Bug 1154724 - Load and mark restricted bugs with an api key

README.md

@@ -4,6 +4,23 @@
 
 Bugherder is a tool for marking bugs post-merge, created by [Graeme McCutcheon](http://www.graememcc.co.uk/).
 
+RESTRICTED BUGS
+---------------
+Bugherder loads bug data anonymously, so bugs that are restricted to a Bugzilla group can't
+be loaded, and can't be marked. Sheriffs generally don't have access to them either, so they
+are normally left for someone from Release Management to deal with by hand afterwards.
+
+When a push contains such bugs, bugherder offers to load them with an API key. Supply one
+belonging to an account that can see them, and bugherder will restart the normal flow with
+everything except those bugs filtered out - the same commenting, resolving and flag setting as
+usual, over just the restricted bugs. The key is reused for the submission, so it is only asked
+for once. Anything that still can't be loaded with the key given is called out so it can be
+followed up manually.
+
+This doesn't affect the sheriff pass in any way: without a key, nothing loads and the push is
+presented exactly as before.
+
+
 NOTES ON TESTING
 ----------------
 Adding "?debug=1" shows how all changesets were identified, and shows what changesets Bugherder decided were affected by a backout.

bugherder/css/style.css

@@ -335,6 +335,24 @@ div.ctr {
   color: rgb(51,51,51);
 }
 
+#restricted {
+  max-width: 940px;
+  margin: 10px auto 0;
+  padding: 0 10px;
+}
+
+#restrictedText {
+  display: inline-block;
+  border: 1px solid rgb(255,213,153);
+  background-color: rgb(255,239,217);
+  color: rgb(51,51,51);
+  padding: 2px 5px;
+}
+
+#restrictedButton {
+  margin-left: 10px;
+}
+
 #loadingOverlay {
   padding-left: 25px;
 }

bugherder/index.html

@@ -45,6 +45,11 @@ <h4>A tool to help with post-merge Bugzilla administrivia. <a href="https://gith
 
         <div class="hiddenContent hideAll" id="detail"></div>
 
+        <div class="hiddenContent hideAll" id="restricted">
+          <span id="restrictedText"></span>
+          <button type="button" id="restrictedButton">Load restricted bugs</button>
+        </div>
+
       </div>
 
       <div class="wrap">

bugherder/js/BugData.js

@@ -4,11 +4,17 @@ var BugData = {
   bugs: {},
   trackingFlag: null,
   statusFlag: null,
-  fields: 'id,resolution,status,whiteboard,keywords,target_milestone,summary,product,component,flags,assigned_to',
+  fields: 'id,resolution,status,whiteboard,keywords,target_milestone,summary,product,component,flags,assigned_to,groups',
   notYetLoaded: [],
   loadCallback: null,
   errorCallback: null,
   checkComments: false,
+  apiKey: null,
+
+  setApiKey: function BD_setApiKey(key) {
+    this.apiKey = key || null;
+  },
+
 
   load: function BD_load(bugs, checkComments, loadCallback, errorCallback) {
     this.notYetLoaded = bugs;
@@ -56,7 +62,7 @@ var BugData = {
         self.parseData(data);
     };
 
-    var bugzilla = bz.createClient({timeout: timeout});
+    var bugzilla = bz.createClient({timeout: timeout, api_key: this.apiKey});
     bugzilla.searchBugs(bugs, callback);
   },
 
@@ -109,9 +115,16 @@ var BugData = {
 
     bug.isUnassigned = /^nobody@(?:mozilla.org|nss.bugs)$/.test(bugObj.assigned_to.name);
 
+    bug.securityGroups = (bugObj.groups || []).filter(function BD_isSecurityGroup(group) {
+      return Config.securityGroupRE.test(group);
+    });
+    bug.canSecurityRelease = bug.securityGroups.length > 0;
+
     bug.intestsuite = ' ';
     bug.testsuiteFlagID = -1;
-    bug.canSetTestsuite = ConfigurationData.hasTestsuiteFlag[bug.product][bugObj.component];
+    // The configuration is loaded anonymously, so it omits logged-in-only products
+    var componentFlags = ConfigurationData.hasTestsuiteFlag[bug.product];
+    bug.canSetTestsuite = !!(componentFlags && componentFlags[bugObj.component]);
     if (bug.canSetTestsuite && 'flags' in bugObj && bugObj.flags) {
       for (var i = 0; i < bugObj.flags.length; i++) {
         var f = bugObj.flags[i];

bugherder/js/Config.js

@@ -11,6 +11,11 @@ var Config = {
   hgPushlogURL: "https://hg.mozilla.org/mozilla-central/pushloghtml?changeset=",
   showBugURL: "https://bugzilla.mozilla.org/show_bug.cgi?id=",
 
+  // Matched by shape, not by name: Bugzilla only advertises the core-security groups
+  // that still accept new bugs, so any fixed list misses most of the ones in use
+  securityGroupRE: /^(?:[a-z0-9-]+-)?core-security$/,
+  securityReleaseGroup: "core-security-release",
+
   // Here be dragons
   versionRE: /^mozilla\d+$/i,
   csetInputRE: /^(tip|[\da-f]{12,40})$/i,