Merge lp:~twom/launchpad/rework-git-permissions-for-shadowing into lp:launchpad

[Tom Wardill]

Rework git branch permissions to improve shadowing for multiple grants

[Colin Watson (cjwatson)]

review: Needs Fixing

[Colin Watson (cjwatson)]

Just a few minor tweaks, but otherwise this looks good and we can land it.

review: Approve

=== modified file 'lib/lp/code/interfaces/gitapi.py'
--- lib/lp/code/interfaces/gitapi.py	2018-09-28 13:53:41 +0000
+++ lib/lp/code/interfaces/gitapi.py	2018-10-19 08:51:38 +0000
@@ -68,8 +68,9 @@
             not yet supported.
         """
 
-    def listRefRules(self, repository, user):
-        """Return the list of ref rules for `user` in `repository`
+    def checkRefPermissions(self, repository, ref_paths, user):
+        """Return a list of ref rules for a `user` in a `repository` that
+        match the input refs.
 
         :returns: A list of rules for the user in the specified repository
         """
 
=== modified file 'lib/lp/code/xmlrpc/git.py'
--- lib/lp/code/xmlrpc/git.py	2018-10-17 10:09:33 +0000
+++ lib/lp/code/xmlrpc/git.py	2018-10-19 08:51:38 +0000
@@ -8,6 +8,8 @@
     'GitAPI',
     ]
 
+from collections import defaultdict
+from fnmatch import fnmatch
 import sys
 
 from pymacaroons import Macaroon
@@ -24,7 +26,10 @@
 
 from lp.app.errors import NameLookupFailed
 from lp.app.validators import LaunchpadValidationError
-from lp.code.enums import GitRepositoryType
+from lp.code.enums import (
+    GitGranteeType,
+    GitRepositoryType,
+    )
 from lp.code.errors import (
     GitRepositoryCreationException,
     GitRepositoryCreationFault,
@@ -350,67 +355,57 @@
             permissions.add('force_push')
         return permissions
 
-    def _listRefRules(self, requester, translated_path):
+    def _findMatchingRules(self, repository, ref_path):
+        """Find all matching rules for a given ref path"""
+        matching_rules = []
+        for rule in repository.rules:
+            if fnmatch(ref_path, rule.ref_pattern):
+                matching_rules.append(rule)
+        return matching_rules
+
+    def _checkRefPermissions(self, requester, translated_path, ref_paths):
         repository = removeSecurityProxy(
             getUtility(IGitLookup).getByHostingPath(translated_path))
         is_owner = requester.inTeam(repository.owner)
+        result = {}
+
+        grants_for_user = defaultdict(list)
         grants = repository.findRuleGrantsByGrantee(requester)
-        # If the user is the owner, get the grants for REPOSITORY_OWNER
-        # and add them to our available grants to match against
         if is_owner:
             owner_grants = repository.findRuleGrantsForRepositoryOwner()
             grants = grants.union(owner_grants)
-        result = []
+        for grant in grants:
+            grants_for_user[grant.rule].append(grant)
 
-        for rule in repository.rules:
-            # Do we have any grants for this rule, for this user?
-            matching_grants = [x for x in grants if x.rule == rule]
-            # If we don't have any grants, but the user is the owner,
-            # they get a default grant to the ref specified by the rule.
-            if is_owner and not matching_grants:
-                result.append(
-                    {'ref_pattern': rule.ref_pattern,
-                     'permissions': ['create', 'push'],
-                    })
+        for ref in ref_paths:
+            matching_rules = self._findMatchingRules(repository, ref)
+            if is_owner and not matching_rules:
+                result[ref] = ['create', 'push', 'force_push']
                 continue
-
-            # Permissions are a union of all the applicable grants
+            seen_grantees = set()
             union_permissions = set()
-            for grant in matching_grants:
-                permissions = self._buildPermissions(grant)
-                union_permissions.update(permissions)
+            for rule in matching_rules:
+                for grant in grants_for_user[rule]:
+                    if (grant.grantee, grant.grantee_type) in seen_grantees:
+                        continue
+                    permissions = self._buildPermissions(grant)
+                    union_permissions.update(permissions)
+                    seen_grantees.add((grant.grantee, grant.grantee_type))
 
