Add Enterprise Add-on API

Author: chrstinalin

docs/topics/api/addons.rst

@@ -497,6 +497,9 @@ This endpoint allows you to list all versions belonging to a specific add-on.
                           a user account listed as a developer of the add-on.
         all_with_deleted  Show all versions attached to this add-on, including
                           deleted ones. Requires admin permissions.
+        enterprise_only   Show all enterprise versions attached to this add-on.
+                          Requires either reviewer permissions or a user
+                          account listed as a developer of the add-on.
     ====================  =====================================================
 
 --------------
@@ -517,7 +520,7 @@ This endpoint allows you to fetch a single version belonging to a specific add-o
     :query string lang: Activate translations in the specific language for that query. (See :ref:`translated fields <api-overview-translations>`)
     :>json int id: The version id.
     :>json string approval_notes: Information for Mozilla reviewers, for when the add-on is reviewed.  These notes are only visible to Mozilla, and this field is only present if the user has reviewer permissions, or is listed as a developer of the add-on.
-    :>json string channel: The version channel, which determines its visibility on the site. Can be either ``unlisted`` or ``listed``.
+    :>json string channel: The version channel, which determines its visibility on the site. Can be either ``unlisted``, ``listed``, or ``enterprise``.
     :>json object compatibility:
         Object detailing which :ref:`applications <addon-detail-application>` the version is compatible with.
         The exact min/max version numbers in the object correspond to the :ref:`supported versions<applications-version-list>`.
@@ -854,7 +857,7 @@ This endpoint is for uploading an addon file, to then be submitted to create a n
     .. _upload-create-request:
 
     :form upload: The add-on file being uploaded.
-    :form channel: The channel this version should be uploaded to, which determines its visibility on the site. It can be either ``unlisted`` or ``listed``.
+    :form channel: The channel this version should be uploaded to, which determines its visibility on the site. It can be either ``unlisted``, ``listed``, or ``enterprise``.
     :reqheader Content-Type: multipart/form-data
 
 
@@ -901,7 +904,7 @@ This endpoint is for fetching a single previous upload by uuid.
     .. _upload-detail-object:
 
     :>json string uuid: The upload id.
-    :>json string channel: The version channel, which determines its visibility on the site. Can be either ``unlisted`` or ``listed``.
+    :>json string channel: The version channel, which determines its visibility on the site. Can be either ``unlisted``, ``listed``, or ``enterprise``.
     :>json boolean processed: If the version has been processed by the validator.
     :>json boolean submitted: If this upload has been submitted as a new add-on or version already. An upload can only be submitted once.
     :>json string url: URL to check the status of this upload.

docs/topics/api/scanners.rst

@@ -223,7 +223,7 @@ Rule results
     :query boolean was_signed: Only results whose file is signed.
     :query boolean addon_disabled_by_user: Only results whose add-on listing is
         invisible (``true``) or visible (``false``).
-    :query string channel: Version channel, ``unlisted`` or ``listed``.
+    :query string channel: Version channel. Can be either ``unlisted``, ``listed``, or ``enterprise``.
     :query string addon_status: Add-on status (e.g. ``public``, ``disabled``).
     :query string file_status: File status (e.g. ``public``, ``disabled``).
     :query string sort: Ordering field. One of ``id``, ``addon_adu``
@@ -237,7 +237,7 @@ Rule results
     :>json object results[].version: Minimal version representation (may be ``null``).
     :>json int results[].version.id: The version id.
     :>json string results[].version.version: The version number.
-    :>json string results[].version.channel: The version channel (``listed`` or ``unlisted``).
+    :>json string results[].version.channel: The version channel (``listed``, ``unlisted``, or ``enterprise``).
     :>json string results[].version.created: When the version was created.
     :>json object results[].version.addon: The add-on (``id``, ``guid``, ``average_daily_users``).
     :>json object results[].matches: The matched files and metadata, keyed by rule name.

src/olympia/addons/tests/test_views.py

@@ -3165,6 +3165,54 @@ def test_unlisted_version_user_but_not_author(self):
         response = self.client.get(self.url)
         assert response.status_code == 403
 
