build_daily on OCI Recipe creation API

[Thiago F. Pappacena (pappacena)]

cjwatson, it took a while to adjust all the tests that needed to `OCIRecipe.__init__` or `OCIRecipeAddView.initialize`, and those adjustments made the diff bigger, although it's just setting the correct feature flag where appropriate.

Anyway, I think it covers all requested changes. Let me know if you want to do another round of review.

d227d91... by Thiago F. Pappacena on 2020-03-31

Fixing tests to use feature flag

[Thiago F. Pappacena (pappacena)]

Ah, I'm actually missing one of the requests. I'll push in some minutes.

fd4fa2e... by Thiago F. Pappacena on 2020-04-01

Actually using build_daily on OCIRecipe's create UI

a258de0... by Thiago F. Pappacena on 2020-04-01

Merge branch 'master' into oci-api-create-recipe

efc1f7f... by Thiago F. Pappacena on 2020-04-01

Merge branch 'master' into oci-api-create-recipe

[Thiago F. Pappacena (pappacena)]

Now I think it's done, and ready for another round of review.

Sorry for the long diff, but most of the new changes are just adding the FeatureFixture on old tests.

[Colin Watson (cjwatson)]

review: Approve

ff742c6... by Thiago F. Pappacena on 2020-04-02

Minor refactoring and adjusting constraing on OCIProject.newRecipe

[Thiago F. Pappacena (pappacena)]

Thanks for the review. All requested changes were made. I'll top-approve this MP now.

diff --git a/lib/lp/_schema_circular_imports.py b/lib/lp/_schema_circular_imports.py
index dd4e9d4..37369b4 100644
--- a/lib/lp/_schema_circular_imports.py
+++ b/lib/lp/_schema_circular_imports.py
@@ -1103,6 +1103,7 @@ patch_entry_explicit_version(IWikiName, 'beta')
 
 # IOCIProject
 patch_collection_property(IOCIProject, 'series', IOCIProjectSeries)
+patch_entry_return_type(IOCIProject, 'newRecipe', IOCIRecipe)
 
 # IOCIRecipe
 patch_collection_property(IOCIRecipe, 'builds', IOCIRecipeBuild)
diff --git a/lib/lp/oci/browser/ocirecipe.py b/lib/lp/oci/browser/ocirecipe.py
index 7d044f5..10e9d4b 100644
--- a/lib/lp/oci/browser/ocirecipe.py
+++ b/lib/lp/oci/browser/ocirecipe.py
@@ -35,7 +35,9 @@ from lp.oci.interfaces.ocirecipe import (
     IOCIRecipe,
     IOCIRecipeSet,
     NoSuchOCIRecipe,
+    OCI_RECIPE_ALLOW_CREATE,
     OCI_RECIPE_WEBHOOKS_FEATURE_FLAG,
+    OCIRecipeFeatureDisabled,
     )
 from lp.oci.interfaces.ocirecipebuild import IOCIRecipeBuildSet
 from lp.services.features import getFeatureFlag
@@ -174,6 +176,11 @@ class OCIRecipeAddView(LaunchpadFormView):
         )
     custom_widget_git_ref = GitRefWidget
 
+    def initialize(self):
+        super(OCIRecipeAddView, self).initialize()
+        if not getFeatureFlag(OCI_RECIPE_ALLOW_CREATE):
+            raise OCIRecipeFeatureDisabled()
+
     @property
     def cancel_url(self):
         """See `LaunchpadFormView`."""
@@ -205,7 +212,8 @@ class OCIRecipeAddView(LaunchpadFormView):
         recipe = getUtility(IOCIRecipeSet).new(
             name=data["name"], registrant=self.user, owner=data["owner"],
             oci_project=self.context, git_ref=data["git_ref"],
-            build_file=data["build_file"], description=data["description"])
+            build_file=data["build_file"], description=data["description"],
+            build_daily=data["build_daily"])
         self.next_url = canonical_url(recipe)
 
 
diff --git a/lib/lp/oci/browser/tests/test_ocirecipe.py b/lib/lp/oci/browser/tests/test_ocirecipe.py
index 540649f..bd87975 100644
--- a/lib/lp/oci/browser/tests/test_ocirecipe.py
+++ b/lib/lp/oci/browser/tests/test_ocirecipe.py
@@ -29,7 +29,9 @@ from lp.oci.browser.ocirecipe import (
     OCIRecipeEditView,
     OCIRecipeView,
     )
+from lp.oci.interfaces.ocirecipe import OCI_RECIPE_ALLOW_CREATE
 from lp.services.database.constants import UTC_NOW
+from lp.services.features.testing import FeatureFixture
 from lp.services.propertycache import get_property_cache
 from lp.services.webapp import canonical_url
 from lp.services.webapp.servers import LaunchpadTestRequest
@@ -62,6 +64,10 @@ class TestOCIRecipeNavigation(TestCaseWithFactory):
 
     layer = DatabaseFunctionalLayer
 
+    def setUp(self):
+        super(TestOCIRecipeNavigation, self).setUp()
+        self.useFixture(FeatureFixture({OCI_RECIPE_ALLOW_CREATE: 'on'}))
+
     def test_canonical_url(self):
         owner = self.factory.makePerson(name="person")
         distribution = self.factory.makeDistribution(name="distro")
@@ -96,6 +102,10 @@ class BaseTestOCIRecipeView(BrowserTestCase):
 
 class TestOCIRecipeAddView(BaseTestOCIRecipeView):
 
