Merge ~twom/launchpad:oci-actually-the-push-rule-models into launchpad:master

[Tom Wardill]

Add OCIPushRule model

Add the interface, model and tests for OCIPushRule, rules for pushing to an OCI registry.
Alter OCIRecipe to add a convenience lookup method.

[Colin Watson (cjwatson)]

This can't land until master has database/schema/patch-2210-08-6.sql.

review: Approve

[Otto Co-Pilot (otto-copilot)]

Merging failed
https://jenkins.ols.canonical.com/online-services/job/launchpad/307/

ee12bf4... by Tom Wardill on 2020-04-01

Fix rebase issues

diff --git a/lib/lp/_schema_circular_imports.py b/lib/lp/_schema_circular_imports.py
index a50ddd2..e74605c 100644
--- a/lib/lp/_schema_circular_imports.py
+++ b/lib/lp/_schema_circular_imports.py
@@ -96,6 +96,7 @@ from lp.hardwaredb.interfaces.hwdb import (
     IHWSubmissionDevice,
     IHWVendorID,
     )
+from lp.oci.interfaces.ocipushrule import IOCIPushRule
 from lp.oci.interfaces.ocirecipe import IOCIRecipe
 from lp.oci.interfaces.ocirecipebuild import IOCIRecipeBuild
 from lp.registry.interfaces.commercialsubscription import (
@@ -1106,3 +1107,4 @@ patch_collection_property(IOCIProject, 'series', IOCIProjectSeries)
 patch_collection_property(IOCIRecipe, 'builds', IOCIRecipeBuild)
 patch_collection_property(IOCIRecipe, 'completed_builds', IOCIRecipeBuild)
 patch_collection_property(IOCIRecipe, 'pending_builds', IOCIRecipeBuild)
+patch_collection_property(IOCIRecipe, 'push_rules', IOCIPushRule)
diff --git a/lib/lp/oci/configure.zcml b/lib/lp/oci/configure.zcml
index 3246bc0..43ea399 100644
--- a/lib/lp/oci/configure.zcml
+++ b/lib/lp/oci/configure.zcml
@@ -107,4 +107,23 @@
         <allow interface="lp.services.crypto.interfaces.IEncryptedContainer"/>
     </securedutility>
 
