Merge lp:~salgado/offspring/acl-editor into lp:~linaro-automation/offspring/linaro

[Guilherme Salgado]

Add a new page (+acl) to edit the list of people who can see a given project. For now there are no links to that page but my next branch will add that.

[James Tunnicliffe (dooferlad)]

Good stuff.

review: Approve

[Guilherme Salgado (salgado)]

In fact this was merged into our integration branch (lp:~linaro-infrastructure/offspring/private-builds)

=== modified file 'lib/offspring/web/queuemanager/forms.py'
--- lib/offspring/web/queuemanager/forms.py	2011-03-03 00:06:58 +0000
+++ lib/offspring/web/queuemanager/forms.py	2011-10-10 15:22:27 +0000
@@ -1,8 +1,10 @@
 # Copyright 2010 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
+from django.contrib.auth.models import User
 from django.db import models
-from django.forms import ModelChoiceField, ModelForm, Textarea, TextInput
+from django.forms import (
+    Form, ModelChoiceField, ModelForm, Textarea, TextInput)
 from django.forms import fields
 
 from offspring.web.queuemanager.models import (
@@ -47,6 +49,10 @@
         exclude = ('name', 'priority', 'is_active')
 
 
+class AccessGroupMemberForm(Form):
+    new_user = ModelChoiceField(queryset=User.objects, required=False)
+
+
 class ReleaseForm(ModelForm):
     class Meta:
         model = Release

=== modified file 'lib/offspring/web/queuemanager/tests/test_views.py'
--- lib/offspring/web/queuemanager/tests/test_views.py	2011-10-10 15:22:27 +0000
+++ lib/offspring/web/queuemanager/tests/test_views.py	2011-10-10 15:22:27 +0000
@@ -185,6 +185,80 @@
         self.assertEqual(404, response.status_code)
 
 
+class TestProjectACLView(TestCase):
+
+    def test_is_visible_to_owner(self):
+        project = factory.makeProject(is_private=True)
+        user = project.owner
+        grant_permission_to_user(user, 'change_project')
+        self.assertTrue(
+            self.client.login(username=user.username, password=user.username))
+        response = self.client.get(
+            reverse('offspring.web.queuemanager.views.project_acl',
+                    args=[project.name]))
+        self.assertContains(
+            response, 'Update ACLs for %s' % project.title.capitalize(),
+            status_code=200, msg_prefix=response.content)
+
+    def test_is_visible_to_access_group_member(self):
+        user = factory.makeUser()
+        grant_permission_to_user(user, 'change_project')
+        group = factory.makeAccessGroup([user])
+        project = factory.makeProject(is_private=True, access_groups=[group])
+        self.assertTrue(
+            self.client.login(username=user.username, password=user.username))
+        response = self.client.get(
+            reverse('offspring.web.queuemanager.views.project_acl',
+                    args=[project.name]))
+        self.assertContains(
+            response, 'Update ACLs for %s' % project.title.capitalize(),
+            status_code=200, msg_prefix=response.content)
+
+    def test_is_not_visible_to_others(self):
+        user = factory.makeUser()
+        grant_permission_to_user(user, 'change_project')
+        project = factory.makeProject(is_private=True)
+        self.assertTrue(
+            self.client.login(username=user.username, password=user.username))
+        response = self.client.get(
+            reverse('offspring.web.queuemanager.views.project_acl',
+                    args=[project.name]))
+        self.assertEqual(404, response.status_code)
+
+    def test_add_new_user(self):
+        project = factory.makeProject(is_private=True)
+        user = project.owner
+        grant_permission_to_user(user, 'change_project')
+        self.assertTrue(
+            self.client.login(username=user.username, password=user.username))
+        member = factory.makeUser()
+        data = {'new_user': member.id}
+        response = self.client.post(
+            reverse('offspring.web.queuemanager.views.project_acl',
+                    args=[project.name]),
+            data)
+        self.assertEqual(200, response.status_code)
+        access_group = project.access_groups.all()[0]
+        self.assertEqual([member], list(access_group.members.all()))
+
+    def test_remove_member(self):
+        member = factory.makeUser()
+        group = factory.makeAccessGroup([member])
+        project = factory.makeProject(is_private=True, access_groups=[group])
+        user = project.owner
+        grant_permission_to_user(user, 'change_project')
+        self.assertTrue(
+            self.client.login(username=user.username, password=user.username))
+        data = {'disallow': 'Disallow', member.username: 'on'}
+        response = self.client.post(
+            reverse('offspring.web.queuemanager.views.project_acl',
+                    args=[project.name]),
+            data)
+        self.assertEqual(200, response.status_code)
+        access_group = project.access_groups.all()[0]
+        self.assertEqual([], list(access_group.members.all()))
+
+
 def make_user_and_login(client):
     user = factory.makeUser()
     return client.login(username=user.username, password=user.username)

=== modified file 'lib/offspring/web/queuemanager/views.py'
--- lib/offspring/web/queuemanager/views.py	2011-10-10 15:22:27 +0000
+++ lib/offspring/web/queuemanager/views.py	2011-10-10 15:22:27 +0000
@@ -41,9 +41,12 @@
 
 from pygooglechart import PieChart3D
 
+from django_group_access.models import AccessGroup
+
 from offspring import config
 from offspring.enums import ProjectBuildStates
 from offspring.web.queuemanager.forms import (
+    AccessGroupMemberForm,
     CreateProjectForm,
     EditProjectForm,
     LaunchpadProjectForm,
@@ -257,6 +260,58 @@
         'queuemanager/project_details.html', pageData, 
         context_instance=RequestContext(request))
 