+    def setUp(self):
+        super(TestOCIRecipeAddView, self).setUp()
+        self.useFixture(FeatureFixture({OCI_RECIPE_ALLOW_CREATE: 'on'}))
+
     def test_create_new_recipe_not_logged_in(self):
         oci_project = self.factory.makeOCIProject()
         self.assertRaises(
@@ -151,6 +161,10 @@ class TestOCIRecipeAddView(BaseTestOCIRecipeView):
 
 class TestOCIRecipeAdminView(BaseTestOCIRecipeView):
 
+    def setUp(self):
+        super(TestOCIRecipeAdminView, self).setUp()
+        self.useFixture(FeatureFixture({OCI_RECIPE_ALLOW_CREATE: 'on'}))
+
     def test_unauthorized(self):
         # A non-admin user cannot administer an OCI recipe.
         login_person(self.person)
@@ -199,6 +213,10 @@ class TestOCIRecipeAdminView(BaseTestOCIRecipeView):
 
 class TestOCIRecipeEditView(BaseTestOCIRecipeView):
 
+    def setUp(self):
+        super(TestOCIRecipeEditView, self).setUp()
+        self.useFixture(FeatureFixture({OCI_RECIPE_ALLOW_CREATE: 'on'}))
+
     def test_edit_recipe(self):
         oci_project = self.factory.makeOCIProject()
         oci_project_display = oci_project.display_name
@@ -275,6 +293,10 @@ class TestOCIRecipeEditView(BaseTestOCIRecipeView):
 
 class TestOCIRecipeDeleteView(BaseTestOCIRecipeView):
 
+    def setUp(self):
+        super(TestOCIRecipeDeleteView, self).setUp()
+        self.useFixture(FeatureFixture({OCI_RECIPE_ALLOW_CREATE: 'on'}))
+
     def test_unauthorized(self):
         # A user without edit access cannot delete an OCI recipe.
         recipe = self.factory.makeOCIRecipe(
@@ -326,6 +348,7 @@ class TestOCIRecipeView(BaseTestOCIRecipeView):
             distroseries=self.distroseries, architecturetag="i386",
             processor=processor)
         self.factory.makeBuilder(virtualized=True)
+        self.useFixture(FeatureFixture({OCI_RECIPE_ALLOW_CREATE: 'on'}))
 
     def makeOCIRecipe(self, oci_project=None, **kwargs):
         if oci_project is None:
diff --git a/lib/lp/oci/browser/tests/test_ocirecipebuild.py b/lib/lp/oci/browser/tests/test_ocirecipebuild.py
index ed3cb9b..72f29e9 100644
--- a/lib/lp/oci/browser/tests/test_ocirecipebuild.py
+++ b/lib/lp/oci/browser/tests/test_ocirecipebuild.py
@@ -13,6 +13,8 @@ from storm.locals import Store
 from testtools.matchers import StartsWith
 
 from lp.buildmaster.enums import BuildStatus
+from lp.oci.interfaces.ocirecipe import OCI_RECIPE_ALLOW_CREATE
+from lp.services.features.testing import FeatureFixture
 from lp.services.webapp import canonical_url
 from lp.testing import (
     BrowserTestCase,
@@ -29,6 +31,10 @@ class TestCanonicalUrlForOCIRecipeBuild(TestCaseWithFactory):
 
     layer = DatabaseFunctionalLayer
 
+    def setUp(self):
+        super(TestCanonicalUrlForOCIRecipeBuild, self).setUp()
+        self.useFixture(FeatureFixture({OCI_RECIPE_ALLOW_CREATE: 'on'}))
+
     def test_canonical_url(self):
         owner = self.factory.makePerson(name="person")
         distribution = self.factory.makeDistribution(name="distro")
@@ -51,6 +57,7 @@ class TestOCIRecipeBuildOperations(BrowserTestCase):
 
     def setUp(self):
         super(TestOCIRecipeBuildOperations, self).setUp()
+        self.useFixture(FeatureFixture({OCI_RECIPE_ALLOW_CREATE: 'on'}))
         self.build = self.factory.makeOCIRecipeBuild()
         self.build_url = canonical_url(self.build)
 
diff --git a/lib/lp/oci/interfaces/ocirecipe.py b/lib/lp/oci/interfaces/ocirecipe.py
index 99a0719..ca70e38 100644
--- a/lib/lp/oci/interfaces/ocirecipe.py
+++ b/lib/lp/oci/interfaces/ocirecipe.py
@@ -15,8 +15,10 @@ __all__ = [
     'IOCIRecipeView',
     'NoSourceForOCIRecipe',
     'NoSuchOCIRecipe',
+    'OCI_RECIPE_ALLOW_CREATE',
     'OCI_RECIPE_WEBHOOKS_FEATURE_FLAG',
     'OCIRecipeBuildAlreadyPending',
+    'OCIRecipeFeatureDisabled',
     'OCIRecipeNotOwner',
     ]
 
@@ -58,6 +60,16 @@ from lp.services.webhooks.interfaces import IWebhookTarget
 
 
 OCI_RECIPE_WEBHOOKS_FEATURE_FLAG = "oci.recipe.webhooks.enabled"
+OCI_RECIPE_ALLOW_CREATE = 'oci.recipe.create.enabled'
+
+
+@error_status(http_client.UNAUTHORIZED)
+class OCIRecipeFeatureDisabled(Unauthorized):
+    """Only certain users can create new LiveFS-related objects."""
+
+    def __init__(self):
+        super(OCIRecipeFeatureDisabled, self).__init__(
+            "You do not have permission to create new OCI recipe.")
 
