add in permissions api (bug 868252)

Andy McKay · Andy McKay · commit 07467281569d · 2013-05-03T14:02:50.000-07:00
diff --git a/docs/api/topics/accounts.rst b/docs/api/topics/accounts.rst
@@ -9,15 +9,15 @@ User accounts on the Firefox Marketplace.
 Account
 =======
 
-The account API, makes use of the term `mine`. This is an explicit variable to
+.. note:: Requires authentication.
+
+The account API, makes use of the term ``mine``. This is an explicit variable to
 lookup the logged in user account id.
 
 .. http:get:: /api/v1/account/settings/mine/
 
     Returns data on the currently logged in user.
 
-    .. note:: Requires authentication.
-
     **Response**
 
     .. code-block:: json
@@ -27,9 +27,6 @@ lookup the logged in user account id.
             "display_name": "Nice person",
         }
 
-The same information is also accessible at the canoncial `resource_uri`
-`/api/v1/account/settings/1/`.
-
 To update account information:
 
 .. http:patch:: /api/v1/account/settings/mine/
@@ -53,8 +50,6 @@ Fields that can be updated:
     Returns a list of the installed apps for the currently logged in user. This
     ignores any reviewer or developer installed apps.
 
-    .. note:: Requires authentication.
-
     **Request**
 
     The standard :ref:`list-query-params-label`.
@@ -65,6 +60,32 @@ Fields that can be updated:
     :param objects: A :ref:`listing <objects-response-label>` of :ref:`apps <app-response-label>`.
     :status 200: sucessfully completed.
 
+.. _permission-get-label:
+
+.. http:get:: /api/v1/account/permissions/mine/
+
+    Returns a mapping of the permissions for the currently logged in user.
+
+    **Response**
+
+    .. code-block:: json
+
+        {
+            "permissions": {
+                "admin": false,
+                "developer": false,
+                "localizer": false,
+                "lookup": true,
+                "reviewer": false
+            },
+            "resource_uri": "/api/v1/account/permissions/1/"
+        }
+
+    :param permissions: permissions and properties for the user account. It
+        contains boolean values which describe whether the user has the
+        permission described by the key of the field.
+    :status 200: sucessfully completed.
+
 Feedback
 ========
 
diff --git a/docs/api/topics/authentication.rst b/docs/api/topics/authentication.rst
@@ -33,11 +33,12 @@ stored as a cookie.
 
     **Response**
 
-    :param error: any error that occurred.
-    :param token: a shared secret to be used on later requests. It should be
+    :param string error: any error that occurred.
+    :param string token: a shared secret to be used on later requests. It should be
         sent with authorized requests as a query string parameter named
         ``_user``.
-    :param settings: user account settings.
+    :param object permissions: :ref:`user permissions <permission-get-label>`.
+    :param object settings: user account settings.
 
     Example:
 
@@ -50,6 +51,13 @@ stored as a cookie.
                 "display_name": "fred foobar",
                 "email": "ffoob@example.com",
                 "region": "appistan"
+            },
+            "permissions": {
+                "reviewer": false,
+                "admin": false,
+                "localizer": false,
+                "lookup": true,
+                "developer": true
             }
         }
 
diff --git a/mkt/account/api.py b/mkt/account/api.py
@@ -7,9 +7,11 @@
 from django_browserid import get_audience
 from tastypie import fields, http
 from tastypie.authorization import Authorization
+from tastypie.bundle import Bundle
 from tastypie.exceptions import ImmediateHttpResponse
 from tastypie.throttle import CacheThrottle
 
+from access import acl
 from amo.utils import send_mail_jinja
 from mkt.api.authentication import (OAuthAuthentication,
                                     OptionalOAuthAuthentication,
@@ -27,7 +29,20 @@
 from .forms import FeedbackForm, LoginForm
 
 
-class AccountResource(CORSResource, MarketplaceModelResource):
+class Mine(object):
+
+    def obj_get(self, request=None, **kwargs):
+        if kwargs.get('pk') == 'mine':
+            kwargs['pk'] = request.amo_user.pk
+
+        # TODO: put in acl checks for admins to get other users information.
+        obj = super(Mine, self).obj_get(request=request, **kwargs)
+        if not OwnerAuthorization().is_authorized(request, object=obj):
+            raise ImmediateHttpResponse(response=http.HttpForbidden())
+        return obj
+
+
+class AccountResource(Mine, CORSResource, MarketplaceModelResource):
 
     class Meta(MarketplaceModelResource.Meta):
         authentication = (SharedSecretAuthentication(), OAuthAuthentication())
@@ -38,15 +53,28 @@ class Meta(MarketplaceModelResource.Meta):
         queryset = UserProfile.objects.filter()
         resource_name = 'settings'
 
-    def obj_get(self, request=None, **kwargs):
-        if kwargs.get('pk') == 'mine':
-            kwargs['pk'] = request.amo_user.pk
 
