Merge "Support retrieving project access rights via REST"
This commit is contained in:
David Pursehouse
376
Documentation/rest-api-access.txt
Normal file
376
Documentation/rest-api-access.txt
Normal file
@@ -0,0 +1,376 @@
|
||||
Gerrit Code Review - /access/ REST API
|
||||
======================================
|
||||
|
||||
This page describes the access rights related REST endpoints.
|
||||
Please also take note of the general information on the
|
||||
link:rest-api.html[REST API].
|
||||
|
||||
[[access-endpoints]]
|
||||
Access Rights Endpoints
|
||||
-----------------------
|
||||
|
||||
[[list-access]]
|
||||
List Access Rights
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
[verse]
|
||||
'GET /access/?project=link:rest-api-projects.html#project-name[\{project-name\}]'
|
||||
|
||||
Lists the access rights for projects. The projects for which the access
|
||||
rights should be returned must be specified as `project` options. The
|
||||
`project` can be specified multiple times.
|
||||
|
||||
As result a map is returned that maps the project name to
|
||||
link:#project-access-info[ProjectAccessInfo] entities.
|
||||
|
||||
The entries in the map are sorted by project name.
|
||||
|
||||
.Request
|
||||
----
|
||||
GET /access/?project=MyProject&project=All-Projects HTTP/1.0
|
||||
----
|
||||
|
||||
.Response
|
||||
----
|
||||
HTTP/1.1 200 OK
|
||||
Content-Type: application/json;charset=UTF-8
|
||||
|
||||
)]}'
|
||||
{
|
||||
"All-Projects": {
|
||||
"revision": "edd453d18e08640e67a8c9a150cec998ed0ac9aa",
|
||||
"local": {
|
||||
"GLOBAL_CAPABILITIES": {
|
||||
"permissions": {
|
||||
"priority": {
|
||||
"rules": {
|
||||
"15bfcd8a6de1a69c50b30cedcdcc951c15703152": {
|
||||
"action": "BATCH"
|
||||
}
|
||||
}
|
||||
},
|
||||
"streamEvents": {
|
||||
"rules": {
|
||||
"15bfcd8a6de1a69c50b30cedcdcc951c15703152": {
|
||||
"action": "ALLOW"
|
||||
}
|
||||
}
|
||||
},
|
||||
"administrateServer": {
|
||||
"rules": {
|
||||
"53a4f647a89ea57992571187d8025f830625192a": {
|
||||
"action": "ALLOW"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"refs/meta/config": {
|
||||
"permissions": {
|
||||
"submit": {
|
||||
"rules": {
|
||||
"53a4f647a89ea57992571187d8025f830625192a": {
|
||||
"action": "ALLOW"
|
||||
},
|
||||
"global:Project-Owners": {
|
||||
"action": "ALLOW"
|
||||
}
|
||||
}
|
||||
},
|
||||
"label-Code-Review": {
|
||||
"label": "Code-Review",
|
||||
"rules": {
|
||||
"53a4f647a89ea57992571187d8025f830625192a": {
|
||||
"action": "ALLOW",
|
||||
"min": -2,
|
||||
"max": 2
|
||||
},
|
||||
"global:Project-Owners": {
|
||||
"action": "ALLOW",
|
||||
"min": -2,
|
||||
"max": 2
|
||||
}
|
||||
}
|
||||
},
|
||||
"read": {
|
||||
"exclusive": true,
|
||||
"rules": {
|
||||
"53a4f647a89ea57992571187d8025f830625192a": {
|
||||
"action": "ALLOW"
|
||||
},
|
||||
"global:Project-Owners": {
|
||||
"action": "ALLOW"
|
||||
}
|
||||
}
|
||||
},
|
||||
"push": {
|
||||
"rules": {
|
||||
"53a4f647a89ea57992571187d8025f830625192a": {
|
||||
"action": "ALLOW"
|
||||
},
|
||||
"global:Project-Owners": {
|
||||
"action": "ALLOW"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"refs/for/refs/*": {
|
||||
"permissions": {
|
||||
"pushMerge": {
|
||||
"rules": {
|
||||
"global:Registered-Users": {
