Merge lp:~salgado/offspring/make-piston-handlers-privacy-aware into lp:offspring

[Guilherme Salgado]

Update the piston handlers to include private objects the user is allowed to see.

[lp:~salgado/offspring/make-piston-handlers-privacy-aware]

105. By Guilherme Salgado on 2011-12-02

Plenty of docstrings for tests

106. By Guilherme Salgado on 2011-12-14

A few changes suggested by Kevin

107. By Guilherme Salgado on 2011-12-14

merge trunk

108. By Guilherme Salgado on 2011-12-14

A few more changes suggested by Kevin

109. By Guilherme Salgado on 2011-12-14

Remove base_dir from config/offspring.cfg or else the tree root will not be used

110. By Guilherme Salgado on 2011-12-14

Fix one last thing Keving mentioned

Unmerged revisions

=== modified file 'config/offspring.cfg'
--- config/offspring.cfg	2011-11-30 14:15:52 +0000
+++ config/offspring.cfg	2011-12-02 15:32:33 +0000
@@ -159,8 +159,8 @@
 
 [publisher]
 db: postgres://offspring:temp1234@localhost/offspring
-development_pool: /srv/builds/
-production_pool: /srv/partners/
+development_pool: %(base_dir)s/builds/
+production_pool: %(base_dir)s/partners/
 signer_directory: 
 signer_files: 
 signer_results: 

=== modified file 'lib/offspring/web/queuemanager/handlers.py'
--- lib/offspring/web/queuemanager/handlers.py	2011-08-13 07:24:06 +0000
+++ lib/offspring/web/queuemanager/handlers.py	2011-12-02 15:32:33 +0000
@@ -43,9 +43,11 @@
     allowed_methods = ('GET')
 
     def read(self, request, projectName, buildName):
+        projects = Project.all_objects.accessible_by_user(request.user)
         try:
-            project = Project.objects.get(pk=projectName)
-            build = BuildResult.objects.get(project=project, name=buildName)
+            project = projects.get(pk=projectName)
+            build = BuildResult.all_objects.accessible_by_user(
+                request.user).get(project=project, name=buildName)
         except: 
             return rc.NOT_FOUND
         manifestPath = glob.glob(build.result_directory + '/images/*/*.manifest')[0]
@@ -56,14 +58,17 @@
     allowed_methods = ('GET')
 
     def read(self, request, projectName, buildName):
+        projects = Project.all_objects.accessible_by_user(request.user)
+        builds = BuildResult.all_objects.accessible_by_user(request.user)
         try:
-            project = Project.objects.get(pk=projectName)
-            base_build = BuildResult.objects.get(project=project, name=buildName)
+            project = projects.get(pk=projectName)
+            base_build = builds.get(project=project, name=buildName)
         except:
             return rc.NOT_FOUND
         if request.GET.has_key('build'):
             try:
-                target_build = BuildResult.objects.get(project=project, name=request.GET['build'])
+                target_build = builds.get(
+                    project=project, name=request.GET['build'])
             except:
                 return rc.NOT_FOUND
         else:
@@ -81,6 +86,7 @@
         return output
 
 
+# TODO: Must be made privacy-aware.
 class ProjectNotificationSubscriptionHandler(BaseHandler):
     allowed_methods = ('GET', 'POST', 'DELETE')
     model = ProjectNotificationSubscription
@@ -138,7 +144,7 @@
         'reason', 'result', 'notes', 'is_released')
 
     def read(self, request, projectName=None, buildName=None, builderName=None):
-        results = BuildResult.objects.all()
+        results = BuildResult.all_objects.accessible_by_user(request.user)
         if projectName is not None:
             results = results.filter(project__name=projectName)
         if buildName is not None:
@@ -155,10 +161,10 @@
 
