Merge ~twom/launchpad:oci-recipe-targetseries into launchpad:master

[Tom Wardill]

Add implementation for OCIProjectSeries

Adds interface, model, tests, zcml and security.cfg changes for OCIProjectSeries

[Colin Watson (cjwatson)]

review: Needs Fixing

[Colin Watson (cjwatson)]

Looks mostly fine, thanks, but some minor attention-to-detail kinds of things. Also, lint complains:

./lib/lp/registry/interfaces/ociproject.py
      37: 'IHasOwner' imported but unused
      22: 'Attribute' imported but unused
./lib/lp/registry/interfaces/ociprojectseries.py
      15: 'export_as_webservice_entry' imported but unused
      32: 'IPerson' imported but unused
      15: 'exported' imported but unused
./lib/lp/registry/model/ociproject.py
     109: E303 too many blank lines (3)
./lib/lp/registry/model/ociprojectseries.py
      28: 'IMasterStore' imported but unused
./lib/lp/registry/tests/test_ociproject.py
      55: local variable 'second_series' is assigned to but never used
./lib/lp/registry/tests/test_ociprojectseries.py
      10: 'getUtility' imported but unused

review: Approve

diff --git a/database/schema/security.cfg b/database/schema/security.cfg
index 0e0e91e..06da0d4 100644
--- a/database/schema/security.cfg
+++ b/database/schema/security.cfg
@@ -1241,8 +1241,6 @@ public.ociproject                       = SELECT, INSERT, UPDATE, DELETE
 public.ociprojectname                   = SELECT, INSERT, UPDATE
 public.ociprojectseries                 = SELECT, INSERT, UPDATE, DELETE
 public.openididentifier                 = SELECT
-public.ociproject                       = SELECT, INSERT, UPDATE, DELETE
-public.ociprojectname                   = SELECT, INSERT, UPDATE
 public.packageupload                    = SELECT, INSERT, UPDATE
 public.packageuploadbuild               = SELECT, INSERT, UPDATE
 public.packageuploadcustom              = SELECT, INSERT, UPDATE
@@ -1420,6 +1418,7 @@ public.milestone                        = SELECT
 public.milestonetag                     = SELECT
 public.ociproject                       = SELECT
 public.ociprojectname                   = SELECT
+public.ociprojectseries                 = SELECT
 public.openididentifier                 = SELECT
 public.packagecopyjob                   = SELECT, INSERT
 public.packagediff                      = SELECT, INSERT, UPDATE, DELETE
@@ -1538,6 +1537,7 @@ public.milestone                        = SELECT
 public.milestonetag                     = SELECT
 public.ociproject                       = SELECT
 public.ociprojectname                   = SELECT
+public.ociprojectseries                 = SELECT
 public.openididentifier                 = SELECT
 public.packagecopyjob                   = SELECT, INSERT, UPDATE
 public.packagediff                      = SELECT, UPDATE
@@ -1642,6 +1642,7 @@ public.milestone                        = SELECT
 public.milestonetag                     = SELECT
 public.ociproject                       = SELECT
 public.ociprojectname                   = SELECT
+public.ociprojectseries                 = SELECT
 public.person                           = SELECT
 public.personlanguage                   = SELECT
 public.personsettings                   = SELECT
@@ -1845,6 +1846,7 @@ public.milestone                        = SELECT
 public.milestonetag                     = SELECT, INSERT, DELETE
 public.ociproject                       = SELECT
 public.ociprojectname                   = SELECT
+public.ociprojectseries                 = SELECT
