subscribed team cannot view branch owned by (a different) private team

[Monty Taylor]

Bear with me - this is a slightly obtuse edge case.

Make a private branch associated with a project.
Subscribe a team to that branch.
Add a member to that team that cannot otherwise view the branch.

Now, as that member, go to the code.lp.net page for the project- you should see that the branch exists.
Click the link - you should experience FAIL.

BUT - if you bzr lp-login as that user and do a bzr branch of that branch, is does work as expected.

So, a team subscription does allow viewing of the branch, but for some reason web UI for this is bunk.

[Tim Penhey (thumper)]

This has to do with how we actually handle branch traversal. We have a
denormalised field that stores the full unique name of the branch. This is
what is used for branch access and code browse.

However the web UI traversal goes through each segment of the URL, and thus
hits the private team that is the owner of the branch, and causes the page to
be forbidden to the subscriber.

  status triaged
  importance medium
  tag privacy

[Robert Collins (lifeless)]

Private PPA's had precisely the same issue - the same 'restrictedview'
permission (which I believe Curtis is renaming to 'Traversal' for
clarity) should help with addressing this.

[Curtis Hovey (sinzui)]

P3A access is granted by ViewPublicOrPrivateTeamMembers in the archive subscriber block. This method could be extended to check if the user is subscribed to any branch or merge proposal. I do not certain this kind of extension scales. The implementation would grant the user access to all of the private-teams pages by virtue of a single subscription. This is what happens with P3A and it is not ideal--having access to an archive should not convey access to anything outside of the traversal path.

When we talk about restricted observers in the context of a project (a user with a subscription to an artefact owned by a hypothetical private project) We believe a subscriber may know the names of the objects in the path of traversal, but nothing more. The user may see all the detail of the subscribed artefact and all the details of its subordinate artefacts. Thus subscribing a user to a branch owned by a private team should reveal the team name and displayname, give full access to the branch, and full access to the branches' MP's

I'd like to know William's opinion on this since he has been thinking about the restricted observer implementation.

[Launchpad QA Bot (lpqabot)]

Fixed in stable r14477 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/stable/revision/14477>.

[Launchpad QA Bot (lpqabot)]

Fixed in stable r14489 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/stable/revision/14489>.

[Launchpad QA Bot (lpqabot)]

Fixed in stable r14490 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/stable/revision/14490>.

[Launchpad QA Bot (lpqabot)]

Fixed in stable r14500 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/stable/revision/14500>.

[Launchpad QA Bot (lpqabot)]

Fixed in stable r14513 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/stable/revision/14513>.