Expose IPerson.inTeam via launchpad REST API

Bug #377579 reported by Elliot Murphy
12
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Launchpad itself
Triaged
Low
Unassigned

Bug Description

I am writing some code to do simple checking of whether a person is a member (either directly or indirectly of a team). In my particular use case, I use a restricted team to keep track of people who have signed a contributor license agreement for the project, and I want to make lp:tarmac only merge branches from people who are a member of that team.

Currently I have this code snippet:

person = launchpad.people['statik']
contributor_team = launchpad.people['ubuntuone-contributor-agreement']
authorized_contributors = []

for p in contributor_team.participants:
    authorized_contributors.append(p.name)

if person.name in authorized_contributors:
    status = 'APPROVED CONTRIBUTOR'
else:
    status = 'CONTRIBUTOR AGREEMENT NOT YET RECEIVED'

However, looking at the launchpad API documentation, I see a note on team.participants_collection_link referring to IPerson.inTeam. I believe this would be better if I could just do:

    if person.inTeam(authorized_contributors):

Could you expose this method through the web API? Talking to sinzui today he thought it might be one line of code to add this.

affects: launchpad → launchpad-registry
Changed in launchpad-registry:
status: New → Triaged
Curtis Hovey (sinzui)
Changed in launchpad-registry:
assignee: nobody → Curtis Hovey (sinzui)
importance: Undecided → High
milestone: none → 2.2.5
Curtis Hovey (sinzui)
Changed in launchpad-registry:
milestone: 2.2.5 → 2.2.6
Curtis Hovey (sinzui)
Changed in launchpad-registry:
status: Triaged → In Progress
Revision history for this message
Curtis Hovey (sinzui) wrote :

I must abandon this. IPerson.inTeam is a privileged method and making work for external API is very difficult.

I recommend anyone working on this in the future to review the rejected work first:
https://code.edge.launchpad.net/~sinzui/launchpad/in-team/+merge/6894

I propose that instead of exposing inTeam, a new API-safe method be added (isInTeam()). The method could use the is_visible_by_user construct as a guard that calls the real inTeam() method.

Changed in launchpad-registry:
importance: High → Low
milestone: 2.2.6 → none
status: In Progress → Triaged
Curtis Hovey (sinzui)
Changed in launchpad-registry:
assignee: Curtis Hovey (sinzui) → nobody
Curtis Hovey (sinzui)
tags: added: api teams
Revision history for this message
Curtis Hovey (sinzui) wrote :

Hi, Robert, William.

I would like to think that our new understanding of when a user may know of a private team, and when a user may know everything about a private team will help make this bug ready to code. I still believe we want to create a separate method on IPerson that allows API callsites to ask if a user *participates* in a team. I believe we want to check if the callsite is acting as a *participant* of the private team to return the answer, otherwise return False.

Revision history for this message
Robert Collins (lifeless) wrote : Re: [Bug 377579] Re: please expose IPerson.inTeam via launchpad REST API

Yes, the same rules that grant visibility of the membership of the
team will permit this to work - the easiest one here being
superteam-owners-see-membership-of-subteams.

E.g.
private-robot-team
owned by sinzui-robot
private-team memberof private-robot-team

will grant sinzui-robot listing of private-robot-team members without
being a member itself.

_Rob

Curtis Hovey (sinzui)
tags: added: disclosure
Curtis Hovey (sinzui)
summary: - please expose IPerson.inTeam via launchpad REST API
+ Expose IPerson.inTeam via launchpad REST API
Curtis Hovey (sinzui)
tags: added: hardening
Curtis Hovey (sinzui)
tags: removed: disclosure hardening
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.