Merge lp:~salgado/offspring/make-piston-handlers-privacy-aware into lp:~linaro-automation/offspring/private-builds

[Guilherme Salgado]

Update most of the piston handlers to include private objects the user is allowed to see. There are two handlers that still need to be updated but those will be done in another branch as this one is already of a reasonable size.

[James Tunnicliffe (dooferlad)]

Good stuff.

review: Approve

=== modified file 'lib/offspring/web/queuemanager/handlers.py'
--- lib/offspring/web/queuemanager/handlers.py	2011-08-13 07:24:06 +0000
+++ lib/offspring/web/queuemanager/handlers.py	2011-10-13 23:27:26 +0000
@@ -43,9 +43,11 @@
     allowed_methods = ('GET')
 
     def read(self, request, projectName, buildName):
+        projects = Project.all_objects.accessible_by_user(request.user)
         try:
-            project = Project.objects.get(pk=projectName)
-            build = BuildResult.objects.get(project=project, name=buildName)
+            project = projects.get(pk=projectName)
+            build = BuildResult.all_objects.accessible_by_user(
+                request.user).get(project=project, name=buildName)
         except: 
             return rc.NOT_FOUND
         manifestPath = glob.glob(build.result_directory + '/images/*/*.manifest')[0]
@@ -56,14 +58,17 @@
     allowed_methods = ('GET')
 
     def read(self, request, projectName, buildName):
+        projects = Project.all_objects.accessible_by_user(request.user)
+        builds = BuildResult.all_objects.accessible_by_user(request.user)
         try:
-            project = Project.objects.get(pk=projectName)
-            base_build = BuildResult.objects.get(project=project, name=buildName)
+            project = projects.get(pk=projectName)
+            base_build = builds.get(project=project, name=buildName)
         except:
             return rc.NOT_FOUND
         if request.GET.has_key('build'):
             try:
-                target_build = BuildResult.objects.get(project=project, name=request.GET['build'])
+                target_build = builds.get(
+                    project=project, name=request.GET['build'])
             except:
                 return rc.NOT_FOUND
         else:
@@ -81,6 +86,7 @@
         return output
 
 
+# TODO: Must be made privacy-aware.
 class ProjectNotificationSubscriptionHandler(BaseHandler):
     allowed_methods = ('GET', 'POST', 'DELETE')
     model = ProjectNotificationSubscription
@@ -138,7 +144,7 @@
         'reason', 'result', 'notes', 'is_released')
 
     def read(self, request, projectName=None, buildName=None, builderName=None):
-        results = BuildResult.objects.all()
+        results = BuildResult.all_objects.accessible_by_user(request.user)
         if projectName is not None:
             results = results.filter(project__name=projectName)
         if buildName is not None:
@@ -148,6 +154,7 @@
         return results
 
 
+# TODO: Must be made privacy-aware.
 class BuildRequestHandler(BaseHandler):
     allowed_methods = ('GET', 'POST', 'DELETE')
     model = BuildRequest
@@ -217,8 +224,9 @@
         'created_at', 'published_at', 'status', 'checklist_url', 'notes')
 
     def read(self, request, projectName):
+        objects = Release.all_objects.accessible_by_user(request.user)
         try:
-            releases = Release.objects.filter(build__project__name=projectName)
+            releases = objects.filter(build__project__name=projectName)
         except:
             return rc.NOT_FOUND
         return releases

=== modified file 'lib/offspring/web/queuemanager/tests/__init__.py'
--- lib/offspring/web/queuemanager/tests/__init__.py	2011-09-29 19:19:09 +0000
+++ lib/offspring/web/queuemanager/tests/__init__.py	2011-10-13 23:27:26 +0000
@@ -1,2 +1,3 @@
+from .test_handlers import *
 from .test_models import *
 from .test_views import *

=== modified file 'lib/offspring/web/queuemanager/tests/factory.py'
--- lib/offspring/web/queuemanager/tests/factory.py	2011-10-10 14:11:38 +0000
+++ lib/offspring/web/queuemanager/tests/factory.py	2011-10-13 23:27:26 +0000
@@ -66,13 +66,15 @@
         group.save()
         return group
 
-    def makeBuildResult(self, project=None, name=None, result=None):
+    def makeBuildResult(self, project=None, name=None, result=None,
+                        builder=None):
         if name is None:
             name = self.getUniqueString()
         if project is None:
             project = self.makeProject()
             project.save()
-        result = BuildResult(name=name, project=project, result=result)
+        result = BuildResult(name=name, project=project, result=result,
+                             builder=builder)
         result.save()
         return result
 

