hypothesis / h / 9256

70%

master: 97%

push

travis-ci

Compute annotation authorizations correctly in streamer

Most authorisations on annotations are granted by virtue of a dynamic
ACL computed in `h.api.resources.Annotation`. This class uses
`h.api.auth.translate_annotation_principals` to map between annotation
permissions strings (such as "group:__world__") and internal Pyramid
principals such as `pyramid.security.Everyone` (AKA "system.Everyone").

The streamer has historically not used this ACL, and as a result a bug
was introduced where world-readable annotations were not sent to
logged-out clients.

This commit:

- Ensures that `h.api.groups.auth.group_principals` doesn't include
  "group:__world__" in the list of group principals for a given user.
  This principal is already represented by the "system.Everyone"
  principal which Pyramid already grants to *all* requests.
- Uses `h.api.auth.translate_annotation_principals` in `h.streamer` to
  ensure that annotation permissions strings are correctly compared with
  `request.effective_principals`.

4 of 4 new or added lines in 2 files covered. (100.0%)

2577 of 3675 relevant lines covered (70.12%)

0.7 hits per line