+    <!-- OCIPushRule -->
+    <class class="lp.oci.model.ocipushrule.OCIPushRule">
+        <require
+            permission="launchpad.View"
+            interface="lp.oci.interfaces.ocipushrule.IOCIPushRuleView
+                       lp.oci.interfaces.ocipushrule.IOCIPushRuleEditableAttributes" />
+        <require
+            permission="launchpad.Edit"
+            interface="lp.oci.interfaces.ocipushrule.IOCIPushRuleEdit"
+            set_schema="lp.oci.interfaces.ocipushrule.IOCIPushRuleEditableAttributes" />
+    </class>
+
+    <securedutility
+        class="lp.oci.model.ocipushrule.OCIPushRuleSet"
+        provides="lp.oci.interfaces.ocipushrule.IOCIPushRuleSet">
+        <allow
+            interface="lp.oci.interfaces.ocipushrule.IOCIPushRuleSet"/>
+    </securedutility>
+
 </configure>
diff --git a/lib/lp/oci/interfaces/ocipushrule.py b/lib/lp/oci/interfaces/ocipushrule.py
new file mode 100644
index 0000000..2351edf
--- /dev/null
+++ b/lib/lp/oci/interfaces/ocipushrule.py
@@ -0,0 +1,79 @@
+# Copyright 2020 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+"""Interfaces for handling credentials for OCI registry actions."""
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+__metaclass__ = type
+__all__ = [
+    'IOCIPushRule',
+    'IOCIPushRuleSet'
+    ]
+
+from lazr.restful.fields import Reference
+from zope.interface import Interface
+from zope.schema import (
+    Int,
+    TextLine,
+    )
+
+from lp import _
+from lp.oci.interfaces.ocirecipe import IOCIRecipe
+from lp.oci.interfaces.ociregistrycredentials import IOCIRegistryCredentials
+
+
+class IOCIPushRuleView(Interface):
+    """`IOCIPushRule` methods that require launchpad.View
+    permission.
+    """
+
+    id = Int(title=_("ID"), required=True, readonly=True)
+
+
+class IOCIPushRuleEditableAttributes(Interface):
+    """`IOCIPushRule` attributes that can be edited.
+
+    These attributes need launchpad.View to see, and launchpad.Edit to change.
+    """
+
+    recipe = Reference(
+        IOCIRecipe,
+        title=_("OCI recipe"),
+        description=_("The recipe for which the rule is defined."),
+        required=True,
+        readonly=False)
+
+    registry_credentials = Reference(
+        IOCIRegistryCredentials,
+        title=_("Registry credentials"),
+        description=_("The registry credentials to use."),
+        required=True,
+        readonly=False)
+
+    image_name = TextLine(
+        title=_("Image name"),
+        description=_("The intended name of the image on the registry."),
+        required=True,
+        readonly=False)
+
+
+class IOCIPushRuleEdit(Interface):
+    """`IOCIPushRule` methods that require launchpad.Edit
+    permission.
+    """
+
+    def destroySelf():
+        """Destroy this push rule."""
+
+
+class IOCIPushRule(IOCIPushRuleEdit, IOCIPushRuleEditableAttributes,
+                   IOCIPushRuleView):
+    """A rule for pushing builds of an OCI recipe to a registry."""
+
+
+class IOCIPushRuleSet(Interface):
+    """A utility to create and access OCI Push Rules."""
+
+    def new(recipe, registry_credentials, image_name):
+        """Create an `IOCIPushRule`."""
diff --git a/lib/lp/oci/interfaces/ocirecipe.py b/lib/lp/oci/interfaces/ocirecipe.py
index d5a7c92..99a0719 100644
--- a/lib/lp/oci/interfaces/ocirecipe.py
+++ b/lib/lp/oci/interfaces/ocirecipe.py
@@ -140,6 +140,13 @@ class IOCIRecipeView(Interface):
         :return: `IOCIRecipeBuild`.
         """
 
+    push_rules = CollectionField(
+        title=_("Push rules for this OCI recipe."),
+        description=_("All of the push rules for registry upload "
+                      "that apply to this recipe."),
+        # Really IOCIPushRule, patched in _schema_cirular_imports.
+        value_type=Reference(schema=Interface), readonly=True)
+
 
 class IOCIRecipeEdit(IWebhookTarget):
     """`IOCIRecipe` methods that require launchpad.Edit permission."""
diff --git a/lib/lp/oci/model/ocipushrule.py b/lib/lp/oci/model/ocipushrule.py
new file mode 100644
index 0000000..84e4a1c
--- /dev/null
+++ b/lib/lp/oci/model/ocipushrule.py
@@ -0,0 +1,61 @@
+# Copyright 2020 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+"""Registry credentials for use by an `OCIPushRule`."""
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+__metaclass__ = type
+__all__ = [
+    'OCIPushRule',
+    'OCIPushRuleSet',
+    ]
+
+from storm.locals import (
+    Int,
+    Reference,
+    Storm,
+    Unicode,
+    )
+from zope.interface import implementer
+
+from lp.oci.interfaces.ocipushrule import (
+    IOCIPushRule,
+    IOCIPushRuleSet,
+    )
+from lp.services.database.interfaces import IStore
+
+
+@implementer(IOCIPushRule)
+class OCIPushRule(Storm):
+
+    __storm_table__ = 'OCIPushRule'
+
+    id = Int(primary=True)
+
+    recipe_id = Int(name='recipe', allow_none=False)
+    recipe = Reference(recipe_id, 'OCIRecipe.id')
+
+    registry_credentials_id = Int(
+        name='registry_credentials', allow_none=False)
+    registry_credentials = Reference(
+        registry_credentials_id, 'OCIRegistryCredentials.id')
+
+    image_name = Unicode(name="image_name", allow_none=False)
+
+    def __init__(self, recipe, registry_credentials, image_name):
+        self.recipe = recipe
+        self.registry_credentials = registry_credentials
+        self.image_name = image_name
+
+    def destroySelf(self):
+        """See `IOCIPushRule`."""
+        IStore(OCIPushRule).get(self.id).remove()
+
+
+@implementer(IOCIPushRuleSet)
+class OCIPushRuleSet:
+
+    def new(self, recipe, registry_credentials, image_name):
+        """See `IOCIPushRuleSet`."""
+        return OCIPushRule(recipe, registry_credentials, image_name)
diff --git a/lib/lp/oci/model/ocirecipe.py b/lib/lp/oci/model/ocirecipe.py
index 9a4bd8e..68f5e92 100644
--- a/lib/lp/oci/model/ocirecipe.py
+++ b/lib/lp/oci/model/ocirecipe.py
@@ -46,6 +46,7 @@ from lp.oci.interfaces.ocirecipe import (
     OCIRecipeNotOwner,
     )
 from lp.oci.interfaces.ocirecipebuild import IOCIRecipeBuildSet
+from lp.oci.model.ocipushrule import OCIPushRule
 from lp.oci.model.ocirecipebuild import OCIRecipeBuild
 from lp.registry.interfaces.person import IPersonSet
 from lp.services.database.constants import (
@@ -189,6 +190,13 @@ class OCIRecipe(Storm, WebhookTargetMixin):
         return build
 