+
+@permission_required('queuemanager.change_project')
+def project_acl(request, projectName):
+    user_visible_objects = Project.all_objects.accessible_by_user(
+        request.user)
+    project = get_possibly_private_object(
+        request.user, user_visible_objects, pk=projectName)
+    access_group = None
+    allowed_users = []
+    if len(project.access_groups.all()) > 0:
+        # We always use the first access group because there's no way for
+        # users to register more than one access group for any given project.
+        access_group = project.access_groups.all()[0]
+        allowed_users = access_group.members.all()
+    if request.method == 'POST':
+        form = AccessGroupMemberForm(request.POST)
+        if form.is_valid():
+            # A form submission can be either to add a new member or to remove
+            # an existing one.
+            if form.data.get('new_user'):
+                if access_group is None:
+                    # This project has no access group set up yet, so we
+                    # create one.
+                    access_group = AccessGroup(name=project.name)
+                    access_group.save()
+                    project.access_groups.add(access_group)
+                    project.save()
+                access_group.members.add(form.cleaned_data['new_user'])
+                access_group.save()
+            else:
+                assert 'disallow' in form.data.keys(), ("Unknown form action")
+                for user in allowed_users:
+                    if user.username in form.data.keys():
+                        access_group.members.remove(user)
+                        access_group.save()
+            # We don't redirect on a successful form submission because most
+            # of the time users will want to make multiple changes to the ACL.
+            allowed_users = access_group.members.all()
+            form = AccessGroupMemberForm()
+    else:
+        form = AccessGroupMemberForm()
+    pageData = {
+        'csrf_token' : csrf.get_token(request),
+        'project' : project,
+        'form': form,
+        'allowed_users': allowed_users,
+        }
+    return render_to_response(
+        'queuemanager/project_acl.html', pageData,
+        context_instance=RequestContext(request))
+
+
 def projectgroup_details(request, projectGroupName):
     pg = get_object_or_404(
         ProjectGroup, pk=projectGroupName)

=== added file 'lib/offspring/web/templates/queuemanager/project_acl.html'
--- lib/offspring/web/templates/queuemanager/project_acl.html	1970-01-01 00:00:00 +0000
+++ lib/offspring/web/templates/queuemanager/project_acl.html	2011-10-10 15:22:27 +0000
@@ -0,0 +1,64 @@
+{% extends "base.html" %}
+
+{% block header_css %}
+<link rel="stylesheet" type="text/css" href="/media/css/forms.css" />
+{% endblock %}
+
+{% block title %}
+Update ACLs for {{project.title|capfirst}}
+{% endblock %}
+
+{% block content %}
+  {% if project.is_private %}
+    <p>These are the only users who can see this project or anything related
+    to it.</p>
+  {% else %}
+    <p>This project is not private, so this access control list has no
+    effect.</p>
+  {% endif %}
+  <form method="POST" action="">{% csrf_token %}
+    <div class="module aligned ">
+      {% for field in form %}
+        <div class="form-row {% if line.errors %} errors{% endif %} {{ field.name }}">
+          <div>
+            {{ field.label_tag }}
+            {{ field }}
+            {% if field.field.field.help_text %}
+                <p class="help">{{ field.field.field.help_text|safe }}</p>
+            {% endif %}
+            <input type="submit" value="Add" class="default" name="_save"/>
+          </div>
+            {{ field.errors }}
+        </div>
+      {% endfor %}
+      <h3>Currently allowed users</h3>
+      <table>
+      {% for user in allowed_users %}
+        <tr>
+          <td>
+            <input type="checkbox" name="{{ user.username }}" />
+          </td>
+          <td>
+            {% if user.get_full_name %}
+              {{ user.get_full_name }}
+            {% else %}
+              {{ user.username }}
+            {% endif %}
+            ({{ user.email }})
+          </td>
+        </tr>
+      {% empty %}
+        <div>None</div>
+      {% endfor %}
+      </table>
+      <div class="submit-row" style="overflow: auto;">
+          <input type="submit" value="Disallow Selected Users" name="disallow" />
+          <input type="button" value="Cancel" class="default" name="_cancel"
+                 OnClick="window.location.href = '{% url offspring.web.queuemanager.views.project_details project.name %}';"/>
+      </div>
+    </div>
+  </form>
+{% endblock %}
+
+{% block two-columns %}
+{% endblock %}

=== modified file 'lib/offspring/web/urls.py'
--- lib/offspring/web/urls.py	2011-08-12 01:45:45 +0000
+++ lib/offspring/web/urls.py	2011-10-10 15:22:27 +0000
@@ -28,6 +28,7 @@
     ReleaseHandler
 )
 from offspring.web.queuemanager.views import (
+    project_acl,
     project_create,
     project_edit,
     secure_object_list,
@@ -84,6 +85,7 @@
     (r'^project-groups/(?P<projectGroupName>[^/]+)/$', 'offspring.web.queuemanager.views.projectgroup_details'),
     url(r'^projects/\+add/$', project_create, name="project_create"),
     url(r'^projects/(?P<projectName>[^/]+)/\+edit$', project_edit, name="project_edit"),
+    url(r'^projects/(?P<projectName>[^/]+)/\+acl$', project_acl, name="project_acl"),
     (r'^projects/(?P<projectName>[^/]+)/sources\.list$', 'offspring.web.queuemanager.views.project_development_sourcesList'),
     (r'^projects/(?P<projectName>[^/]+)/\+api/subscription/$', projectNotificationSubscription_handler),
     (r'^projects/(?P<projectName>[^/]+)/\+api/releases/$', release_handler),