     def read(self, request, projectName=None, request_id=None):
         try:
+            requests = BuildRequest.all_objects.accessible_by_user(
+                request.user)
             if projectName is not None:
-                requests = BuildRequest.objects.filter(project__name=projectName)
-            else:
-                requests = BuildRequest.objects
+                requests = requests.filter(project__name=projectName)
         except:
             return rc.NOT_FOUND
         if request_id is not None:
@@ -170,12 +176,12 @@
     def delete(self, request, projectName=None, request_id=None):
         if request.user.has_perm("queuemanager.can_build"):
             try:
+                requests = BuildRequest.all_objects.accessible_by_user(
+                    request.user)
                 if projectName is not None:
-                    requests = BuildRequest.objects.filter(project__name=projectName)
-                else:
-                    requests = BuildRequest.objects
+                    requests = requests.filter(project__name=projectName)
             except:
-                return RC.NOT_FOUND
+                return rc.NOT_FOUND
             if request_id is not None:
                 try:
                     requests.get(pk=request_id).delete()
@@ -195,7 +201,8 @@
     def create(self, request, projectName):
         if request.user.has_perm("queuemanager.can_build"):
             try:
-                p = Project.objects.get(pk=projectName)
+                p = Project.all_objects.accessible_by_user(request.user).get(
+                    pk=projectName)
                 if request.POST.has_key('build_reason'):
                     request = BuildRequest.queue_build(p, request.user, reason=request.POST['build_reason'], scoreBonus=25)
                 else:
@@ -217,8 +224,9 @@
         'created_at', 'published_at', 'status', 'checklist_url', 'notes')
 
     def read(self, request, projectName):
+        objects = Release.all_objects.accessible_by_user(request.user)
         try:
-            releases = Release.objects.filter(build__project__name=projectName)
+            releases = objects.filter(build__project__name=projectName)
         except:
             return rc.NOT_FOUND
         return releases

=== modified file 'lib/offspring/web/queuemanager/models.py'
--- lib/offspring/web/queuemanager/models.py	2011-11-30 14:15:52 +0000
+++ lib/offspring/web/queuemanager/models.py	2011-12-02 15:32:33 +0000
@@ -12,7 +12,6 @@
 )
 import math
 
-from django.conf import settings
 from django.contrib.auth.models import AnonymousUser, User
 from django.db import (
     connection,
@@ -23,9 +22,12 @@
     AccessGroup,
     AccessGroupMixin,
     AccessManager)
+from offspring.config import get_configuration
 from offspring.enums import ProjectBuildStates
 
 
+config = get_configuration()
+
 ARCH_CHOICES = (
     (u'i386', u'i386'),
     (u'amd64', u'amd64'),
@@ -412,7 +414,7 @@
     def result_directory(self):
         if self.name:
             try:
-                base_dir = getattr(settings, 'BUILDRESULTS_DIRECTORY', '/srv/builds/')
+                base_dir = config.get('builder', 'result_dir')
                 buildDate, buildId = self.name.rsplit('-', 1)
             except:
                 return None

=== modified file 'lib/offspring/web/queuemanager/tests/__init__.py'
--- lib/offspring/web/queuemanager/tests/__init__.py	2011-12-02 15:32:33 +0000
+++ lib/offspring/web/queuemanager/tests/__init__.py	2011-12-02 15:32:33 +0000
@@ -1,2 +1,3 @@
+from .test_handlers import *
 from offspring.web.queuemanager.tests.test_models import *
 from offspring.web.queuemanager.tests.test_views import *

=== modified file 'lib/offspring/web/queuemanager/tests/factory.py'
--- lib/offspring/web/queuemanager/tests/factory.py	2011-12-02 15:32:33 +0000
+++ lib/offspring/web/queuemanager/tests/factory.py	2011-12-02 15:32:33 +0000
@@ -73,7 +73,8 @@
             title = self.get_unique_string()
         return ProjectGroup.objects.create(name=name, title=title)
 