     @property
+    def push_rules(self):
+        rules = IStore(self).find(
+            OCIPushRule,
+            OCIPushRule.recipe == self.id)
+        return rules
+
+    @property
     def _pending_states(self):
         """All the build states we consider pending (non-final)."""
         return [
diff --git a/lib/lp/oci/tests/helpers.py b/lib/lp/oci/tests/helpers.py
new file mode 100644
index 0000000..dc0e82f
--- /dev/null
+++ b/lib/lp/oci/tests/helpers.py
@@ -0,0 +1,27 @@
+# Copyright 2020 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+"""Helper methods and mixins for OCI tests."""
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+__metaclass__ = type
+__all__ = []
+
+import base64
+
+from nacl.public import PrivateKey
+
+
+class OCIConfigHelperMixin:
+
+    def setConfig(self):
+        self.private_key = PrivateKey.generate()
+        self.pushConfig(
+            "oci",
+            registry_secrets_public_key=base64.b64encode(
+                bytes(self.private_key.public_key)).decode("UTF-8"))
+        self.pushConfig(
+            "oci",
+            registry_secrets_private_key=base64.b64encode(
+                bytes(self.private_key)).decode("UTF-8"))
diff --git a/lib/lp/oci/tests/test_ocipushrule.py b/lib/lp/oci/tests/test_ocipushrule.py
new file mode 100644
index 0000000..90ddd96
--- /dev/null
+++ b/lib/lp/oci/tests/test_ocipushrule.py
@@ -0,0 +1,70 @@
+# Copyright 2020 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+"""Tests for OCI registry push rules."""
+
+from __future__ import absolute_import, print_function, unicode_literals
+
+from testtools.matchers import MatchesStructure
+from zope.component import getUtility
+
+from lp.oci.interfaces.ocipushrule import (
+    IOCIPushRule,
+    IOCIPushRuleSet,
+    )
+from lp.oci.tests.helpers import OCIConfigHelperMixin
+from lp.testing import (
+    person_logged_in,
+    TestCaseWithFactory,
+    )
+from lp.testing.layers import LaunchpadZopelessLayer
+
+
+class TestOCIPushRule(OCIConfigHelperMixin, TestCaseWithFactory):
+
+    layer = LaunchpadZopelessLayer
+
+    def setUp(self):
+        super(TestOCIPushRule, self).setUp()
+        self.setConfig()
+
+    def test_implements_interface(self):
+        push_rule = self.factory.makeOCIPushRule()
+        self.assertProvides(push_rule, IOCIPushRule)
+
+    def test_change_attribute(self):
+        push_rule = self.factory.makeOCIPushRule()
+        with person_logged_in(push_rule.recipe.owner):
+            push_rule.image_name = 'new image name'
+
+        found_rule = push_rule.recipe.push_rules[0]
+        self.assertEqual(found_rule.image_name, 'new image name')
+
+
+class TestOCIPushRuleSet(OCIConfigHelperMixin, TestCaseWithFactory):
+
+    layer = LaunchpadZopelessLayer
+
+    def setUp(self):
+        super(TestOCIPushRuleSet, self).setUp()
+        self.setConfig()
+
+    def test_implements_interface(self):
+        push_rule_set = getUtility(IOCIPushRuleSet)
+        self.assertProvides(push_rule_set, IOCIPushRuleSet)
+
+    def test_new(self):
+        recipe = self.factory.makeOCIRecipe()
+        registry_credentials = self.factory.makeOCIRegistryCredentials()
+        image_name = self.factory.getUniqueUnicode()
+        push_rule = getUtility(IOCIPushRuleSet).new(
+            recipe=recipe,
+            registry_credentials=registry_credentials,
+            image_name=image_name)
+
+        self.assertThat(
+            push_rule,
+            MatchesStructure.byEquality(
+                recipe=recipe,
+                registry_credentials=registry_credentials,
+                image_name=image_name))
diff --git a/lib/lp/oci/tests/test_ocirecipe.py b/lib/lp/oci/tests/test_ocirecipe.py
index 379d0ce..3c60e7e 100644
--- a/lib/lp/oci/tests/test_ocirecipe.py
+++ b/lib/lp/oci/tests/test_ocirecipe.py
@@ -5,10 +5,12 @@
 
