restrict /policy PATCH to non-themes

[eviljeff]

Fixes: mozilla/addons#14937

Description

Themes can't have EULA or privacy policies, so restrict the endpoint to non-themes, like devhub does.

Context

PATCH for /policy was added recently.

Testing

• Try to patch a theme's eula or privacy via https://mozilla.github.io/addons-server/topics/api/addons.html#eula-and-privacy-policy-edit (and get a 400)
• Try to patch a non-theme with the same API and succeed

Checklist

• Add #ISSUENUM at the top of your PR to an existing open issue in the mozilla/addons repository.
• Successfully verified the change locally.
• The change is covered by automated tests, or otherwise indicated why doing so is unnecessary/impossible.
• Add before and after screenshots (Only for changes that impact the UI).
• Add or update relevant docs reflecting the changes made.

[KevinMind]

@eviljeff how do I create a new theme locally?

[eviljeff]

@eviljeff how do I create a new theme locally?

Either download one from prod and submit it as a new add-on, or use the theme wizard to create one with whatever random image you have lying around.

[KevinMind]

Also FWIW I will try testing this using the swagger docs. http://olympia.test/api/v5/swagger/#/addons/addons_addon_eula_policy_partial_update

Note: Interesting swagger is not groking the serializer TranslationField correctly, expecting a string. Should be fixed at some point.

For now used Curl to update an addon's policy, once I find out how to upload a theme I'll test the opposite case.

curl -X PATCH http://olympia.test/api/v5/addons/addon/97/eula_policy/
-H "Authorization: Session "
-H "Content-Type: application/json"
-d '{
"privacy_policy": {
"en-us": "private"
}
}'

[KevinMind]

Code looks good. One question, " like devhub does." this indicates that devhub is also limiting access to the endpoint? Thought the validator you added doesn't seem to be referenced by devhub code. Does this mean we have two mechanisms for access control or can you expand on what you mean by the quoted statement.

Confirmed themese not able to patch, extension was able to patch.

[KevinMind]

Filed mozilla/addons#14958

[eviljeff]

Code looks good. One question, " like devhub does." this indicates that devhub is also limiting access to the endpoint? Thought the validator you added doesn't seem to be referenced by devhub code. Does this mean we have two mechanisms for access control or can you expand on what you mean by the quoted statement.

Devhub has a form to set/edit privacy policy and EULA (under ownership), and we don't show those fields for themes.