Merge lp:~stevenk/launchpad/product-distribution-accesspolicy into lp:launchpad

[Steve Kowalik]

Create default accesspolicies on creation of a new product or distribution.

Create default accesspolicies on creation of a new product or distribution.

[Ian Booth (wallyworld)]

Excellent Smithers

review: Approve

=== modified file 'database/schema/security.cfg'
--- database/schema/security.cfg	2012-03-07 22:48:03 +0000
+++ database/schema/security.cfg	2012-03-12 06:35:22 +0000
@@ -1108,6 +1108,7 @@
 type=user
 
 [write]
+public.accesspolicy                     = SELECT, INSERT
 public.account                          = SELECT, INSERT, UPDATE
 public.archive                          = SELECT, INSERT, UPDATE
 public.archivearch                      = SELECT, INSERT, UPDATE, DELETE
@@ -1916,6 +1917,7 @@
 
 [updateremoteproduct]
 groups=script
+public.accesspolicy                     = SELECT, INSERT
 public.account                          = SELECT, INSERT, UPDATE
 public.bug                              = SELECT, INSERT, UPDATE
 public.bugaffectsperson                 = SELECT, INSERT, UPDATE, DELETE

=== modified file 'lib/lp/bugs/tests/test_bug_mirror_access_triggers.py'
--- lib/lp/bugs/tests/test_bug_mirror_access_triggers.py	2012-03-07 00:23:37 +0000
+++ lib/lp/bugs/tests/test_bug_mirror_access_triggers.py	2012-03-12 06:35:22 +0000
@@ -78,13 +78,8 @@
         # properly.
         return grant_count, policy_count
 
-    def makeBugAndPolicies(self, private=False, policy_types=None):
-        if policy_types is None:
-            policy_types = [
-                InformationType.USERDATA, InformationType.EMBARGOEDSECURITY]
+    def makeBugAndPolicies(self, private=False):
         product = self.factory.makeProduct()
-        for policy_type in policy_types:
-            self.factory.makeAccessPolicy(pillar=product, type=policy_type)
         bug = self.factory.makeBug(private=private, product=product)
         return removeSecurityProxy(bug)
 
@@ -124,9 +119,6 @@
     def test_add_task(self):
         # Adding a task on a new product links its policy.
         product = self.factory.makeProduct()
-        self.factory.makeAccessPolicy(
-            pillar=product, type=InformationType.USERDATA)
-
         bug = self.makeBugAndPolicies(private=True)
         bug.addTask(bug.owner, product)
         self.assertEqual((1, 2), self.assertMirrored(bug))
@@ -134,9 +126,6 @@
     def test_remove_task(self):
         # Removing a task removes its policy.
         product = self.factory.makeProduct()
-        self.factory.makeAccessPolicy(
-            pillar=product, type=InformationType.USERDATA)
-
         bug = self.makeBugAndPolicies(private=True)
         task = bug.addTask(bug.owner, product)
         Store.of(bug).flush()
@@ -178,9 +167,6 @@
     def test_productseries_task(self):
         # A productseries task causes a link to its product's policy.
         productseries = self.factory.makeProductSeries()
-        self.factory.makeAccessPolicy(
-            pillar=productseries.product, type=InformationType.USERDATA)
-
         bug = self.makeBugAndPolicies(private=True)
         bug.addTask(bug.owner, productseries)
         self.assertEqual((1, 2), self.assertMirrored(bug))
@@ -191,9 +177,6 @@
     def test_distribution_task(self):
         # A distribution task causes a link to its policy.
         distro = self.factory.makeDistribution()
-        self.factory.makeAccessPolicy(
-            pillar=distro, type=InformationType.USERDATA)
-
         bug = self.makeBugAndPolicies(private=True)
         bug.addTask(bug.owner, distro)
         self.assertEqual((1, 2), self.assertMirrored(bug))
@@ -202,9 +185,6 @@
         # A distroseries task causes a link to its distribution's
         # policy.
         distroseries = self.factory.makeDistroSeries()
-        self.factory.makeAccessPolicy(
-            pillar=distroseries.distribution, type=InformationType.USERDATA)
-
         bug = self.makeBugAndPolicies(private=True)
         bug.addTask(bug.owner, distroseries)
         self.assertEqual((1, 2), self.assertMirrored(bug))

