1
70%
master: 97%

Ran 07 Dec 2015 04:02PM UTC

Files 91

Run time 1s

Badge

Embed ▾

Committed 07 Dec 2015 03:50PM UTC coverage: 70.122%. First build

Job # 9256.1

Build Type

push

travis-ci

Committed by

nickstenning

Commit Message

Compute annotation authorizations correctly in streamer

Most authorisations on annotations are granted by virtue of a dynamic
ACL computed in `h.api.resources.Annotation`. This class uses
`h.api.auth.translate_annotation_principals` to map between annotation
permissions strings (such as "group:__world__") and internal Pyramid
principals such as `pyramid.security.Everyone` (AKA "system.Everyone").

The streamer has historically not used this ACL, and as a result a bug
was introduced where world-readable annotations were not sent to
logged-out clients.

This commit:

- Ensures that `h.api.groups.auth.group_principals` doesn't include
  "group:__world__" in the list of group principals for a given user.
  This principal is already represented by the "system.Everyone"
  principal which Pyramid already grants to *all* requests.
- Uses `h.api.auth.translate_annotation_principals` in `h.streamer` to
  ensure that annotation permissions strings are correctly compared with
  `request.effective_principals`.

Run Details

2577 of 3675 relevant lines covered (70.12%)

0.7 hits per line

hypothesis / h / 9256 / 1
70%
master: 97%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 9256.1

hypothesis / h / 9256 / 1 70% master: 97%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 9256.1

hypothesis / h / 9256 / 1
70%
master: 97%

README BADGES
x