|
||||
"action": "ALLOW"
|
||||
}
|
||||
}
|
||||
},
|
||||
"push": {
|
||||
"rules": {
|
||||
"global:Registered-Users": {
|
||||
"action": "ALLOW"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"refs/tags/*": {
|
||||
"permissions": {
|
||||
"pushSignedTag": {
|
||||
"rules": {
|
||||
"53a4f647a89ea57992571187d8025f830625192a": {
|
||||
"action": "ALLOW"
|
||||
},
|
||||
"global:Project-Owners": {
|
||||
"action": "ALLOW"
|
||||
}
|
||||
}
|
||||
},
|
||||
"pushTag": {
|
||||
"rules": {
|
||||
"53a4f647a89ea57992571187d8025f830625192a": {
|
||||
"action": "ALLOW"
|
||||
},
|
||||
"global:Project-Owners": {
|
||||
"action": "ALLOW"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"refs/heads/*": {
|
||||
"permissions": {
|
||||
"forgeCommitter": {
|
||||
"rules": {
|
||||
"53a4f647a89ea57992571187d8025f830625192a": {
|
||||
"action": "ALLOW"
|
||||
},
|
||||
"global:Project-Owners": {
|
||||
"action": "ALLOW"
|
||||
}
|
||||
}
|
||||
},
|
||||
"forgeAuthor": {
|
||||
"rules": {
|
||||
"global:Registered-Users": {
|
||||
"action": "ALLOW"
|
||||
}
|
||||
}
|
||||
},
|
||||
"submit": {
|
||||
"rules": {
|
||||
"53a4f647a89ea57992571187d8025f830625192a": {
|
||||
"action": "ALLOW"
|
||||
},
|
||||
"global:Project-Owners": {
|
||||
"action": "ALLOW"
|
||||
}
|
||||
}
|
||||
},
|
||||
"editTopicName": {
|
||||
"rules": {
|
||||
"53a4f647a89ea57992571187d8025f830625192a": {
|
||||
"action": "ALLOW",
|
||||
"force": true
|
||||
},
|
||||
"global:Project-Owners": {
|
||||
"action": "ALLOW",
|
||||
"force": true
|
||||
}
|
||||
}
|
||||
},
|
||||
"label-Code-Review": {
|
||||
"label": "Code-Review",
|
||||
"rules": {
|
||||
"global:Registered-Users": {
|
||||
"action": "ALLOW",
|
||||
"min": -1,
|
||||
"max": 1
|
||||
},
|
||||
"53a4f647a89ea57992571187d8025f830625192a": {
|
||||
"action": "ALLOW",
|
||||
"min": -2,
|
||||
"max": 2
|
||||
},
|
||||
"global:Project-Owners": {
|
||||
"action": "ALLOW",
|
||||
"min": -2,
|
||||
"max": 2
|
||||
}
|
||||
}
|
||||
},
|
||||
"create": {
|
||||
"rules": {
|
||||
"53a4f647a89ea57992571187d8025f830625192a": {
|
||||
"action": "ALLOW"
|
||||
},
|
||||
"global:Project-Owners": {
|
||||
"action": "ALLOW"
|
||||
}
|
||||
}
|
||||
},
|
||||
"push": {
|
||||
"rules": {
|
||||
"53a4f647a89ea57992571187d8025f830625192a": {
|
||||
"action": "ALLOW"
|
||||
},
|
||||
"global:Project-Owners": {
|
||||
"action": "ALLOW"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"refs/*": {
|
||||
"permissions": {
|
||||
"read": {
|
||||
"rules": {
|
||||
"global:Anonymous-Users": {
|
||||
"action": "ALLOW"
|
||||
},
|
||||
"53a4f647a89ea57992571187d8025f830625192a": {
|
||||
"action": "ALLOW"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"owner_of": [
|
||||
"GLOBAL_CAPABILITIES",
|
||||
"refs/meta/config",
|
||||
"refs/for/refs/*",
|
||||
"refs/tags/*",
|
||||
"refs/heads/*",
|
||||
"refs/*"
|
||||
],
|
||||
"can_upload": true,
|
||||
"can_add": true,
|
||||
"config_visible": true
|
||||
},
|
||||
"MyProject": {
|
||||
"revision": "61157ed63e14d261b6dca40650472a9b0bd88474",
|
||||
"inherits_from": {
|
||||
"kind": "gerritcodereview#project",
|
||||
"id": "All-Projects",
|
||||
"name": "All-Projects",
|
||||
"description": "Access inherited by all other projects."
