Merge lp:~twom/launchpad/branch-permissions-for-gitapi into lp:launchpad

[Tom Wardill]

Add GitRuleGrant api to xmlrpc API

[Tom Wardill (twom)]

I'm unsure on the use of IGitLookup to add an interface for doing the GitRuleGrant lookups, it seemed logical at the time but on reflection it doesn't quite feel to be in the right place/correct structure

[Colin Watson (cjwatson)]

A quick first-pass review to get you started ...

review: Needs Fixing

[Colin Watson (cjwatson)]

review: Needs Fixing

[Colin Watson (cjwatson)]

Thanks, this is looking better now. Just a few more bits and pieces.

A quick pass over the whole diff to conform to the prevailing style would be good (e.g. public methods of model objects get a """See `IFoo`.""" docstring, no blank line at the start of methods, multi-line displays generally have a newline after the opening punctuation and then a four-space indent for their contents rather than the contents being indented to the opening punctuation, etc.).

review: Approve

=== modified file 'lib/lp/code/interfaces/gitapi.py'
--- lib/lp/code/interfaces/gitapi.py	2015-03-31 04:18:22 +0000
+++ lib/lp/code/interfaces/gitapi.py	2018-10-15 14:44:56 +0000
@@ -67,3 +67,9 @@
         :returns: An `Unauthorized` fault, as password authentication is
             not yet supported.
         """
+
+    def listRefRules(self, repository, user):
+        """Return the list of ref rules for `user` in `repository`
+
+        :returns: A list of rules for the user in the specified repository
+        """

=== modified file 'lib/lp/code/interfaces/gitrepository.py'
--- lib/lp/code/interfaces/gitrepository.py	2018-10-12 16:41:14 +0000
+++ lib/lp/code/interfaces/gitrepository.py	2018-10-15 14:44:56 +0000
@@ -746,6 +746,16 @@
         :param user: The `IPerson` who is moving the rule.
         """
 
+    def findRuleGrantsByGrantee(grantee):
+        """Find the grants for a grantee applied to this repository.
+
+        :param grantee: The Person affected
+        """
+
+    def findRuleGrantsForRepositoryOwner():
+        """Find the grants of type REPOSITORY_OWNER applied to this repository.
+        """
+
     @export_read_operation()
     @operation_for_version("devel")
     def canBeDeleted():

=== modified file 'lib/lp/code/model/gitrepository.py'
--- lib/lp/code/model/gitrepository.py	2018-10-12 16:41:14 +0000
+++ lib/lp/code/model/gitrepository.py	2018-10-15 14:44:56 +0000
@@ -72,6 +72,7 @@
 from lp.app.interfaces.services import IService
 from lp.code.enums import (
     BranchMergeProposalStatus,
+    GitGranteeType,
     GitObjectType,
     GitRepositoryType,
     )
@@ -1193,6 +1194,20 @@
         return Store.of(self).find(
             GitRuleGrant, GitRuleGrant.repository_id == self.id)
 
+    def findRuleGrantsByGrantee(self, grantee):
+        """See `IGitRepository`."""
+        clauses = [
+            GitRuleGrant.grantee_type == GitGranteeType.PERSON,
+            TeamParticipation.person == grantee,
+            GitRuleGrant.grantee == TeamParticipation.teamID
+            ]
+        return self.grants.find(*clauses).config(distinct=True)
+
+    def findRuleGrantsForRepositoryOwner(self):
+        """See `IGitRepository`."""
+        return self.grants.find(
+            GitRuleGrant.grantee_type == GitGranteeType.REPOSITORY_OWNER)
+
     def getActivity(self):
         """See `IGitRepository`."""
         clauses = [GitActivity.repository_id == self.id]

