[api] support special maintainerships in "_product" package container…

…s (issue 477)

src/api/app/models/package.rb

@@ -266,7 +266,10 @@ def is_locked?
 
   def check_write_access!(ignoreLock=nil)
     return if Rails.env.test? and User.current.nil? # for unit tests
-    unless User.current.can_modify_package? self, ignoreLock
+    # test _product permissions if any other _product: subcontainer is used
+    obj = self
+    obj = self.project.packages.where(:name => "_product").first if self.name =~ /\A_product:\w[-+\w\.]*\z/
+    unless User.current.can_modify_package? obj, ignoreLock
       raise WritePermissionError, "No permission to modify package '#{self.name}' for user '#{User.current.login}'"
     end
   end

src/api/app/models/project.rb

@@ -1136,7 +1136,7 @@ def valid_name
 
   # updates packages automatically generated in the backend after submitting a product file
   def update_product_autopackages
-    check_write_access!
+    self.packages.where(:name => "_product").first.check_write_access!
 
     backend_pkgs = Collection.find :id, :what => 'package', :match => "@project='#{self.name}' and starts-with(@name,'_product:')"
     b_pkg_index = backend_pkgs.each(:package).inject(Hash.new) {|hash,elem| hash[elem.value(:name)] = elem; hash}

src/api/test/functional/product_test.rb

@@ -13,9 +13,12 @@ def test_simple_product_file
     assert_response :success
     put "/source/home:tom:temporary/_product/_meta",
         '<package project="home:tom:temporary" name="_product"> <title/> <description/> 
+            <person userid="adrian" role="maintainer" />
          </package>'
     assert_response :success
 
+    # everything works even when the project is not owner by me?
+    login_adrian
     # upload sources in right order
     ["defaults-archsets.include", "defaults-conditionals.include", "defaults-repositories.include", "obs.group", "obs-release.spec", "simple.product"].each do |file|
       raw_put "/source/home:tom:temporary/_product/#{file}",
@@ -53,6 +56,7 @@ def test_simple_product_file
     assert_xml_tag :tag => "status", :attributes => { :code => '400', :origin => 'backend' }
     assert_match(/Illegal support key ILLEGAL for obs-server/, @response.body)
 
+    login_tom
     delete "/source/home:tom:temporary"
     assert_response :success
   end

src/api/test/unit/code_quality_test.rb

@@ -113,6 +113,7 @@ def setup
       'Project::check_access?' => 54.05,
       'Project::get_by_name' => 53.44,
       'Project#release_targets_ng' => 57.91,
+      'Project#update_product_autopackages' => 52.05,
       'ProjectStatusCalculator#calc_status' => 74.59,
       'PublicController#binary_packages' => 131.24,
       'Repository#cleanup_before_destroy' => 85.53,