disallow creation of any Classifier with Private at top level

tests/unit/admin/views/test_classifiers.py

@@ -12,6 +12,7 @@
 
 import pretend
 import pytest
+import sqlalchemy
 
 from warehouse.admin.views import classifiers as views
 from warehouse.classifiers.models import Classifier
@@ -80,6 +81,37 @@ def test_add_parent_classifier(self, db_request):
         assert new.l4 == 0
         assert new.l5 == 0
 
+    @pytest.mark.parametrize(
+        "parent_levels, expected_levels",
+        [
+            ((2, 0, 0, 0), (2, None, 0, 0)),
+            ((2, 3, 0, 0), (2, 3, None, 0)),
+            ((2, 3, 4, 0), (2, 3, 4, None)),
+            # This won't actually happen but it's needed for coverage
+            ((2, 3, 4, 5), (2, 3, 4, 5)),
+        ],
+    )
+    def test_add_private_child_classifier(
+        self, db_request, parent_levels, expected_levels
+    ):
+        l2, l3, l4, l5 = parent_levels
+        parent = ClassifierFactory(l2=l2, l3=l3, l4=l4, l5=l5, classifier="Private")
+
+        db_request.params = {"parent_id": parent.id, "child": "Foobar"}
+        db_request.session.flash = pretend.call_recorder(lambda *a, **kw: None)
+        db_request.route_path = lambda *a: "/the/path"
+
+        with pytest.raises(sqlalchemy.exc.IntegrityError):
+            views.AddClassifier(db_request).add_child_classifier()
+
+    def test_add_private_parent_classifier(self, db_request):
+        db_request.params = {"parent": "Private :: Do Not Upload"}
+        db_request.session.flash = pretend.call_recorder(lambda *a, **kw: None)
+        db_request.route_path = lambda *a: "/the/path"
+
+        with pytest.raises(sqlalchemy.exc.IntegrityError):
+            views.AddClassifier(db_request).add_parent_classifier()
+
 
 class TestDeprecateClassifier:
     def test_deprecate_classifier(self, db_request):

warehouse/classifiers/models.py

@@ -10,7 +10,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-from sqlalchemy import Boolean, Column, Integer, Text, sql
+from sqlalchemy import Boolean, CheckConstraint, Column, Integer, Text, sql
 
 from warehouse import db
 from warehouse.utils.attrs import make_repr
@@ -19,6 +19,10 @@
 class Classifier(db.ModelBase):
 
     __tablename__ = "trove_classifiers"
+    __tableargs__ = CheckConstraint(
+        "classifier not ilike 'private ::%'",
+        name="ck_disallow_private_top_level_classifier",
+    )
 
     __repr__ = make_repr("classifier")