Bug 2081856 - Migrate Bug REST resource to native Mojo API: attachments (attachments, add_attachment, update_attachment)

[Xzzz]

Summary

Ports attachments, add_attachment and update_attachment from Bugzilla::WebService::Bug into a native Bugzilla::API::V1::BugAttachment Mojo controller, following the earlier migrations in this series.

Second of the four sub-bugs of 2081819. The rest of the legacy Bug module stays until 2081860.

Changes

• Add Bugzilla/API/V1/BugAttachment.pm, with the same responses as the legacy endpoints:
  • GET / POST /rest/bug/<id>/attachment
  • GET / PUT /rest/bug/attachment/<attachment_id>
  • OPTIONS on both (GET, POST / GET, PUT)
• Remove the three methods, their constants and POD from Bugzilla/WebService/Bug.pm, and their routes from Resources/Bug.pm. The attachment/flag/user hash helpers stay there for bug get until 2081860.
• Kept from the legacy server:
  • data is base64-decoded on input and encoded on output.
  • Anonymous GETs are rate-limited; logged-in GETs are logged.
  • ids must be a list of plain values (invalid_params otherwise).
  • A path id is added to the query ids on GET; on POST/PUT, ids from the body or query string win over the path.
• Tests:
  • New qa/t/rest_bug_update_attachment.t (PUT had almost no coverage).
  • t/app-cgi-request-limit.t: the legacy rest.cgi CORS check now uses POST /rest/bug, since the attachment path is native.

Behaviour changes:

• update_attachment drops request-level keys (api_key, Bugzilla_*, include_fields…) before set_all(). An api_key in the query string no longer causes an unknown_method error; unknown fields still do.
• A repeated ids in the query string of a POST/PUT is now used as a list. The legacy server kept only the first value.
• With disable_bug_updates on, add_attachment returns a JSON error. The legacy REST server returned the HTML "updates disabled" page

Not carried over: ETag/304 and JSONP callback=, as in the other migrated V1 modules.

Merge order: please merge after #2785 (2081849). Both remove code from Bugzilla/WebService/Bug.pm and Resources/Bug.pm; this branch will be updated with master once #2785 has landed.

Test plan

• GET /rest/bug/<id>/attachment with include_fields=_all&exclude_fields=data, logged out and logged in
• GET /rest/bug/attachment/<id>?include_fields=data, and ?attachment_ids=<other> returns both
• Private attachment as a non-insider, expecting auth_failure
• POST /rest/bug/<id>/attachment with base64 data, expecting 201
• PUT /rest/bug/attachment/<id> changing summary / is_obsolete with a comment
• PUT with ids in the body updates those ids, not the path one
• PUT with an ids hash of conditions, expecting invalid_params
• OPTIONS on both paths
• Bug modal: open the attachments overlay, view an attachment, paste text as an attachment

References

• Bugzilla link: 2081856
• Part of 2081819 / 2057358

[dklawren]

LGTM r=dkl