+    def test_enterprise_version_reviewer(self):
+        user = UserProfile.objects.create(username='reviewer')
+        self.grant_permission(user, 'Addons:Review')
+        self.client.login_api(user)
+        self.version.update(channel=amo.CHANNEL_ENTERPRISE)
+        response = self.client.get(self.url)
+        assert response.status_code == 403
+
+    def test_enterprise_version_enterprise_reviewer(self):
+        user = UserProfile.objects.create(username='reviewer')
+        self.grant_permission(user, 'Addons:ReviewUnlisted')
+        self.client.login_api(user)
+        self.version.update(channel=amo.CHANNEL_ENTERPRISE)
+        self._test_url()
+
+    def test_enterprise_version_enterprise_viewer(self):
+        user = UserProfile.objects.create(username='reviewer')
+        self.grant_permission(user, 'ReviewerTools:ViewUnlisted')
+        self.client.login_api(user)
+        self.version.update(channel=amo.CHANNEL_ENTERPRISE)
+        self._test_url()
+
+    def test_enterprise_version_author(self):
+        user = UserProfile.objects.create(username='author')
+        AddonUser.objects.create(user=user, addon=self.addon)
+        self.client.login_api(user)
+        self.version.update(channel=amo.CHANNEL_ENTERPRISE)
+        self._test_url()
+
+    def test_enterprise_version_admin(self):
+        user = UserProfile.objects.create(username='admin')
+        self.grant_permission(user, '*:*')
+        self.client.login_api(user)
+        self.version.update(channel=amo.CHANNEL_ENTERPRISE)
+        self._test_url()
+
+    def test_enterprise_version_anonymous(self):
+        self.version.update(channel=amo.CHANNEL_ENTERPRISE)
+        response = self.client.get(self.url)
+        assert response.status_code == 401
+
+    def test_enterprise_version_user_but_not_author(self):
+        user = UserProfile.objects.create(username='simpleuser')
+        self.client.login_api(user)
+        self.version.update(channel=amo.CHANNEL_ENTERPRISE)
+        response = self.client.get(self.url)
+        assert response.status_code == 403
+
     def test_developer_version_serializer_used_for_authors(self):
         self.version.update(source='src.zip')
         # not logged in
@@ -5101,6 +5149,15 @@ def setUp(self):
             channel=amo.CHANNEL_UNLISTED,
         )
 
+        # This version is enterprise and should be hidden by default, only
+        # shown when requesting to see enterprise explicitly, with the
+        # right permissions.
+        self.enterprise_version = version_factory(
+            addon=self.addon,
+            version='5.0',
+            channel=amo.CHANNEL_ENTERPRISE,
+        )
+
         self._set_tested_url(self.addon.pk)
 
     def _test_url(self, **kwargs):
@@ -5146,6 +5203,16 @@ def _test_url_only_contains_old_version(self, **kwargs):
         assert result_version['id'] == self.old_version.pk
         assert result_version['version'] == self.old_version.version
 
+    def _test_url_only_contains_enterprise_version(self, **kwargs):
+        response = self.client.get(self.url, data=kwargs)
+        assert response.status_code == 200
+        result = json.loads(force_str(response.content))
+        assert result['results']
+        assert len(result['results']) == 1
+        result_version = result['results'][0]
+        assert result_version['id'] == self.enterprise_version.pk
+        assert result_version['version'] == self.enterprise_version.version
+
     def _set_tested_url(self, param):
         self.url = reverse_ns('addon-version-list', kwargs={'addon_pk': param})
 
@@ -5351,6 +5418,51 @@ def test_all_with_unlisted_when_no_unlisted_versions_viewer(self):
         response = self.client.get(self.url, data={'filter': 'all_without_unlisted'})
         assert response.status_code == 200
 
+    def test_enterprise_only_admin(self):
+        user = UserProfile.objects.create(username='admin')
+        self.grant_permission(user, '*:*')
+        self.client.login_api(user)
+        self._test_url_only_contains_enterprise_version(filter='enterprise_only')
+
+    def test_with_enterprise_unlisted_viewer(self):
+        user = UserProfile.objects.create(username='reviewer')
+        self.grant_permission(user, 'ReviewerTools:ViewUnlisted')
+        self.client.login_api(user)
+        self._test_url_only_contains_enterprise_version(filter='enterprise_only')
+
+    def test_with_enterprise_unlisted_author(self):
+        user = UserProfile.objects.create(username='author')
+        AddonUser.objects.create(user=user, addon=self.addon)
+        self.client.login_api(user)
+        self._test_url_only_contains_enterprise_version(filter='enterprise_only')
+
+    def test_enterprise_only_when_no_enterprise_versions(self):
+        user = UserProfile.objects.create(username='reviewer')
+        self.grant_permission(user, 'Addons:Review')
+        self.grant_permission(user, 'Addons:ReviewUnlisted')
+        self.client.login_api(user)
+        # delete the unlisted version so only the listed versions remain.
+        self.enterprise_version.delete()
+
+        # confirm that we have access to view unlisted versions.
+        response = self.client.get(self.url, data={'filter': 'enterprise_only'})
+        assert response.status_code == 200
+        result = json.loads(force_str(response.content))
+        assert len(result['results']) == 0
+
+    def test_enterprise_only_when_no_enterprise_versions_viewer(self):
+        user = UserProfile.objects.create(username='reviewer')
+        self.grant_permission(user, 'ReviewerTools:ViewUnlisted')
+        self.client.login_api(user)
+        # delete the unlisted version so only the listed versions remain.
+        self.enterprise_version.delete()
+
+        # confirm that we have access to view unlisted versions.
+        response = self.client.get(self.url, data={'filter': 'enterprise_only'})
+        assert response.status_code == 200
+        result = json.loads(force_str(response.content))
+        assert len(result['results']) == 0
+
     def test_deleted_version_anonymous(self):
         self.version.delete()
         self._test_url_only_contains_old_version()