=== modified file 'lib/lp/code/model/tests/test_gitrepository.py'
--- lib/lp/code/model/tests/test_gitrepository.py	2018-10-12 16:41:14 +0000
+++ lib/lp/code/model/tests/test_gitrepository.py	2018-10-15 14:44:56 +0000
@@ -47,6 +47,7 @@
     BranchSubscriptionDiffSize,
     BranchSubscriptionNotificationLevel,
     CodeReviewNotificationLevel,
+    GitGranteeType,
     GitObjectType,
     GitRepositoryType,
     TargetRevisionControlSystems,
@@ -224,6 +225,130 @@
         bmp = self.factory.makeBranchMergeProposalForGit(target_ref=ref)
         self.assertEqual([bmp], list(repository.getMergeProposals()))
 
+    def test_findRuleGrantsByGrantee_person(self):
+        requester = self.factory.makePerson()
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(owner=requester))
+
+        rule = self.factory.makeGitRule(repository)
+        grant = self.factory.makeGitRuleGrant(
+            rule=rule, grantee=requester, can_push=True, can_create=True)
+
+        results = repository.findRuleGrantsByGrantee(requester)
+        self.assertEqual([grant], list(results))
+
+    def test_findRuleGrantsByGrantee_team(self):
+        requester = self.factory.makeTeam()
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(owner=requester))
+
+        rule = self.factory.makeGitRule(repository)
+        grant = self.factory.makeGitRuleGrant(
+            rule=rule, grantee=requester, can_push=True, can_create=True)
+
+        results = repository.findRuleGrantsByGrantee(requester)
+        self.assertEqual([grant], list(results))
+
+    def test_findRuleGrantsByGrantee_member_of_team(self):
+        member = self.factory.makePerson()
+        requester = self.factory.makeTeam(members=[member])
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(owner=requester))
+
+        rule = self.factory.makeGitRule(repository)
+        grant = self.factory.makeGitRuleGrant(
+            rule=rule, grantee=requester, can_push=True, can_create=True)
+
+        results = repository.findRuleGrantsByGrantee(requester)
+        self.assertEqual([grant], list(results))
+
+    def test_findRuleGrantsByGrantee_team_in_team(self):
+        member = self.factory.makePerson()
+        team = self.factory.makeTeam(owner=member, members=[member])
+        top_level = removeSecurityProxy(self.factory.makeTeam())
+        top_level.addMember(team, top_level.teamowner, force_team_add=True)
+
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(owner=top_level))
+
+        rule = self.factory.makeGitRule(repository)
+        grant = self.factory.makeGitRuleGrant(
+            rule=rule, grantee=top_level, can_push=True, can_create=True)
+
+        results = repository.findRuleGrantsByGrantee(member)
+        self.assertEqual([grant], list(results))
+
+    def test_findRuleGrantsByGrantee_team_in_team_not_owner(self):
+        member = self.factory.makePerson()
+        team = self.factory.makeTeam(owner=member, members=[member])
+        top_level = removeSecurityProxy(self.factory.makeTeam())
+        top_level.addMember(team, top_level.teamowner, force_team_add=True)
+
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository())
+
+        rule = self.factory.makeGitRule(repository)
+        grant = self.factory.makeGitRuleGrant(
+            rule=rule, grantee=top_level, can_push=True, can_create=True)
+
+        results = repository.findRuleGrantsByGrantee(member)
+        self.assertEqual([grant], list(results))
+
+    def test_findRuleGrantsByGrantee_not_owner(self):
+        requester = self.factory.makePerson()
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository())
+
+        rule = self.factory.makeGitRule(repository)
+        grant = self.factory.makeGitRuleGrant(
+            rule=rule, grantee=requester, can_push=True, can_create=True)
+
+        results = repository.findRuleGrantsByGrantee(requester)
+        self.assertEqual([grant], list(results))
+
+    def test_findRuleGrantsByGrantee_grantee_type(self):
+        requester = self.factory.makePerson()
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(owner=requester))
+
+        rule = self.factory.makeGitRule(repository)
+        grant = self.factory.makeGitRuleGrant(
+            rule=rule,
+            grantee=GitGranteeType.REPOSITORY_OWNER,
+            can_push=True,
+            can_create=True)
+
+        results = repository.findRuleGrantsForRepositoryOwner()
+        self.assertEqual([grant], list(results))
+
+    def test_findRuleGrantsByGrantee_owner_and_other(self):
+        requester = self.factory.makePerson()
+        other = self.factory.makePerson()
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(owner=requester))
+
+        rule = self.factory.makeGitRule(repository)
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=other, can_push=True, can_create=True)
+
+        results = repository.findRuleGrantsByGrantee(requester)
+        self.assertEqual([], list(results))
+
+    def test_findRuleGrantsByGrantee_owner_and_other_with_owner_grant(self):
+        requester = self.factory.makePerson()
+        other = self.factory.makePerson()
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(owner=requester))
+
+        rule = self.factory.makeGitRule(repository)
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=other, can_push=True, can_create=True)
+        owner_grant = self.factory.makeGitRuleGrant(
+            rule=rule, grantee=requester, can_push=True)
+
+        results = repository.findRuleGrantsByGrantee(requester)
+        self.assertEqual([owner_grant], list(results))
+
 