-            # If the user is the repository owner, they essentially have
-            # the equivalent of a default team grant, but only
-            # if there is no explicit grant to them otherwise specified
-            if is_owner and not any(g for g in owner_grants if g.rule == rule):
+            owner_type = (None, GitGranteeType.REPOSITORY_OWNER)
+            if is_owner and owner_type not in seen_grantees:
                 union_permissions.update(['create', 'push'])
 
-            # Sort the permissions from the set for consistency
             sorted_permissions = self._sortPermissions(union_permissions)
-            result.append(
-                {'ref_pattern': rule.ref_pattern,
-                 'permissions': sorted_permissions,
-                })
-
-        # The last rule is a default wildcard. The repository owner gets
-        # permissions to everything, whereas other people get no permissions.
-        if is_owner:
-            default_permissions = ['create', 'push', 'force_push']
-        else:
-            default_permissions = []
-        result.append(
-            {'ref_pattern': '*',
-             'permissions': default_permissions,
-            })
-
+            result[ref] = sorted_permissions
         return result
 
-    def listRefRules(self, translated_path, auth_params):
-        """See `IGitAPI`"""
+    def checkRefPermissions(self, translated_path, ref_paths, auth_params):
+        """ See `IGitAPI`"""
         requester_id = auth_params.get("uid")
         return run_with_login(
             requester_id,
-            self._listRefRules,
+            self._checkRefPermissions,
             translated_path,
-            )
+            ref_paths
+        )
 
=== modified file 'lib/lp/code/xmlrpc/tests/test_git.py'
--- lib/lp/code/xmlrpc/tests/test_git.py	2018-10-17 10:09:33 +0000
+++ lib/lp/code/xmlrpc/tests/test_git.py	2018-10-19 08:51:38 +0000
@@ -266,410 +266,7 @@
         self.assertEqual(
             initial_count, getUtility(IAllGitRepositories).count())
 