|
||||
},
|
||||
"local": {},
|
||||
"owner_of": [
|
||||
"refs/*"
|
||||
],
|
||||
"can_upload": true,
|
||||
"can_add": true,
|
||||
"config_visible": true
|
||||
}
|
||||
}
|
||||
----
|
||||
|
||||
[[access-section-info]]
|
||||
AccessSectionInfo
|
||||
~~~~~~~~~~~~~~~~~
|
||||
The `AccessSectionInfo` describes the access rights that are assigned
|
||||
on a ref.
|
||||
|
||||
[options="header",width="50%",cols="1,^1,5"]
|
||||
|==================================
|
||||
|Field Name ||Description
|
||||
|`permissions` ||
|
||||
The permissions assigned on the ref of this access section as a map
|
||||
that maps the permission names to link:#permission-info[PermissionInfo]
|
||||
entities.
|
||||
|==================================
|
||||
|
||||
[[permission-info]]
|
||||
PermissionInfo
|
||||
~~~~~~~~~~~~~~
|
||||
The `PermissionInfo` entity contains information about an assigned
|
||||
permission.
|
||||
|
||||
[options="header",width="50%",cols="1,^1,5"]
|
||||
|==================================
|
||||
|Field Name ||Description
|
||||
|`label` |optional|
|
||||
The name of the label. Not set if it's not a label permission.
|
||||
|`exclusive` |not set if `false`|
|
||||
Whether this permission is assigned exclusively.
|
||||
|`rules` ||
|
||||
The rules assigned for this permission as a map that maps the UUIDs of
|
||||
the groups for which the permission are assigned to
|
||||
link:#permission-info[PermissionRuleInfo] entities.
|
||||
|==================================
|
||||
|
||||
[[permission-rule-info]]
|
||||
PermissionRuleInfo
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
The `PermissionRuleInfo` entity contains information about a permission
|
||||
rule that is assigned to group.
|
||||
|
||||
[options="header",width="50%",cols="1,^1,5"]
|
||||
|==================================
|
||||
|Field Name ||Description
|
||||
|`action` ||
|
||||
The action of this rule. For normal permissions this can be `ALLOW`,
|
||||
`DENY` or `BLOCK`. Special values for global capabilities are
|
||||
`INTERACTIVE` and `BATCH`.
|
||||
|`force` |not set if `false`|
|
||||
Whether the force flag is set.
|
||||
|`min` |
|
||||
not set if range if empty (from `0` to `0`) or not set|
|
||||
The min value of the permission range.
|
||||
|`max` |
|
||||
not set if range if empty (from `0` to `0`) or not set|
|
||||
The max value of the permission range.
|
||||
|==================================
|
||||
|
||||
[[project-access-info]]
|
||||
ProjectAccessInfo
|
||||
~~~~~~~~~~~~~~~~~
|
||||
The `ProjectAccessInfo` entity contains information about the access
|
||||
rights for a project.
|
||||
|
||||
[options="header",width="50%",cols="1,^1,5"]
|
||||
|==================================
|
||||
|Field Name ||Description
|
||||
|`revision` ||
|
||||
The revision of the `refs/meta/config` branch from which the access
|
||||
rights were loaded.
|
||||
|`inherits_from` |not set for the `All-Project` project|
|
||||
The parent project from which permissions are inherited as a
|
||||
link:rest-api-projects.html#project-info[ProjectInfo] entity.
|
||||
|`local` ||
|
||||
The local access rights of the project as a map that maps the refs to
|
||||
link:#access-section-info[AccessSectionInfo] entities.
|
||||
|`owner_of` ||The list of refs owned by the calling user.
|
||||
|`can_upload` |not set if `false`|
|
||||
Whether the calling user can upload to any ref.
|
||||
|`can_add` |not set if `false`|
|
||||
Whether the calling user can add any ref.
