Merge lp:~sinzui/launchpad/delete-private-0 into lp:launchpad

[Curtis Hovey]

This is my branch to allow users to delete regardless of privacy.

    lp:~sinzui/launchpad/delete-private-0
    Diff size: 120
    Launchpad bug: https://bugs.launchpad.net/bugs/556131
                   https://bugs.launchpad.net/bugs/462036
    Test command: ./bin/test -vv \
        -t milestone-views -t peoplemerge-views
    Pre-implementation: no one
    Target release: 10.05

Allow users to delete regardless of privacy
-------------------------------------------

Bug 556131 [deleting a private-membership team via the delete button, doesn't]
    The bug reported the issue was about a private team, but the test I wrote
    always passed. The *real* examples are about PRIVATE_MEMBERSHIP teams,
    which we supported last year.

Bug 462036 [Delete milestone will fail if private bugs are targeted]
    The RegistryDeleteViewMixin._getBugtasks() could use the principal of the
    current interaction, but that will not prevent this error from occurring
    if the owner or release manager does not have permission to see the bug.
    The correct fix must retrieve all bugtasks regardless of privacy. Private
    bugs that the user can see should be shown in the list. Those that cannot
    be seen will be silently untargeted. This implies that the untarget
    operation needs special access to get the list of bugtasks and need to use
    removeSecurityProxy to untarget the milestones. The user does not need to
    know that this happened.

Rules
-----

Bug 556131 [deleting a private-membership team via the delete button, doesn't]
    * Add PRIVATE_MEMBERSHIP to the ValidTeam vocab when the user is admin.

Bug 462036 [Delete milestone will fail if private bugs are targeted]
    * Pass the user in the bug params so that private bugs he can access are
      are untargeted. The user did have access to the bug in every oops; he
      had to manually untarget the private bugs before deleting the milestone.
    * It is possible that a driver will target a private bug that the
      owner/release manager cannot access. It is not possible to get all
      private bugs because there is not system user we can use as a proxy
      for the user doing the delete. We can re-examine this issue when ACLs
      are re-implemented.

QA
--

Bug 556131 [deleting a private-membership team via the delete button, doesn't]
    * As an admin, delete the teams in:
      https://answers.edge.launchpad.net/launchpad-registry/+question/106563

Bug 462036 [Delete milestone will fail if private bugs are targeted]
    * Create milestone and target a private and a public bug to it.
    * Choose the Delete link.
    * Verify the private bug is listed with the public bug.
    * Delete the milestone.
    * Verify you see the series page (not an oops)
    * Visit the private bug.
    * Verify that it is untargeted.

Lint
----
Linting changed files:
  lib/lp/registry/vocabularies.py
  lib/lp/registry/browser/__init__.py
  lib/lp/registry/browser/tests/milestone-views.txt
  lib/lp/registry/browser/tests/peoplemerge-views.txt

Test
----

    * lib/lp/registry/browser/tests/milestone-views.txt
      Added a test to verify that private bugs the user has access to are
      listed and deleted
    * lib/lp/registry/browser/tests/peoplemerge-views.txt
      Added a test to verify that PRIVATE_MEMBERSHIP teams can be deleted.

Implementation
--------------
    * lib/lp/registry/vocabularies.py
      In the case where the user is an admin, include PRIVATE_MEMBERSHIP teams
      in the ValidTeam vocabulary.
    * lib/lp/registry/browser/__init__.py
      Pass the user in the bugtask search so that private bug he has access to
      will be included.

[Eleanor Berger (intellectronica)]

Looks good. There were a couple of typos and grammar errors in one of the doctest paragraphs and below is a corrected version you can use:

Milestones with private bugs can be deleted. There is one caveate, the person deleting the milestone must have permssion to access the bug for it to be untargeted. It is possible for the owner or release manager to not have access to a private bug that was targeted to a milestone by a driver.