 class TestGitIdentityMixin(TestCaseWithFactory):
     """Test the defaults and identities provided by GitIdentityMixin."""

=== modified file 'lib/lp/code/xmlrpc/git.py'
--- lib/lp/code/xmlrpc/git.py	2018-08-28 13:58:37 +0000
+++ lib/lp/code/xmlrpc/git.py	2018-10-15 14:44:56 +0000
@@ -325,3 +325,94 @@
         else:
             # Only macaroons are supported for password authentication.
             return faults.Unauthorized()
+
+    def _sortPermissions(self, set_of_permissions):
+        """Sort an iterable of permission strings for consistency"""
+        permissions = []
+        if 'create' in set_of_permissions:
+            permissions.append('create')
+        if 'push' in set_of_permissions:
+            permissions.append('push')
+        if 'force_push' in set_of_permissions:
+            permissions.append('force_push')
+        return permissions
+
+    def _buildPermissions(self, grant):
+        """Build a set of the available permissions from a GitRuleGrant"""
+        permissions = set()
+        if grant.can_create:
+            permissions.add('create')
+        if grant.can_push:
+            permissions.add('push')
+        if grant.can_force_push:
+            # can_force_push implies can_push.
+            permissions.add('push')
+            permissions.add('force_push')
+        return permissions
+
+    def _listRefRules(self, requester, translated_path):
+        repository = removeSecurityProxy(
+            getUtility(IGitLookup).getByHostingPath(translated_path))
+        is_owner = requester.inTeam(repository.owner)
+        grants = repository.findRuleGrantsByGrantee(requester)
+        # If the user is the owner, get the grants for REPOSITORY_OWNER
+        # and add them to our available grants to match against
+        if is_owner:
+            owner_grants = repository.findRuleGrantsForRepositoryOwner()
+            grants = grants.union(owner_grants)
+        result = []
+
+        for rule in repository.rules:
+            # Do we have any grants for this rule, for this user?
+            matching_grants = [x for x in grants if x.rule == rule]
+            # If we don't have any grants, but the user is the owner,
+            # they get a default grant to the ref specified by the rule.
+            if is_owner and not matching_grants:
+                result.append(
+                    {'ref_pattern': rule.ref_pattern,
+                     'permissions': ['create', 'push'],
+                    })
+                continue
+            # If we otherwise don't have any matching grants,
+            # we can ignore this rule
+            if not matching_grants:
+                continue
+
+            # Permissions are a union of all the applicable grants
+            union_permissions = set()
+            for grant in matching_grants:
+                permissions = self._buildPermissions(grant)
+                union_permissions.update(permissions)
+
+            # If the user is the repository owner, they essentially have
+            # the equivalent of a default team grant, but only
+            # if there is no explicit grant to them otherwise specified
+            if is_owner and not any(g for g in owner_grants if g.rule == rule):
+                union_permissions.update(['create', 'push'])
+
+            # Sort the permissions from the set for consistency
+            sorted_permissions = self._sortPermissions(union_permissions)
+            result.append(
+                {'ref_pattern': rule.ref_pattern,
+                 'permissions': sorted_permissions,
+                })
+
+        # The last rule for a repository owner is a default permission
+        # for everything. This is overridden by any matching rules previously
+        # in the list
+        if is_owner:
+            result.append(
+                {'ref_pattern': '*',
+                 'permissions': ['create', 'push', 'force_push'],
+                })
+
+        return result
+
+    def listRefRules(self, translated_path, auth_params):
+        """See `IGitAPI`"""
+        requester_id = auth_params.get("uid")
+        return run_with_login(
+            requester_id,
+            self._listRefRules,
+            translated_path,
+            )