 public.openididentifier                 = SELECT
 public.packageset                       = SELECT
 public.packagesetgroup                  = SELECT
@@ -1966,6 +1968,7 @@ public.message                          = SELECT, INSERT
 public.messagechunk                     = SELECT, INSERT
 public.ociproject                       = SELECT
 public.ociprojectname                   = SELECT
+public.ociprojectseries                 = SELECT
 public.openididentifier                 = SELECT
 public.person                           = SELECT
 public.product                          = SELECT
@@ -2025,6 +2028,7 @@ public.messagechunk                     = SELECT, INSERT
 public.milestone                        = SELECT
 public.ociproject                       = SELECT
 public.ociprojectname                   = SELECT
+public.ociprojectseries                 = SELECT
 public.person                           = SELECT
 public.personsettings                   = SELECT
 public.previewdiff                      = SELECT, INSERT
@@ -2163,6 +2167,7 @@ public.messagechunk                     = SELECT, INSERT
 public.milestonetag                     = SELECT
 public.ociproject                       = SELECT
 public.ociprojectname                   = SELECT
+public.ociprojectseries                 = SELECT
 public.person                           = SELECT, INSERT
 public.personsettings                   = SELECT, INSERT
 public.product                          = SELECT, INSERT, UPDATE
@@ -2554,6 +2559,7 @@ public.gitrepository                    = SELECT
 public.job                              = SELECT, INSERT, UPDATE
 public.ociproject                       = SELECT
 public.ociprojectname                   = SELECT
+public.ociprojectseries                 = SELECT
 public.person                           = SELECT
 public.packaging                        = SELECT
 public.product                          = SELECT, UPDATE
@@ -2578,6 +2584,7 @@ public.distribution                     = SELECT
 public.distroseries                     = SELECT
 public.ociproject                       = SELECT
 public.ociprojectname                   = SELECT
+public.ociprojectseries                 = SELECT
 public.product                          = SELECT
 public.productseries                    = SELECT
 public.sourcepackagename                = SELECT
@@ -2591,6 +2598,7 @@ public.gitrepository                    = SELECT
 public.job                              = SELECT, UPDATE
 public.ociproject                       = SELECT
 public.ociprojectname                   = SELECT
+public.ociprojectseries                 = SELECT
 public.person                           = SELECT
 public.product                          = SELECT
 public.snap                             = SELECT
diff --git a/lib/lp/registry/configure.zcml b/lib/lp/registry/configure.zcml
index 66f1d14..c5b2673 100644
--- a/lib/lp/registry/configure.zcml
+++ b/lib/lp/registry/configure.zcml
@@ -743,6 +743,7 @@
                        lp.registry.interfaces.ociproject.IOCIProjectEditableAttributes"/>
         <require
             permission="launchpad.Edit"
+            interface="lp.registry.interfaces.ociproject.IOCIProjectEdit"
             set_schema="lp.registry.interfaces.ociproject.IOCIProjectEditableAttributes" />
     </class>
     <securedutility
@@ -758,6 +759,19 @@
             interface="lp.registry.interfaces.ociproject.IOCIProjectSet"/>
     </securedutility>
 
