Merge ~pappacena/launchpad:oci-project-admin into launchpad:master

[Thiago F. Pappacena]

Adding the attribute and method to check if a given person has permission to manage OCI projects for a given Distribution.

This MP only adds the new Distribution.oci_project_admin attribute and Distribution.canAdministerOCIProjects, so we can unlock the development of UI and API for OCI project creation.

[Colin Watson (cjwatson)]

Thanks. Various comments, but nothing too major. As usual, this will need to wait until the corresponding database patch has been deployed to production and merged into master.

review: Approve

fd62276... by Thiago F. Pappacena on 2020-03-30

Removing oci_project_admin as parameter from some methods and adding special user cases

[Thiago F. Pappacena (pappacena)]

Thanks for the review! I'm pushing requested changes.

fdcd57d... by Thiago F. Pappacena on 2020-04-03

Merge branch 'master' into oci-project-admin

[Colin Watson (cjwatson)]

The corresponding database patch has landed now, so you can go ahead and land this (with one tweak).

review: Approve

2cc36da... by Thiago F. Pappacena on 2020-04-14

Removing duplicated condition on distribution.canAdministerOCIProjects

diff --git a/lib/lp/registry/interfaces/distribution.py b/lib/lp/registry/interfaces/distribution.py
index 4f949e4..23bd93b 100644
--- a/lib/lp/registry/interfaces/distribution.py
+++ b/lib/lp/registry/interfaces/distribution.py
@@ -274,6 +274,11 @@ class IDistributionPublic(
         "All unofficial mirrors of this Distribution.")
     pending_review_mirrors = Attribute(
         "All mirrors of this Distribution that haven't been reviewed yet.")
+    oci_project_admin = exported(PublicPersonChoice(
+        title=_("OCI Project Administrator"),
+        description=_("The person or team that has the rights to manage OCI "
+                      "Projects for this distribution."),
+        required=False, vocabulary='ValidPersonOrTeam'))
     series = exported(doNotSnapshot(
         CollectionField(
             title=_("DistroSeries inside this Distribution"),
@@ -656,6 +661,10 @@ class IDistributionPublic(
     def userCanEdit(user):
         """Can the user edit this distribution?"""
 
+    def canAdministerOCIProjects(person):
+        """Checks if the given person can administer OCI Projects of this
+        distro."""
+
     # XXX: pappacena 2020-04-25: This method is here on IDistributionPublic
     # for now, until we workout the specific permission for creating OCI
     # Projects. It's guarded by the feature flag oci.project.create.enabled.
diff --git a/lib/lp/registry/model/distribution.py b/lib/lp/registry/model/distribution.py
index caaad41..8d565c6 100644
--- a/lib/lp/registry/model/distribution.py
+++ b/lib/lp/registry/model/distribution.py
@@ -114,6 +114,7 @@ from lp.registry.interfaces.person import (
     )
 from lp.registry.interfaces.pillar import IPillarNameSet
 from lp.registry.interfaces.pocket import suffixpocket
+from lp.registry.interfaces.role import IPersonRoles
 from lp.registry.interfaces.series import SeriesStatus
 from lp.registry.interfaces.sourcepackagename import ISourcePackageName
 from lp.registry.model.announcement import MakesAnnouncements
@@ -241,6 +242,9 @@ class Distribution(SQLBase, BugTargetBase, MakesAnnouncements,
     mirror_admin = ForeignKey(
         dbName='mirror_admin', foreignKey='Person',
         storm_validator=validate_public_person, notNull=True)
+    oci_project_admin = ForeignKey(
+        dbName='oci_project_admin', foreignKey='Person',
+        storm_validator=validate_public_person, notNull=False, default=None)
     translationgroup = ForeignKey(
         dbName='translationgroup', foreignKey='TranslationGroup',
         notNull=False, default=None)
@@ -1365,6 +1369,17 @@ class Distribution(SQLBase, BugTargetBase, MakesAnnouncements,
         admins = getUtility(ILaunchpadCelebrities).admin
         return user.inTeam(self.owner) or user.inTeam(admins)
 