 
 @error_status(http_client.UNAUTHORIZED)
@@ -255,7 +267,7 @@ class IOCIRecipeSet(Interface):
 
     def new(name, registrant, owner, oci_project, git_ref, build_file,
             description=None, official=False, require_virtualized=True,
-            date_created=DEFAULT):
+            build_daily=False, date_created=DEFAULT):
         """Create an IOCIRecipe."""
 
     def exists(owner, oci_project, name):
diff --git a/lib/lp/oci/model/ocirecipe.py b/lib/lp/oci/model/ocirecipe.py
index 68f5e92..21a936b 100644
--- a/lib/lp/oci/model/ocirecipe.py
+++ b/lib/lp/oci/model/ocirecipe.py
@@ -42,7 +42,9 @@ from lp.oci.interfaces.ocirecipe import (
     IOCIRecipeSet,
     NoSourceForOCIRecipe,
     NoSuchOCIRecipe,
+    OCI_RECIPE_ALLOW_CREATE,
     OCIRecipeBuildAlreadyPending,
+    OCIRecipeFeatureDisabled,
     OCIRecipeNotOwner,
     )
 from lp.oci.interfaces.ocirecipebuild import IOCIRecipeBuildSet
@@ -62,6 +64,7 @@ from lp.services.database.stormexpr import (
     Greatest,
     NullsLast,
     )
+from lp.services.features import getFeatureFlag
 from lp.services.webhooks.interfaces import IWebhookSet
 from lp.services.webhooks.model import WebhookTargetMixin
 
@@ -112,7 +115,9 @@ class OCIRecipe(Storm, WebhookTargetMixin):
 
     def __init__(self, name, registrant, owner, oci_project, git_ref,
                  description=None, official=False, require_virtualized=True,
-                 build_file=None, date_created=DEFAULT):
+                 build_file=None, build_daily=False, date_created=DEFAULT):
+        if not getFeatureFlag(OCI_RECIPE_ALLOW_CREATE):
+            raise OCIRecipeFeatureDisabled()
         super(OCIRecipe, self).__init__()
         self.name = name
         self.registrant = registrant
@@ -122,6 +127,7 @@ class OCIRecipe(Storm, WebhookTargetMixin):
         self.build_file = build_file
         self.official = official
         self.require_virtualized = require_virtualized
+        self.build_daily = build_daily
         self.date_created = date_created
         self.date_last_modified = date_created
         self.git_ref = git_ref
@@ -276,7 +282,7 @@ class OCIRecipeSet:
 
     def new(self, name, registrant, owner, oci_project, git_ref, build_file,
             description=None, official=False, require_virtualized=True,
-            date_created=DEFAULT):
+            build_daily=False, date_created=DEFAULT):
         """See `IOCIRecipeSet`."""
         if not registrant.inTeam(owner):
             if owner.is_team:
@@ -297,7 +303,8 @@ class OCIRecipeSet:
         store = IMasterStore(OCIRecipe)
         oci_recipe = OCIRecipe(
             name, registrant, owner, oci_project, git_ref, description,
-            official, require_virtualized, build_file, date_created)
+            official, require_virtualized, build_file, build_daily,
+            date_created)
         store.add(oci_recipe)
 
         return oci_recipe
diff --git a/lib/lp/oci/tests/helpers.py b/lib/lp/oci/tests/helpers.py
index dc0e82f..e199241 100644
--- a/lib/lp/oci/tests/helpers.py
+++ b/lib/lp/oci/tests/helpers.py
@@ -12,6 +12,9 @@ import base64
 
 from nacl.public import PrivateKey
 
+from lp.oci.interfaces.ocirecipe import OCI_RECIPE_ALLOW_CREATE
+from lp.services.features.testing import FeatureFixture
+
 
 class OCIConfigHelperMixin:
 
@@ -25,3 +28,5 @@ class OCIConfigHelperMixin:
             "oci",
             registry_secrets_private_key=base64.b64encode(
                 bytes(self.private_key)).decode("UTF-8"))
+        # Default feature flags for our tests
+        self.useFixture(FeatureFixture({OCI_RECIPE_ALLOW_CREATE: 'on'}))
diff --git a/lib/lp/oci/tests/test_ocirecipe.py b/lib/lp/oci/tests/test_ocirecipe.py
index 3c60e7e..e15dd8e 100644
--- a/lib/lp/oci/tests/test_ocirecipe.py
+++ b/lib/lp/oci/tests/test_ocirecipe.py
@@ -9,8 +9,8 @@ import base64
 import json
 
 from fixtures import FakeLogger
-from six import string_types
 from nacl.public import PrivateKey
+from six import string_types
 from storm.exceptions import LostObjectError
 from testtools.matchers import (
     ContainsDict,
@@ -29,6 +29,7 @@ from lp.oci.interfaces.ocirecipe import (
     IOCIRecipeSet,
     NoSourceForOCIRecipe,
     NoSuchOCIRecipe,
+    OCI_RECIPE_ALLOW_CREATE,
     OCI_RECIPE_WEBHOOKS_FEATURE_FLAG,
     OCIRecipeBuildAlreadyPending,
     OCIRecipeNotOwner,
@@ -60,6 +61,10 @@ class TestOCIRecipe(TestCaseWithFactory):
 