-    def test_listRefRules_simple(self):
-        # Test that correct ref rules are retrieved for a Person
-        requester = self.factory.makePerson()
-        repository = removeSecurityProxy(
-            self.factory.makeGitRepository())
-
-        rule = self.factory.makeGitRule(repository)
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=requester, can_push=True, can_create=True)
-
-        results = self.git_api.listRefRules(
-            repository.getInternalPath(),
-            {'uid': requester.id})
-        self.assertThat(results, MatchesListwise([
-            MatchesDict({
-                'ref_pattern': Equals('refs/heads/*'),
-                'permissions': Equals(['create', 'push']),
-                }),
-            MatchesDict({
-                'ref_pattern': Equals('*'),
-                'permissions': Equals([]),
-                }),
-            ]))
-
-    def test_listRefRules_with_other_grants(self):
-        # Test that findRuleGrantsByGrantee only returns relevant rules
-        requester = self.factory.makePerson()
-        other_user = self.factory.makePerson()
-        repository = removeSecurityProxy(
-            self.factory.makeGitRepository())
-
-        rule = self.factory.makeGitRule(repository)
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=requester, can_push=True)
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=other_user, can_create=True)
-
-        results = self.git_api.listRefRules(
-            repository.getInternalPath(),
-            {'uid': requester.id})
-        self.assertThat(results, MatchesListwise([
-            MatchesDict({
-                'ref_pattern': Equals('refs/heads/*'),
-                'permissions': Equals(['push']),
-                }),
-            MatchesDict({
-                'ref_pattern': Equals('*'),
-                'permissions': Equals([]),
-                }),
-            ]))
-
-    def test_listRefRules_owner_has_default(self):
-        owner = self.factory.makePerson()
-        repository = removeSecurityProxy(
-            self.factory.makeGitRepository(owner=owner))
-
-        results = self.git_api.listRefRules(
-            repository.getInternalPath(),
-            {'uid': owner.id})
-
-        self.assertThat(results, MatchesListwise([
-            MatchesDict({
-                'ref_pattern': Equals('*'),
-                'permissions': Equals(['create', 'push', 'force_push']),
-                }),
-            ]))
-
-    def test_listRefRules_owner_modifies_rules(self):
-        owner = self.factory.makePerson()
-        person = self.factory.makePerson()
-        repository = removeSecurityProxy(
-            self.factory.makeGitRepository(owner=owner))
-
-        rule = self.factory.makeGitRule(
-            repository, ref_pattern=u'refs/heads/stable/*')
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=person, can_push=True)
-
-        results = self.git_api.listRefRules(
-            repository.getInternalPath(),
-            {'uid': owner.id})
-
-        self.assertThat(results, MatchesListwise([
-            MatchesDict({
-                'ref_pattern': Equals('refs/heads/stable/*'),
-                'permissions': Equals(['create', 'push']),
-                }),
-            MatchesDict({
-                'ref_pattern': Equals('*'),
-                'permissions': Equals(['create', 'push', 'force_push']),
-                }),
-            ]))
-
-    def test_listRefRules_owner_no_default_with_explicit(self):
-        owner = self.factory.makePerson()
-        repository = removeSecurityProxy(
-            self.factory.makeGitRepository(owner=owner))
-
-        rule = self.factory.makeGitRule(
-            repository, ref_pattern=u'refs/heads/stable/*')
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=GitGranteeType.REPOSITORY_OWNER, can_push=True)
-
-        results = self.git_api.listRefRules(
-            repository.getInternalPath(),
-            {'uid': owner.id})
-
-        self.assertThat(results, MatchesListwise([
-            MatchesDict({
-                'ref_pattern': Equals('refs/heads/stable/*'),
-                'permissions': Equals(['push']),
-                }),
-            MatchesDict({
-                'ref_pattern': Equals('*'),
-                'permissions': Equals(['create', 'push', 'force_push']),
-                }),
-            ]))
-
-    def test_listRefRules_owner_modifies_rules_multiple_grants(self):
-        owner = self.factory.makePerson()
-        person = self.factory.makePerson()
-        repository = removeSecurityProxy(
-            self.factory.makeGitRepository(owner=owner))
-
-        rule = self.factory.makeGitRule(
-            repository, ref_pattern=u'refs/heads/stable/*')
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=person, can_push=True, can_create=True)
-
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=GitGranteeType.REPOSITORY_OWNER, can_push=True)
-
-        results = self.git_api.listRefRules(
-            repository.getInternalPath(),
-            {'uid': owner.id})
-
-        self.assertThat(results, MatchesListwise([
-            MatchesDict({
-                'ref_pattern': Equals('refs/heads/stable/*'),
-                'permissions': Equals(['push']),
-                }),
-            MatchesDict({
-                'ref_pattern': Equals('*'),
-                'permissions': Equals(['create', 'push', 'force_push']),
-                }),
-            ]))
-
-    def test_listRefRules_no_grants(self):
-        # User that has no grants and is not the owner
-        requester = self.factory.makePerson()
-        owner = self.factory.makePerson()
-        repository = removeSecurityProxy(
-            self.factory.makeGitRepository(owner=owner))
-
-        rule = self.factory.makeGitRule(repository)
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=owner, can_push=True, can_create=True)
-
-        results = self.git_api.listRefRules(
-            repository.getInternalPath(),
-            {'uid': requester.id})
-        self.assertThat(results, MatchesListwise([
-            MatchesDict({
-                'ref_pattern': Equals('refs/heads/*'),
-                'permissions': Equals([]),
-                }),
-            MatchesDict({
-                'ref_pattern': Equals('*'),
-                'permissions': Equals([]),
-                }),
-            ]))
-
-    def test_listRefRules_owner_has_default_with_other_grant(self):
-        owner = self.factory.makePerson()
-        repository = removeSecurityProxy(
-            self.factory.makeGitRepository(owner=owner))
-
-        rule = self.factory.makeGitRule(
-            repository=repository, ref_pattern=u'refs/heads/master')
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=owner, can_push=True, can_create=True)
-
-        results = self.git_api.listRefRules(
-            repository.getInternalPath(),
-            {'uid': owner.id})
-        # Default grant should be last in pattern
-        self.assertThat(results, MatchesListwise([
-            MatchesDict({
-                'ref_pattern': Equals('refs/heads/master'),
-                'permissions': Equals(['create', 'push']),
-                }),
-            MatchesDict({
-                'ref_pattern': Equals('*'),
-                'permissions': Equals(['create', 'push', 'force_push']),
-                }),
-            ]))
-
-    def test_listRefRules_owner_is_team(self):
-        member = self.factory.makePerson()
-        owner = self.factory.makeTeam(members=[member])
-        repository = removeSecurityProxy(
-            self.factory.makeGitRepository(
-                owner=owner, information_type=InformationType.USERDATA))
-
-        results = self.git_api.listRefRules(
-            repository.getInternalPath(),
-            {'uid': member.id})
-