 from __future__ import absolute_import, print_function, unicode_literals
 
+import base64
 import json
 
 from fixtures import FakeLogger
 from six import string_types
+from nacl.public import PrivateKey
 from storm.exceptions import LostObjectError
 from testtools.matchers import (
     ContainsDict,
@@ -192,6 +194,21 @@ class TestOCIRecipe(TestCaseWithFactory):
             [fullybuilt, instacancelled], list(oci_recipe.completed_builds))
         self.assertEqual([], list(oci_recipe.pending_builds))
 
+    def test_push_rules(self):
+        self.pushConfig(
+            "oci",
+            registry_secrets_public_key=base64.b64encode(
+                bytes(PrivateKey.generate().public_key)).decode("UTF-8"))
+        oci_recipe = self.factory.makeOCIRecipe()
+        for _ in range(3):
+            self.factory.makeOCIPushRule(recipe=oci_recipe)
+        # Add some others
+        for _ in range(3):
+            self.factory.makeOCIPushRule()
+
+        for rule in oci_recipe.push_rules:
+            self.assertEqual(rule.recipe, oci_recipe)
+
 
 class TestOCIRecipeSet(TestCaseWithFactory):
 
diff --git a/lib/lp/oci/tests/test_ociregistrycredentials.py b/lib/lp/oci/tests/test_ociregistrycredentials.py
index 283ff0c..fba4b1a 100644
--- a/lib/lp/oci/tests/test_ociregistrycredentials.py
+++ b/lib/lp/oci/tests/test_ociregistrycredentials.py
@@ -5,10 +5,8 @@
 
 from __future__ import absolute_import, print_function, unicode_literals
 
-import base64
 import json
 
-from nacl.public import PrivateKey
 from testtools.matchers import (
     AfterPreprocessing,
     Equals,
@@ -21,6 +19,7 @@ from lp.oci.interfaces.ociregistrycredentials import (
     IOCIRegistryCredentials,
     IOCIRegistryCredentialsSet,
     )
+from lp.oci.tests.helpers import OCIConfigHelperMixin
 from lp.services.crypto.interfaces import IEncryptedContainer
 from lp.testing import (
     person_logged_in,
@@ -29,21 +28,13 @@ from lp.testing import (
 from lp.testing.layers import LaunchpadZopelessLayer
 