-    def make_build_result(self, project=None, name=None, result=None):
+    def make_build_result(self, project=None, name=None, result=None,
+                          builder=None):
         """
         Create a BuildResult with the given project or a newly created one if
         none is given.
@@ -83,7 +84,7 @@
         if project is None:
             project = self.make_project()
         return BuildResult.objects.create(
-            project=project, name=name, result=result)
+            project=project, name=name, result=result, builder=builder)
 
     def make_release(self, build=None, name=None, creator=None):
         """

=== added file 'lib/offspring/web/queuemanager/tests/helpers.py'
--- lib/offspring/web/queuemanager/tests/helpers.py	1970-01-01 00:00:00 +0000
+++ lib/offspring/web/queuemanager/tests/helpers.py	2011-12-02 15:32:33 +0000
@@ -0,0 +1,14 @@
+from django.contrib.auth.models import (
+    Group,
+    Permission,
+    )
+
+
+def grant_permission_to_user(user, permission):
+    group = Group(name=user.username)
+    group.save()
+    group.permissions.add(Permission.objects.get(codename=permission))
+    group.save()
+    user.groups.add(group)
+    user.save()
+    return user

=== added file 'lib/offspring/web/queuemanager/tests/test_handlers.py'
--- lib/offspring/web/queuemanager/tests/test_handlers.py	1970-01-01 00:00:00 +0000
+++ lib/offspring/web/queuemanager/tests/test_handlers.py	2011-12-02 15:32:33 +0000
@@ -0,0 +1,300 @@
+import errno
+import os
+
+from django.contrib.auth import authenticate, login
+from django.http import HttpRequest, HttpResponse
+from django.test import TestCase
+from django.contrib.sessions.middleware import SessionMiddleware
+
+from piston.utils import rc
+
+from offspring.web.queuemanager.models import BuildRequest
+from offspring.web.queuemanager.handlers import (
+    BuildManifestComparisonHandler,
+    BuildManifestHandler,
+    BuildRequestHandler,
+    BuildResultHandler,
+    ReleaseHandler,
+    )
+from offspring.web.queuemanager.tests.factory import factory
+from offspring.web.queuemanager.tests.helpers import grant_permission_to_user
+
+
+class BaseHandlerTestCase(TestCase):
+
+    def setUp(self):
+        super(BaseHandlerTestCase, self).setUp()
+        self.request = HttpRequest()
+        self.request.method = 'GET'
+        # Set request.user and process the request manually using
+        # SessionMiddleware so that we can use login(request, user) in tests.
+        self.request.user = None
+        SessionMiddleware().process_request(self.request)
+
+    def _login(self, user):
+        user = authenticate(username=user.username, password=user.username)
+        login(self.request, user)
+        return user
+
+
+class BuildResultHandlerTests(BaseHandlerTestCase):
+
+    def test_builds_for_inexistent_project(self):
+        results = BuildResultHandler().read(
+            self.request, projectName='not-existent')
+        self.assertEqual(0, results.count())
+
+    def test_inexistent_build(self):
+        results = BuildResultHandler().read(
+            self.request, buildName='not-existent')
+        self.assertEqual(0, results.count())
+
+    def test_public_project_builds(self):
+        # The builds of public projects are visible to anyone.
+        build = make_build(is_private=False)
+        self.assertBuildIsVisibleToUser(build, factory.make_user())
+
+    def test_private_project_build_is_visible_to_project_owner(self):
+        build = make_build(is_private=True)
+        self.assertBuildIsVisibleToUser(build, build.project.owner)
+
+    def test_private_project_builds_invisible_to_user(self):
+        # If the user has no rights to see a given project, they'll get an
+        # empty list of builds, just like if the project didn't exist.
+        build = make_build(is_private=True)
+        self.assertBuildIsNotVisibleToUser(build, factory.make_user())
+
+    def assertBuildIsVisibleToUser(self, build, user):
+        """Assert that the given build is visible to the given user."""
+        user = self._login(user)
+        handler = BuildResultHandler()
+
+        # It is visible when looking at all project builds...
+        results = handler.read(self.request, projectName=build.project.name)
+        self.assertEqual(1, results.count())
+        self.assertEqual([build], list(results))
+
+        # when looking at one specific build ...
+        results = handler.read(self.request, buildName=build.name)
+        self.assertEqual(1, results.count())
+        self.assertEqual([build], list(results))
+
+        # and when looking at all builds of a builder.
+        results = handler.read(self.request, builderName=build.builder.name)
+        self.assertEqual(1, results.count())
