broken inline incremental ajax diff on private branches

[Martin Pool]

following on from bug 813349: the inline incremental diff does not work on private branches, because loggerhead and lp use different authentication cookies.

There are a few ways we could fix this:

1- it actually work for private branches
  1a- make lp and loggerhead understand the same cookie
  1b- make the front end check and rewrite the authentication when it passes through a request
2- add a feature scope that checks privacy and use this to turn off the feature there (which would be generally useful)
3- in code, turn this off for private branches

I'm inclined to do #2.

[Michael Hudson-Doyle (mwhudson)]

I like the sound of 1a tbh. I think we should add a translatePath-like method that takes the value of the session cookie, and have the loggerhead glue read this cookie (in secure mode, though it should not be sent at all over http) and pass it to the translatePath method. This would allow us to get rid of a lot of code from the glue, and the hack where logging out goes via bazaar.lp.net.

It might involve a bit of grovelling around in the auth code to interpret the cookie. Thinking about it a little more, it might even 'just work' to attach the cookie verbatim to the XML-RPC request to translatePath... that would need testing though. This would make the xml-rpc method implementation simpler, and avoid the risk of disclosing the session cookie in oopses and such. I don't know if the PrivateXMLRPCPublication stuff is set up to process the session cookie either, but that can't be too hard to change if needed...

[Robert Collins (lifeless)]

1a is totally appropriate. +1.

Long term we want loggerhead to be a backend service, but this is a good cleanup step that will reduce the surface area to consider when backending it comes along.

[Launchpad QA Bot (lpqabot)]

Fixed in stable r18707 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/stable/revision/18707>.