=== modified file 'lib/lp/registry/model/distribution.py'
--- lib/lp/registry/model/distribution.py	2012-02-08 06:00:46 +0000
+++ lib/lp/registry/model/distribution.py	2012-03-12 06:35:22 +0000
@@ -27,7 +27,6 @@
 from storm.locals import (
     And,
     Desc,
-    Int,
     Join,
     Max,
     Or,
@@ -97,7 +96,9 @@
 from lp.code.interfaces.seriessourcepackagebranch import (
     IFindOfficialBranchLinks,
     )
+from lp.registry.enums import InformationType
 from lp.registry.errors import NoSuchDistroSeries
+from lp.registry.interfaces.accesspolicy import IAccessPolicySource
 from lp.registry.interfaces.distribution import (
     IBaseDistribution,
     IDerivativeDistribution,
@@ -1764,6 +1765,10 @@
             icon=icon)
         getUtility(IArchiveSet).new(distribution=distro,
             owner=owner, purpose=ArchivePurpose.PRIMARY)
+        policies = itertools.product(
+            (distro,), (InformationType.USERDATA,
+                InformationType.EMBARGOEDSECURITY))
+        getUtility(IAccessPolicySource).create(policies)
         return distro
 
     def getCurrentSourceReleases(self, distro_source_packagenames):

=== modified file 'lib/lp/registry/model/product.py'
--- lib/lp/registry/model/product.py	2012-03-09 18:29:32 +0000
+++ lib/lp/registry/model/product.py	2012-03-12 06:35:22 +0000
@@ -15,6 +15,7 @@
 import calendar
 import datetime
 import httplib
+import itertools
 import operator
 
 from lazr.delegates import delegates
@@ -114,7 +115,9 @@
     )
 from lp.code.model.sourcepackagerecipe import SourcePackageRecipe
 from lp.code.model.sourcepackagerecipedata import SourcePackageRecipeData
+from lp.registry.enums import InformationType
 from lp.registry.errors import CommercialSubscribersOnly
+from lp.registry.interfaces.accesspolicy import IAccessPolicySource
 from lp.registry.interfaces.oopsreferences import IHasOOPSReferences
 from lp.registry.interfaces.person import (
     IPersonSet,
@@ -1486,6 +1489,12 @@
              'called MAIN or HEAD.'))
         product.development_focus = trunk
 
+        # Add default AccessPolicies.
+        policies = itertools.product(
+            (product,), (InformationType.USERDATA,
+                InformationType.EMBARGOEDSECURITY))
+        getUtility(IAccessPolicySource).create(policies)
+
         return product
 
     def forReview(self, search_text=None, active=None,

=== modified file 'lib/lp/registry/services/sharingservice.py'
--- lib/lp/registry/services/sharingservice.py	2012-03-08 04:26:43 +0000
+++ lib/lp/registry/services/sharingservice.py	2012-03-12 06:35:22 +0000
@@ -115,16 +115,8 @@
         pillar_info_types = [
             (pillar, information_type)
             for information_type in information_types]
-
-        # Create any missing pillar access policies.
         policy_source = getUtility(IAccessPolicySource)
         pillar_policies = list(policy_source.find(pillar_info_types))
-        existing_policy_types = [
-            (pillar, pillar_policy.type) for pillar_policy in pillar_policies]
-        required_policies = (
-            set(pillar_info_types).difference(existing_policy_types))
-        if len(required_policies) > 0:
-            pillar_policies.extend(policy_source.create(required_policies))
 
         # We have the policies, we need to figure out which grants we need to
         # create. We also need to revoke any grants which are not required.