+    <!-- OCIProjectSeries -->
+    <class
+        class="lp.registry.model.ociprojectseries.OCIProjectSeries">
+        <require
+            permission="launchpad.View"
+            interface="lp.registry.interfaces.ociprojectseries.IOCIProjectSeriesView
+                       lp.registry.interfaces.ociprojectseries.IOCIProjectSeriesEditableAttributes"/>
+        <require
+            permission="launchpad.Edit"
+            interface="lp.registry.interfaces.ociprojectseries.IOCIProjectSeriesEdit"
+            set_schema="lp.registry.interfaces.ociprojectseries.IOCIProjectSeriesEditableAttributes" />
+    </class>
+
     <!-- SourcePackageName -->
 
     <class
diff --git a/lib/lp/registry/interfaces/ociproject.py b/lib/lp/registry/interfaces/ociproject.py
index 64bb50c..100dccd 100644
--- a/lib/lp/registry/interfaces/ociproject.py
+++ b/lib/lp/registry/interfaces/ociproject.py
@@ -11,15 +11,11 @@ __all__ = [
     'IOCIProjectSet',
     ]
 
-from lazr.restful.declarations import (
-    export_as_webservice_entry,
-    exported,
-    )
-from lazr.restful.fields import Reference
-from zope.interface import (
-    Attribute,
-    Interface,
+from lazr.restful.fields import (
+    CollectionField,
+    Reference,
     )
+from zope.interface import Interface
 from zope.schema import (
     Datetime,
     Int,
@@ -30,7 +26,8 @@ from lp import _
 from lp.bugs.interfaces.bugtarget import IBugTarget
 from lp.registry.interfaces.distribution import IDistribution
 from lp.registry.interfaces.ociprojectname import IOCIProjectName
-from lp.registry.interfaces.role import IHasOwner
+from lp.registry.interfaces.series import SeriesStatus
+from lp.services.database.constants import DEFAULT
 from lp.services.fields import PublicPersonChoice
 
 
@@ -38,15 +35,20 @@ class IOCIProjectView(Interface):
     """IOCIProject attributes that require launchpad.View permission."""
 
     id = Int(title=_("ID"), required=True, readonly=True)
-    date_created = exported(
-        Datetime(title=_("Date created"), required=True), readonly=True)
-    date_last_modified = exported(
-        Datetime(title=_("Date last modified"), required=True), readonly=True)
+    date_created = Datetime(
+        title=_("Date created"), required=True, readonly=True)
+    date_last_modified = Datetime(
+        title=_("Date last modified"), required=True, readonly=True)
 
-    registrant = exported(PublicPersonChoice(
+    registrant = PublicPersonChoice(
         title=_("Registrant"),
         description=_("The person that registered this project."),
-        vocabulary='ValidPersonOrTeam', required=True, readonly=True))
+        vocabulary='ValidPersonOrTeam', required=True, readonly=True)
+
+    series = CollectionField(
+        title=_("Series inside this OCI project."),
+        # Really IOCIProjectSeries
+        value_type=Reference(schema=Interface))
 
 
 class IOCIProjectEditableAttributes(IBugTarget):
@@ -58,24 +60,29 @@ class IOCIProjectEditableAttributes(IBugTarget):
     distribution = Reference(
         IDistribution,
         title=_("The distribution that this OCI project is associated with."))
-    ociprojectname = exported(Reference(
+    ociprojectname = Reference(
         IOCIProjectName,
         title=_("The name of this OCI project."),
         required=True,
-        readonly=True))
-    description = exported(
-        Text(title=_("The description for this OCI project.")))
-    pillar = exported(Reference(
+        readonly=True)
+    description = Text(title=_("The description for this OCI project."))
+    pillar = Reference(
         IDistribution,
-        title=_("The pillar containing this target."), readonly=True))
+        title=_("The pillar containing this target."), readonly=True)
+
 
+class IOCIProjectEdit(Interface):
+    """IOCIProject attributes that require launchpad.Edit permission."""
 
-class IOCIProject(IOCIProjectView,
+    def newSeries(name, summary, registrant,
+                  status=SeriesStatus.DEVELOPMENT, date_created=DEFAULT):
+        """Creates a new `IOCIProjectSeries`."""
+
+
+class IOCIProject(IOCIProjectView, IOCIProjectEdit,
                        IOCIProjectEditableAttributes):
     """A project containing Open Container Initiative recipes."""
 