=== modified file 'lib/lp/code/xmlrpc/tests/test_git.py'
--- lib/lp/code/xmlrpc/tests/test_git.py	2018-08-28 14:07:38 +0000
+++ lib/lp/code/xmlrpc/tests/test_git.py	2018-10-15 14:44:56 +0000
@@ -6,11 +6,17 @@
 __metaclass__ = type
 
 from pymacaroons import Macaroon
+from testtools.matchers import (
+    Equals,
+    MatchesListwise,
+    MatchesDict,
+    )
 from zope.component import getUtility
 from zope.security.proxy import removeSecurityProxy
 
 from lp.app.enums import InformationType
 from lp.code.enums import (
+    GitGranteeType,
     GitRepositoryType,
     TargetRevisionControlSystems,
     )
@@ -260,6 +266,577 @@
         self.assertEqual(
             initial_count, getUtility(IAllGitRepositories).count())
 
+    def test_listRefRules_simple(self):
+        # Test that correct ref rules are retrieved for a Person
+        requester = self.factory.makePerson()
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository())
+
+        rule = self.factory.makeGitRule(repository)
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=requester, can_push=True, can_create=True)
+
+        results = self.git_api.listRefRules(
+            repository.getInternalPath(),
+            {'uid': requester.id})
+        self.assertThat(results, MatchesListwise([
+            MatchesDict({
+                'ref_pattern': Equals('refs/heads/*'),
+                'permissions': Equals(['create', 'push']),
+                }),
+            ]))
+
+    def test_listRefRules_with_other_grants(self):
+        # Test that findRuleGrantsByGrantee only returns relevant rules
+        requester = self.factory.makePerson()
+        other_user = self.factory.makePerson()
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository())
+
+        rule = self.factory.makeGitRule(repository)
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=requester, can_push=True)
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=other_user, can_create=True)
+
+        results = self.git_api.listRefRules(
+            repository.getInternalPath(),
+            {'uid': requester.id})
+        self.assertThat(results, MatchesListwise([
+            MatchesDict({
+                'ref_pattern': Equals('refs/heads/*'),
+                'permissions': Equals(['push']),
+                })
+            ]))
+
+    def test_listRefRules_owner_has_default(self):
+        owner = self.factory.makePerson()
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(owner=owner))
+
+        results = self.git_api.listRefRules(
+            repository.getInternalPath(),
+            {'uid': owner.id})
+
+        self.assertThat(results, MatchesListwise([
+            MatchesDict({
+                'ref_pattern': Equals('*'),
+                'permissions': Equals(['create', 'push', 'force_push']),
+                }),
+            ]))
+
+    def test_listRefRules_owner_modifies_rules(self):
+        owner = self.factory.makePerson()
+        person = self.factory.makePerson()
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(owner=owner))
+
+        rule = self.factory.makeGitRule(
+            repository, ref_pattern=u'refs/heads/stable/*')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=person, can_push=True)
+
+        results = self.git_api.listRefRules(
+            repository.getInternalPath(),
+            {'uid': owner.id})
+
+        self.assertThat(results, MatchesListwise([
+            MatchesDict({
+                'ref_pattern': Equals('refs/heads/stable/*'),
+                'permissions': Equals(['create', 'push']),
+                }),
+            MatchesDict({
+                'ref_pattern': Equals('*'),
+                'permissions': Equals(['create', 'push', 'force_push']),
+                }),
+            ]))
+
+    def test_listRefRules_owner_no_default_with_explicit(self):
+        owner = self.factory.makePerson()
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(owner=owner))
+
+        rule = self.factory.makeGitRule(
+            repository, ref_pattern=u'refs/heads/stable/*')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=GitGranteeType.REPOSITORY_OWNER, can_push=True)
+
+        results = self.git_api.listRefRules(
+            repository.getInternalPath(),
+            {'uid': owner.id})
+
+        self.assertThat(results, MatchesListwise([
+            MatchesDict({
+                'ref_pattern': Equals('refs/heads/stable/*'),