-        # Should have default grant as member of owning team
-        self.assertThat(results, MatchesListwise([
-            MatchesDict({
-                'ref_pattern': Equals('*'),
-                'permissions': Equals(['create', 'push', 'force_push']),
-                }),
-            ]))
-
-    def test_listRefRules_owner_is_team_with_grants(self):
-        member = self.factory.makePerson()
-        owner = self.factory.makeTeam(members=[member])
-        repository = removeSecurityProxy(
-            self.factory.makeGitRepository(
-                owner=owner, information_type=InformationType.USERDATA))
-
-        rule = self.factory.makeGitRule(
-            repository=repository, ref_pattern=u'refs/heads/master')
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=owner, can_push=True, can_create=True)
-
-        results = self.git_api.listRefRules(
-            repository.getInternalPath(),
-            {'uid': member.id})
-
-        # Should have default grant as member of owning team
-        self.assertThat(results, MatchesListwise([
-            MatchesDict({
-                'ref_pattern': Equals('refs/heads/master'),
-                'permissions': Equals(['create', 'push']),
-                }),
-            MatchesDict({
-                'ref_pattern': Equals('*'),
-                'permissions': Equals(['create', 'push', 'force_push']),
-                }),
-            ]))
-
-    def test_listRefRules_owner_is_team_with_grants_to_person(self):
-        member = self.factory.makePerson()
-        other_member = self.factory.makePerson()
-        owner = self.factory.makeTeam(members=[member, other_member])
-        repository = removeSecurityProxy(
-            self.factory.makeGitRepository(
-                owner=owner, information_type=InformationType.USERDATA))
-
-        rule = self.factory.makeGitRule(
-            repository=repository, ref_pattern=u'refs/heads/master')
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=GitGranteeType.REPOSITORY_OWNER,
-            can_push=True, can_create=True)
-
-        rule = self.factory.makeGitRule(
-            repository=repository, ref_pattern=u'refs/heads/tags')
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=member, can_create=True)
-
-        # This should not appear
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=other_member, can_push=True)
-
-        results = self.git_api.listRefRules(
-            repository.getInternalPath(),
-            {'uid': member.id})
-
-        # Should have default grant as member of owning team
-        self.assertThat(results, MatchesListwise([
-            MatchesDict({
-                'ref_pattern': Equals('refs/heads/master'),
-                'permissions': Equals(['create', 'push']),
-                }),
-            MatchesDict({
-                'ref_pattern': Equals('refs/heads/tags'),
-                'permissions': Equals(['create', 'push']),
-                }),
-            MatchesDict({
-                'ref_pattern': Equals('*'),
-                'permissions': Equals(['create', 'push', 'force_push']),
-                }),
-            ]))
-
-    def test_listRefRules_multiple_grants_to_same_ref_with_owner(self):
-        member = self.factory.makePerson()
-        owner = self.factory.makeTeam(members=[member])
-        repository = removeSecurityProxy(
-            self.factory.makeGitRepository(owner=owner))
-
-        rule = self.factory.makeGitRule(repository=repository)
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=member, can_create=True)
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=owner, can_push=True)
-
-        results = self.git_api.listRefRules(
-            repository.getInternalPath(),
-            {'uid': member.id})
-
-        self.assertThat(results, MatchesListwise([
-            MatchesDict({
-                'ref_pattern': Equals('refs/heads/*'),
-                'permissions': Equals(['create', 'push']),
-                }),
-            MatchesDict({
-                'ref_pattern': Equals('*'),
-                'permissions': Equals(['create', 'push', 'force_push']),
-                }),
-            ]))
-
-    def test_listRefRules_multiple_grants_collapsing(self):
-        member = self.factory.makePerson()
-        second_member = self.factory.makePerson()
-        third_member = self.factory.makePerson()
-        owner = self.factory.makePerson()
-        repository = removeSecurityProxy(
-            self.factory.makeGitRepository(owner=owner))
-
-        rule = self.factory.makeGitRule(repository=repository)
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=member, can_create=True)
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=second_member, can_push=True)
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=third_member, can_force_push=True)
-
-        results = self.git_api.listRefRules(
-            repository.getInternalPath(),
-            {'uid': owner.id})
-
-        self.assertThat(results, MatchesListwise([
-            MatchesDict({
-                'ref_pattern': Equals('refs/heads/*'),
-                'permissions': Equals(['create', 'push']),
-                }),
-            MatchesDict({
-                'ref_pattern': Equals('*'),
-                'permissions': Equals(['create', 'push', 'force_push']),
-                }),
-            ]))
-
-    def test_listRefRules_grantee_owner_type(self):
-        owner = self.factory.makePerson()
-        repository = removeSecurityProxy(
-            self.factory.makeGitRepository(owner=owner))
-        rule = self.factory.makeGitRule(repository=repository)
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=GitGranteeType.REPOSITORY_OWNER,
-            can_create=True)
-
-        results = self.git_api.listRefRules(
-            repository.getInternalPath(),
-            {'uid': owner.id})
-
-        self.assertThat(results, MatchesListwise([
-            MatchesDict({
-                'ref_pattern': Equals('refs/heads/*'),
-                'permissions': Equals(['create']),
-                }),
-            MatchesDict({
-                'ref_pattern': Equals('*'),
-                'permissions': Equals(['create', 'push', 'force_push']),
-                }),
-            ]))
-
-    def test_listRefRules_grantee_owner_type_and_other_grants(self):
-        owner = self.factory.makePerson()
-        other_person = self.factory.makePerson()
-        repository = removeSecurityProxy(
-            self.factory.makeGitRepository(owner=owner))
-        rule = self.factory.makeGitRule(repository=repository)
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=GitGranteeType.REPOSITORY_OWNER,
-            can_create=True)
-
-        rule = self.factory.makeGitRule(
-            repository=repository, ref_pattern=u'refs/heads/other')
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=other_person, can_push=True)
-
-        results = self.git_api.listRefRules(
-            repository.getInternalPath(),
-            {'uid': owner.id})
-
-        self.assertThat(results, MatchesListwise([
-            MatchesDict({
-                'ref_pattern': Equals('refs/heads/other'),
-                'permissions': Equals(['create', 'push']),
-                }),
-            MatchesDict({
-                'ref_pattern': Equals('refs/heads/*'),
-                'permissions': Equals(['create']),
-                }),
-            MatchesDict({
-                'ref_pattern': Equals('*'),
-                'permissions': Equals(['create', 'push', 'force_push']),
-                }),
-            ]))
-
-    def test_listRefRules_grantee_example_one(self):
+    def _make_scenario_one_repository(self):
         user_a = self.factory.makePerson()
         user_b = self.factory.makePerson()
         user_c = self.factory.makePerson()
@@ -686,6 +283,10 @@
             can_force_push=True)
 
