opendev/gerrit
Code Issues Proposed changes

Merge "Assign default permissions on user branches"

Browse Source
This commit is contained in:
David Pursehouse
2016-06-02 23:44:52 +00:00
committed by Gerrit Code Review
parent 795bebfc24 d42599ecea
commit 036560dbe0
5 changed files with 168 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
gerrit-server/src/main/java/com/google/gerrit/server/schema/AclUtil.java
View File

@@ -29,7 +29,16 @@ public class AclUtil {
public static void grant(ProjectConfig config, AccessSection section,
String permission, boolean force, GroupReference... groupList) {
grant(config, section, permission, force, null, groupList);
}
public static void grant(ProjectConfig config, AccessSection section,
String permission, boolean force, Boolean exclusive,
GroupReference... groupList) {
Permission p = section.getPermission(permission, true);
if (exclusive != null) {
p.setExclusiveGroup(exclusive);
}
for (GroupReference group : groupList) {
if (group != null) {
PermissionRule r = rule(config, group);

15
gerrit-server/src/main/java/com/google/gerrit/server/schema/AllUsersCreator.java
View File

@@ -14,11 +14,13 @@
package com.google.gerrit.server.schema;
import static com.google.gerrit.server.group.SystemGroupBackend.REGISTERED_USERS;
import static com.google.gerrit.server.schema.AclUtil.grant;
import com.google.gerrit.common.Version;
import com.google.gerrit.common.data.AccessSection;
import com.google.gerrit.common.data.GroupReference;
import com.google.gerrit.common.data.LabelType;
import com.google.gerrit.common.data.Permission;
import com.google.gerrit.reviewdb.client.Project;
import com.google.gerrit.reviewdb.client.RefNames;
@@ -28,6 +30,8 @@ import com.google.gerrit.server.extensions.events.GitReferenceUpdated;
import com.google.gerrit.server.git.GitRepositoryManager;
import com.google.gerrit.server.git.MetaDataUpdate;
import com.google.gerrit.server.git.ProjectConfig;
import com.google.gerrit.server.group.SystemGroupBackend;
import com.google.gerrit.server.project.RefPattern;
import com.google.inject.Inject;
import org.eclipse.jgit.errors.ConfigInvalidException;
@@ -42,6 +46,7 @@ public class AllUsersCreator {
private final GitRepositoryManager mgr;
private final AllUsersName allUsersName;
private final PersonIdent serverUser;
private final GroupReference registered;
private GroupReference admin;
@@ -53,6 +58,7 @@ public class AllUsersCreator {
this.mgr = mgr;
this.allUsersName = allUsersName;
this.serverUser = serverUser;
this.registered = SystemGroupBackend.getGroup(REGISTERED_USERS);
}
public AllUsersCreator setAdministrators(GroupReference admin) {
@@ -87,8 +93,13 @@ public class AllUsersCreator {
Project project = config.getProject();
project.setDescription("Individual user settings and preferences.");
AccessSection all = config.getAccessSection(RefNames.REFS_USERS + "*", true);
all.getPermission(Permission.READ, true).setExclusiveGroup(true);
AccessSection users = config.getAccessSection(
RefNames.REFS_USERS + "${" + RefPattern.USERID_SHARDED + "}", true);
LabelType cr = AllProjectsCreator.initCodeReviewLabel(config);
grant(config, users, Permission.READ, false, true, registered);
grant(config, users, Permission.PUSH, false, true, registered);
grant(config, users, Permission.SUBMIT, false, true, registered);
grant(config, users, cr, -2, 2, registered);
AccessSection defaults = config.getAccessSection(RefNames.REFS_USERS_DEFAULT, true);
defaults.getPermission(Permission.READ, true).setExclusiveGroup(true);

2
gerrit-server/src/main/java/com/google/gerrit/server/schema/SchemaVersion.java
View File

@@ -33,7 +33,7 @@ import java.util.List;
/** A version of the database schema. */
public abstract class SchemaVersion {
/** The current schema version. */
public static final Class<Schema_124> C = Schema_124.class;
public static final Class<Schema_125> C = Schema_125.class;
public static int getBinaryVersion() {
return guessVersion(C);

131
gerrit-server/src/main/java/com/google/gerrit/server/schema/Schema_125.java Normal file
View File