+        self.assertEqual([build], list(results))
+
+    def assertBuildIsNotVisibleToUser(self, build, user):
+        """Assert that the given build is not visible to the given user."""
+        user = self._login(user)
+        handler = BuildResultHandler()
+
+        # It is *not* visible when looking at all project builds...
+        results = handler.read(self.request, projectName=build.project.name)
+        self.assertEqual(0, results.count())
+
+        # when looking at one specific build ...
+        results = handler.read(self.request, buildName=build.name)
+        self.assertEqual(0, results.count())
+
+        # and when looking at all builds of a builder.
+        results = handler.read(self.request, builderName=build.builder.name)
+        self.assertEqual(0, results.count())
+
+
+class BuildRequestHandlerTests(BaseHandlerTestCase):
+
+    def test_public_build_request_is_visible_to_anyone(self):
+        job = factory.make_build_request(
+            project=factory.make_project(is_private=False))
+        results = BuildRequestHandler().read(
+            self.request, projectName=job.project.name, request_id=job.id)
+        self.assertEqual(job, results)
+
+    def test_private_build_request_is_visible_to_owner(self):
+        job = factory.make_build_request(
+            project=factory.make_project(is_private=True))
+        self._login(job.project.owner)
+        results = BuildRequestHandler().read(
+            self.request, projectName=job.project.name, request_id=job.id)
+        self.assertEqual(job, results)
+
+    def test_private_build_request_is_not_visible_to_others(self):
+        job = factory.make_build_request(
+            project=factory.make_project(is_private=True))
+        self._login(factory.make_user())
+        self.assertRaises(
+            BuildRequest.DoesNotExist,
+            BuildRequestHandler().read,
+            self.request, projectName=job.project.name, request_id=job.id)
+
+    def test_new_build_request_on_public_project(self):
+        project = factory.make_project(is_private=False)
+        self.assertCreateReturnCode(
+            project, factory.make_user(), rc.CREATED.status_code)
+
+    def test_owner_requests_new_build_on_private_project(self):
+        project = factory.make_project(is_private=True)
+        self.assertCreateReturnCode(
+            project, project.owner, rc.CREATED.status_code)
+
+    def test_other_user_requests_new_build_on_private_project(self):
+        project = factory.make_project(is_private=True)
+        self.assertCreateReturnCode(
+            project, factory.make_user(), rc.BAD_REQUEST.status_code)
+
+    def test_delete_build_request_on_public_project(self):
+        job = factory.make_build_request(
+            project=factory.make_project(is_private=False))
+        self.assertDeleteReturnCode(
+            job, factory.make_user(), rc.DELETED.status_code)
+
+    def test_owner_deletes_build_request_on_private_project(self):
+        job = factory.make_build_request(
+            project=factory.make_project(is_private=True))
+        self.assertDeleteReturnCode(
+            job, job.project.owner, rc.DELETED.status_code)
+
+    def test_other_user_deletes_build_request_on_private_project(self):
+        job = factory.make_build_request(
+            project=factory.make_project(is_private=True))
+        self.assertDeleteReturnCode(
+            job, factory.make_user(), rc.NOT_FOUND.status_code)
+
+    def assertCreateReturnCode(self, project, user, return_code):
+        """Assert that BuildRequestHandler.create() returns the given code.
+
+        Also grant the given user the 'can_build' permission and logs it in.
+        """
+        grant_permission_to_user(user, 'can_build')
+        self._login(user)
+        result = BuildRequestHandler().create(
+            self.request, projectName=project.name)
+        self.assertEqual(return_code, result.status_code)
+
+    def assertDeleteReturnCode(self, job, user, return_code):
+        """Assert that BuildRequestHandler.delete() returns the given code.
+
+        Also grant the given user the 'can_build' permission and logs it in.
+        """
+        grant_permission_to_user(user, 'can_build')
+        self._login(user)
+        result = BuildRequestHandler().delete(
+            self.request, projectName=job.project.name, request_id=job.id)
+        self.assertEqual(return_code, result.status_code)
+
+
+class ReleaseHandlerTests(BaseHandlerTestCase):
+
+    def test_public_project_release(self):
+        release = factory.make_release(make_build(is_private=False))
+        results = ReleaseHandler().read(
+            self.request, projectName=release.build.project.name)
