Merge lp:~sinzui/launchpad/commercial-admin-private-teams into lp:launchpad

[Curtis Hovey]

This is my branch to permit commercial admins to see private teams.

    lp:~sinzui/launchpad/registry-rename-0
    Diff size: 97
    Launchpad bug:
          https://bugs.launchpad.net/bugs/613791
    Test command: ./bin/test -vv -t private-team-visibility
    Pre-implementation: bigjools
    Target release: 10.09

Permit commercial admins to see private teams
---------------------------------------------

Commercial admins have been asked to help private teams resolve setup and
launchpad usage issues, but they cannot see the team to help. Canonical
groups, canonical partners, and commercial users expect the people who help
setup private teams be able to help resolve issues.

Rules
-----

    * Add commercial admins to the launchpad.View rules for private teams.

QA
--

    * As a commercial admin verify you can see a private team that you are not
      a member of.

Lint
----

Linting changed files:
  lib/canonical/launchpad/security.py
  lib/lp/registry/doc/private-team-visibility.txt

Test
----

    * lib/lp/registry/doc/private-team-visibility.txt
      * Updated the doctest to show who is permitted to see private teams.

Implementation
--------------

    * lib/canonical/launchpad/security.py
      * Added commercial admins the launchpad.View on private teams and
        TeamMemberships (which are implcitly private if the team is private).

[Brad Crittenden (bac)]

review: Approve (code)

=== modified file 'lib/canonical/launchpad/security.py'
--- lib/canonical/launchpad/security.py	2010-08-09 17:14:10 +0000
+++ lib/canonical/launchpad/security.py	2010-08-14 22:18:47 +0000
@@ -654,11 +654,12 @@
         """Verify that the user can view the team's membership.
 
         Anyone can see a public team's membership. Only a team member or
-        a Launchpad admin can view a private team.
+        commercial admin or a Launchpad admin can view a private team.
         """
         if self.obj.team.visibility == PersonVisibility.PUBLIC:
             return True
-        if user.in_admin or user.inTeam(self.obj.team):
+        if (user.in_admin or user.in_commercial_admin
+            or user.inTeam(self.obj.team)):
             return True
         return False
 
@@ -725,12 +726,13 @@
     def checkAuthenticated(self, user):
         """Verify that the user can view the team's membership.
 
-        Anyone can see a public team's membership. Only a team member
-        or a Launchpad admin can view a private team's members.
+        Anyone can see a public team's membership. Only a team member,
+        commercial admin, or a Launchpad admin can view a private team's
+        members.
         """
         if self.obj.visibility == PersonVisibility.PUBLIC:
             return True
-        if user.in_admin or user.inTeam(self.obj):
+        if user.in_admin or user.in_commercial_admin or user.inTeam(self.obj):
             return True
         # We also grant visibility of the private team to administrators of
         # other teams that have been invited to join the private team.

=== modified file 'lib/lp/registry/doc/private-team-visibility.txt'
--- lib/lp/registry/doc/private-team-visibility.txt	2010-07-27 22:13:36 +0000
+++ lib/lp/registry/doc/private-team-visibility.txt	2010-08-14 22:18:47 +0000
@@ -10,9 +10,11 @@
 administrators .
 
     >>> from lp.registry.interfaces.person import PersonVisibility
+    >>> from lp.testing import login_celebrity
+
     >>> priv_owner = factory.makePerson(name="priv-owner")
     >>> priv_member = factory.makePerson(name="priv-member")
-    >>> login('[e-mail]')
+    >>> commercial_admin = login_celebrity('commercial_admin')
     >>> priv_team = factory.makeTeam(owner=priv_owner, name="priv-team",
     ...                              visibility=PersonVisibility.PRIVATE)
     >>> login_person(priv_owner)
@@ -31,6 +33,17 @@
     >>> login_person(priv_member)
     >>> members = priv_team.activemembers
 
+A commercial admin can view private teams and private team memberships.
+
+    >>> from canonical.launchpad.webapp.authorization import check_permission
+
+    >>> commercial_admin = login_celebrity('commercial_admin')
+    >>> check_permission('launchpad.View', priv_team)
+    True
+    >>> team_membership = priv_member.myactivememberships[0]
+    >>> check_permission('launchpad.View', team_membership)
+    True
+
 A person who is not in the team cannot see the membership and cannot
 see other details of the team, such as the name.
 
@@ -38,12 +51,14 @@
     >>> members = priv_team.activemembers
     Traceback (most recent call last):
     ...
-    Unauthorized: (<Person at ... priv-team (Priv Team)>, 'activemembers', 'launchpad.View')
+    Unauthorized: (<Person at ... priv-team (Priv Team)>,
+        'activemembers', 'launchpad.View')
 
     >>> print priv_team.name
     Traceback (most recent call last):
     ...
-    Unauthorized: (<Person at ... priv-team (Priv Team)>, 'name', 'launchpad.View')
+    Unauthorized: (<Person at ... priv-team (Priv Team)>,
+        'name', 'launchpad.View')
 
 Public teams can join private teams.  When adding one team to another
 the team is invited to join and that invitation must be accepted by
@@ -63,7 +78,8 @@
     >>> print priv_team.name
     Traceback (most recent call last):
     ...
-    Unauthorized: (<Person at ... priv-team (Priv Team)>, 'name', 'launchpad.View')
+    Unauthorized: (<Person at ... priv-team (Priv Team)>,
+        'name', 'launchpad.View')
 
     >>> login_person(priv_owner)
     >>> ignored = priv_team.addMember(pub_team, reviewer=priv_owner)
@@ -89,4 +105,5 @@
     >>> print priv_team.name
     Traceback (most recent call last):
     ...
-    Unauthorized: (<Person at ... priv-team (Priv Team)>, 'name', 'launchpad.View')
+    Unauthorized: (<Person at ... priv-team (Priv Team)>,
+        'name', 'launchpad.View')