+                'permissions': Equals(['push']),
+                }),
+            MatchesDict({
+                'ref_pattern': Equals('*'),
+                'permissions': Equals(['create', 'push', 'force_push']),
+                }),
+            ]))
+
+    def test_listRefRules_owner_modifies_rules_multiple_grants(self):
+        owner = self.factory.makePerson()
+        person = self.factory.makePerson()
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(owner=owner))
+
+        rule = self.factory.makeGitRule(
+            repository, ref_pattern=u'refs/heads/stable/*')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=person, can_push=True, can_create=True)
+
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=GitGranteeType.REPOSITORY_OWNER, can_push=True)
+
+        results = self.git_api.listRefRules(
+            repository.getInternalPath(),
+            {'uid': owner.id})
+
+        self.assertThat(results, MatchesListwise([
+            MatchesDict({
+                'ref_pattern': Equals('refs/heads/stable/*'),
+                'permissions': Equals(['push']),
+                }),
+            MatchesDict({
+                'ref_pattern': Equals('*'),
+                'permissions': Equals(['create', 'push', 'force_push']),
+                }),
+            ]))
+
+    def test_listRefRules_no_grants(self):
+        # User that has no grants and is not the owner
+        requester = self.factory.makePerson()
+        owner = self.factory.makePerson()
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(owner=owner))
+
+        rule = self.factory.makeGitRule(repository)
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=owner, can_push=True, can_create=True)
+
+        results = self.git_api.listRefRules(
+            repository.getInternalPath(),
+            {'uid': requester.id})
+        self.assertEqual(0, len(results))
+
+    def test_listRefRules_owner_has_default_with_other_grant(self):
+        owner = self.factory.makePerson()
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(owner=owner))
+
+        rule = self.factory.makeGitRule(
+            repository=repository, ref_pattern=u'refs/heads/master')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=owner, can_push=True, can_create=True)
+
+        results = self.git_api.listRefRules(
+            repository.getInternalPath(),
+            {'uid': owner.id})
+        self.assertEqual(len(results), 2)
+        # Default grant should be last in pattern
+        self.assertThat(results, MatchesListwise([
+            MatchesDict({
+                'ref_pattern': Equals('refs/heads/master'),
+                'permissions': Equals(['create', 'push']),
+                }),
+            MatchesDict({
+                'ref_pattern': Equals('*'),
+                'permissions': Equals(['create', 'push', 'force_push']),
+                }),
+            ]))
+
+    def test_listRefRules_owner_is_team(self):
+        member = self.factory.makePerson()
+        owner = self.factory.makeTeam(members=[member])
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(
+                owner=owner, information_type=InformationType.USERDATA))
+
+        results = self.git_api.listRefRules(
+            repository.getInternalPath(),
+            {'uid': member.id})
+
+        # Should have default grant as member of owning team
+        self.assertThat(results, MatchesListwise([
+            MatchesDict({
+                'ref_pattern': Equals('*'),
+                'permissions': Equals(['create', 'push', 'force_push']),
+                }),
+            ]))
+
+    def test_listRefRules_owner_is_team_with_grants(self):
+        member = self.factory.makePerson()
+        owner = self.factory.makeTeam(members=[member])
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(
+                owner=owner, information_type=InformationType.USERDATA))
+
+        rule = self.factory.makeGitRule(
+            repository=repository, ref_pattern=u'refs/heads/master')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=owner, can_push=True, can_create=True)
+
+        results = self.git_api.listRefRules(
+            repository.getInternalPath(),
+            {'uid': member.id})
+
+        # Should have default grant as member of owning team
+        self.assertThat(results, MatchesListwise([
+            MatchesDict({
+                'ref_pattern': Equals('refs/heads/master'),