|
||||
|`config_visible` |not set if `false`|
|
||||
Whether the calling user can see the `refs/meta/config` branch of the
|
||||
project.
|
||||
|==================================
|
||||
|
||||
|
||||
GERRIT
|
||||
------
|
||||
Part of link:index.html[Gerrit Code Review]
|
||||
@@ -9,6 +9,8 @@ See also: link:dev-rest-api.html[REST API Developers' Notes].
|
||||
|
||||
Endpoints
|
||||
---------
|
||||
link:rest-api-access.html[/access/]::
|
||||
Access Right related REST endpoints
|
||||
link:rest-api-accounts.html[/accounts/]::
|
||||
Account related REST endpoints
|
||||
link:rest-api-changes.html[/changes/]::
|
||||
|
||||
@@ -24,6 +24,7 @@ import com.google.gerrit.httpd.raw.LegacyGerritServlet;
|
||||
import com.google.gerrit.httpd.raw.SshInfoServlet;
|
||||
import com.google.gerrit.httpd.raw.StaticServlet;
|
||||
import com.google.gerrit.httpd.raw.ToolServlet;
|
||||
import com.google.gerrit.httpd.rpc.access.AccessRestApiServlet;
|
||||
import com.google.gerrit.httpd.rpc.account.AccountsRestApiServlet;
|
||||
import com.google.gerrit.httpd.rpc.change.ChangesRestApiServlet;
|
||||
import com.google.gerrit.httpd.rpc.change.DeprecatedChangeQueryServlet;
|
||||
@@ -101,6 +102,7 @@ class UrlModule extends ServletModule {
|
||||
|
||||
filter("/a/*").through(RequireIdentifiedUserFilter.class);
|
||||
serveRegex("^/(?:a/)?tools/(.*)$").with(ToolServlet.class);
|
||||
serveRegex("^/(?:a/)?access/(.*)$").with(AccessRestApiServlet.class);
|
||||
serveRegex("^/(?:a/)?accounts/(.*)$").with(AccountsRestApiServlet.class);
|
||||
serveRegex("^/(?:a/)?changes/(.*)$").with(ChangesRestApiServlet.class);
|
||||
serveRegex("^/(?:a/)?config/(.*)$").with(ConfigRestApiServlet.class);
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
// Copyright (C) 2013 The Android Open Source Project
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package com.google.gerrit.httpd.rpc.access;
|
||||
|
||||
import com.google.gerrit.httpd.restapi.RestApiServlet;
|
||||
import com.google.gerrit.server.access.AccessCollection;
|
||||
import com.google.inject.Inject;
|
||||
import com.google.inject.Provider;
|
||||
import com.google.inject.Singleton;
|
||||
|
||||
@Singleton
|
||||
public class AccessRestApiServlet extends RestApiServlet {
|
||||
private static final long serialVersionUID = 1L;
|
||||
|
||||
@Inject
|
||||
AccessRestApiServlet(RestApiServlet.Globals globals,
|
||||
Provider<AccessCollection> access) {
|
||||
super(globals, access);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,53 @@
|
||||
// Copyright (C) 2013 The Android Open Source Project
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package com.google.gerrit.server.access;
|
||||
|
||||
import com.google.gerrit.extensions.registration.DynamicMap;
|
||||
import com.google.gerrit.extensions.restapi.IdString;
|
||||
import com.google.gerrit.extensions.restapi.ResourceNotFoundException;
|
||||
import com.google.gerrit.extensions.restapi.RestCollection;
|
||||
import com.google.gerrit.extensions.restapi.RestView;
|
||||
import com.google.gerrit.extensions.restapi.TopLevelResource;
|
||||
import com.google.inject.Inject;
|
||||
import com.google.inject.Provider;
|
||||
|
||||
public class AccessCollection implements
|
||||
RestCollection<TopLevelResource, AccessResource> {
|
||||
private final Provider<ListAccess> list;
|
||||
private final DynamicMap<RestView<AccessResource>> views;
|
||||
|
||||
@Inject
|
||||
AccessCollection(Provider<ListAccess> list,
|
||||
DynamicMap<RestView<AccessResource>> views) {
|
||||
this.list = list;
|
||||