-    export_as_webservice_entry()
-
 
 class IOCIProjectSet(Interface):
     """A utility to create and access OCI Projects."""
diff --git a/lib/lp/registry/interfaces/ociprojectseries.py b/lib/lp/registry/interfaces/ociprojectseries.py
 new file mode 100644
index 0000000..8ef9705
--- /dev/null
+++ b/lib/lp/registry/interfaces/ociprojectseries.py
@@ -0,0 +1,82 @@
+# Copyright 2019 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+"""Interfaces to allow bug filing on multiple versions of an OCI Project."""
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+__metaclass__ = type
+__all__ = [
+    'IOCIProjectSeries',
+    'IOCIProjectSeriesEditableAttributes',
+    'IOCIProjectSeriesView',
+    ]
+
+from lazr.restful.fields import Reference
+from zope.interface import Interface
+from zope.schema import (
+    Choice,
+    Datetime,
+    Int,
+    Text,
+    TextLine,
+    )
+
+from lp import _
+from lp.app.validators.name import name_validator
+from lp.registry.interfaces.ociproject import IOCIProject
+from lp.registry.interfaces.series import SeriesStatus
+from lp.services.fields import PublicPersonChoice
+
+
+class IOCIProjectSeriesView(Interface):
+    """IOCIProjectSeries attributes that require launchpad.View permission."""
+
+    id = Int(title=_("ID"), required=True, readonly=True)
+
+    ociproject = Reference(
+        IOCIProject,
+        title=_("The OCI project that this series belongs to."),
+        required=True, readonly=True)
+
+    date_created = Datetime(
+        title=_("Date created"), required=True, readonly=True,
+        description=_(
+            "The date on which this series was created in Launchpad."))
+
+    registrant = PublicPersonChoice(
+        title=_("Registrant"),
+        description=_("The person that registered this series."),
+        vocabulary='ValidPersonOrTeam', required=True, readonly=True)
+
+
+class IOCIProjectSeriesEditableAttributes(Interface):
+    """IOCIProjectSeries attributes that can be edited.
+
+    These attributes need launchpad.View to see, and launchpad.Edit to change.
+    """
+
+    name = TextLine(
+        title=_("Name"), constraint=name_validator,
+        required=True, readonly=False,
+        description=_("The name of this series."))
+
+    summary = Text(
+        title=_("Summary"), required=True, readonly=False,
+        description=_("A brief summary of this series."))
+
+    status = Choice(
+        title=_("Status"), required=True,
+        vocabulary=SeriesStatus)
+
+
+class IOCIProjectSeriesEdit(Interface):
+    """IOCIProjectSeries attributes that require launchpad.Edit permission."""
+
+
+class IOCIProjectSeries(IOCIProjectSeriesView, IOCIProjectSeriesEdit,
+                        IOCIProjectSeriesEditableAttributes):
+    """A series of an Open Container Initiative project.
+
+    This is used to allow tracking bugs against multiple versions of images.
+    """
diff --git a/lib/lp/registry/model/ociproject.py b/lib/lp/registry/model/ociproject.py
index 45de84d..7250692 100644
--- a/lib/lp/registry/model/ociproject.py
+++ b/lib/lp/registry/model/ociproject.py
@@ -27,7 +27,9 @@ from lp.registry.interfaces.ociproject import (
     IOCIProject,
     IOCIProjectSet,
     )
+from lp.registry.interfaces.series import SeriesStatus
 from lp.registry.model.ociprojectname import OCIProjectName
+from lp.registry.model.ociprojectseries import OCIProjectSeries
 from lp.services.database.constants import DEFAULT
 from lp.services.database.interfaces import (
     IMasterStore,
@@ -81,6 +83,27 @@ class OCIProject(BugTargetBase, StormBase):
         return "OCI project %s for %s" % (
             self.ociprojectname.name, self.pillar.name)
 
+    def newSeries(self, name, summary, registrant,
+                  status=SeriesStatus.DEVELOPMENT, date_created=DEFAULT):
+        """See `IOCIProject`."""
+        series = OCIProjectSeries(
+            ociproject=self,
+            name=name,
+            summary=summary,
+            registrant=registrant,
+            status=status,
+        )
+        return series
+
+    @property
+    def series(self):
+        """See `IOCIProject`."""
+        ret = IStore(OCIProjectSeries).find(
+            OCIProjectSeries,
+            OCIProjectSeries.ociproject == self
+            ).order_by(OCIProjectSeries.date_created)
+        return ret
+
 