+    def canAdministerOCIProjects(self, person):
+        """See `IDistribution`."""
+        if person is None:
+            return False
+        if person.inTeam(self.oci_project_admin):
+            return True
+        person_roles = IPersonRoles(person)
+        if person_roles.in_admin or person_roles.isOwner(self):
+            return True
+        return False
+
     def newSeries(self, name, display_name, title, summary,
                   description, version, previous_series, registrant):
         """See `IDistribution`."""
diff --git a/lib/lp/registry/tests/test_distribution.py b/lib/lp/registry/tests/test_distribution.py
index c7bf86f..8f20b7b 100644
--- a/lib/lp/registry/tests/test_distribution.py
+++ b/lib/lp/registry/tests/test_distribution.py
@@ -1,4 +1,4 @@
-# Copyright 2009-2015 Canonical Ltd.  This software is licensed under the
+# Copyright 2009-2020 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """Tests for Distribution."""
@@ -689,3 +689,50 @@ class TestWebService(WebServiceTestCase):
         self.assertEqual(
             [],
             ws_distro.findReferencedOOPS(start_date=now - day, end_date=now))
+
+
+class DistributionOCIProjectAdminPermission(TestCaseWithFactory):
+    layer = DatabaseFunctionalLayer
+
+    def test_check_oci_project_admin_person(self):
+        person1 = self.factory.makePerson()
+        person2 = self.factory.makePerson()
+        distro = self.factory.makeDistribution(oci_project_admin=person1)
+
+        self.assertTrue(distro.canAdministerOCIProjects(person1))
+        self.assertFalse(distro.canAdministerOCIProjects(person2))
+        self.assertFalse(distro.canAdministerOCIProjects(None))
+
+    def test_check_oci_project_admin_team(self):
+        person1 = self.factory.makePerson()
+        person2 = self.factory.makePerson()
+        person3 = self.factory.makePerson()
+        team = self.factory.makeTeam(owner=person1)
+        distro = self.factory.makeDistribution(oci_project_admin=team)
+
+        admin = self.factory.makeAdministrator()
+        with person_logged_in(admin):
+            person2.join(team)
+
+        self.assertTrue(distro.canAdministerOCIProjects(team))
+        self.assertTrue(distro.canAdministerOCIProjects(person1))
+        self.assertTrue(distro.canAdministerOCIProjects(person2))
+        self.assertFalse(distro.canAdministerOCIProjects(person3))
+        self.assertFalse(distro.canAdministerOCIProjects(None))
+
+    def test_check_oci_project_admin_without_any_admin(self):
+        person1 = self.factory.makePerson()
+        distro = self.factory.makeDistribution(oci_project_admin=None)
+
+        self.assertFalse(distro.canAdministerOCIProjects(person1))
+        self.assertFalse(distro.canAdministerOCIProjects(None))
+
+    def test_check_oci_project_admin_user_and_distro_owner(self):
+        admin = self.factory.makeAdministrator()
+        owner = self.factory.makePerson()
+        someone = self.factory.makePerson()
+        distro = self.factory.makeDistribution(owner=owner)
+
+        self.assertFalse(distro.canAdministerOCIProjects(someone))
+        self.assertTrue(distro.canAdministerOCIProjects(owner))
+        self.assertTrue(distro.canAdministerOCIProjects(admin))
diff --git a/lib/lp/testing/factory.py b/lib/lp/testing/factory.py
index db46838..c1475af 100644
--- a/lib/lp/testing/factory.py
+++ b/lib/lp/testing/factory.py
@@ -2664,7 +2664,8 @@ class BareLaunchpadObjectFactory(ObjectFactory):
                          aliases=None, bug_supervisor=None, driver=None,
                          publish_root_dir=None, publish_base_url=None,
                          publish_copy_base_url=None, no_pubconf=False,
-                         icon=None, summary=None, vcs=None):
+                         icon=None, summary=None, vcs=None,
+                         oci_project_admin=None):
         """Make a new distribution."""
         if name is None:
             name = self.getUniqueString(prefix="distribution")
@@ -2692,6 +2693,8 @@ class BareLaunchpadObjectFactory(ObjectFactory):
             naked_distro.driver = driver
         if bug_supervisor is not None:
             naked_distro.bug_supervisor = bug_supervisor
+        if oci_project_admin is not None:
+            naked_distro.oci_project_admin = oci_project_admin
         if not no_pubconf:
             self.makePublisherConfig(
                 distro, publish_root_dir, publish_base_url,