     layer = DatabaseFunctionalLayer
 
+    def setUp(self):
+        super(TestOCIRecipe, self).setUp()
+        self.useFixture(FeatureFixture({OCI_RECIPE_ALLOW_CREATE: 'on'}))
+
     def test_implements_interface(self):
         target = self.factory.makeOCIRecipe()
         with admin_logged_in():
@@ -106,7 +111,8 @@ class TestOCIRecipe(TestCaseWithFactory):
     def test_requestBuild_triggers_webhooks(self):
         # Requesting a build triggers webhooks.
         logger = self.useFixture(FakeLogger())
-        with FeatureFixture({OCI_RECIPE_WEBHOOKS_FEATURE_FLAG: "on"}):
+        with FeatureFixture({OCI_RECIPE_WEBHOOKS_FEATURE_FLAG: "on",
+                             OCI_RECIPE_ALLOW_CREATE: 'on'}):
             recipe = self.factory.makeOCIRecipe()
             oci_arch = self.factory.makeOCIRecipeArch(recipe=recipe)
             hook = self.factory.makeWebhook(
@@ -153,7 +159,8 @@ class TestOCIRecipe(TestCaseWithFactory):
 
     def test_related_webhooks_deleted(self):
         owner = self.factory.makePerson()
-        with FeatureFixture({OCI_RECIPE_WEBHOOKS_FEATURE_FLAG: "on"}):
+        with FeatureFixture({OCI_RECIPE_WEBHOOKS_FEATURE_FLAG: "on",
+                             OCI_RECIPE_ALLOW_CREATE: 'on'}):
             recipe = self.factory.makeOCIRecipe(registrant=owner, owner=owner)
             webhook = self.factory.makeWebhook(target=recipe)
         with person_logged_in(recipe.owner):
@@ -214,6 +221,10 @@ class TestOCIRecipeSet(TestCaseWithFactory):
 
     layer = DatabaseFunctionalLayer
 
+    def setUp(self):
+        super(TestOCIRecipeSet, self).setUp()
+        self.useFixture(FeatureFixture({OCI_RECIPE_ALLOW_CREATE: 'on'}))
+
     def test_implements_interface(self):
         target_set = getUtility(IOCIRecipeSet)
         with admin_logged_in():
@@ -382,10 +393,12 @@ class TestOCIRecipeWebservice(TestCaseWithFactory):
 
     def setUp(self):
         super(TestOCIRecipeWebservice, self).setUp()
-        self.person = self.factory.makePerson(displayname="Test Person")
+        self.person = self.factory.makePerson(
+            displayname="Test Person")
         self.webservice = webservice_for_person(
             self.person, permission=OAuthPermission.WRITE_PUBLIC,
             default_api_version="devel")
+        self.useFixture(FeatureFixture({OCI_RECIPE_ALLOW_CREATE: 'on'}))
 
     def getAbsoluteURL(self, target):
         """Get the webservice absolute URL of the given object or relative
@@ -401,38 +414,39 @@ class TestOCIRecipeWebservice(TestCaseWithFactory):
 
     def test_api_get_oci_recipe(self):
         with person_logged_in(self.person):
-            project = removeSecurityProxy(self.factory.makeOCIProject(
-                registrant=self.person))
-            recipe = removeSecurityProxy(self.factory.makeOCIRecipe(
-                oci_project=project))
+            oci_project = self.factory.makeOCIProject(
+                registrant=self.person)
+            recipe = self.factory.makeOCIRecipe(
+                oci_project=oci_project)
             url = api_url(recipe)
 
         ws_recipe = self.load_from_api(url)
 
-        recipe_abs_url = self.getAbsoluteURL(recipe)
-        self.assertThat(ws_recipe, ContainsDict(dict(
-            date_created=Equals(recipe.date_created.isoformat()),
-            date_last_modified=Equals(recipe.date_last_modified.isoformat()),
-            registrant_link=Equals(self.getAbsoluteURL(recipe.registrant)),
-            webhooks_collection_link=Equals(recipe_abs_url + "/webhooks"),
-            name=Equals(recipe.name),
-            owner_link=Equals(self.getAbsoluteURL(recipe.owner)),
-            oci_project_link=Equals(self.getAbsoluteURL(project)),
-            git_ref_link=Equals(self.getAbsoluteURL(recipe.git_ref)),
-            description=Equals(recipe.description),
-            build_file=Equals(recipe.build_file),
-            build_daily=Equals(recipe.build_daily)
-            )))
+        with person_logged_in(self.person):
+            recipe_abs_url = self.getAbsoluteURL(recipe)
+            self.assertThat(ws_recipe, ContainsDict(dict(
+                date_created=Equals(recipe.date_created.isoformat()),
+                date_last_modified=Equals(recipe.date_last_modified.isoformat()),
+                registrant_link=Equals(self.getAbsoluteURL(recipe.registrant)),
+                webhooks_collection_link=Equals(recipe_abs_url + "/webhooks"),
+                name=Equals(recipe.name),
+                owner_link=Equals(self.getAbsoluteURL(recipe.owner)),
+                oci_project_link=Equals(self.getAbsoluteURL(oci_project)),
+                git_ref_link=Equals(self.getAbsoluteURL(recipe.git_ref)),
+                description=Equals(recipe.description),
+                build_file=Equals(recipe.build_file),
+                build_daily=Equals(recipe.build_daily)
+                )))
 