         rule = self.factory.makeGitRule(
+            repository, ref_pattern=u'refs/heads/stable/protected')
+        self.factory.makeGitRuleGrant(rule=rule, grantee=stable_team)
+
+        rule = self.factory.makeGitRule(
             repository, ref_pattern=u'refs/heads/archived/*')
         self.factory.makeGitRuleGrant(
             rule=rule, grantee=GitGranteeType.REPOSITORY_OWNER)
@@ -710,247 +311,158 @@
         self.factory.makeGitRuleGrant(
             rule=rule, grantee=stable_team, can_create=True)
 
-        results = self.git_api.listRefRules(
-            repository.getInternalPath(),
+        test_ref_paths = [
+            'refs/heads/stable/next', 'refs/heads/stable/protected',
+            'refs/heads/stable/foo', 'refs/heads/archived/foo',
+            'refs/heads/foo/next', 'refs/heads/unprotected',
+            'refs/tags/1.0',
+        ]
+
+        return (user_a, user_b, user_c, stable_team, next_team, repository,
+                test_ref_paths)
+
+    def test_checkRefPermissions_scenario_one_user_a(self):
+        user_a, _, _, _, _, repo, paths = self._make_scenario_one_repository()
+
+        results = self.git_api.checkRefPermissions(
+            repo.getInternalPath(),
+            paths,
             {'uid': user_a.id})
 