 
-class TestOCIRegistryCredentials(TestCaseWithFactory):
+class TestOCIRegistryCredentials(OCIConfigHelperMixin, TestCaseWithFactory):
 
     layer = LaunchpadZopelessLayer
 
     def setUp(self):
         super(TestOCIRegistryCredentials, self).setUp()
-        self.private_key = PrivateKey.generate()
-        self.pushConfig(
-            "oci",
-            registry_secrets_public_key=base64.b64encode(
-                bytes(self.private_key.public_key)).decode("UTF-8"))
-        self.pushConfig(
-            "oci",
-            registry_secrets_private_key=base64.b64encode(
-                bytes(self.private_key)).decode("UTF-8"))
+        self.setConfig()
 
     def test_implements_interface(self):
         oci_credentials = getUtility(IOCIRegistryCredentialsSet).new(
@@ -77,21 +68,13 @@ class TestOCIRegistryCredentials(TestCaseWithFactory):
             }))
 
 
-class TestOCIRegistryCredentialsSet(TestCaseWithFactory):
+class TestOCIRegistryCredentialsSet(OCIConfigHelperMixin, TestCaseWithFactory):
 
     layer = LaunchpadZopelessLayer
 
     def setUp(self):
         super(TestOCIRegistryCredentialsSet, self).setUp()
-        self.private_key = PrivateKey.generate()
-        self.pushConfig(
-            "oci",
-            registry_secrets_public_key=base64.b64encode(
-                bytes(self.private_key.public_key)).decode("UTF-8"))
-        self.pushConfig(
-            "oci",
-            registry_secrets_private_key=base64.b64encode(
-                bytes(self.private_key)).decode("UTF-8"))
+        self.setConfig()
 
     def test_implements_interface(self):
         credentials_set = getUtility(IOCIRegistryCredentialsSet)
diff --git a/lib/lp/security.py b/lib/lp/security.py
index 10aad34..a44393a 100644
--- a/lib/lp/security.py
+++ b/lib/lp/security.py
@@ -112,6 +112,7 @@ from lp.hardwaredb.interfaces.hwdb import (
     IHWSubmissionDevice,
     IHWVendorID,
     )
+from lp.oci.interfaces.ocipushrule import IOCIPushRule
 from lp.oci.interfaces.ocirecipe import IOCIRecipe
 from lp.oci.interfaces.ocirecipebuild import IOCIRecipeBuild
 from lp.oci.interfaces.ociregistrycredentials import IOCIRegistryCredentials
@@ -3521,3 +3522,8 @@ class ViewOCIRegistryCredentials(AuthorizationBase):
         return (
             user.isOwner(self.obj) or
             user.in_admin)
+
+
+class ViewOCIPushRule(AnonymousAuthorization):
+    """Anyone can view an `IOCIPushRule`."""
+    usedfor = IOCIPushRule
diff --git a/lib/lp/testing/factory.py b/lib/lp/testing/factory.py
index c66175d..8e0f1c1 100644
--- a/lib/lp/testing/factory.py
+++ b/lib/lp/testing/factory.py
@@ -157,6 +157,7 @@ from lp.hardwaredb.interfaces.hwdb import (
     IHWSubmissionDeviceSet,
     IHWSubmissionSet,
     )
+from lp.oci.interfaces.ocipushrule import IOCIPushRuleSet
 from lp.oci.interfaces.ocirecipe import IOCIRecipeSet
 from lp.oci.interfaces.ocirecipebuild import IOCIRecipeBuildSet
 from lp.oci.interfaces.ociregistrycredentials import IOCIRegistryCredentialsSet
@@ -5051,6 +5052,20 @@ class BareLaunchpadObjectFactory(ObjectFactory):
             url=url,
             credentials=credentials)
 
+    def makeOCIPushRule(self, recipe=None, registry_credentials=None,
+                        image_name=None):
+        """Make a new OCIPushRule."""
+        if recipe is None:
+            recipe = self.makeOCIRecipe()
+        if registry_credentials is None:
+            registry_credentials = self.makeOCIRegistryCredentials()
+        if image_name is None:
+            image_name = self.getUniqueUnicode(u"oci-image-name")
+        return getUtility(IOCIPushRuleSet).new(
+            recipe=recipe,
+            registry_credentials=registry_credentials,
+            image_name=image_name)
+
 
 # Some factory methods return simple Python types. We don't add
 # security wrappers for them, as well as for objects created by