     def test_api_patch_oci_recipe(self):
         with person_logged_in(self.person):
             distro = self.factory.makeDistribution(owner=self.person)
-            project = removeSecurityProxy(self.factory.makeOCIProject(
-                pillar=distro, registrant=self.person))
+            oci_project = self.factory.makeOCIProject(
+                pillar=distro, registrant=self.person)
             # Only the owner should be able to edit.
-            recipe = removeSecurityProxy(self.factory.makeOCIRecipe(
-                oci_project=project, owner=self.person,
-                registrant=self.person))
+            recipe = self.factory.makeOCIRecipe(
+                oci_project=oci_project, owner=self.person,
+                registrant=self.person)
             url = api_url(recipe)
 
         new_description = 'Some other description'
@@ -450,13 +464,13 @@ class TestOCIRecipeWebservice(TestCaseWithFactory):
             other_person = self.factory.makePerson()
         with person_logged_in(other_person):
             distro = self.factory.makeDistribution(owner=other_person)
-            project = removeSecurityProxy(self.factory.makeOCIProject(
-                pillar=distro, registrant=other_person))
+            oci_project = self.factory.makeOCIProject(
+                pillar=distro, registrant=other_person)
             # Only the owner should be able to edit.
-            recipe = removeSecurityProxy(self.factory.makeOCIRecipe(
-                oci_project=project, owner=other_person,
+            recipe = self.factory.makeOCIRecipe(
+                oci_project=oci_project, owner=other_person,
                 registrant=other_person,
-                description="old description"))
+                description="old description")
             url = api_url(recipe)
 
         new_description = 'Some other description'
@@ -467,3 +481,92 @@ class TestOCIRecipeWebservice(TestCaseWithFactory):
 
         ws_project = self.load_from_api(url)
         self.assertEqual("old description", ws_project['description'])
+
+    def test_api_create_oci_recipe(self):
+        with person_logged_in(self.person):
+            distro = self.factory.makeDistribution(
+                owner=self.person)
+            oci_project = self.factory.makeOCIProject(
+                pillar=distro, registrant=self.person)
+            git_ref = self.factory.makeGitRefs()[0]
+
+            oci_project_url = api_url(oci_project)
+            git_ref_url = api_url(git_ref)
+            person_url = api_url(self.person)
+
+        obj = {
+            "name": "my-recipe",
+            "owner": person_url,
+            "git_ref": git_ref_url,
+            "build_file": "./Dockerfile",
+            "description": "My recipe"}
+
+        resp = self.webservice.named_post(oci_project_url, "newRecipe", **obj)
+        self.assertEqual(201, resp.status, resp.body)
+
+        new_obj_url = resp.getHeader("Location")
+        ws_recipe = self.load_from_api(new_obj_url)
+
+        with person_logged_in(self.person):
+            self.assertThat(ws_recipe, ContainsDict(dict(
+                name=Equals(obj["name"]),
+                oci_project_link=Equals(self.getAbsoluteURL(oci_project)),
+                git_ref_link=Equals(self.getAbsoluteURL(git_ref)),
+                build_file=Equals(obj["build_file"]),
+                description=Equals(obj["description"]),
+                owner_link=Equals(self.getAbsoluteURL(self.person)),
+                registrant_link=Equals(self.getAbsoluteURL(self.person)),
+            )))
+
+    def test_api_create_oci_recipe_non_legitimate_user(self):
+        """Ensure that a non-legitimate user cannot create recipe using API"""
+        self.pushConfig(
+            'launchpad', min_legitimate_karma=9999,
+            min_legitimate_account_age=9999)
+
+        with person_logged_in(self.person):
+            distro = self.factory.makeDistribution(
+                owner=self.person)
+            oci_project = self.factory.makeOCIProject(
+                pillar=distro, registrant=self.person)
+            git_ref = self.factory.makeGitRefs()[0]
+
+            oci_project_url = api_url(oci_project)
+            git_ref_url = api_url(git_ref)
+            person_url = api_url(self.person)
+
+        obj = {
+            "name": "My recipe",
+            "owner": person_url,
+            "git_ref": git_ref_url,
+            "build_file": "./Dockerfile",
+            "description": "My recipe"}
+
+        resp = self.webservice.named_post(oci_project_url, "newRecipe", **obj)
+        self.assertEqual(401, resp.status, resp.body)
+
+    def test_api_create_oci_recipe_is_disabled_by_feature_flag(self):
+        """Ensure that OCI newRecipe API method returns HTTP 401 when the
+        feature flag is not set."""
+        self.useFixture(FeatureFixture({OCI_RECIPE_ALLOW_CREATE: ''}))
+
+        with person_logged_in(self.person):
+            distro = self.factory.makeDistribution(
+                owner=self.person)
+            oci_project = self.factory.makeOCIProject(
+                pillar=distro, registrant=self.person)
+            git_ref = self.factory.makeGitRefs()[0]
+
+            oci_project_url = api_url(oci_project)
+            git_ref_url = api_url(git_ref)
+            person_url = api_url(self.person)
+
+        obj = {
+            "name": "My recipe",
+            "owner": person_url,
+            "git_ref": git_ref_url,
+            "build_file": "./Dockerfile",
+            "description": "My recipe"}
+
+        resp = self.webservice.named_post(oci_project_url, "newRecipe", **obj)
+        self.assertEqual(401, resp.status, resp.body)
diff --git a/lib/lp/oci/tests/test_ocirecipebuild.py b/lib/lp/oci/tests/test_ocirecipebuild.py
index eec8850..e60a362 100644
--- a/lib/lp/oci/tests/test_ocirecipebuild.py
+++ b/lib/lp/oci/tests/test_ocirecipebuild.py
@@ -23,7 +23,10 @@ from lp.buildmaster.enums import BuildStatus
 from lp.buildmaster.interfaces.buildqueue import IBuildQueue
 from lp.buildmaster.interfaces.packagebuild import IPackageBuild
 from lp.buildmaster.interfaces.processor import IProcessorSet
-from lp.oci.interfaces.ocirecipe import OCI_RECIPE_WEBHOOKS_FEATURE_FLAG
+from lp.oci.interfaces.ocirecipe import (
+    OCI_RECIPE_ALLOW_CREATE,
+    OCI_RECIPE_WEBHOOKS_FEATURE_FLAG,
+    )
 from lp.oci.interfaces.ocirecipebuild import (
     IOCIRecipeBuild,
     IOCIRecipeBuildSet,
@@ -54,6 +57,7 @@ class TestOCIRecipeBuild(TestCaseWithFactory):
 