=== added file 'lib/offspring/web/queuemanager/tests/test_handlers.py'
--- lib/offspring/web/queuemanager/tests/test_handlers.py	1970-01-01 00:00:00 +0000
+++ lib/offspring/web/queuemanager/tests/test_handlers.py	2011-10-13 23:27:26 +0000
@@ -0,0 +1,213 @@
+import errno
+import os
+
+from django.contrib.auth import authenticate, login
+from django.http import HttpRequest, HttpResponse
+from django.test import TestCase
+from django.contrib.sessions.middleware import SessionMiddleware
+
+from offspring.web.queuemanager.handlers import (
+    BuildManifestComparisonHandler,
+    BuildManifestHandler,
+    BuildResultHandler,
+    ReleaseHandler,
+    )
+from offspring.web.queuemanager.tests.factory import factory
+
+
+class BaseHandlerTestCase(TestCase):
+
+    def setUp(self):
+        super(BaseHandlerTestCase, self).setUp()
+        self.request = HttpRequest()
+        self.request.method = 'GET'
+        # Set request.user and process the request manually using
+        # SessionMiddleware so that we can use login(request, user) in tests.
+        self.request.user = None
+        SessionMiddleware().process_request(self.request)
+
+    def _login(self, user):
+        user = authenticate(username=user.username, password=user.username)
+        login(self.request, user)
+        return user
+
+
+class BuildResultHandlerTests(BaseHandlerTestCase):
+
+    def test_builds_for_inexistent_project(self):
+        results = BuildResultHandler().read(
+            self.request, projectName='not-existent')
+        self.assertEqual(0, results.count())
+
+    def test_inexistent_build(self):
+        results = BuildResultHandler().read(
+            self.request, buildName='not-existent')
+        self.assertEqual(0, results.count())
+
+    def test_public_project_builds(self):
+        # The builds of public projects are visible to anyone.
+        build = make_build(is_private=False)
+        self.assertBuildIsVisibleToUser(build, factory.makeUser())
+
+    def test_private_project_build_is_visible_to_project_owner(self):
+        build = make_build(is_private=True)
+        self.assertBuildIsVisibleToUser(build, build.project.owner)
+
+    def test_private_project_builds_invisible_to_user(self):
+        # If the user has no rights to see a given project, they'll get an
+        # empty list of builds, just like if the project didn't exist.
+        build = make_build(is_private=True)
+        self.assertBuildIsNotVisibleToUser(build, factory.makeUser())
+
+    def assertBuildIsVisibleToUser(self, build, user):
+        """Assert that the given build is visible to the given user."""
+        user = self._login(user)
+        handler = BuildResultHandler()
+
+        # It is visible when looking at all project builds...
+        results = handler.read(self.request, projectName=build.project.name)
+        self.assertEqual(1, results.count())
+        self.assertEqual([build], list(results))
+
+        # when looking at one specific build ...
+        results = handler.read(self.request, buildName=build.name)
+        self.assertEqual(1, results.count())
+        self.assertEqual([build], list(results))
+
+        # and when looking at all builds of a builder.
+        results = handler.read(self.request, builderName=build.builder.name)
+        self.assertEqual(1, results.count())
+        self.assertEqual([build], list(results))
+
+    def assertBuildIsNotVisibleToUser(self, build, user):
+        """Assert that the given build is not visible to the given user."""
+        user = self._login(user)
+        handler = BuildResultHandler()
+
+        # It is *not* visible when looking at all project builds...
+        results = handler.read(self.request, projectName=build.project.name)
+        self.assertEqual(0, results.count())
+
+        # when looking at one specific build ...
+        results = handler.read(self.request, buildName=build.name)
+        self.assertEqual(0, results.count())
+
+        # and when looking at all builds of a builder.
+        results = handler.read(self.request, builderName=build.builder.name)
+        self.assertEqual(0, results.count())
+
+
+class ReleaseHandlerTests(BaseHandlerTestCase):
+
+    def test_public_project_release(self):
+        release = factory.makeRelease(make_build(is_private=False))
+        results = ReleaseHandler().read(
+            self.request, projectName=release.build.project.name)
+        self.assertEqual(1, results.count())
+        self.assertEqual([release], list(results))
+
+    def test_private_project_release_is_visible_to_owner(self):