 @implementer(IOCIProjectSet)
 class OCIProjectSet:
diff --git a/lib/lp/registry/model/ociprojectseries.py b/lib/lp/registry/model/ociprojectseries.py
 new file mode 100644
index 0000000..04a81e9
--- /dev/null
+++ b/lib/lp/registry/model/ociprojectseries.py
@@ -0,0 +1,65 @@
+# Copyright 2019 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+"""Model implementing `IOCIProjectSeries`."""
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+__metaclass__ = type
+__all__ = [
+    'OCIProjectSeries',
+    ]
+
+import pytz
+from storm.locals import (
+    DateTime,
+    Int,
+    Reference,
+    Unicode,
+    )
+from zope.interface import implementer
+
+from lp.app.validators.name import valid_name
+from lp.registry.errors import InvalidName
+from lp.registry.interfaces.ociprojectseries import IOCIProjectSeries
+from lp.registry.interfaces.series import SeriesStatus
+from lp.services.database.constants import DEFAULT
+from lp.services.database.enumcol import DBEnum
+from lp.services.database.stormbase import StormBase
+
+
+@implementer(IOCIProjectSeries)
+class OCIProjectSeries(StormBase):
+    """See `IOCIProjectSeries`."""
+
+    __storm_table__ = "OCIProjectSeries"
+
+    id = Int(primary=True)
+
+    ociproject_id = Int(name='ociproject', allow_none=False)
+    ociproject = Reference(ociproject_id, "OCIProject.id")
+
+    name = Unicode(name="name", allow_none=False)
+
+    summary = Unicode(name="summary", allow_none=False)
+
+    date_created = DateTime(
+        name="date_created", tzinfo=pytz.UTC, allow_none=False)
+
+    registrant_id = Int(name='registrant', allow_none=False)
+    registrant = Reference(registrant_id, "Person.id")
+
+    status = DBEnum(
+        name='status', allow_none=False, enum=SeriesStatus)
+
+    def __init__(self, ociproject, name, summary,
+                 registrant, status, date_created=DEFAULT):
+        if not valid_name(name):
+            raise InvalidName(
+                "%s is not a valid name for an OCI project series." % name)
+        self.name = name
+        self.ociproject = ociproject
+        self.summary = summary
+        self.registrant = registrant
+        self.status = status
+        self.date_created = date_created
diff --git a/lib/lp/registry/tests/test_ociproject.py b/lib/lp/registry/tests/test_ociproject.py
index a68f786..d170bbb 100644
--- a/lib/lp/registry/tests/test_ociproject.py
+++ b/lib/lp/registry/tests/test_ociproject.py
@@ -7,12 +7,15 @@ from __future__ import absolute_import, print_function, unicode_literals
 
 __metaclass__ = type
 
+from testtools.testcase import ExpectedException
 from zope.component import getUtility
+from zope.security.interfaces import Unauthorized
 
 from lp.registry.interfaces.ociproject import (
     IOCIProject,
     IOCIProjectSet,
     )
+from lp.registry.interfaces.ociprojectseries import IOCIProjectSeries
 from lp.testing import (
     admin_logged_in,
     person_logged_in,
@@ -30,6 +33,40 @@ class TestOCIProject(TestCaseWithFactory):
         with admin_logged_in():
             self.assertProvides(oci_project, IOCIProject)
 
+    def test_newSeries(self):
+        driver = self.factory.makePerson()
+        distribution = self.factory.makeDistribution(driver=driver)
+        registrant = self.factory.makePerson()
+        oci_project = self.factory.makeOCIProject(pillar=distribution)
+        with person_logged_in(driver):
+            series = oci_project.newSeries(
+                'test-series',
+                'test-summary',
+                registrant)
+            self.assertProvides(series, IOCIProjectSeries)
+
+    def test_newSeries_bad_permissions(self):
+        distribution = self.factory.makeDistribution()
+        registrant = self.factory.makePerson()
+        oci_project = self.factory.makeOCIProject(pillar=distribution)
+        with ExpectedException(Unauthorized):
+            oci_project.newSeries(
+                'test-series',
+                'test-summary',
+                registrant)
+
+    def test_series(self):
+        driver = self.factory.makePerson()
+        distribution = self.factory.makeDistribution(driver=driver)
+        first_oci_project = self.factory.makeOCIProject(pillar=distribution)
+        second_oci_project = self.factory.makeOCIProject(pillar=distribution)
+        with person_logged_in(driver):
+            first_series = self.factory.makeOCIProjectSeries(
+                oci_project=first_oci_project)
+            self.factory.makeOCIProjectSeries(
+                oci_project=second_oci_project)
+            self.assertContentEqual([first_series], first_oci_project.series)
+
 
