Record which restriction instance(s) disabled auto-approval

src/olympia/addons/tests/test_views.py

@@ -61,7 +61,12 @@
 from olympia.search.utils import get_es
 from olympia.tags.models import Tag
 from olympia.translations.models import Translation
-from olympia.users.models import EmailUserRestriction, UserProfile
+from olympia.users.models import (
+    RESTRICTION_TYPES,
+    EmailUserRestriction,
+    UserProfile,
+    UserRestrictionHistory,
+)
 from olympia.versions.models import (
     ApplicationsVersions,
     AppVersion,
@@ -4088,6 +4093,35 @@ def _submit_source(self, filepath, error=False):
             version = None
         return response, version
 
+    def test_restriction_instance_recorded_on_auto_approval_denial(self):
+        # End to end: a restriction denying auto-approval during a real API
+        # submission is recorded with the specific matching instance, linked
+        # to the version that was created.
+        user_factory(pk=settings.TASK_USER_ID)  # DISABLE_AUTO_APPROVAL author.
+        restriction = EmailUserRestriction.objects.create(
+            email_pattern=self.user.email,
+            restriction_type=RESTRICTION_TYPES.ADDON_APPROVAL,
+        )
+        response = self.client.post(self.url, data=self.minimal_data)
+        assert response.status_code == 201, response.content
+
+        self.addon.reload()
+        version = self.addon.find_latest_version(channel=None)
+        history = UserRestrictionHistory.objects.get(user=self.user)
+        assert history.get_restriction_display() == 'EmailUserRestriction'
+        assert history.restriction_instance == restriction
+        assert history.version == version
+        activity_log = ActivityLog.objects.filter(
+            action=amo.LOG.DISABLE_AUTO_APPROVAL.id
+        ).get()
+        assert activity_log.details['restrictions'] == ['EmailUserRestriction']
+        assert activity_log.details['restriction_history_ids'] == [history.pk]
+        assert activity_log.details['comments'] == (
+            'Unlisted auto-approval automatically disabled because of a '
+            'restriction (EmailUserRestriction)'
+        )
+        assert self.addon.auto_approval_disabled_unlisted
+
 
 class TestVersionViewSetCreateJWTAuth(TestVersionViewSetCreate):
     client_class = APITestClientJWT

src/olympia/reviewers/tests/test_views.py

@@ -74,7 +74,13 @@
 from olympia.reviewers.views import queue
 from olympia.scanners.models import ScannerResult, ScannerRule
 from olympia.stats.utils import VERSION_ADU_LIMIT
-from olympia.users.models import UserProfile
+from olympia.users.models import (
+    RESTRICTION_TYPES,
+    EmailUserRestriction,
+    UserProfile,
+    UserRestrictionHistory,
+)
+from olympia.users.utils import get_task_user
 from olympia.versions.models import (
     ApplicationsVersions,
     AppVersion,
@@ -5358,6 +5364,43 @@ def test_important_changes_log(self):
         change_text = doc('#important-changes-history .activity tr:nth-child(8)').text()
         assert change_text.startswith('Auto-Approval disabled (Unlisted)')
 
+    def test_important_changes_shows_restriction_that_disabled_auto_approval(self):
+        # State created exactly as Version.from_upload() records it when a
+        # restriction denies auto-approval: the matched instance on a
+        # UserRestrictionHistory row linked to the version, and the
+        # DISABLE_AUTO_APPROVAL entry naming the class.
+        restriction = EmailUserRestriction.objects.create(
+            email_pattern=self.addon_author.email,
+            restriction_type=RESTRICTION_TYPES.ADDON_APPROVAL,
+        )
+        history = UserRestrictionHistory.objects.create(
+            user=self.addon_author,
+            restriction=2,  # EmailUserRestriction
+            restriction_instance=restriction,
+            version=self.version,
+        )
+        core.set_user(get_task_user())
+        ActivityLog.objects.create(
+            amo.LOG.DISABLE_AUTO_APPROVAL,
+            self.addon,
+            details={
+                'channel': amo.CHANNEL_LISTED,
+                'comments': (
+                    'Listed auto-approval automatically disabled because of a '
+                    'restriction (EmailUserRestriction)'
+                ),
+                'restrictions': ['EmailUserRestriction'],
+                'restriction_history_ids': [history.pk],
+            },
+        )
+        response = self.client.get(self.url)
+        assert response.status_code == 200
+        self.assertContains(
+            response,
+            'Listed auto-approval automatically disabled because of a '
+            'restriction (EmailUserRestriction)',
+        )
+
     def test_important_changes_log_with_versions_attached(self):
         version1 = self.addon.versions.get()
         version2 = version_factory(addon=self.addon)

src/olympia/users/migrations/0027_userrestrictionhistory_restriction_instance_and_version.py

@@ -0,0 +1,35 @@
+# Generated by Django 5.2.17 on 2026-08-25 14:53
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('contenttypes', '0002_remove_content_type_name'),
+        ('users', '0026_alter_userrestrictionhistory_restriction_and_more'),
+        ('versions', '0053_auto_20260720_1345'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='userrestrictionhistory',
+            name='restriction_content_type',
+            field=models.ForeignKey(null=True, on_delete=django.db.models.deletion.SET_NULL, to='contenttypes.contenttype'),
+        ),
+        migrations.AddField(
+            model_name='userrestrictionhistory',
+            name='restriction_object_id',
+            field=models.PositiveIntegerField(null=True),
+        ),
+        migrations.AddField(
+            model_name='userrestrictionhistory',
+            name='version',
+            field=models.ForeignKey(null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='restriction_history', to='versions.version'),
+        ),
+        migrations.AddIndex(
+            model_name='userrestrictionhistory',
+            index=models.Index(fields=['restriction_content_type', 'restriction_object_id'], name='urh_restriction_instance_idx'),
+        ),
+    ]