+        self.assertEqual(1, results.count())
+        self.assertEqual([release], list(results))
+
+    def test_private_project_release_is_visible_to_owner(self):
+        release = factory.make_release(make_build(is_private=True))
+        user = self._login(release.build.project.owner)
+        results = ReleaseHandler().read(
+            self.request, projectName=release.build.project.name)
+        self.assertEqual(1, results.count())
+        self.assertEqual([release], list(results))
+
+    def test_private_project_release_is_not_visible_to_others(self):
+        release = factory.make_release(make_build(is_private=True))
+        user = self._login(factory.make_user())
+        results = ReleaseHandler().read(
+            self.request, projectName=release.build.project.name)
+        self.assertEqual(0, results.count())
+
+
+class BuildManifestHandlerTests(BaseHandlerTestCase):
+
+    def test_public_project_build_manifest(self):
+        build = make_build(is_private=False)
+        make_build_manifest_file(build)
+        results = BuildManifestHandler().read(
+            self.request, build.project.name, build.name)
+        self.assertEqual([{'package': 'foo', 'version': '1.2'}], results)
+
+    def test_private_project_build_manifest_is_visible_to_owner(self):
+        build = make_build(is_private=True)
+        make_build_manifest_file(build)
+        user = self._login(build.project.owner)
+        results = BuildManifestHandler().read(
+            self.request, build.project.name, build.name)
+        self.assertEqual([{'package': 'foo', 'version': '1.2'}], results)
+
+    def test_private_project_build_manifest_returns_404_for_others(self):
+        build = make_build(is_private=True)
+        make_build_manifest_file(build)
+        user = self._login(factory.make_user())
+        results = BuildManifestHandler().read(
+            self.request, build.project.name, build.name)
+        self.assertTrue(isinstance(results, HttpResponse))
+        self.assertEqual(404, results.status_code)
+
+
+class BuildManifestComparisonHandlerTests(BaseHandlerTestCase):
+
+    def test_public_projects_build_manifest_comparison(self):
+        build = make_build(is_private=False)
+        build2 = factory.make_build_result(
+            project=build.project, builder=factory.make_lexbuilder())
+        make_build_manifest_file(build)
+        make_build_manifest_file(build2)
+        self.request.GET['build'] = build2.name
+        results = BuildManifestComparisonHandler().read(
+            self.request, build.project.name, build.name)
+        self.assertEqual(
+            [{'changeType': 'no_change', 'target_version': '1.2',
+              'base_version': '1.2', 'package': 'foo'}],
+            results)
+
+    def test_private_build_manifest_comparison_is_visible_to_owner(self):
+        build = make_build(is_private=True)
+        build2 = factory.make_build_result(
+            project=build.project, builder=factory.make_lexbuilder())
+        make_build_manifest_file(build)
+        make_build_manifest_file(build2)
+        user = self._login(build.project.owner)
+        self.request.GET['build'] = build2.name
+        results = BuildManifestComparisonHandler().read(
+            self.request, build.project.name, build.name)
+        self.assertEqual(
+            [{'changeType': 'no_change', 'target_version': '1.2',
+              'base_version': '1.2', 'package': 'foo'}],
+            results)
+
+    def test_private_build_manifest_comparison_returns_404_for_others(self):
+        build = make_build(is_private=True)
+        build2 = factory.make_build_result(
+            project=build.project, builder=factory.make_lexbuilder())
+        make_build_manifest_file(build)
+        make_build_manifest_file(build2)
+        user = self._login(factory.make_user())
+        self.request.GET['build'] = build2.name
+        results = BuildManifestComparisonHandler().read(
+            self.request, build.project.name, build.name)
+        self.assertTrue(isinstance(results, HttpResponse))
+        self.assertEqual(404, results.status_code)
+
+
+def make_build(is_private):
+    return factory.make_build_result(
+        project=factory.make_project(is_private=is_private),
+        builder=factory.make_lexbuilder())
+
+
+def make_build_manifest_file(build):
+    """Create a manifest file where BuildManifestHandler expects to find it."""
+    manifest_dir = os.path.join(build.result_directory, 'images', 'build')
+    try:
+        os.makedirs(manifest_dir)
+    except OSError, exc:
+        if exc.errno != errno.EEXIST:
+            raise
+    path = os.path.join(manifest_dir, 'build.manifest')
+    with open(path, 'w') as fd:
+        fd.write('foo 1.2')