 class TestOCIProjectSet(TestCaseWithFactory):
 
diff --git a/lib/lp/registry/tests/test_ociprojectseries.py b/lib/lp/registry/tests/test_ociprojectseries.py
 new file mode 100644
index 0000000..3d4e6cf
--- /dev/null
+++ b/lib/lp/registry/tests/test_ociprojectseries.py
@@ -0,0 +1,99 @@
+# Copyright 2019 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+"""Test OCIProjectSeries."""
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+__metaclass__ = type
+
+from testtools.matchers import MatchesStructure
+from testtools.testcase import ExpectedException
+from zope.security.interfaces import Unauthorized
+
+from lp.registry.errors import InvalidName
+from lp.registry.interfaces.ociprojectseries import IOCIProjectSeries
+from lp.registry.interfaces.series import SeriesStatus
+from lp.registry.model.ociprojectseries import OCIProjectSeries
+from lp.services.database.constants import UTC_NOW
+from lp.testing import (
+    person_logged_in,
+    TestCaseWithFactory,
+    )
+from lp.testing.layers import DatabaseFunctionalLayer
+
+
+class TestOCIProjectSeries(TestCaseWithFactory):
+
+    layer = DatabaseFunctionalLayer
+
+    def test_implements_interface(self):
+        name = 'test-name'
+        oci_project = self.factory.makeOCIProject()
+        summary = 'test_summary'
+        registrant = self.factory.makePerson()
+        status = SeriesStatus.DEVELOPMENT
+        project_series = OCIProjectSeries(
+            oci_project, name, summary, registrant, status)
+        self.assertProvides(project_series, IOCIProjectSeries)
+
+    def test_init(self):
+        name = 'test-name'
+        oci_project = self.factory.makeOCIProject()
+        summary = 'test_summary'
+        registrant = self.factory.makePerson()
+        status = SeriesStatus.DEVELOPMENT
+        date_created = UTC_NOW
+        project_series = OCIProjectSeries(
+            oci_project, name, summary, registrant, status, date_created)
+        self.assertThat(
+            project_series, MatchesStructure.byEquality(
+                ociproject=project_series.ociproject,
+                name=project_series.name,
+                summary=project_series.summary,
+                registrant=project_series.registrant,
+                status=project_series.status,
+                date_created=project_series.date_created))
+
+    def test_invalid_name(self):
+        name = 'invalid%20name'
+        oci_project = self.factory.makeOCIProject()
+        summary = 'test_summary'
+        registrant = self.factory.makePerson()
+        status = SeriesStatus.DEVELOPMENT
+        with ExpectedException(InvalidName):
+            OCIProjectSeries(oci_project, name, summary, registrant, status)
+
+    def test_edit_permissions_invalid(self):
+        name = 'test-name'
+        summary = 'test_summary'
+        registrant = self.factory.makePerson()
+        another_person = self.factory.makePerson()
+
+        driver = self.factory.makePerson()
+        distribution = self.factory.makeDistribution(driver=driver)
+
+        with person_logged_in(driver):
+            project_series = self.factory.makeOCIProject(
+                pillar=distribution).newSeries(
+                    name, summary, registrant)
+
+        with person_logged_in(another_person):
+            with ExpectedException(Unauthorized):
+                project_series.name = 'not-allowed'
+
+    def test_edit_permissions_valid(self):
+        name = 'test-name'
+        summary = 'test_summary'
+        registrant = self.factory.makePerson()
+
+        driver = self.factory.makePerson()
+        distribution = self.factory.makeDistribution(driver=driver)
+
+        with person_logged_in(driver):
+            project_series = self.factory.makeOCIProject(
+                pillar=distribution).newSeries(
+                    name, summary, registrant)
+            project_series.name = 'allowed'
+
+            self.assertEqual(project_series.name, 'allowed')
diff --git a/lib/lp/security.py b/lib/lp/security.py
index 050c1fe..21caa71 100644
--- a/lib/lp/security.py
+++ b/lib/lp/security.py
@@ -136,6 +136,8 @@ from lp.registry.interfaces.nameblacklist import (
     INameBlacklist,
     INameBlacklistSet,
     )
+from lp.registry.interfaces.ociproject import IOCIProject
+from lp.registry.interfaces.ociprojectseries import IOCIProjectSeries
 from lp.registry.interfaces.packaging import IPackaging
 from lp.registry.interfaces.person import (
     IPerson,
@@ -3430,3 +3432,26 @@ class EditSnapBase(EditByRegistryExpertsOrAdmins):
 