-        self.assertThat(results, MatchesListwise([
-            MatchesDict(
-                {'ref_pattern': Equals('refs/heads/stable/next'),
-                 'permissions': Equals(['push', 'force_push']),
-                }),
-            MatchesDict(
-                {'ref_pattern': Equals('refs/heads/archived/*'),
-                 'permissions': Equals([]),
-                }),
-            MatchesDict(
-                {'ref_pattern': Equals('refs/heads/stable/*'),
-                 'permissions': Equals(['create', 'push']),
-                }),
-            MatchesDict(
-                {'ref_pattern': Equals('refs/heads/*/next'),
-                 'permissions': Equals(['create', 'push']),
-                }),
-            MatchesDict(
-                {'ref_pattern': Equals('refs/tags/*'),
-                 'permissions': Equals(['create']),
-                }),
-            MatchesDict(
-                {'ref_pattern': Equals('*'),
-                 'permissions': Equals(['create', 'push', 'force_push']),
-                }),
-            ]))
-
-    def test_listRefRules_grantee_example_two(self):
-        user_a = self.factory.makePerson()
-        user_b = self.factory.makePerson()
-        user_c = self.factory.makePerson()
-        stable_team = self.factory.makeTeam(members=[user_a, user_b])
-        next_team = self.factory.makeTeam(members=[user_b, user_c])
-
-        repository = removeSecurityProxy(
-            self.factory.makeGitRepository(owner=user_a))
-
-        rule = self.factory.makeGitRule(
-            repository, ref_pattern=u'refs/heads/stable/next')
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=user_a, can_force_push=True)
-
-        rule = self.factory.makeGitRule(
-            repository, ref_pattern=u'refs/heads/archived/*')
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=user_a)
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=user_b, can_create=True)
-
-        rule = self.factory.makeGitRule(
-            repository, ref_pattern=u'refs/heads/stable/*')
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=stable_team, can_push=True)
-
-        rule = self.factory.makeGitRule(
-            repository, ref_pattern=u'refs/heads/*/next')
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=next_team, can_force_push=True)
-
-        rule = self.factory.makeGitRule(
-            repository, ref_pattern=u'refs/tags/*')
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=user_a, can_create=True)
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=stable_team, can_create=True)
-
-        results = self.git_api.listRefRules(
-            repository.getInternalPath(),
+        self.assertThat(results, MatchesDict({
+            'refs/heads/stable/next': Equals(['push', 'force_push']),
+            'refs/heads/stable/protected': Equals(['create', 'push']),
+            'refs/heads/stable/foo': Equals(['create', 'push']),
+            'refs/heads/archived/foo': Equals([]),
+            'refs/heads/foo/next': Equals(['create', 'push']),
+            'refs/heads/unprotected': Equals(['create', 'push', 'force_push']),
+            'refs/tags/1.0': Equals(['create']),
+        }))
+
+    def test_checkRefPermissions_scenario_one_user_b(self):
+        _, user_b, _, _, _, repo, paths = self._make_scenario_one_repository()
+
+        results = self.git_api.checkRefPermissions(
+            repo.getInternalPath(),
+            paths,
             {'uid': user_b.id})
 
-        self.assertThat(results, MatchesListwise([
-            MatchesDict(
-                {'ref_pattern': Equals('refs/heads/stable/next'),
-                 'permissions': Equals([]),
-                }),
-            MatchesDict(
-                {'ref_pattern': Equals('refs/heads/archived/*'),
-                 'permissions': Equals(['create']),
-                }),
-            MatchesDict(
-                {'ref_pattern': Equals('refs/heads/stable/*'),
-                 'permissions': Equals(['push']),
-                }),
-            MatchesDict(
-                {'ref_pattern': Equals('refs/heads/*/next'),
-                 'permissions': Equals(['push', 'force_push']),
-                }),
-            MatchesDict(
-                {'ref_pattern': Equals('refs/tags/*'),
-                 'permissions': Equals(['create']),
-                }),
-            MatchesDict(
-                {'ref_pattern': Equals('*'),
-                 'permissions': Equals([]),
-                }),
-            ]))
-
-    def test_listRefRules_grantee_example_three(self):
-        user_a = self.factory.makePerson()
-        user_b = self.factory.makePerson()
-        user_c = self.factory.makePerson()
-        stable_team = self.factory.makeTeam(members=[user_a, user_b])
-        next_team = self.factory.makeTeam(members=[user_b, user_c])
-
-        repository = removeSecurityProxy(
-            self.factory.makeGitRepository(owner=user_a))
-
-        rule = self.factory.makeGitRule(
-            repository, ref_pattern=u'refs/heads/stable/next')
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=user_a, can_force_push=True)
-
-        rule = self.factory.makeGitRule(
-            repository, ref_pattern=u'refs/heads/archived/*')
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=user_a)
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=user_b, can_create=True)
-
-        rule = self.factory.makeGitRule(
-            repository, ref_pattern=u'refs/heads/stable/*')
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=stable_team, can_push=True)
-
-        rule = self.factory.makeGitRule(
-            repository, ref_pattern=u'refs/heads/*/next')
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=next_team, can_force_push=True)
-
-        rule = self.factory.makeGitRule(
-            repository, ref_pattern=u'refs/tags/*')
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=user_a, can_create=True)
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=stable_team, can_create=True)
-
-        results = self.git_api.listRefRules(
-            repository.getInternalPath(),
+        self.assertThat(results, MatchesDict({
+            'refs/heads/stable/next': Equals(['push', 'force_push']),
+            'refs/heads/stable/protected': Equals([]),
+            'refs/heads/stable/foo': Equals(['push']),
+            'refs/heads/archived/foo': Equals(['create']),
+            'refs/heads/foo/next': Equals(['push', 'force_push']),
+            'refs/heads/unprotected': Equals([]),
+            'refs/tags/1.0': Equals(['create']),
+        }))
+
+    def test_checkRefPermissions_scenario_one_user_c(self):
+        _, _, user_c, _, _, repo, paths = self._make_scenario_one_repository()
+
+        results = self.git_api.checkRefPermissions(
+            repo.getInternalPath(),
+            paths,
             {'uid': user_c.id})
 