this.views = views;
|
||||
}
|
||||
|
||||
@Override
|
||||
public RestView<TopLevelResource> list() {
|
||||
return list.get();
|
||||
}
|
||||
|
||||
@Override
|
||||
public AccessResource parse(TopLevelResource parent, IdString id)
|
||||
throws ResourceNotFoundException {
|
||||
throw new ResourceNotFoundException(id);
|
||||
}
|
||||
|
||||
@Override
|
||||
public DynamicMap<RestView<AccessResource>> views() {
|
||||
return views;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,24 @@
|
||||
// Copyright (C) 2013 The Android Open Source Project
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package com.google.gerrit.server.access;
|
||||
|
||||
import com.google.gerrit.extensions.restapi.RestResource;
|
||||
import com.google.gerrit.extensions.restapi.RestView;
|
||||
import com.google.inject.TypeLiteral;
|
||||
|
||||
public class AccessResource implements RestResource {
|
||||
public static final TypeLiteral<RestView<AccessResource>> ACCESS_KIND =
|
||||
new TypeLiteral<RestView<AccessResource>>() {};
|
||||
}
|
||||
@@ -0,0 +1,306 @@
|
||||
// Copyright (C) 2013 The Android Open Source Project
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package com.google.gerrit.server.access;
|
||||
|
||||
import com.google.common.collect.Iterables;
|
||||
import com.google.common.collect.Lists;
|
||||
import com.google.common.collect.Maps;
|
||||
import com.google.common.collect.Sets;
|
||||
import com.google.gerrit.common.data.AccessSection;
|
||||
import com.google.gerrit.common.data.Permission;
|
||||
import com.google.gerrit.common.data.PermissionRule;
|
||||
import com.google.gerrit.common.data.RefConfigSection;
|
||||
import com.google.gerrit.common.errors.NoSuchGroupException;
|
||||
import com.google.gerrit.extensions.restapi.ResourceConflictException;
|
||||
import com.google.gerrit.extensions.restapi.ResourceNotFoundException;
|
||||
import com.google.gerrit.extensions.restapi.RestReadView;
|
||||
import com.google.gerrit.extensions.restapi.TopLevelResource;
|
||||
import com.google.gerrit.reviewdb.client.AccountGroup;
|
||||
import com.google.gerrit.reviewdb.client.Project;
|
||||
import com.google.gerrit.server.CurrentUser;
|
||||
import com.google.gerrit.server.account.GroupBackend;
|
||||
import com.google.gerrit.server.account.GroupControl;
|
||||
import com.google.gerrit.server.config.AllProjectsName;
|
||||
import com.google.gerrit.server.git.GitRepositoryManager;
|
||||
import com.google.gerrit.server.git.MetaDataUpdate;
|
||||
import com.google.gerrit.server.git.ProjectConfig;
|
||||
import com.google.gerrit.server.group.GroupJson;
|
||||
import com.google.gerrit.server.project.NoSuchProjectException;
|
||||
import com.google.gerrit.server.project.ProjectCache;
|
||||
import com.google.gerrit.server.project.ProjectControl;
|
||||
import com.google.gerrit.server.project.ProjectJson;
|
||||
import com.google.gerrit.server.project.ProjectJson.ProjectInfo;
|
||||
import com.google.gerrit.server.project.ProjectState;
|
||||
import com.google.gerrit.server.project.RefControl;
|
||||
import com.google.inject.Inject;
|
||||
import com.google.inject.Provider;
|
||||
|
||||
import org.eclipse.jgit.errors.ConfigInvalidException;
|
||||
import org.eclipse.jgit.errors.RepositoryNotFoundException;
|
||||
import org.kohsuke.args4j.Option;
|
||||
|
||||
import java.io.IOException;
|
||||
import java.util.HashMap;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.Set;
|
||||
|
||||
public class ListAccess implements RestReadView<TopLevelResource> {
|
||||
|
||||
