Bug 1389372 - Add REST API endpoint to validate whether a BMO user ID can see a given BMO bug

1 files changed, 38 insertions, 0 deletions

diff --git a/extensions/PhabBugz/lib/WebService.pm b/extensions/PhabBugz/lib/WebService.pm
index 0d88114f6..84561c3db 100644
--- a/extensions/PhabBugz/lib/WebService.pm
+++ b/extensions/PhabBugz/lib/WebService.pm
@@ -23,6 +23,7 @@ use Bugzilla::User;
 use Bugzilla::Util qw(correct_urlbase detaint_natural);
 use Bugzilla::WebService::Constants;
 
+use Bugzilla::Extension::PhabBugz::Constants;
 use Bugzilla::Extension::PhabBugz::Util qw(
     create_revision_attachment
     create_private_revision_policy
@@ -41,6 +42,7 @@ use constant PUBLIC_METHODS => qw(
     revision
 );
 
+
 sub revision {
     my ($self, $params) = @_;
 
@@ -110,8 +112,35 @@ sub revision {
     };
 }
 
+sub check_user_permission_for_bug {
+    my ($self, $params) = @_;
+
+    my $user = Bugzilla->login(LOGIN_REQUIRED);
+
+    # Ensure PhabBugz is on
+    ThrowUserError('phabricator_not_enabled')
+        unless Bugzilla->params->{phabricator_enabled};
+
+    # Validate that the requesting user's email matches phab-bot
+    ThrowUserError('phabricator_unauthorized_user')
+        unless $user->login eq PHAB_AUTOMATION_USER;
+
+    # Validate that a bug id and user id are provided
+    ThrowUserError('phabricator_invalid_request_params')
+        unless ($params->{bug_id} && $params->{user_id});
+
+    # Validate that the user and bug exist
+    my $target_user = Bugzilla::User->check({ id => $params->{user_id}, cache => 1 });
+
+    # Send back an object which says { "result": 1|0 }
+    return {
+        result => $target_user->can_see_bug($params->{bug_id})
+    };
+}
+
 sub rest_resources {
     return [
+        # Revision creation
         qr{^/phabbugz/revision/([^/]+)$}, {
             POST => {
                 method => 'revision',
@@ -119,6 +148,15 @@ sub rest_resources {
                     return { revision => $_[0] };
                 }
             }
+        },
+        # Bug permission checks
+        qr{^/phabbugz/check_bug/(\d+)/(\d+)$}, {
+            GET => {
+                method => 'check_user_permission_for_bug',
+                params => sub {
+                    return { bug_id => $_[0], user_id => $_[1] };
+                }
+            }
         }
     ];
 }