@@ -0,0 +1,131 @@
// Copyright (C) 2016 The Android Open Source Project
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package com.google.gerrit.server.schema;
import static com.google.gerrit.server.group.SystemGroupBackend.REGISTERED_USERS;
import static com.google.gerrit.server.schema.AclUtil.grant;
import com.google.gerrit.common.data.AccessSection;
import com.google.gerrit.common.data.GroupReference;
import com.google.gerrit.common.data.LabelType;
import com.google.gerrit.common.data.Permission;
import com.google.gerrit.reviewdb.client.Project;
import com.google.gerrit.reviewdb.client.RefNames;
import com.google.gerrit.reviewdb.server.ReviewDb;
import com.google.gerrit.server.GerritPersonIdent;
import com.google.gerrit.server.config.AllProjectsName;
import com.google.gerrit.server.config.AllUsersName;
import com.google.gerrit.server.extensions.events.GitReferenceUpdated;
import com.google.gerrit.server.git.GitRepositoryManager;
import com.google.gerrit.server.git.MetaDataUpdate;
import com.google.gerrit.server.git.ProjectConfig;
import com.google.gerrit.server.group.SystemGroupBackend;
import com.google.gerrit.server.project.RefPattern;
import com.google.gwtorm.server.OrmException;
import com.google.inject.Inject;
import com.google.inject.Provider;
import org.eclipse.jgit.errors.ConfigInvalidException;
import org.eclipse.jgit.lib.PersonIdent;
import org.eclipse.jgit.lib.Repository;
import java.io.IOException;
import java.util.Collection;
import java.util.HashMap;
import java.util.Map;
public class Schema_125 extends SchemaVersion {
private static final String COMMIT_MSG =
"Assign default permissions on user branches\n" +
"\n" +
"By default each user should be able to read and update the own user\n" +
"branch. Also the user should be able to approve and submit changes for\n" +
"the own user branch. Assign default permissions for this and remove the\n" +
"old exclusive read protection from the user branches.\n";
private final GitRepositoryManager repoManager;
private final AllUsersName allUsersName;
private final AllProjectsName allProjectsName;
private final PersonIdent serverUser;
@Inject
Schema_125(Provider<Schema_124> prior,
GitRepositoryManager repoManager,
AllUsersName allUsersName,
AllProjectsName allProjectsName,
@GerritPersonIdent PersonIdent serverUser) {
super(prior);
this.repoManager = repoManager;
this.allUsersName = allUsersName;
this.allProjectsName = allProjectsName;
this.serverUser = serverUser;
}
@Override
protected void migrateData(ReviewDb db, UpdateUI ui) throws OrmException {
try (Repository git = repoManager.openRepository(allUsersName);
MetaDataUpdate md = new MetaDataUpdate(GitReferenceUpdated.DISABLED,
allUsersName, git)) {
ProjectConfig config = ProjectConfig.read(md);
config.load(md);
config.getAccessSection(RefNames.REFS_USERS + "*", true)
.remove(new Permission(Permission.READ));
GroupReference registered = SystemGroupBackend.getGroup(REGISTERED_USERS);
AccessSection users = config.getAccessSection(
RefNames.REFS_USERS + "${" + RefPattern.USERID_SHARDED + "}", true);
grant(config, users, Permission.READ, true, registered);
grant(config, users, Permission.PUSH, true, registered);
grant(config, users, Permission.SUBMIT, true, registered);
for (LabelType lt : getLabelTypes(config)) {
if ("Code-Review".equals(lt.getName())
|| "Verified".equals(lt.getName())) {
grant(config, users, lt, lt.getMin().getValue(),
lt.getMax().getValue(), registered);
}
}
md.getCommitBuilder().setAuthor(serverUser);
md.getCommitBuilder().setCommitter(serverUser);
md.setMessage(COMMIT_MSG);
config.commit(md);
} catch (ConfigInvalidException | IOException ex) {
throw new OrmException(ex);
}
}
private Collection<LabelType> getLabelTypes(ProjectConfig config)
throws IOException, ConfigInvalidException {
Map<String, LabelType> labelTypes =
new HashMap<>(config.getLabelSections());
Project.NameKey parent = config.getProject().getParent(allProjectsName);
while (parent != null) {
try (Repository git = repoManager.openRepository(parent);
MetaDataUpdate md =
new MetaDataUpdate(GitReferenceUpdated.DISABLED, parent, git)) {
ProjectConfig parentConfig = ProjectConfig.read(md);
parentConfig.load(md);
for (LabelType lt : parentConfig.getLabelSections().values()) {
if (!labelTypes.containsKey(lt.getName())) {
labelTypes.put(lt.getName(), lt);
}
}
parent = parentConfig.getProject().getParent(allProjectsName);
}
}
return labelTypes.values();
}
}