-        self.assertThat(results, MatchesListwise([
-            MatchesDict(
-                {'ref_pattern': Equals('refs/heads/stable/next'),
-                 'permissions': Equals([]),
-                }),
-            MatchesDict(
-                {'ref_pattern': Equals('refs/heads/archived/*'),
-                 'permissions': Equals([]),
-                }),
-            MatchesDict(
-                {'ref_pattern': Equals('refs/heads/stable/*'),
-                 'permissions': Equals([]),
-                }),
-            MatchesDict(
-                {'ref_pattern': Equals('refs/heads/*/next'),
-                 'permissions': Equals(['push', 'force_push']),
-                }),
-            MatchesDict(
-                {'ref_pattern': Equals('refs/tags/*'),
-                 'permissions': Equals([]),
-                }),
-            MatchesDict(
-                {'ref_pattern': Equals('*'),
-                 'permissions': Equals([]),
-                }),
-            ]))
+        self.assertThat(results, MatchesDict({
+            'refs/heads/stable/next': Equals(['push', 'force_push']),
+            'refs/heads/stable/protected': Equals([]),
+            'refs/heads/stable/foo': Equals([]),
+            'refs/heads/archived/foo': Equals([]),
+            'refs/heads/foo/next': Equals(['push', 'force_push']),
+            'refs/heads/unprotected': Equals([]),
+            'refs/tags/1.0': Equals([]),
+        }))
 
-    def test_listRefRules_grantee_example_four(self):
-        user_a = self.factory.makePerson()
-        user_b = self.factory.makePerson()
-        user_c = self.factory.makePerson()
+    def test_checkRefPermissions_scenario_one_user_d(self):
         user_d = self.factory.makePerson()
-        stable_team = self.factory.makeTeam(members=[user_a, user_b])
-        next_team = self.factory.makeTeam(members=[user_b, user_c])
-
-        repository = removeSecurityProxy(
-            self.factory.makeGitRepository(owner=user_a))
-
-        rule = self.factory.makeGitRule(
-            repository, ref_pattern=u'refs/heads/stable/next')
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=user_a, can_force_push=True)
-
-        rule = self.factory.makeGitRule(
-            repository, ref_pattern=u'refs/heads/archived/*')
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=user_a)
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=user_b, can_create=True)
-
-        rule = self.factory.makeGitRule(
-            repository, ref_pattern=u'refs/heads/stable/*')
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=stable_team, can_push=True)
-
-        rule = self.factory.makeGitRule(
-            repository, ref_pattern=u'refs/heads/*/next')
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=next_team, can_force_push=True)
-
-        rule = self.factory.makeGitRule(
-            repository, ref_pattern=u'refs/tags/*')
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=user_a, can_create=True)
-        self.factory.makeGitRuleGrant(
-            rule=rule, grantee=stable_team, can_create=True)
-
-        results = self.git_api.listRefRules(
-            repository.getInternalPath(),
+        _, _, user_c, _, _, repo, paths = self._make_scenario_one_repository()
+
+        results = self.git_api.checkRefPermissions(
+            repo.getInternalPath(),
+            paths,
             {'uid': user_d.id})
 