[Eleanor Berger (intellectronica)]

review: Approve

=== modified file 'lib/lp/registry/browser/__init__.py'
--- lib/lp/registry/browser/__init__.py	2010-04-29 15:21:05 +0000
+++ lib/lp/registry/browser/__init__.py	2010-05-18 17:46:27 +0000
@@ -142,10 +142,10 @@
     def _getBugtasks(self, target):
         """Return the list `IBugTask`s associated with the target."""
         if IProductSeries.providedBy(target):
-            params = BugTaskSearchParams(user=None)
+            params = BugTaskSearchParams(user=self.user)
             params.setProductSeries(target)
         else:
-            params = BugTaskSearchParams(milestone=target, user=None)
+            params = BugTaskSearchParams(milestone=target, user=self.user)
         bugtasks = getUtility(IBugTaskSet).search(params)
         return list(bugtasks)
 

=== modified file 'lib/lp/registry/browser/product.py'
--- lib/lp/registry/browser/product.py	2010-05-11 20:01:34 +0000
+++ lib/lp/registry/browser/product.py	2010-05-18 17:46:27 +0000
@@ -293,7 +293,7 @@
 
     def _addLicenseChangeToReviewWhiteboard(self):
         """Update the whiteboard for the reviewer's benefit."""
-        now = datetime.now(tz=pytz.UTC).strftime('YYYY-mm-dd')
+        now = datetime.now(tz=pytz.UTC).strftime('%Y-%M-%d')
         whiteboard = 'User notified of license policy on %s.' % now
         naked_product = removeSecurityProxy(self.product)
         if naked_product.reviewer_whiteboard is None:

=== modified file 'lib/lp/registry/browser/tests/milestone-views.txt'
--- lib/lp/registry/browser/tests/milestone-views.txt	2010-04-16 15:06:55 +0000
+++ lib/lp/registry/browser/tests/milestone-views.txt	2010-05-18 17:46:27 +0000
@@ -726,3 +726,26 @@
     >>> view = create_initialized_view(milestone, '+delete')
     >>> check_permission('launchpad.Edit', view)
     False
+
+Milestones with private bugs can be deleted. There is one caveate, the person
+deleting the milestone must have permssion to access the bug for it to be
+untargeted. It is possible for the owner or release manager to not have access
+to a private bug that was targeted to a milestone by a driver.
+
+    >>> login_person(owner)
+    >>> milestone = firefox_1_0.newMilestone('1.0.13')
+    >>> private_bug = factory.makeBug(product=firefox, private=True)
+    >>> private_bugtask = bug.bugtasks[0]
+    >>> private_bugtask.milestone = milestone
+    >>> view = create_initialized_view(milestone, '+delete')
+    >>> [bugtask.milestone.name for bugtask in view.bugtasks]
+    [u'1.0.13']
+
+    >>> view = create_initialized_view(milestone, '+delete', form=form)
+    >>> for notification in view.request.response.notifications:
+    ...     print notification.message
+    Milestone 1.0.13 deleted.
+
+    >>> transaction.commit()
+    >>> print private_bugtask.milestone
+    None

=== modified file 'lib/lp/registry/browser/tests/peoplemerge-views.txt'
--- lib/lp/registry/browser/tests/peoplemerge-views.txt	2010-04-20 19:40:13 +0000
+++ lib/lp/registry/browser/tests/peoplemerge-views.txt	2010-05-18 17:46:27 +0000
@@ -275,3 +275,34 @@
     >>> for notification in view.request.response.notifications:
     ...     print notification.message
     Team deleted.
+
+Private teams can be deleted by admins.
+
+    >>> from lp.registry.interfaces.person import PersonVisibility
+
+    >>> login('[e-mail]')
+    >>> private_team = factory.makeTeam(
+    ...     name='secret', visibility=PersonVisibility.PRIVATE)
+    >>> login('[e-mail]')
+    >>> form = {'field.actions.delete': 'Delete'}
+    >>> view = create_initialized_view(private_team, '+delete', form=form)
+    >>> view.errors
+    []
+    >>> for notification in view.request.response.notifications:
+    ...     print notification.message
+    Team deleted.
+
+Private membership teams can be deleted by admins, and when they are all
+deleted, we can remove this visibility type.
+
+    >>> login('[e-mail]')
+    >>> pm_team = factory.makeTeam(
+    ...     name='sekret', visibility=PersonVisibility.PRIVATE_MEMBERSHIP)
+    >>> login('[e-mail]')
+    >>> form = {'field.actions.delete': 'Delete'}
+    >>> view = create_initialized_view(pm_team, '+delete', form=form)
+    >>> view.errors
+    []
+    >>> for notification in view.request.response.notifications:
+    ...     print notification.message
+    Team deleted.

