Create excluded request API

Co-authored-by: Moisés Déniz Alemán <mdeniz@suse.com>

src/api/app/controllers/staging/excluded_requests_controller.rb

@@ -0,0 +1,54 @@
+class Staging::ExcludedRequestsController < ApplicationController
+  before_action :require_login
+  before_action :set_staging_workflow, only: :create
+  before_action :set_request_exclusion, only: :destroy
+
+  def create
+    request = @staging_workflow.target_of_bs_requests.find_by!(number: params[:number])
+    request_exclusion = @staging_workflow.request_exclusions.build(bs_request: request, description: params[:description])
+
+    authorize request_exclusion
+
+    if request_exclusion.save
+      render_ok
+    else
+      render_error(
+        status: 400,
+        errorcode: 'invalid_request',
+        message: request_exclusion.errors.full_messages.to_sentence
+      )
+    end
+  end
+
+  def destroy
+    authorize @request_exclusion
+
+    if @request_exclusion.destroy
+      render_ok
+    else
+      render_error(
+        status: 400,
+        errorcode: 'invalid_request',
+        message: "Request #{@request_exclusion.number} couldn't be unexcluded"
+      )
+    end
+  end
+
+  private
+
+  def set_staging_workflow
+    project = Project.get_by_name(params[:project_name])
+    @staging_workflow = project.staging
+    return if @staging_workflow
+
+    raise InvalidParameterError, "Project #{params[:project_name]} doesn't have an asociated Staging Workflow"
+  end
+
+  def set_request_exclusion
+    request = BsRequest.find_by!(number: params[:number])
+    @request_exclusion = request.request_exclusion
+    return if @request_exclusion
+
+    raise InvalidParameterError, "Request #{params[:number]} is not excluded"
+  end
+end

src/api/app/policies/staging/request_exclusion_policy.rb

@@ -0,0 +1,11 @@
+class Staging::RequestExclusionPolicy < ApplicationPolicy
+  def create?
+    group = record.staging_workflow.managers_group
+    user.groups_users.where(group: group).exists? ||
+      ProjectPolicy.new(user, record.staging_workflow.project).update?
+  end
+
+  def destroy?
+    create?
+  end
+end

src/api/config/routes.rb

@@ -737,6 +737,12 @@ def self.public_or_about_path?(request)
       resource :staged_requests, controller: 'staged_requests', only: [:create, :destroy], constraints: cons
     end
   end
+
+  controller 'staging/excluded_requests' do
+    post 'staging_excluded_requests/:number/:project_name' => :create, constraints: cons
+    delete 'staging_excluded_requests/:number' => :destroy, constraints: cons
+  end
+
   controller :source_attribute do
     get 'source/:project(/:package(/:binary))/_attribute(/:attribute)' => :show, constraints: cons
     post 'source/:project(/:package(/:binary))/_attribute(/:attribute)' => :update, constraints: cons, as: :change_attribute