-        self.assertThat(results, MatchesListwise([
-            MatchesDict(
-                {'ref_pattern': Equals('refs/heads/stable/next'),
-                 'permissions': Equals([]),
-                }),
-            MatchesDict(
-                {'ref_pattern': Equals('refs/heads/archived/*'),
-                 'permissions': Equals([]),
-                }),
-            MatchesDict(
-                {'ref_pattern': Equals('refs/heads/stable/*'),
-                 'permissions': Equals([]),
-                }),
-            MatchesDict(
-                {'ref_pattern': Equals('refs/heads/*/next'),
-                 'permissions': Equals([]),
-                }),
-            MatchesDict(
-                {'ref_pattern': Equals('refs/tags/*'),
-                 'permissions': Equals([]),
-                }),
-            MatchesDict(
-                {'ref_pattern': Equals('*'),
-                 'permissions': Equals([]),
-                }),
-            ]))
+        self.assertThat(results, MatchesDict({
+            'refs/heads/stable/next': Equals([]),
+            'refs/heads/stable/protected': Equals([]),
+            'refs/heads/stable/foo': Equals([]),
+            'refs/heads/archived/foo': Equals([]),
+            'refs/heads/foo/next': Equals([]),
+            'refs/heads/unprotected': Equals([]),
+            'refs/tags/1.0': Equals([]),
+        }))
+
+    def _make_scenario_two_repository(self):
+        user_a = self.factory.makePerson()
+        user_b = self.factory.makePerson()
+
+        repository = removeSecurityProxy(
+            self.factory.makeGitRepository(owner=user_a))
+
+        rule = self.factory.makeGitRule(
+            repository, ref_pattern=u'refs/heads/master')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=user_b, can_push=True)
+
+        rule = self.factory.makeGitRule(
+            repository, ref_pattern=u'refs/heads/*')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=GitGranteeType.REPOSITORY_OWNER,
+            can_create=True, can_push=True, can_force_push=True)
+
+        rule = self.factory.makeGitRule(
+            repository, ref_pattern=u'refs/tags/*')
+        self.factory.makeGitRuleGrant(
+            rule=rule, grantee=user_b, can_push=True)
+
+        test_ref_paths = ['refs/heads/master', 'refs/heads/foo',
+                          'refs/tags/1.0', 'refs/other']
+        return user_a, user_b, repository, test_ref_paths
+
+    def test_checkRefPermissions_scenario_two_user_a(self):
+        user_a, _, repo, paths = self._make_scenario_two_repository()
+        results = self.git_api.checkRefPermissions(
+            repo.getInternalPath(),
+            paths,
+            {'uid': user_a.id})
+
+        self.assertThat(results, MatchesDict({
+            'refs/heads/master': Equals(['create', 'push', 'force_push']),
+            'refs/heads/foo': Equals(['create', 'push', 'force_push']),
+            'refs/tags/1.0': Equals(['create', 'push']),
+            'refs/other': Equals(['create', 'push', 'force_push']),
+        }))
+
+    def test_checkRefPermissions_scenario_two_user_b(self):
+        _, user_b, repo, paths = self._make_scenario_two_repository()
+        results = self.git_api.checkRefPermissions(
+            repo.getInternalPath(),
+            paths,
+            {'uid': user_b.id})
+
+        self.assertThat(results, MatchesDict({
+            'refs/heads/master': Equals(['push']),
+            'refs/heads/foo': Equals([]),
+            'refs/tags/1.0': Equals(['push']),
+            'refs/other': Equals([]),
+        }))
+
+    def test_checkRefPermissions_scenario_two_user_c(self):
+        _, _, repo, paths = self._make_scenario_two_repository()
+        user_c = self.factory.makePerson()
+        results = self.git_api.checkRefPermissions(
+            repo.getInternalPath(),
+            paths,
+            {'uid': user_c.id})
+
+        self.assertThat(results, MatchesDict({
+            'refs/heads/master': Equals([]),
+            'refs/heads/foo': Equals([]),
+            'refs/tags/1.0': Equals([]),
+            'refs/other': Equals([]),
+        }))
 
 
 class TestGitAPI(TestGitAPIMixin, TestCaseWithFactory):