=== modified file 'lib/lp/registry/doc/vocabularies.txt'
--- lib/lp/registry/doc/vocabularies.txt	2010-04-19 15:13:39 +0000
+++ lib/lp/registry/doc/vocabularies.txt	2010-05-18 17:46:27 +0000
@@ -767,6 +767,7 @@
 for 'team' should give us some of them.  Notice that the
 PRIVATE_MEMBERSHIP_TEAM 'myteam' is not included in the results.
 
+    >>> login_person(sample_person)
     >>> ephemeral = factory.makeTeam(owner=foo_bar, name='ephemeral-team')
     >>> sorted(person.name for person in vocab.search('team'))
     [u'ephemeral-team', u'hwdb-team', u'name18', u'name20', u'name21',
@@ -776,8 +777,10 @@
 
 Valid teams do not include teams that have been merged.
 
+    >>> login_person(foo_bar)
     >>> ephemeral.deactivateAllMembers("Merging", foo_bar)
     >>> person_set.merge(ephemeral, foo_bar)
+    >>> login_person(sample_person)
     >>> sorted(person.name for person in vocab.search('team'))
     [u'hwdb-team', u'name18', u'name20', u'name21',
      u'no-team-memberships', u'otherteam', u'simple-team',
@@ -809,11 +812,12 @@
      u'simple-team', u'testing-spanish-team', u'ubuntu-security',
      u'ubuntu-team', u'warty-gnome']
 
-The PRIVATE team is also displayed for Launchpad admins.
+The PRIVATE team is also displayed for Launchpad admins, as is the
+PRIVATE_MEMBERSHIP team 'myteam'.
 
     >>> login('[e-mail]')
     >>> sorted(person.name for person in vocab.search('team'))
-    [u'hwdb-team', u'name18', u'name20', u'name21',
+    [u'hwdb-team', u'myteam', u'name18', u'name20', u'name21',
      u'no-team-memberships', u'otherteam',
      u'private-team', u'simple-team', u'testing-spanish-team',
      u'ubuntu-security', u'ubuntu-team', u'warty-gnome']

=== modified file 'lib/lp/registry/vocabularies.py'
--- lib/lp/registry/vocabularies.py	2010-04-19 08:30:06 +0000
+++ lib/lp/registry/vocabularies.py	2010-05-18 17:46:27 +0000
@@ -441,7 +441,9 @@
                 # visible.
                 private_query = AND(
                     Not(Person.teamowner == None),
-                    Person.visibility == PersonVisibility.PRIVATE)
+                    OR(
+                        Person.visibility == PersonVisibility.PRIVATE,
+                        Person.visibility == PersonVisibility.PRIVATE_MEMBERSHIP))
             else:
                 private_query = AND(
                     TeamParticipation.person == logged_in_user.id,
@@ -1330,7 +1332,6 @@
 
         query = query.lower()
         like_query = "'%%' || %s || '%%'" % quote_like(query)
-        fti_query = quote(query)
         kw = {}
         if self._orderBy:
             kw['orderBy'] = self._orderBy
@@ -1457,7 +1458,8 @@
             return IDistribution.providedBy(obj)
 
 
-class FeaturedProjectVocabulary(DistributionOrProductOrProjectGroupVocabulary):
+class FeaturedProjectVocabulary(
+                               DistributionOrProductOrProjectGroupVocabulary):
     """Vocabulary of projects that are featured on the LP Home Page."""
 
     _filter = AND(PillarName.q.id == FeaturedProject.q.pillar_name,