-        # TODO: put in acl checks for admins to get other users information.
-        obj = super(AccountResource, self).obj_get(request=request, **kwargs)
-        if not OwnerAuthorization().is_authorized(request, object=obj):
-            raise ImmediateHttpResponse(response=http.HttpForbidden())
-        return obj
+class PermissionResource(Mine, CORSResource, MarketplaceModelResource):
+
+    class Meta(MarketplaceModelResource.Meta):
+        authentication = (SharedSecretAuthentication(), OAuthAuthentication())
+        authorization = OwnerAuthorization()
+        detail_allowed_methods = ['get']
+        list_allowed_methods = []
+        fields = ['resource_uri']
+        queryset = UserProfile.objects.filter()
+        resource_name = 'permissions'
+
+    def dehydrate(self, bundle):
+        permissions = {
+            'reviewer': acl.check_reviewer(bundle.request),
+            'admin': acl.action_allowed(bundle.request, 'Admin', '%'),
+            'localizer': acl.action_allowed(bundle.request, 'Localizers', '%'),
+            'lookup': acl.action_allowed(bundle.request, 'AccountLookup', '%'),
+            'developer': bundle.request.amo_user.is_app_developer
+        }
+        bundle.data['permissions'] = permissions
+        return bundle
 
 
 class InstalledResource(AppResource):
@@ -65,6 +93,7 @@ def obj_get_list(self, request=None, **kwargs):
 
 
 class LoginResource(CORSResource, MarketplaceResource):
+
     class Meta(MarketplaceResource.Meta):
         resource_name = 'login'
         always_return_data = True
@@ -97,15 +126,18 @@ def post_list(self, request, **kwargs):
 
         res = browserid_login(request, browserid_audience=audience)
         if res.status_code == 200:
-            return self.create_response(request, {
+            request.amo_user = request.user.get_profile()
+            result = {
                 'error': None,
                 'token': self.get_token(request.user.email),
                 'settings': {
-                    'display_name': (UserProfile.objects
-                                     .get(user=request.user).display_name),
+                    'display_name': request.amo_user.display_name,
                     'email': request.user.email,
                 }
-            })
+            }
+            result.update(PermissionResource()
+                          .dehydrate(Bundle(request=request)).data)
+            return self.create_response(request, result)
         return res
 
 
diff --git a/mkt/account/tests/test_api.py b/mkt/account/tests/test_api.py
@@ -6,11 +6,11 @@
 from django.core import mail
 
 from mock import patch
-from nose.tools import eq_
+from nose.tools import eq_, ok_
 
 from amo.tests import TestCase
 from mkt.account.api import FeedbackResource
-from mkt.api.base import list_url, get_url
+from mkt.api.base import get_url, list_url
 from mkt.api.tests.test_oauth import BaseOAuth, get_absolute_url
 from mkt.api.tests.test_throttle import ThrottleTests
 from mkt.constants.apps import INSTALL_TYPE_REVIEWER
@@ -27,6 +27,32 @@ def _test_bad_api_potato_data(self, response, data=None):
         assert '__all__' in data['error_message']
 
 
+class TestPermission(BaseOAuth):
+    fixtures = fixture('user_2519')
+
+    def setUp(self):
+        super(TestPermission, self).setUp(api_name='account')
+        self.get_url = get_url('permissions', '2519')
+        self.user = UserProfile.objects.get(pk=2519)
+
+    def test_verbs(self):
+        self._allowed_verbs(self.get_url, ('get'))
+
+    def test_no_permissions(self):
+        res = self.client.get(self.get_url)
+        eq_(res.status_code, 200, res.content)
+        self.assertSetEqual(
+            ['reviewer', 'admin', 'localizer', 'lookup', 'developer'],
+            res.json['permissions'].keys()
+        )
+        ok_(not all(res.json['permissions'].values()))
+
+    def test_some_permission(self):
+        self.grant_permission(self.user, 'Localizers:%')
+        res = self.client.get(self.get_url)
+        ok_(res.json['permissions']['localizer'])
+
+
 class TestAccount(BaseOAuth):
     fixtures = fixture('user_2519', 'user_10482', 'webapp_337141')
 
@@ -154,6 +180,7 @@ def test_login_success(self, http_request):
             'cvan@mozilla.com,95c9063d9f249aacfe5697fc83192ed6480c01463e2a80b3'
             '5af5ecaef11754700f4be33818d0e83a0cfc2cab365d60ba53b3c2b9f8f6589d1'
             'c43e9bbb876eef0,000000')
+        eq_(data['permissions']['localizer'], False)
 
     @patch('requests.post')
     def test_login_failure(self, http_request):
diff --git a/mkt/account/urls.py b/mkt/account/urls.py
@@ -6,7 +6,8 @@
 from amo.decorators import login_required
 from lib.misc.urlconf_decorator import decorate
 from mkt.account.api import (AccountResource, FeedbackResource,
-                             InstalledResource, LoginResource)
+                             InstalledResource, LoginResource,
+                             PermissionResource)
 from . import views
 
 settings_patterns = patterns('',
@@ -53,6 +54,7 @@
 account.register(FeedbackResource())
 account.register(InstalledResource())
 account.register(LoginResource())
+account.register(PermissionResource())
 
 api_patterns = patterns('',
     url('^', include(account.urls)),