+                'permissions': Equals(['create', 'push']),
+                }),
+            MatchesDict({
+                'ref_pattern': Equals('*'),
+                'permissions': Equals(['create', 'push', 'force_push']),
+                }),
+            ]))
+
+    def test_listRefRules_owner_is_team_with_grants_to_person(self):
+        member = self.factory.makePerson()
+        other_member = self.factory.makePerson()
+        owner = self.factory.makeTeam(members=[member, other_member])
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(
+                owner=owner, information_type=InformationType.USERDATA))
+
+        rule = self.factory.makeGitRule(
+            repository=repository, ref_pattern=u'refs/heads/master')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=GitGranteeType.REPOSITORY_OWNER,
+            can_push=True, can_create=True)
+
+        rule = self.factory.makeGitRule(
+            repository=repository, ref_pattern=u'refs/heads/tags')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=member, can_create=True)
+
+        # This should not appear
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=other_member, can_push=True)
+
+        results = self.git_api.listRefRules(
+            repository.getInternalPath(),
+            {'uid': member.id})
+
+        # Should have default grant as member of owning team
+        self.assertThat(results, MatchesListwise([
+            MatchesDict({
+                'ref_pattern': Equals('refs/heads/master'),
+                'permissions': Equals(['create', 'push']),
+                }),
+            MatchesDict({
+                'ref_pattern': Equals('refs/heads/tags'),
+                'permissions': Equals(['create', 'push']),
+                }),
+            MatchesDict({
+                'ref_pattern': Equals('*'),
+                'permissions': Equals(['create', 'push', 'force_push']),
+                }),
+            ]))
+
+    def test_listRefRules_multiple_grants_to_same_ref_with_owner(self):
+        member = self.factory.makePerson()
+        owner = self.factory.makeTeam(members=[member])
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(owner=owner))
+
+        rule = self.factory.makeGitRule(repository=repository)
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=member, can_create=True)
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=owner, can_push=True)
+
+        results = self.git_api.listRefRules(
+            repository.getInternalPath(),
+            {'uid': member.id})
+
+        self.assertThat(results, MatchesListwise([
+            MatchesDict({
+                'ref_pattern': Equals('refs/heads/*'),
+                'permissions': Equals(['create', 'push']),
+                }),
+            MatchesDict({
+                'ref_pattern': Equals('*'),
+                'permissions': Equals(['create', 'push', 'force_push']),
+                }),
+            ]))
+
+    def test_listRefRules_multiple_grants_collapsing(self):
+        member = self.factory.makePerson()
+        second_member = self.factory.makePerson()
+        third_member = self.factory.makePerson()
+        owner = self.factory.makePerson()
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(owner=owner))
+
+        rule = self.factory.makeGitRule(repository=repository)
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=member, can_create=True)
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=second_member, can_push=True)
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=third_member, can_force_push=True)
+
+        results = self.git_api.listRefRules(
+            repository.getInternalPath(),
+            {'uid': owner.id})
+
+        self.assertThat(results, MatchesListwise([
+            MatchesDict({
+                'ref_pattern': Equals('refs/heads/*'),
+                'permissions': Equals(['create', 'push']),
+                }),
+            MatchesDict({
+                'ref_pattern': Equals('*'),
+                'permissions': Equals(['create', 'push', 'force_push']),
+                }),
+            ]))
+
+    def test_listRefRules_grantee_owner_type(self):
+        owner = self.factory.makePerson()
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(owner=owner))
+        rule = self.factory.makeGitRule(repository=repository)
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=GitGranteeType.REPOSITORY_OWNER,
+            can_create=True)