=== modified file 'lib/lp/registry/services/tests/test_sharingservice.py'
--- lib/lp/registry/services/tests/test_sharingservice.py	2012-03-08 04:26:43 +0000
+++ lib/lp/registry/services/tests/test_sharingservice.py	2012-03-12 06:35:22 +0000
@@ -153,8 +153,8 @@
         # Make existing grants to ensure sharePillarInformation handles those
         # cases correctly.
         # First, a grant that is in the add set - it wil be retained.
-        policy = self.factory.makeAccessPolicy(
-            pillar=pillar, type=InformationType.EMBARGOEDSECURITY)
+        policy = getUtility(IAccessPolicySource).find(((
+            pillar, InformationType.EMBARGOEDSECURITY),))[0]
         self.factory.makeAccessPolicyGrant(
             policy, grantee=sharee, grantor=grantor)
         # Second, a grant that is not in the add set - it will be deleted.
@@ -227,15 +227,9 @@
         self._test_sharePillarInformationUnauthorized(product)
 
     def _test_deletePillarSharee(self, pillar, types_to_delete=None):
-        # Make grants for some information types.
-        information_types = [
-            InformationType.EMBARGOEDSECURITY,
-            InformationType.USERDATA]
-        access_policies = []
-        for info_type in information_types:
-            access_policy = self.factory.makeAccessPolicy(
-                pillar=pillar, type=info_type)
-            access_policies.append(access_policy)
+        access_policies = getUtility(IAccessPolicySource).findByPillar(
+            (pillar,))
+        information_types = [ap.type for ap in access_policies]
         grantee = self.factory.makePerson()
         # Make some access policy grants for our sharee.
         for access_policy in access_policies:

=== modified file 'lib/lp/registry/tests/test_accesspolicy.py'
--- lib/lp/registry/tests/test_accesspolicy.py	2012-03-08 08:01:44 +0000
+++ lib/lp/registry/tests/test_accesspolicy.py	2012-03-12 06:35:22 +0000
@@ -46,7 +46,8 @@
     def test_create(self):
         wanted = [
             (self.factory.makeProduct(), InformationType.PROPRIETARY),
-            (self.factory.makeDistribution(), InformationType.USERDATA),
+            (self.factory.makeDistribution(),
+                InformationType.UNEMBARGOEDSECURITY),
             ]
         policies = getUtility(IAccessPolicySource).create(wanted)
         self.assertThat(
@@ -64,17 +65,17 @@
 
         wanted = [
             (product, InformationType.PROPRIETARY),
-            (product, InformationType.USERDATA),
+            (product, InformationType.UNEMBARGOEDSECURITY),
             (distribution, InformationType.PROPRIETARY),
-            (distribution, InformationType.USERDATA),
+            (distribution, InformationType.UNEMBARGOEDSECURITY),
             (other_product, InformationType.PROPRIETARY),
             ]
         getUtility(IAccessPolicySource).create(wanted)
 
         query = [
             (product, InformationType.PROPRIETARY),
-            (product, InformationType.USERDATA),
-            (distribution, InformationType.USERDATA),
+            (product, InformationType.UNEMBARGOEDSECURITY),
+            (distribution, InformationType.UNEMBARGOEDSECURITY),
             ]
         self.assertContentEqual(
             query,
@@ -101,18 +102,24 @@
         product = self.factory.makeProduct()
         distribution = self.factory.makeProduct()
         other_product = self.factory.makeProduct()
-        wanted = [
-            (pillar, type)
-            for type in InformationType.items
-            for pillar in (product, distribution, other_product)]
-        policies = getUtility(IAccessPolicySource).create(wanted)
+        policies = (
+            (product, InformationType.EMBARGOEDSECURITY),
+            (product, InformationType.USERDATA),
+            (distribution, InformationType.EMBARGOEDSECURITY),
+            (distribution, InformationType.USERDATA),
+            (other_product, InformationType.EMBARGOEDSECURITY),
+            (other_product, InformationType.USERDATA),
+            )
         self.assertContentEqual(
             policies,
-            getUtility(IAccessPolicySource).findByPillar(
-                [product, distribution, other_product]))
+            [(ap.pillar, ap.type)
+                for ap in getUtility(IAccessPolicySource).findByPillar(
+                [product, distribution, other_product])])
         self.assertContentEqual(
-            [policy for policy in policies if policy.pillar == product],
-            getUtility(IAccessPolicySource).findByPillar([product]))
+            [policy for policy in policies if policy[0] == product],
+            [(ap.pillar, ap.type)
+                for ap in getUtility(IAccessPolicySource).findByPillar(
+                    [product])])
 
 
 class TestAccessArtifact(TestCaseWithFactory):

