feat: add delegation commands

[Sakib25800]

Fixes: #209
Fixes: #129

[Sakib25800]

I've modified the undelegation logic to require either reviewer permission or for the user to be a delegated user. However, the original Homu implementation required the try permission - seems like they never got around to it.

elif command.action == 'undelegate':
        # TODO: why is this a TRY?
        if not _try_auth_verified():
            continue
        state.delegate = ''
        state.save()

Source reference

So I guess #206 will need updating.

[Kobzol]

Thank you! Implementation looks good at a first glance, but I have to say that I forgot about @bors delegate=<username>. That sounds a bit.. useless, to be honest, and could be a potential security problem if someone mispells the name, since some other user could then get approval rights. Or a user could rename themselves to get approval rights (in theory). In general, we should try to store user GitHub IDs instead of usernames, but in this case I think we can just store a boolean property (delegated/not delegated).

I think that delegate+ and delegate- should be enough. I asked others about this here.

[Kobzol]

Yeah let's just keep delegate+ and delegate-, to keep it simpler.

[Sakib25800]

I've removed it.

DB wise: delegated_to -> delegated.

[Kobzol]

There is kind of a glaring security hole in the current implementation 😆 But should be easy to fix.

The tests will also require some modifications to actually test a situation with multiple users. In particular, there should be a test where person A creates a PR, person B delegates it, and then person C tries to approve, but it fails. This would find the "security hole" xD

But otherwise it looks very good!

[Kobzol]

Btw, when you are implementing review remarks, it's fine to keep pushing individual commits, we can always squash at the very end just before merging. It is easier to review the changes more separately, rather than checking a big force push that changes the whole PR.

[Kobzol]

Thank you! Left a few more comments.

[Kobzol]

I think that it works now, but could you please also add a test that a (non-PR-author) user with try permissions cannot delegate? Thanks!

[Sakib25800]

Let's just say I got into a fight with git. I'll fix it though - should be good git practice.

[Sakib25800]

Added delegatee_can_set_priority test.

[Kobzol]

Thank you, awesome work!