+
+        results = self.git_api.listRefRules(
+            repository.getInternalPath(),
+            {'uid': owner.id})
+
+        self.assertThat(results, MatchesListwise([
+            MatchesDict({
+                'ref_pattern': Equals('refs/heads/*'),
+                'permissions': Equals(['create']),
+                }),
+            MatchesDict({
+                'ref_pattern': Equals('*'),
+                'permissions': Equals(['create', 'push', 'force_push']),
+                }),
+            ]))
+
+    def test_listRefRules_grantee_owner_type_and_other_grants(self):
+        owner = self.factory.makePerson()
+        other_person = self.factory.makePerson()
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(owner=owner))
+        rule = self.factory.makeGitRule(repository=repository)
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=GitGranteeType.REPOSITORY_OWNER,
+            can_create=True)
+
+        rule = self.factory.makeGitRule(
+            repository=repository, ref_pattern=u'refs/heads/other')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=other_person, can_push=True)
+
+        results = self.git_api.listRefRules(
+            repository.getInternalPath(),
+            {'uid': owner.id})
+
+        self.assertThat(results, MatchesListwise([
+            MatchesDict({
+                'ref_pattern': Equals('refs/heads/other'),
+                'permissions': Equals(['create', 'push']),
+                }),
+            MatchesDict({
+                'ref_pattern': Equals('refs/heads/*'),
+                'permissions': Equals(['create']),
+                }),
+            MatchesDict({
+                'ref_pattern': Equals('*'),
+                'permissions': Equals(['create', 'push', 'force_push']),
+                }),
+            ]))
+
+    def test_listRefRules_grantee_example_one(self):
+        user_a = self.factory.makePerson()
+        user_b = self.factory.makePerson()
+        user_c = self.factory.makePerson()
+        stable_team = self.factory.makeTeam(members=[user_a, user_b])
+        next_team = self.factory.makeTeam(members=[user_b, user_c])
+
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(owner=user_a))
+
+        rule = self.factory.makeGitRule(
+            repository, ref_pattern=u'refs/heads/stable/next')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=GitGranteeType.REPOSITORY_OWNER,
+            can_force_push=True)
+
+        rule = self.factory.makeGitRule(
+            repository, ref_pattern=u'refs/heads/archived/*')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=GitGranteeType.REPOSITORY_OWNER)
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=user_b, can_create=True)
+
+        rule = self.factory.makeGitRule(
+            repository, ref_pattern=u'refs/heads/stable/*')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=stable_team, can_push=True)
+
+        rule = self.factory.makeGitRule(
+            repository, ref_pattern=u'refs/heads/*/next')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=next_team, can_force_push=True)
+
+        rule = self.factory.makeGitRule(
+            repository, ref_pattern=u'refs/tags/*')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=GitGranteeType.REPOSITORY_OWNER,
+            can_create=True)
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=stable_team, can_create=True)
+
+        results = self.git_api.listRefRules(
+            repository.getInternalPath(),
+            {'uid': user_a.id})
+
+        self.assertThat(results, MatchesListwise([
+            MatchesDict(
+                {'ref_pattern': Equals('refs/heads/stable/next'),
+                 'permissions': Equals(['push', 'force_push']),
+                }),
+            MatchesDict(
+                {'ref_pattern': Equals('refs/heads/archived/*'),
+                 'permissions': Equals([]),
+                }),
+            MatchesDict(
+                {'ref_pattern': Equals('refs/heads/stable/*'),
+                 'permissions': Equals(['create', 'push']),
+                }),
+            MatchesDict(
+                {'ref_pattern': Equals('refs/heads/*/next'),
+                 'permissions': Equals(['create', 'push']),
+                }),
+            MatchesDict(
+                {'ref_pattern': Equals('refs/tags/*'),
+                 'permissions': Equals(['create']),
+                }),
+            MatchesDict(