 class EditSnapBaseSet(EditByRegistryExpertsOrAdmins):
     usedfor = ISnapBaseSet
+
+
+class EditOCIProject(AuthorizationBase):
+    permission = 'launchpad.Edit'
+    usedfor = IOCIProject
+
+    def checkAuthenticated(self, user):
+        """Maintainers, drivers, and admins can drive projects."""
+        # XXX twom 2019-10-29 This ideally shouldn't be driver, but a
+        # new role name that cascades upwards from the OCIProject
+        # to the pillar
+        return (user.in_admin or
+                user.isDriver(self.obj.pillar))
+
+
+class EditOCIProjectSeries(AuthorizationBase):
+    permission = 'launchpad.Edit'
+    usedfor = IOCIProjectSeries
+
+    def checkAuthenticated(self, user):
+        """Maintainers, drivers, and admins can drive projects."""
+        return (user.in_admin or
+                user.isDriver(self.obj.ociproject.pillar))
diff --git a/lib/lp/testing/factory.py b/lib/lp/testing/factory.py
index 5c0cc18..39d2725 100644
--- a/lib/lp/testing/factory.py
+++ b/lib/lp/testing/factory.py
@@ -4904,10 +4904,10 @@ class BareLaunchpadObjectFactory(ObjectFactory):
         return getUtility(IOCIProjectNameSet).new(name)
 
     def makeOCIProject(self, registrant=None, pillar=None,
-                            ociprojectname=None, date_created=DEFAULT,
-                            description=None, bug_reporting_guidelines=None,
-                            bug_reported_acknowledgement=None,
-                            bugfiling_duplicate_search=False):
+                       ociprojectname=None, date_created=DEFAULT,
+                       description=None, bug_reporting_guidelines=None,
+                       bug_reported_acknowledgement=None,
+                       bugfiling_duplicate_search=False):
         """Make a new OCIProject."""
         if registrant is None:
             registrant = self.makePerson()
@@ -4922,6 +4922,19 @@ class BareLaunchpadObjectFactory(ObjectFactory):
             bug_reported_acknowledgement=bug_reported_acknowledgement,
             bugfiling_duplicate_search=bugfiling_duplicate_search)
 
+    def makeOCIProjectSeries(self, name=None, summary=None, registrant=None,
+                             oci_project=None, **kwargs):
+        """Make a new OCIProjectSeries attached to an OCIProject."""
+        if name is None:
+            name = self.getUniqueString(u"oci-project-series-name")
+        if summary is None:
+            summary = self.getUniqueString(u"oci-project-series-summary")
+        if registrant is None:
+            registrant = self.makePerson()
+        if oci_project is None:
+            oci_project = self.makeOCIProject(**kwargs)
+        return oci_project.newSeries(name, summary, registrant)
+
 
 # Some factory methods return simple Python types. We don't add
 # security wrappers for them, as well as for objects created by