+        release = factory.makeRelease(make_build(is_private=True))
+        user = self._login(release.build.project.owner)
+        results = ReleaseHandler().read(
+            self.request, projectName=release.build.project.name)
+        self.assertEqual(1, results.count())
+        self.assertEqual([release], list(results))
+
+    def test_private_project_release_is_not_visible_to_others(self):
+        release = factory.makeRelease(make_build(is_private=True))
+        user = self._login(factory.makeUser())
+        results = ReleaseHandler().read(
+            self.request, projectName=release.build.project.name)
+        self.assertEqual(0, results.count())
+
+
+class BuildManifestHandlerTests(BaseHandlerTestCase):
+
+    def test_public_project_build_manifest(self):
+        build = make_build(is_private=False)
+        make_build_manifest_file(build)
+        results = BuildManifestHandler().read(
+            self.request, build.project.name, build.name)
+        self.assertEqual([{'package': 'foo', 'version': '1.2'}], results)
+
+    def test_private_project_build_manifest_is_visible_to_owner(self):
+        build = make_build(is_private=True)
+        make_build_manifest_file(build)
+        user = self._login(build.project.owner)
+        results = BuildManifestHandler().read(
+            self.request, build.project.name, build.name)
+        self.assertEqual([{'package': 'foo', 'version': '1.2'}], results)
+
+    def test_private_project_build_manifest_returns_404_for_others(self):
+        build = make_build(is_private=True)
+        make_build_manifest_file(build)
+        user = self._login(factory.makeUser())
+        results = BuildManifestHandler().read(
+            self.request, build.project.name, build.name)
+        self.assertTrue(isinstance(results, HttpResponse))
+        self.assertEqual(404, results.status_code)
+
+
+class BuildManifestComparisonHandlerTests(BaseHandlerTestCase):
+
+    def test_public_projects_build_manifest_comparison(self):
+        build = make_build(is_private=False)
+        build2 = factory.makeBuildResult(
+            project=build.project, builder=factory.makeLexbuilder())
+        make_build_manifest_file(build)
+        make_build_manifest_file(build2)
+        self.request.GET['build'] = build2.name
+        results = BuildManifestComparisonHandler().read(
+            self.request, build.project.name, build.name)
+        self.assertEqual(
+            [{'changeType': 'no_change', 'target_version': '1.2',
+              'base_version': '1.2', 'package': 'foo'}],
+            results)
+
+    def test_private_build_manifest_comparison_is_visible_to_owner(self):
+        build = make_build(is_private=True)
+        build2 = factory.makeBuildResult(
+            project=build.project, builder=factory.makeLexbuilder())
+        make_build_manifest_file(build)
+        make_build_manifest_file(build2)
+        user = self._login(build.project.owner)
+        self.request.GET['build'] = build2.name
+        results = BuildManifestComparisonHandler().read(
+            self.request, build.project.name, build.name)
+        self.assertEqual(
+            [{'changeType': 'no_change', 'target_version': '1.2',
+              'base_version': '1.2', 'package': 'foo'}],
+            results)
+
+    def test_private_build_manifest_comparison_returns_404_for_others(self):
+        build = make_build(is_private=True)
+        build2 = factory.makeBuildResult(
+            project=build.project, builder=factory.makeLexbuilder())
+        make_build_manifest_file(build)
+        make_build_manifest_file(build2)
+        user = self._login(factory.makeUser())
+        self.request.GET['build'] = build2.name
+        results = BuildManifestComparisonHandler().read(
+            self.request, build.project.name, build.name)
+        self.assertTrue(isinstance(results, HttpResponse))
+        self.assertEqual(404, results.status_code)
+
+
+def make_build(is_private):
+    return factory.makeBuildResult(
+        project=factory.makeProject(is_private=is_private),
+        builder=factory.makeLexbuilder())
+
+
+def make_build_manifest_file(build):
+    """Create a manifest file where BuildManifestHandler expects to find it."""
+    manifest_dir = os.path.join(build.result_directory, 'images', 'build')
+    try:
+        os.makedirs(manifest_dir)
+    except OSError, exc:
+        if exc.errno != errno.EEXIST:
+            raise
+    path = os.path.join(manifest_dir, 'build.manifest')
+    with open(path, 'w') as fd:
+        fd.write('foo 1.2')