@Option(name = "--project", aliases = {"-p"}, metaVar = "PROJECT",
|
||||
usage = "projects for which the access rights should be returned")
|
||||
private List<String> projects = Lists.newArrayList();
|
||||
|
||||
private final Provider<CurrentUser> self;
|
||||
private final ProjectControl.GenericFactory projectControlFactory;
|
||||
private final ProjectCache projectCache;
|
||||
private final ProjectJson projectJson;
|
||||
private final MetaDataUpdate.Server metaDataUpdateFactory;
|
||||
private final GroupControl.Factory groupControlFactory;
|
||||
private final GroupBackend groupBackend;
|
||||
private final AllProjectsName allProjectsName;
|
||||
|
||||
@Inject
|
||||
public ListAccess(Provider<CurrentUser> self,
|
||||
ProjectControl.GenericFactory projectControlFactory,
|
||||
ProjectCache projectCache, ProjectJson projectJson,
|
||||
MetaDataUpdate.Server metaDataUpdateFactory,
|
||||
GroupControl.Factory groupControlFactory, GroupBackend groupBackend,
|
||||
GroupJson groupJson, AllProjectsName allProjectsName) {
|
||||
this.self = self;
|
||||
this.projectControlFactory = projectControlFactory;
|
||||
this.projectCache = projectCache;
|
||||
this.projectJson = projectJson;
|
||||
this.metaDataUpdateFactory = metaDataUpdateFactory;
|
||||
this.groupControlFactory = groupControlFactory;
|
||||
this.groupBackend = groupBackend;
|
||||
this.allProjectsName = allProjectsName;
|
||||
}
|
||||
|
||||
@Override
|
||||
public Map<String, ProjectAccessInfo> apply(TopLevelResource resource)
|
||||
throws ResourceNotFoundException, ResourceConflictException, IOException {
|
||||
Map<String, ProjectAccessInfo> access = Maps.newTreeMap();
|
||||
for (String p: projects) {
|
||||
Project.NameKey projectName = new Project.NameKey(p);
|
||||
ProjectControl pc = open(projectName);
|
||||
ProjectConfig config;
|
||||
|
||||
try {
|
||||
// Load the current configuration from the repository, ensuring it's the most
|
||||
// recent version available. If it differs from what was in the project
|
||||
// state, force a cache flush now.
|
||||
//
|
||||
MetaDataUpdate md = metaDataUpdateFactory.create(projectName);
|
||||
try {
|
||||
config = ProjectConfig.read(md);
|
||||
|
||||
if (config.updateGroupNames(groupBackend)) {
|
||||
md.setMessage("Update group names\n");
|
||||
config.commit(md);
|
||||
projectCache.evict(config.getProject());
|
||||
pc = open(projectName);
|
||||
} else if (config.getRevision() != null
|
||||
&& !config.getRevision().equals(
|
||||
pc.getProjectState().getConfig().getRevision())) {
|
||||
projectCache.evict(config.getProject());
|
||||
pc = open(projectName);
|
||||
}
|
||||
} catch (ConfigInvalidException e) {
|
||||
throw new ResourceConflictException(e.getMessage());
|
||||
} finally {
|
||||
md.close();
|
||||
}
|
||||
} catch (RepositoryNotFoundException e) {
|
||||
throw new ResourceNotFoundException(p);
|
||||
}
|
||||
|
||||
access.put(p, new ProjectAccessInfo(pc, config));
|
||||
}
|
||||
return access;
|
||||
}
|
||||
|
||||
private ProjectControl open(Project.NameKey projectName)
|
||||
throws ResourceNotFoundException, IOException {
|
||||
try {
|
||||
return projectControlFactory.validateFor(projectName,
|
||||
ProjectControl.OWNER | ProjectControl.VISIBLE, self.get());
|
||||
} catch (NoSuchProjectException e) {
|
||||
throw new ResourceNotFoundException(projectName.get());
|
||||
}
|
||||
}
|
||||
|
||||
public class ProjectAccessInfo {
|
||||
public String revision;
|
||||
public ProjectInfo inheritsFrom;
|
||||
public Map<String, AccessSectionInfo> local;
|
||||