src/olympia/addons/views.py

@@ -563,7 +563,7 @@ def check_permissions(self, request):
             self.permission_classes = [
                 GroupPermission(amo.permissions.ADDONS_VIEW_DELETED)
             ]
-        elif requested == 'all_with_unlisted':
+        elif requested in ('all_with_unlisted', 'enterprise_only'):
             # To see unlisted versions, you need to be add-on author or
             # unlisted reviewer.
             self.permission_classes = [
@@ -602,7 +602,7 @@ def check_object_permissions(self, request, obj):
         ).has_object_permission(request, self, obj):
             raise http.Http404
 
-        if obj.channel == amo.CHANNEL_UNLISTED:
+        if obj.channel in (amo.CHANNEL_UNLISTED, amo.CHANNEL_ENTERPRISE):
             # If the instance is unlisted, only allow unlisted reviewers and
             # authors..
             self.permission_classes = [
@@ -625,11 +625,15 @@ def check_object_permissions(self, request, obj):
     def get_queryset(self):
         """Return the right base queryset depending on the situation."""
         requested = self.request.GET.get('filter')
-        valid_filters = (
+        valid_filters = [
             'all_with_deleted',
             'all_with_unlisted',
             'all_without_unlisted',
-        )
+        ]
+
+        if not is_gate_active(self.request, 'enterprise-channel-shim'):
+            valid_filters.append('enterprise_only')
+
         if requested is not None:
             if self.action != 'list':
                 raise serializers.ValidationError(
@@ -650,11 +654,17 @@ def get_queryset(self):
         # `addon` property preloaded on each version we return.
         addon = self.get_addon_object()
         if requested == 'all_with_deleted' or self.action != 'list':
-            queryset = addon.versions(manager='unfiltered_for_relations').all()
+            queryset = addon.versions(manager='unfiltered_for_relations').filter(
+                channel__in=(amo.CHANNEL_LISTED, amo.CHANNEL_UNLISTED)
+            )
         elif requested == 'all_with_unlisted':
-            queryset = addon.versions.all()
+            queryset = addon.versions.filter(
+                channel__in=(amo.CHANNEL_LISTED, amo.CHANNEL_UNLISTED)
+            )
         elif requested == 'all_without_unlisted':
             queryset = addon.versions.filter(channel=amo.CHANNEL_LISTED)
+        elif requested == 'enterprise_only':
+            queryset = addon.versions.filter(channel=amo.CHANNEL_ENTERPRISE)
         else:
             queryset = addon.versions.filter(
                 file__status=amo.STATUS_APPROVED, channel=amo.CHANNEL_LISTED

src/olympia/api/permissions.py

@@ -227,9 +227,11 @@ def has_object_permission(self, request, view, obj):
         can_access_because_unlisted_reviewer = acl.is_unlisted_addons_reviewer(
             request.user
         ) and (not self.disallow_unsafe or request.method in SAFE_METHODS)
-        has_unlisted_or_no_listed = obj.has_unlisted_versions(
-            include_deleted=True
-        ) or not obj.has_listed_versions(include_deleted=True)
+        has_unlisted_or_no_listed = (
+            obj.has_unlisted_versions(include_deleted=True)
+            or obj.has_enterprise_versions(include_deleted=True)
+            or not obj.has_listed_versions(include_deleted=True)
+        )
 
         return has_unlisted_or_no_listed and (
             can_access_because_unlisted_viewer or can_access_because_unlisted_reviewer

src/olympia/api/tests/test_permissions.py

@@ -601,11 +601,40 @@ def test_unlisted_viewer(self):
         self.request.method = 'GET'
         assert self.permission.has_object_permission(self.request, myview, obj)
 