     def setUp(self):
         super(TestOCIRecipeBuild, self).setUp()
+        self.useFixture(FeatureFixture({OCI_RECIPE_ALLOW_CREATE: 'on'}))
         self.build = self.factory.makeOCIRecipeBuild()
 
     def test_implements_interface(self):
@@ -212,6 +216,10 @@ class TestOCIRecipeBuildSet(TestCaseWithFactory):
 
     layer = DatabaseFunctionalLayer
 
+    def setUp(self):
+        super(TestOCIRecipeBuildSet, self).setUp()
+        self.useFixture(FeatureFixture({OCI_RECIPE_ALLOW_CREATE: 'on'}))
+
     def test_implements_interface(self):
         target = OCIRecipeBuildSet()
         with admin_logged_in():
@@ -241,7 +249,8 @@ class TestOCIRecipeBuildSet(TestCaseWithFactory):
             distribution=distribution, status=SeriesStatus.CURRENT)
         processor = getUtility(IProcessorSet).getByName("386")
         self.useFixture(FeatureFixture({
-            "oci.build_series.%s" % distribution.name: distroseries.name}))
+            "oci.build_series.%s" % distribution.name: distroseries.name,
+            OCI_RECIPE_ALLOW_CREATE: 'on'}))
         distro_arch_series = self.factory.makeDistroArchSeries(
             distroseries=distroseries, architecturetag="i386",
             processor=processor)
diff --git a/lib/lp/oci/tests/test_ocirecipebuildbehaviour.py b/lib/lp/oci/tests/test_ocirecipebuildbehaviour.py
index 58b6adc..1d9328b 100644
--- a/lib/lp/oci/tests/test_ocirecipebuildbehaviour.py
+++ b/lib/lp/oci/tests/test_ocirecipebuildbehaviour.py
@@ -1,4 +1,4 @@
-# Copyright 2015-2019 Canonical Ltd.  This software is licensed under the
+# Copyright 2015-2020 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """Tests for `OCIRecipeBuildBehaviour`."""
@@ -63,6 +63,7 @@ from lp.buildmaster.tests.snapbuildproxy import (
 from lp.buildmaster.tests.test_buildfarmjobbehaviour import (
     TestGetUploadMethodsMixin,
     )
+from lp.oci.interfaces.ocirecipe import OCI_RECIPE_ALLOW_CREATE
 from lp.oci.model.ocirecipebuildbehaviour import OCIRecipeBuildBehaviour
 from lp.registry.interfaces.series import SeriesStatus
 from lp.services.config import config
@@ -123,6 +124,10 @@ class TestOCIBuildBehaviour(TestCaseWithFactory):
 
     layer = LaunchpadZopelessLayer
 
+    def setUp(self):
+        super(TestOCIBuildBehaviour, self).setUp()
+        self.useFixture(FeatureFixture({OCI_RECIPE_ALLOW_CREATE: 'on'}))
+
     def test_provides_interface(self):
         # OCIRecipeBuildBehaviour provides IBuildFarmJobBehaviour.
         job = OCIRecipeBuildBehaviour(self.factory.makeOCIRecipeBuild())
@@ -159,6 +164,7 @@ class TestAsyncOCIRecipeBuildBehaviour(MakeOCIBuildMixin, TestCaseWithFactory):
         self.now = time.time()
         self.useFixture(fixtures.MockPatch(
             "time.time", return_value=self.now))
+        self.useFixture(FeatureFixture({OCI_RECIPE_ALLOW_CREATE: 'on'}))
 