+                {'ref_pattern': Equals('*'),
+                 'permissions': Equals(['create', 'push', 'force_push']),
+                }),
+            ]))
+
+    def test_listRefRules_grantee_example_two(self):
+        user_a = self.factory.makePerson()
+        user_b = self.factory.makePerson()
+        user_c = self.factory.makePerson()
+        stable_team = self.factory.makeTeam(members=[user_a, user_b])
+        next_team = self.factory.makeTeam(members=[user_b, user_c])
+
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(owner=user_a))
+
+        rule = self.factory.makeGitRule(
+            repository, ref_pattern=u'refs/heads/stable/next')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=user_a, can_force_push=True)
+
+        rule = self.factory.makeGitRule(
+            repository, ref_pattern=u'refs/heads/archived/*')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=user_a)
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=user_b, can_create=True)
+
+        rule = self.factory.makeGitRule(
+            repository, ref_pattern=u'refs/heads/stable/*')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=stable_team, can_push=True)
+
+        rule = self.factory.makeGitRule(
+            repository, ref_pattern=u'refs/heads/*/next')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=next_team, can_force_push=True)
+
+        rule = self.factory.makeGitRule(
+            repository, ref_pattern=u'refs/tags/*')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=user_a, can_create=True)
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=stable_team, can_create=True)
+
+        results = self.git_api.listRefRules(
+            repository.getInternalPath(),
+            {'uid': user_b.id})
+
+        self.assertThat(results, MatchesListwise([
+            MatchesDict(
+                {'ref_pattern': Equals('refs/heads/archived/*'),
+                 'permissions': Equals(['create']),
+                }),
+            MatchesDict(
+                {'ref_pattern': Equals('refs/heads/stable/*'),
+                 'permissions': Equals(['push']),
+                }),
+            MatchesDict(
+                {'ref_pattern': Equals('refs/heads/*/next'),
+                 'permissions': Equals(['push', 'force_push']),
+                }),
+            MatchesDict(
+                {'ref_pattern': Equals('refs/tags/*'),
+                 'permissions': Equals(['create']),
+                }),
+            ]))
+
+    def test_listRefRules_grantee_example_three(self):
+        user_a = self.factory.makePerson()
+        user_b = self.factory.makePerson()
+        user_c = self.factory.makePerson()
+        stable_team = self.factory.makeTeam(members=[user_a, user_b])
+        next_team = self.factory.makeTeam(members=[user_b, user_c])
+
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(owner=user_a))
+
+        rule = self.factory.makeGitRule(
+            repository, ref_pattern=u'refs/heads/stable/next')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=user_a, can_force_push=True)
+
+        rule = self.factory.makeGitRule(
+            repository, ref_pattern=u'refs/heads/archived/*')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=user_a)
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=user_b, can_create=True)
+
+        rule = self.factory.makeGitRule(
+            repository, ref_pattern=u'refs/heads/stable/*')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=stable_team, can_push=True)
+
+        rule = self.factory.makeGitRule(
+            repository, ref_pattern=u'refs/heads/*/next')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=next_team, can_force_push=True)
+
+        rule = self.factory.makeGitRule(
+            repository, ref_pattern=u'refs/tags/*')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=user_a, can_create=True)
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=stable_team, can_create=True)
+
+        results = self.git_api.listRefRules(
+            repository.getInternalPath(),
+            {'uid': user_c.id})
+
+        self.assertThat(results, MatchesListwise([
+            MatchesDict(
+                {'ref_pattern': Equals('refs/heads/*/next'),
+                 'permissions': Equals(['push', 'force_push']),
+                }),
+            ]))
+
 
 class TestGitAPI(TestGitAPIMixin, TestCaseWithFactory):
     """Tests for the implementation of `IGitAPI`."""