Role Management (#2705)

* Add 'manage' permission

* Always store principals as strings

Before, these were always UUID objects, but since #1329 this is stored
as a string for session-based authentication only. To keep everything
consistent, always use strings over UUID objects.

* Split profile and project management

This gives the logged in user a place to manage their profile, and a
place to manage their projects. Mostly stubbed out for now.

* Put the gravatar link on the 'Manage Profile' page

This no longer needs to be a client-side include because we can just
edit it via profile management when the user is logged in.

* Some really rudimentary styling, please revert

* Role management

Adding and deleting roles

* Update logged in information architecture, begin styling

* Make collaborator form more simple

* Allow stacking flash messages

* Reuse dropdown SCSS

* Style releases table

* Update management UI based on meeting feedback

* Fix linter errors

* Hide 'duplicate' roles

* Break management forms into mixins

* Simplify delete view

* Add ability to change existing roles

* Add JournalEntries when adding/removing roles

* Add labels for screen readers

* Add delete modals, tabs, clean up UI

* Put TODOs in comments

* Namespace manage routes

* Hide draft UIs in templates

* Properly comment out Edit Project link

* Change 'Preview' to 'View'

This will always link to a project/release that is live, so it's never
really a "Preview" per se. Also, this allows us to actually have a
"Preview" some day when we allow for staged releases.

* Fix more linting errors

tests/unit/accounts/test_auth_policy.py

@@ -11,6 +11,7 @@
 # limitations under the License.
 
 import pretend
+import uuid
 
 from pyramid import authentication
 from pyramid.interfaces import IAuthenticationPolicy
@@ -74,7 +75,7 @@ def test_unauthenticated_userid_with_userid(self, monkeypatch):
         add_vary_cb = pretend.call_recorder(lambda *v: vary_cb)
         monkeypatch.setattr(auth_policy, "add_vary_callback", add_vary_cb)
 
-        userid = pretend.stub()
+        userid = uuid.uuid4()
         service = pretend.stub(
             find_userid=pretend.call_recorder(lambda username: userid),
         )
@@ -83,7 +84,7 @@ def test_unauthenticated_userid_with_userid(self, monkeypatch):
             add_response_callback=pretend.call_recorder(lambda cb: None),
         )
 
-        assert policy.unauthenticated_userid(request) is userid
+        assert policy.unauthenticated_userid(request) == str(userid)
         assert extract_http_basic_credentials.calls == [pretend.call(request)]
         assert request.find_service.calls == [
             pretend.call(IUserService, context=None),

tests/unit/accounts/test_views.py

@@ -559,15 +559,6 @@ def test_reset_password(self, db_request, user_service, token_service):
         ]
 
 
-class TestClientSideIncludes:
-
-    def test_edit_gravatar_csi_returns_user(self, db_request):
-        user = UserFactory.create()
-        assert views.edit_gravatar_csi(user, db_request) == {
-            "user": user,
-        }
-
-
 class TestProfileCallout:
 
     def test_profile_callout_returns_user(self):

tests/unit/manage/__init__.py

@@ -0,0 +1,11 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.

tests/unit/manage/test_forms.py

@@ -0,0 +1,71 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import pretend
+import pytest
+import wtforms
+
+from webob.multidict import MultiDict
+
+from warehouse.manage import forms
+
+
+class TestCreateRoleForm:
+
+    def test_creation(self):
+        user_service = pretend.stub()
+        form = forms.CreateRoleForm(user_service=user_service)
+
+        assert form.user_service is user_service
+
+    def test_validate_username_with_no_user(self):
+        user_service = pretend.stub(
+            find_userid=pretend.call_recorder(lambda userid: None),
+        )
+        form = forms.CreateRoleForm(user_service=user_service)
+        field = pretend.stub(data="my_username")
+
+        with pytest.raises(wtforms.validators.ValidationError):
+            form.validate_username(field)
+
+        assert user_service.find_userid.calls == [pretend.call("my_username")]
+
+    def test_validate_username_with_user(self):
+        user_service = pretend.stub(
+            find_userid=pretend.call_recorder(lambda userid: 1),
+        )
+        form = forms.CreateRoleForm(user_service=user_service)
+        field = pretend.stub(data="my_username")
+
+        form.validate_username(field)
+
+        assert user_service.find_userid.calls == [pretend.call("my_username")]
+
+    @pytest.mark.parametrize(("value", "expected"), [
+        ("", "Must select a role"),
+        ("invalid", "Not a valid choice"),
+        (None, "Not a valid choice"),
+    ])
+    def test_validate_role_name_fails(self, value, expected):
+        user_service = pretend.stub(
+            find_userid=pretend.call_recorder(lambda userid: 1),
+        )
+        form = forms.CreateRoleForm(
+            MultiDict({
+                'role_name': value,
+                'username': 'valid_username',
+            }),
+            user_service=user_service,
+        )
+
+        assert not form.validate()
+        assert form.role_name.errors == [expected]