     @defer.inlineCallbacks
     def test_composeBuildRequest(self):
@@ -350,7 +356,8 @@ class TestAsyncOCIRecipeBuildBehaviour(MakeOCIBuildMixin, TestCaseWithFactory):
             distribution=distribution, status=SeriesStatus.CURRENT)
         processor = getUtility(IProcessorSet).getByName("386")
         self.useFixture(FeatureFixture({
-            "oci.build_series.%s" % distribution.name: distroseries.name}))
+            "oci.build_series.%s" % distribution.name: distroseries.name,
+            OCI_RECIPE_ALLOW_CREATE: 'on'}))
         distro_arch_series = self.factory.makeDistroArchSeries(
             distroseries=distroseries, architecturetag="i386",
             processor=processor)
@@ -401,6 +408,7 @@ class TestHandleStatusForOCIRecipeBuild(MakeOCIBuildMixin,
     def setUp(self):
         super(TestHandleStatusForOCIRecipeBuild, self).setUp()
         self.useFixture(fixtures.FakeLogger())
+        self.useFixture(FeatureFixture({OCI_RECIPE_ALLOW_CREATE: 'on'}))
         self.build = self.makeBuild()
         # For the moment, we require a builder for the build so that
         # handleStatus_OK can get a reference to the slave.
@@ -627,3 +635,6 @@ class TestHandleStatusForOCIRecipeBuild(MakeOCIBuildMixin,
 class TestGetUploadMethodsForOCIRecipeBuild(
     MakeOCIBuildMixin, TestGetUploadMethodsMixin, TestCaseWithFactory):
     """IPackageBuild.getUpload-related methods work with OCI recipe builds."""
+    def setUp(self):
+        self.useFixture(FeatureFixture({OCI_RECIPE_ALLOW_CREATE: 'on'}))
+        super(TestGetUploadMethodsForOCIRecipeBuild, self).setUp()
diff --git a/lib/lp/registry/configure.zcml b/lib/lp/registry/configure.zcml
index d5875c5..f3bcd9f 100644
--- a/lib/lp/registry/configure.zcml
+++ b/lib/lp/registry/configure.zcml
@@ -745,6 +745,9 @@
             permission="launchpad.Edit"
             interface="lp.registry.interfaces.ociproject.IOCIProjectEdit"
             set_schema="lp.registry.interfaces.ociproject.IOCIProjectEditableAttributes" />
+        <require
+            permission="launchpad.AnyLegitimatePerson"
+            interface="lp.registry.interfaces.ociproject.IOCIProjectLegitimate"/>
     </class>
     <subscriber
         for="lp.registry.interfaces.ociproject.IOCIProject zope.lifecycleevent.interfaces.IObjectModifiedEvent"
diff --git a/lib/lp/registry/interfaces/ociproject.py b/lib/lp/registry/interfaces/ociproject.py
index b39c71f..8a3e734 100644
--- a/lib/lp/registry/interfaces/ociproject.py
+++ b/lib/lp/registry/interfaces/ociproject.py
@@ -13,16 +13,23 @@ __all__ = [
     ]
 
 from lazr.restful.declarations import (
+    call_with,
     export_as_webservice_entry,
+    export_factory_operation,
     exported,
+    operation_for_version,
+    operation_parameters,
+    REQUEST_USER,
     )
 from lazr.restful.fields import (
     CollectionField,
     Reference,
     ReferenceChoice,
     )
+from lp.app.validators.path import path_does_not_escape
 from zope.interface import Interface
 from zope.schema import (
+    Bool,
     Datetime,
     Int,
     Text,
@@ -32,12 +39,16 @@ from zope.schema import (
 from lp import _
 from lp.app.validators.name import name_validator
 from lp.bugs.interfaces.bugtarget import IBugTarget
+from lp.code.interfaces.gitref import IGitRef
 from lp.code.interfaces.hasgitrepositories import IHasGitRepositories
 from lp.registry.interfaces.distribution import IDistribution
 from lp.registry.interfaces.ociprojectname import IOCIProjectName
 from lp.registry.interfaces.series import SeriesStatus
 from lp.services.database.constants import DEFAULT
-from lp.services.fields import PublicPersonChoice
+from lp.services.fields import (
+    PersonChoice,
+    PublicPersonChoice,
+    )
 
 
 OCI_PROJECT_ALLOW_CREATE = 'oci.project.create.enabled'
@@ -105,8 +116,44 @@ class IOCIProjectEdit(Interface):
         """Creates a new `IOCIProjectSeries`."""
 
 
+class IOCIProjectLegitimate(Interface):
+    """IOCIProject methods that require launchpad.AnyLegitimatePerson
+    permission.
+    """
+    @call_with(registrant=REQUEST_USER)
+    @operation_parameters(
+        name=TextLine(
+            title=_("OCI Recipe name."),
+            description=_("The name of the new OCI Recipe."),
+            required=True),
+        owner=PersonChoice(
+            title=_("Person or team that owns the new OCI Recipe."),
+            vocabulary="AllUserTeamsParticipationPlusSelf",
+            required=True),
+        git_ref=Reference(IGitRef, title=_("Git branch."), required=True),
+        build_file=TextLine(
+            title=_("Build file path."),
+            description=_(
+                "The relative path to the file within this recipe's "
+                "branch that defines how to build the recipe."),
+            constraint=path_does_not_escape,
+            required=True),
+        description=Text(
+            title=_("Description for this recipe."),
+            description=_("A short description of this recipe."),
+            required=False),
+        build_daily=Bool(
+            title=_("Should this recipe be built daily?."), required=False))
+    @export_factory_operation(Interface, [])
+    @operation_for_version("devel")
+    def newRecipe(name, registrant, owner, git_ref, build_file,
+                  description=None, build_daily=False,
+                  require_virtualized=True):
+        """Create an IOCIRecipe for this project."""
+
+
 class IOCIProject(IOCIProjectView, IOCIProjectEdit,
-                       IOCIProjectEditableAttributes):
+                  IOCIProjectEditableAttributes, IOCIProjectLegitimate):
     """A project containing Open Container Initiative recipes."""
 
