Implement attachment_api and serving of attachments

[jrobbins]

This PR implements the server side logic for uploading and serving attachments. Specifically,

• Uploading immediately stores the attachment and returns a URL that can be placed into a UI field that has a list of URLs (some of which are stored on our server and some of which might link to other sites)
• Serving checks that the request was made with the expected URL (including a domain that does not have our main domain cookies) and then returns the attachment content or thumbnail

Also in the PR,

• Added an openapi declaration, and the associated generated files. This is our first openapi entry point that accepts binary data.
• Changed the thumbnail size to match the size of images in the existing enterprise release notes page.
• Fixed a comment formatting error in permission.py

[jcscottiii]

A few comments to consider.

Also, I see that you have API tests that:

1. assert the POST behavior
2. assert serving from an entity manually added to the database.

You should add a test that does the POST and serves the entity afterwards. This can come later in a playwright test when we have the UI. But I just wanted to bring that up now.

[jcscottiii]

Can raise headers = self.get_headers() out before the conditional statements

Suggested change

	if is_thumb and attachment.thumbnail:
	content = attachment.thumbnail
	headers = self.get_headers()
	headers['Content-Type'] = 'image/png'
	else:
	content = attachment.content
	headers = self.get_headers()
	headers['Content-Type'] = attachment.mime_type
	headers = self.get_headers()
	if is_thumb and attachment.thumbnail:
	content = attachment.thumbnail
	headers['Content-Type'] = 'image/png'
	else:
	content = attachment.content
	headers['Content-Type'] = attachment.mime_type

[jrobbins]

Done.

[jcscottiii]

Nit: I think this comment was a copy-paste from features_api

chromium-dashboard/api/features_api.py

Line 53 in 92c888d

"""Features are the the main records that we track."""

Instead, you may want to mention how the attachments relate to features

[jrobbins]

Fixed.

[jcscottiii]

We should not have this logic that looks for mock_files in the keywords in the live code. Instead, we should adjust the tests. More about this in the test file.

Suggested change

	files = kwargs.get('mock_files', self.request.files)
	files = self.request.files

[jcscottiii]

Suggested change

	mock_files = {'uploaded-file': testing_config.Blank(
	filename='hello_attach.txt',
	read=lambda: b'hello attachments!',
	mimetype='text/plain')}
	with test_app.test_request_context(self.request_path):
	mock_file = (io.BytesIO(b'hello attachments!'), 'test.txt')
	with test_app.test_request_context(path=self.request_path, data={'uploaded-file': mock_file}):

[jrobbins]

Thanks for that suggestion. I had spent half the day struggling with passing in a complete POST body as a binary string.

[jcscottiii]

Could you add a comment as to why we are doing modulo 1000?

[jrobbins]

Done.

[jcscottiii]

Also, I think you meant to adjust this comment too

[jrobbins]

Done.

[jrobbins]

A few comments to consider.

Also, I see that you have API tests that:

1. assert the POST behavior
2. assert serving from an entity manually added to the database.

You should add a test that does the POST and serves the entity afterwards. This can come later in a playwright test when we have the UI. But I just wanted to bring that up now.

I went ahead and added a round-trip unit test now.