doc/block_commands_operations.txt

PROBLEM
=========================
Customers and stakeholders want to be able to 
prevent accidental damage to Juju deployments.

SOLUTION
=========================
To prevent running some commands, a concept of commands block was implemented.
Once the block is switched on, it has to be manually switched off
to run commands successfully.

There are currently three types of blocks developed.

 1. DESTROY_BLOCK blocks destroy-model command.
 2. REMOVE_BLOCK blocks destroy-model as well as all object removal -
    machines, services, units, relations.
 3. CHANGE_BLOCK blocks all commands from DESTROY and REMOVE blocks 
    as well as all model modifications.

For more information and the list of all commands that are blocked, run
    `juju help block`
or
    `juju help unblock`

IMPLEMENTATION
=========================
Command: package cmd/juju
---------------------------------------------
 1. Help for block/unblock command is updated to contain your command.
 2. Delegate error processing of the client from apiserver error.
    Usually it would be done in the implementation of Command.Run.
    E.g.

          func (c *SetFluffCommand) Run(_ *cmd.Context) (err error) {
            ....
            err := apiclient.SetFluff(args)
            // there are corresponding
            // block.BlockDestroy and block.BlockRemove
            return block.ProcessBlockedError(err, block.BlockChange)
          }
 3. Add tests switching the block on before running the command.
 
Server: client instance in apiserver package
---------------------------------------------
  1. Check if the block is enabled using common.BlockChecker,
     before any other processing.
     Some client already have this checker embedded.
     To construct new checker, you'll need a state.State.
     E.g.

        func (c *Client) SetFluff(args params.SetFluff) error {
            if err := c.check.ChangeAllowed(); err != nil {
               return errors.Trace(err)
            }
            ......
        }
     or

        func (c *Client) SetFluff(args params.SetFluff) error {
            blockChecker := common.NewBlockChecker(st)
            // there are corresponding
            // blockChecker.DestroyAllowed() and block.RemoveAllowed()
            if err := blockChecker.ChangeAllowed(); err != nil {
                return errors.Trace(err)
            }
            ......
        }
  2. Add tests switching the block on. 

Interested Parties
---------------------------------------------
 1. Notify QA team that a new command became block-able.

 2. Juju documentation may need to be updated as well.