+    def test_enterprise_reviewer(self):
+        self.request.user = user_factory()
+        self.grant_permission(self.request.user, 'Addons:ReviewUnlisted')
+        obj = Mock(spec=[])
+        obj.has_unlisted_versions = lambda include_deleted=False: False
+        obj.has_enterprise_versions = lambda include_deleted=False: True
+
+        # Enterprise is restricted in similar manner to unlisted.
+        assert self.permission.has_permission(self.request, myview)
+        assert self.permission.has_object_permission(self.request, myview, obj)
+
+    def test_enterprise_viewer(self):
+        self.request.user = user_factory()
+        self.grant_permission(self.request.user, 'ReviewerTools:ViewUnlisted')
+        obj = Mock(spec=[])
+        obj.has_unlisted_versions = lambda include_deleted=False: False
+        obj.has_enterprise_versions = lambda include_deleted=False: True
+
+        # Enterprise is restricted in similar manner to unlisted.
+        assert self.permission.has_permission(self.request, myview)
+
+        # self.request is a POST, viewers should not have access to that.
+        assert not self.permission.has_object_permission(self.request, myview, obj)
+
+        # GET requests should be allowed.
+        self.request.method = 'GET'
+        assert self.permission.has_object_permission(self.request, myview, obj)
+
     def test_object_with_listed_versions_but_no_unlisted_versions(self):
         self.request.user = user_factory()
         self.grant_permission(self.request.user, 'Addons:ReviewUnlisted')
         obj = Mock(spec=[])
         obj.has_unlisted_versions = lambda include_deleted=False: False
+        obj.has_enterprise_versions = lambda include_deleted=False: False
         obj.has_listed_versions = lambda include_deleted=False: True
 
         assert self.permission.has_permission(self.request, myview)
@@ -616,6 +645,7 @@ def test_object_with_listed_versions_but_no_unlisted_versions_viewer(self):
         self.grant_permission(self.request.user, 'ReviewerTools:ViewUnlisted')
         obj = Mock(spec=[])
         obj.has_unlisted_versions = lambda include_deleted=False: False
+        obj.has_enterprise_versions = lambda include_deleted=False: False
         obj.has_listed_versions = lambda include_deleted=False: True
 
         assert self.permission.has_permission(self.request, myview)
@@ -626,6 +656,7 @@ def test_object_with_no_unlisted_versions_and_no_listed_versions(self):
         self.grant_permission(self.request.user, 'Addons:ReviewUnlisted')
         obj = Mock(spec=[])
         obj.has_unlisted_versions = lambda include_deleted=False: False
+        obj.has_enterprise_versions = lambda include_deleted=False: False
         obj.has_listed_versions = lambda include_deleted=False: False
 
         assert self.permission.has_permission(self.request, myview)
@@ -636,6 +667,7 @@ def test_object_with_no_unlisted_versions_and_no_listed_versions_viewer(self):
         self.grant_permission(self.request.user, 'ReviewerTools:ViewUnlisted')
         obj = Mock(spec=[])
         obj.has_unlisted_versions = lambda include_deleted=False: False
+        obj.has_enterprise_versions = lambda include_deleted=False: False
         obj.has_listed_versions = lambda include_deleted=False: False
 
         assert self.permission.has_permission(self.request, myview)

src/olympia/lib/settings_base.py

@@ -1321,6 +1321,7 @@ def read_only_mode(env):
         'categories-application',
         'minimal-profile-has-all-fields-shim',
         'promoted-groups-shim',
+        'enterprise-channel-shim',
     ),
     'v4': (
         'l10n_flat_input_output',
@@ -1340,6 +1341,7 @@ def read_only_mode(env):
         'block-versions-list-shim',
         'promoted-groups-shim',
         'minimal-profile-has-all-fields-shim',
+        'enterprise-channel-shim',
     ),
     'v5': (
         'addons-search-_score-field',

src/olympia/signing/views.py

@@ -199,7 +199,9 @@ def handle_upload(self, request, addon, version_string, guid=None):
             created = False
             channel_param = request.POST.get('channel')
             channel = amo.CHANNEL_CHOICES_LOOKUP.get(channel_param)
-            if not channel:
+            if (
+                not channel or channel == amo.CHANNEL_ENTERPRISE  # api/v5+ only
+            ):
                 last_version = addon.find_latest_version(None, exclude=())
                 if last_version:
                     channel = last_version.channel