=== modified file 'lib/offspring/web/queuemanager/tests/test_views.py'
--- lib/offspring/web/queuemanager/tests/test_views.py	2011-12-02 15:32:33 +0000
+++ lib/offspring/web/queuemanager/tests/test_views.py	2011-12-02 15:32:33 +0000
@@ -1,9 +1,5 @@
 from django.core.urlresolvers import reverse
-from django.contrib.auth.models import (
-    AnonymousUser,
-    Group,
-    Permission,
-    )
+from django.contrib.auth.models import AnonymousUser
 from django.http import Http404
 from django.test import TestCase
 
@@ -13,6 +9,7 @@
     )
 from offspring.web.queuemanager.views import get_possibly_private_object
 from offspring.web.queuemanager.tests.factory import factory
+from offspring.web.queuemanager.tests.helpers import grant_permission_to_user
 
 
 class Test_get_possibly_private_object(TestCase):
@@ -259,17 +256,53 @@
         self.assertEqual([], list(access_group.members.all()))
 
 
+class ProjectBuildsViewTests(TestCase, ProjectViewTestsMixin):
+    view_path = 'offspring.web.queuemanager.views.builds'
+
+    def get_expected_page_heading(self, project):
+        return 'Build Records for %s' % project.title
+
+    def test_public_project(self):
+        project = factory.make_project(is_private=False)
+        build = factory.make_build_result(project=project)
+        response = self.client.get(
+            reverse(self.view_path, args=[project.name]))
+        self.assertContains(
+            response, self.get_expected_page_heading(project),
+            status_code=200, msg_prefix=response.content)
+
+
+class OverallBuildsViewTests(TestCase):
+    view_path = 'offspring.web.queuemanager.views.builds'
+
+    def test_public_builds_are_shown(self):
+        project = factory.make_project(is_private=False)
+        build = factory.make_build_result(project=project)
+        response = self.client.get(reverse(self.view_path))
+        self.assertContains(
+            response, build.name, status_code=200, msg_prefix=response.content)
+
+    def test_private_builds_are_shown_if_user_has_rights(self):
+        project = factory.make_project(is_private=True)
+        build = factory.make_build_result(project=project)
+        user = project.owner
+        self.assertTrue(
+            self.client.login(username=user.username, password=user.username))
+        response = self.client.get(reverse(self.view_path))
+        self.assertContains(
+            response, build.name, status_code=200, msg_prefix=response.content)
+
+    def test_private_builds_are_not_shown_if_user_has_no_rights(self):
+        project = factory.make_project(is_private=True)
+        build = factory.make_build_result(project=project)
+        user = factory.make_user()
+        self.assertTrue(
+            self.client.login(username=user.username, password=user.username))
+        response = self.client.get(reverse(self.view_path))
+        self.assertNotContains(
+            response, build.name, status_code=200, msg_prefix=response.content)
+
+
 def make_user_and_login(client):
     user = factory.make_user()
     return client.login(username=user.username, password=user.username)
-
-
-def grant_permission_to_user(user, permission):
-    group = Group(name=user.username)
-    group.save()
-    group.permissions.add(Permission.objects.get(codename=permission))
-    group.save()
-    user.groups.add(group)
-    user.save()
-    return user
-

