AllProjectsCreator: Allow admins and owners to create refs/meta/config

Nowadays when a project is created in Gerrit it always has a
refs/meta/config branch, but the refs/meta/config branch may be
missing for imported projects. In this case it is good if the Gerrit
administrators and the project owners can just create the missing
refs/meta/config branch.

Add a schema migration that grants the 'Create Reference' access right
on refs/meta/config to all administrator groups and project owners in
All-Projects.

Also old projects may miss the refs/meta/config branch and having this
'Create Reference' permission on refs/meta/config assigned makes it
easy to add the missing refs/meta/config branch for these projects.

Change-Id: I634bd21189196b479eb6d4b578d684bc9b54d49c
Signed-off-by: Edwin Kempin <ekempin@google.com>

gerrit-server/src/main/java/com/google/gerrit/server/schema/AllProjectsCreator.java

@@ -175,6 +175,7 @@ public class AllProjectsCreator {
       meta.getPermission(Permission.READ, true).setExclusiveGroup(true);
       grant(config, meta, Permission.READ, admin, owners);
       grant(config, meta, cr, -2, 2, admin, owners);
+      grant(config, meta, Permission.CREATE, admin, owners);
       grant(config, meta, Permission.PUSH, admin, owners);
       grant(config, meta, Permission.SUBMIT, admin, owners);
 

gerrit-server/src/main/java/com/google/gerrit/server/schema/SchemaVersion.java

@@ -33,7 +33,7 @@ import java.util.List;
 /** A version of the database schema. */
 public abstract class SchemaVersion {
   /** The current schema version. */
-  public static final Class<Schema_134> C = Schema_134.class;
+  public static final Class<Schema_135> C = Schema_135.class;
 
   public static int getBinaryVersion() {
     return guessVersion(C);

gerrit-server/src/main/java/com/google/gerrit/server/schema/Schema_135.java

@@ -0,0 +1,101 @@
+// Copyright (C) 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.server.schema;
+
+import static com.google.gerrit.server.group.SystemGroupBackend.PROJECT_OWNERS;
+import static java.util.stream.Collectors.toSet;
+
+import com.google.gerrit.common.data.AccessSection;
+import com.google.gerrit.common.data.GlobalCapability;
+import com.google.gerrit.common.data.GroupReference;
+import com.google.gerrit.common.data.Permission;
+import com.google.gerrit.common.data.PermissionRule;
+import com.google.gerrit.reviewdb.client.RefNames;
+import com.google.gerrit.reviewdb.server.ReviewDb;
+import com.google.gerrit.server.GerritPersonIdent;
+import com.google.gerrit.server.config.AllProjectsName;
+import com.google.gerrit.server.extensions.events.GitReferenceUpdated;
+import com.google.gerrit.server.git.GitRepositoryManager;
+import com.google.gerrit.server.git.MetaDataUpdate;
+import com.google.gerrit.server.git.ProjectConfig;
+import com.google.gerrit.server.group.SystemGroupBackend;
+import com.google.gwtorm.server.OrmException;
+import com.google.inject.Inject;
+import com.google.inject.Provider;
+
+import org.eclipse.jgit.errors.ConfigInvalidException;
+import org.eclipse.jgit.lib.PersonIdent;
+import org.eclipse.jgit.lib.Repository;
+
+import java.io.IOException;
+import java.util.Set;
+import java.util.stream.Stream;
+
+public class Schema_135 extends SchemaVersion {
+  private static final String COMMIT_MSG =
+      "Allow admins and project owners to create refs/meta/config";
+
+  private final GitRepositoryManager repoManager;
+  private final AllProjectsName allProjectsName;
+  private final PersonIdent serverUser;
+
+  @Inject
+  Schema_135(Provider<Schema_134> prior,
+      GitRepositoryManager repoManager,
+      AllProjectsName allProjectsName,
+      @GerritPersonIdent PersonIdent serverUser) {
+    super(prior);
+    this.repoManager = repoManager;
+    this.allProjectsName = allProjectsName;
+    this.serverUser = serverUser;
+  }
+
+  @Override
+  protected void migrateData(ReviewDb db, UpdateUI ui) throws OrmException {
+    try (Repository git = repoManager.openRepository(allProjectsName);
+        MetaDataUpdate md = new MetaDataUpdate(GitReferenceUpdated.DISABLED,
+            allProjectsName, git)) {
+      ProjectConfig config = ProjectConfig.read(md);
+
+      AccessSection meta = config.getAccessSection(RefNames.REFS_CONFIG, true);
+      Permission createRefsMetaConfigPermission =
+          meta.getPermission(Permission.CREATE, true);
+
+      Set<GroupReference> groups =
+          Stream.concat(
+                  config
+                      .getAccessSection(AccessSection.GLOBAL_CAPABILITIES, true)
+                      .getPermission(GlobalCapability.ADMINISTRATE_SERVER, true)
+                      .getRules()
+                      .stream()
+                      .map(PermissionRule::getGroup),
+                  Stream.of(SystemGroupBackend.getGroup(PROJECT_OWNERS)))
+              .filter(g -> createRefsMetaConfigPermission.getRule(g) == null)
+              .collect(toSet());
+
+      for (GroupReference group : groups) {
+        createRefsMetaConfigPermission
+            .add(new PermissionRule(config.resolve(group)));
+      }
+
+      md.getCommitBuilder().setAuthor(serverUser);
+      md.getCommitBuilder().setCommitter(serverUser);
+      md.setMessage(COMMIT_MSG);
+      config.commit(md);
+    } catch (ConfigInvalidException | IOException ex) {
+      throw new OrmException(ex);
+    }
+  }
+}