     export_as_webservice_entry(
diff --git a/lib/lp/registry/model/ociproject.py b/lib/lp/registry/model/ociproject.py
index aa3a322..2967007 100644
--- a/lib/lp/registry/model/ociproject.py
+++ b/lib/lp/registry/model/ociproject.py
@@ -25,6 +25,7 @@ from zope.interface import implementer
 from zope.security.proxy import removeSecurityProxy
 
 from lp.bugs.model.bugtarget import BugTargetBase
+from lp.oci.interfaces.ocirecipe import IOCIRecipeSet
 from lp.registry.interfaces.distribution import IDistribution
 from lp.registry.interfaces.ociproject import (
     IOCIProject,
@@ -107,6 +108,21 @@ class OCIProject(BugTargetBase, StormBase):
     bugtargetname = display_name
     bugtargetdisplayname = display_name
 
+    def newRecipe(self, name, registrant, owner, git_ref,
+                  build_file, description=None, build_daily=False,
+                  require_virtualized=True):
+        return getUtility(IOCIRecipeSet).new(
+            name=name,
+            registrant=registrant,
+            owner=owner,
+            oci_project=self,
+            git_ref=git_ref,
+            build_file=build_file,
+            description=description,
+            require_virtualized=require_virtualized,
+            build_daily=build_daily,
+        )
+
     def newSeries(self, name, summary, registrant,
                   status=SeriesStatus.DEVELOPMENT, date_created=DEFAULT):
         """See `IOCIProject`."""
diff --git a/lib/lp/registry/tests/test_personmerge.py b/lib/lp/registry/tests/test_personmerge.py
index 890b421..02fefcc 100644
--- a/lib/lp/registry/tests/test_personmerge.py
+++ b/lib/lp/registry/tests/test_personmerge.py
@@ -1,4 +1,4 @@
-# Copyright 2009-2018 Canonical Ltd.  This software is licensed under the
+# Copyright 2009-2020 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """Tests for merge_people."""
@@ -18,7 +18,10 @@ from zope.security.proxy import removeSecurityProxy
 from lp.app.enums import InformationType
 from lp.app.interfaces.launchpad import ILaunchpadCelebrities
 from lp.code.interfaces.gitrepository import IGitRepositorySet
-from lp.oci.interfaces.ocirecipe import IOCIRecipeSet
+from lp.oci.interfaces.ocirecipe import (
+    IOCIRecipeSet,
+    OCI_RECIPE_ALLOW_CREATE,
+    )
 from lp.registry.interfaces.accesspolicy import (
     IAccessArtifactGrantSource,
     IAccessPolicyGrantSource,
@@ -664,6 +667,7 @@ class TestMergePeople(TestCaseWithFactory, KarmaTestMixin):
     def test_merge_moves_oci_recipes(self):
         # When person/teams are merged, oci recipes owned by the from
         # person are moved.
+        self.useFixture(FeatureFixture({OCI_RECIPE_ALLOW_CREATE: 'on'}))
         duplicate = self.factory.makePerson()
         mergee = self.factory.makePerson()
         self.factory.makeOCIRecipe(registrant=duplicate, owner=duplicate)
@@ -676,6 +680,7 @@ class TestMergePeople(TestCaseWithFactory, KarmaTestMixin):
     def test_merge_with_duplicated_oci_recipes(self):
         # If both the from and to people have oci recipes with the same
         # name, merging renames the duplicate from the from person's side.
+        self.useFixture(FeatureFixture({OCI_RECIPE_ALLOW_CREATE: 'on'}))
         duplicate = self.factory.makePerson()
         mergee = self.factory.makePerson()
         [ref] = self.factory.makeGitRefs()
diff --git a/lib/lp/services/webhooks/tests/test_job.py b/lib/lp/services/webhooks/tests/test_job.py
index caf81ce..fde24da 100644
--- a/lib/lp/services/webhooks/tests/test_job.py
+++ b/lib/lp/services/webhooks/tests/test_job.py
@@ -37,7 +37,10 @@ from zope.component import getUtility
 from zope.security.proxy import removeSecurityProxy
 
 from lp.app import versioninfo
-from lp.oci.interfaces.ocirecipe import OCI_RECIPE_WEBHOOKS_FEATURE_FLAG
+from lp.oci.interfaces.ocirecipe import (
+    OCI_RECIPE_ALLOW_CREATE,
+    OCI_RECIPE_WEBHOOKS_FEATURE_FLAG,
+    )
 from lp.services.database.interfaces import IStore
 from lp.services.features.testing import FeatureFixture
 from lp.services.job.interfaces.job import JobStatus
@@ -358,7 +361,8 @@ class TestWebhookDeliveryJob(TestCaseWithFactory):
     def test_oci_recipe__repr__(self):
         # `WebhookDeliveryJob` objects for OCI recipes have an informative
         # __repr__.
-        with FeatureFixture({OCI_RECIPE_WEBHOOKS_FEATURE_FLAG: "on"}):
+        with FeatureFixture({OCI_RECIPE_WEBHOOKS_FEATURE_FLAG: "on",
+                             OCI_RECIPE_ALLOW_CREATE: 'on'}):
             recipe = self.factory.makeOCIRecipe()
         hook = self.factory.makeWebhook(target=recipe)
         job = WebhookDeliveryJob.create(hook, 'test', payload={'foo': 'bar'})