=== modified file 'lib/lp/registry/tests/test_distribution.py'
--- lib/lp/registry/tests/test_distribution.py	2012-01-25 04:01:19 +0000
+++ lib/lp/registry/tests/test_distribution.py	2012-03-12 06:35:22 +0000
@@ -1,4 +1,4 @@
-# Copyright 2009-2011 Canonical Ltd.  This software is licensed under the
+# Copyright 2009-2012 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """Tests for Distribution."""
@@ -25,10 +25,12 @@
 from lp.app.enums import ServiceUsage
 from lp.app.errors import NotFoundError
 from lp.app.interfaces.launchpad import ILaunchpadCelebrities
+from lp.registry.enums import InformationType
 from lp.registry.errors import (
     NoSuchDistroSeries,
     OpenTeamLinkageError,
     )
+from lp.registry.interfaces.accesspolicy import IAccessPolicySource
 from lp.registry.interfaces.distribution import (
     IDistribution,
     IDistributionSet,
@@ -265,6 +267,14 @@
         provides_all = MatchesAll(*map(Provides, expected_interfaces))
         self.assertThat(distro, provides_all)
 
+    def test_distribution_creation_creates_accesspolicies(self):
+        # Creating a new distribution also creates AccessPolicies for it.
+        distro = self.factory.makeDistribution()
+        ap = getUtility(IAccessPolicySource).findByPillar((distro,))
+        expected = [
+            InformationType.USERDATA, InformationType.EMBARGOEDSECURITY]
+        self.assertContentEqual(expected, [policy.type for policy in ap])
+
 
 class TestDistributionCurrentSourceReleases(
     TestDistroSeriesCurrentSourceReleases):

=== modified file 'lib/lp/registry/tests/test_product.py'
--- lib/lp/registry/tests/test_product.py	2012-03-09 18:29:32 +0000
+++ lib/lp/registry/tests/test_product.py	2012-03-12 06:35:22 +0000
@@ -10,6 +10,7 @@
 import pytz
 from testtools.matchers import MatchesAll
 import transaction
+from zope.component import getUtility
 from zope.security.interfaces import Unauthorized
 from zope.security.proxy import removeSecurityProxy
 
@@ -24,10 +25,12 @@
     )
 from lp.bugs.interfaces.bugsummary import IBugSummaryDimension
 from lp.bugs.interfaces.bugsupervisor import IHasBugSupervisor
+from lp.registry.enums import InformationType
 from lp.registry.errors import (
     CommercialSubscribersOnly,
     OpenTeamLinkageError,
     )
+from lp.registry.interfaces.accesspolicy import IAccessPolicySource
 from lp.registry.interfaces.oopsreferences import IHasOOPSReferences
 from lp.registry.interfaces.person import (
     CLOSED_TEAM_POLICY,
@@ -343,6 +346,14 @@
         product.setPrivateBugs(True, bug_supervisor)
         self.assertTrue(product.private_bugs)
 
+    def test_product_creation_creates_accesspolicies(self):
+        # Creating a new product also creates AccessPolicies for it.
+        product = self.factory.makeProduct()
+        ap = getUtility(IAccessPolicySource).findByPillar((product,))
+        expected = [
+            InformationType.USERDATA, InformationType.EMBARGOEDSECURITY]
+        self.assertContentEqual(expected, [policy.type for policy in ap])
+
 
 class TestProductFiles(TestCase):
     """Tests for downloadable product files."""