Allows a user to create_health_reports.

dashboard/dashboard/create_health_report.py

+# Copyright 2017 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+"""Provides the web interface for adding and editing sheriff rotations."""
+
+from dashboard.common import request_handler
+from dashboard.common import xsrf
+from dashboard.models import table_config
+
+
+class CreateHealthReportHandler(request_handler.RequestHandler):
+
+  def get(self):
+    """Renders the UI with the form fields."""
+    self.RenderHtml('create_health_report.html', {})
+
+  @xsrf.TokenRequired
+  def post(self):
+    """POSTS the data to the datastore."""
+    internal_only = self.request.get('internal-only') == 'true'
+    name = self.request.get('name')
+    master_bot = self.request.get('masterBot').splitlines()

[sullivan, 2017/01/11 20:59:15]

It's poor security to rely on the user to supply whether or not this should be
internal only. We should either:

1 Make the report internal_only if any of the bots are internal_only
2 Make each report public but not display data from internal_only bots to
external users. This would be secure because our hooks prevent us from
displaying this data accidentally.

I think 1) is better because it's less error-prone; 2 should work but it's too
complicated.

[jessimb, 2017/01/11 21:31:21]

Would that check go as a datastore pre-hook?

[sullivan, 2017/01/11 21:38:03]

yep!

[jessimb, 2017/01/12 02:10:30]

I have put this in the new CreateTableConfig() which also checks validity of
master/bots

+    tests = self.request.get('tests').splitlines()
+    table_layout = self.request.get('tableLayout')
+
+    table_config.TableConfig(name=name, bots=master_bot, tests=tests,
+                             table_layout=table_layout,
+                             internal_only=internal_only).put()
+
+    self.RenderHtml('create_health_report.html',
+                    {'msg': 'Health Report Created. View here: [TODO jessimb]'})

[sullivan, 2017/01/11 20:59:15]

We're trying to get away from jinja templates, because it's really hard to have
both jinja templates and polymer templates together. We want to get to a point
where we only have polymer templates.

This endpoint should be called from the client with simple_xhr and return JSON
that is used to populate a polymer template. The JSON should probably return the
URL, or an error message, and the polymer template should update based on that.

[jessimb, 2017/01/11 21:31:21]

Making this a polymer element.