Comment 13 for bug 886366

On Fri, Dec 2, 2011 at 6:26 PM, John Pugh <email address hidden> wrote:
> I think Luke is running into the same issue I am. He has access, but
> something in between the openid auth and fetching the file via http is
> failing preventing access (all I get is "server error").

Hi John - I'm just trying to clear up some confusion on this bug. I
could be missing something, but AFAIK, Luke has access to the ARB part
of the devportal, but he won't (or shouldn't) have access to private
package uploads which are for commercial applications (the ones which
require openid access). Only commercial reviewers should be able to
access those [1], so the fact that Luke was being even asked for any
authentication when downloading a package for an ARB app is the bug
that was fixed here.

>
> I think eventually Luke can download, but I don't know if the fix that
> Anthony submitted fixes the intermittent download issue unrelated to
> rights.

The branch attached to this bug (and the reason it was marked
fix-committed by achuni) fixes an issue where applications that were
switched from commercial->ARB have their packages left in the private
area, and not made available publicly. So when this fix is released,
Luke (and all other ARB reviewers) should be able to download all new
ARB application packages without requiring any authentication. (Note
to achuni: For existing ARB applications, we'll need to run a script
once this fix is released [2])

It doesn't address the openid issue that you experienced (as a person
with commercial access trying to access private package uploads) -
that will require further investigation, and so I've created a
separate bug 900185 for the openid issue (referring back to this one)
so that you and achuni can discuss that.

In the mean time, if luke can currently download any private packages
(as you mentioned above), then please let us know (as something is
mis-configured), but otherwise, it would be great if those ARB apps
that are still private due to the bug could be made available
elsewhere so he's not blocked. I don't have ARB access to devportal,
otherwise I'd do it now. I can help out if given access.

Hope that helps!

[1] https://launchpad.net/~myapps-reviewers/+members
[2] JFTR, basically:
{{{
arb_apps = Application.objects.filter(arb_reviewable=True)
for app in arb_apps:
    app.ensure_access_to_upload()
}}}