=== modified file 'lib/offspring/web/queuemanager/views.py'
--- lib/offspring/web/queuemanager/views.py	2011-12-02 15:32:33 +0000
+++ lib/offspring/web/queuemanager/views.py	2011-12-02 15:32:33 +0000
@@ -107,13 +107,15 @@
         context_instance=RequestContext(request))
 
 def builds(request, projectName=None):
+    user = request.user
+    user_visible_builds = BuildResult.all_objects.accessible_by_user(user)
     if projectName is not None:
-        p = get_object_or_404(Project, pk=projectName)
-        buildResults_list = BuildResult.objects.filter(
-            project = projectName).order_by("finished_at").reverse()
+        p = get_possibly_private_object(user, Project, pk=projectName)
+        buildResults_list = user_visible_builds.filter(
+            project=projectName).order_by("finished_at").reverse()
     else:
         p = None
-        buildResults_list = BuildResult.objects.select_related(
+        buildResults_list = user_visible_builds.select_related(
             'builder', 'requestor', 'project').order_by("finished_at").reverse()
     paginator = Paginator(buildResults_list, 15)
 
@@ -127,8 +129,12 @@
     except (EmptyPage, InvalidPage):
         buildResults = paginator.page(paginator.num_pages)
 
+    is_private = False
+    if p is not None and p.is_private:
+        is_private = True
     pageData = { 
         'project' : p, 
+        'is_private' : is_private,
         'build_results' : buildResults,
         'pillar' : 'builds' 
     }
@@ -232,7 +238,9 @@
         request.user)
     p = get_possibly_private_object(
         request.user, user_visible_objects, pk=projectName)
-    project_build_results = BuildResult.objects.filter(
+    user_visible_builds = BuildResult.all_objects.accessible_by_user(
+        request.user)
+    project_build_results = user_visible_builds.filter(
         project = p).exclude(result = None)
     build_stats = { 
         'fail_count' : project_build_results.filter(result = ProjectBuildStates.FAILED).count(),

=== modified file 'lib/offspring/web/settings.py'
--- lib/offspring/web/settings.py	2011-11-18 15:45:06 +0000
+++ lib/offspring/web/settings.py	2011-12-02 15:32:33 +0000
@@ -131,6 +131,3 @@
 CELERY_RESULT_BACKEND = 'djcelery.backends.database.DatabaseBackend'
 CELERYBEAT_SCHEDULER = 'djcelery.schedulers.DatabaseScheduler'
 djcelery.setup_loader()
-
-# Path to build results
-BUILDRESULTS_DIRECTORY = '/srv/builds/'

=== modified file 'lib/offspring/web/settings_production.py'
--- lib/offspring/web/settings_production.py	2011-11-30 14:15:52 +0000
+++ lib/offspring/web/settings_production.py	2011-12-02 15:32:33 +0000
@@ -16,6 +16,3 @@
 EMAIL_HOST = 'localhost'
 
 MEDIA_URL = 'https://offspring.com/assets/'
-
-# Path to build results
-BUILDRESULTS_DIRECTORY = '/srv/offspring.com/www/builds/'