public Set<String> ownerOf;
|
||||
public Boolean canUpload;
|
||||
public Boolean canAdd;
|
||||
public Boolean configVisible;
|
||||
|
||||
public ProjectAccessInfo(ProjectControl pc, ProjectConfig config) {
|
||||
final RefControl metaConfigControl =
|
||||
pc.controlForRef(GitRepositoryManager.REF_CONFIG);
|
||||
local = Maps.newHashMap();
|
||||
ownerOf = Sets.newHashSet();
|
||||
Map<AccountGroup.UUID, Boolean> visibleGroups =
|
||||
new HashMap<AccountGroup.UUID, Boolean>();
|
||||
|
||||
for (AccessSection section : config.getAccessSections()) {
|
||||
String name = section.getName();
|
||||
if (AccessSection.GLOBAL_CAPABILITIES.equals(name)) {
|
||||
if (pc.isOwner()) {
|
||||
local.put(name, new AccessSectionInfo(section));
|
||||
ownerOf.add(name);
|
||||
|
||||
} else if (metaConfigControl.isVisible()) {
|
||||
local.put(section.getName(), new AccessSectionInfo(section));
|
||||
}
|
||||
|
||||
} else if (RefConfigSection.isValid(name)) {
|
||||
RefControl rc = pc.controlForRef(name);
|
||||
if (rc.isOwner()) {
|
||||
local.put(name, new AccessSectionInfo(section));
|
||||
ownerOf.add(name);
|
||||
|
||||
} else if (metaConfigControl.isVisible()) {
|
||||
local.put(name, new AccessSectionInfo(section));
|
||||
|
||||
} else if (rc.isVisible()) {
|
||||
// Filter the section to only add rules describing groups that
|
||||
// are visible to the current-user. This includes any group the
|
||||
// user is a member of, as well as groups they own or that
|
||||
// are visible to all users.
|
||||
|
||||
AccessSection dst = null;
|
||||
for (Permission srcPerm : section.getPermissions()) {
|
||||
Permission dstPerm = null;
|
||||
|
||||
for (PermissionRule srcRule : srcPerm.getRules()) {
|
||||
AccountGroup.UUID group = srcRule.getGroup().getUUID();
|
||||
if (group == null) {
|
||||
continue;
|
||||
}
|
||||
|
||||
Boolean canSeeGroup = visibleGroups.get(group);
|
||||
if (canSeeGroup == null) {
|
||||
try {
|
||||
canSeeGroup = groupControlFactory.controlFor(group).isVisible();
|
||||
} catch (NoSuchGroupException e) {
|
||||
canSeeGroup = Boolean.FALSE;
|
||||
}
|
||||
visibleGroups.put(group, canSeeGroup);
|
||||
}
|
||||
|
||||
if (canSeeGroup) {
|
||||
if (dstPerm == null) {
|
||||
if (dst == null) {
|
||||
dst = new AccessSection(name);
|
||||
local.put(name, new AccessSectionInfo(dst));
|
||||
}
|
||||
dstPerm = dst.getPermission(srcPerm.getName(), true);
|
||||
}
|
||||
dstPerm.add(srcRule);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (ownerOf.isEmpty() && pc.isOwnerAnyRef()) {
|
||||
// Special case: If the section list is empty, this project has no current
|
||||
// access control information. Rely on what ProjectControl determines
|
||||
// is ownership, which probably means falling back to site administrators.
|
||||
ownerOf.add(AccessSection.ALL);
|
||||
}
|
||||
|
||||
|
||||
if (config.getRevision() != null) {
|
||||
revision = config.getRevision().name();
|
||||
}
|
||||
|
||||
ProjectState parent =
|
||||
Iterables.getFirst(pc.getProjectState().parents(), null);
|
||||
if (parent != null) {
|
||||
inheritsFrom = projectJson.format(parent.getProject());
|
||||
}
|
||||
|
||||
if (pc.getProject().getNameKey().equals(allProjectsName)) {
|
||||
if (pc.isOwner()) {
|
||||
ownerOf.add(AccessSection.GLOBAL_CAPABILITIES);
|
||||
}
|
||||
}
|
||||
|
||||
canUpload = toBoolean(pc.isOwner()
|
||||
|| (metaConfigControl.isVisible() && metaConfigControl.canUpload()));
|
||||
canAdd = toBoolean(pc.canAddRefs());
|
||||
configVisible = pc.isOwner() || metaConfigControl.isVisible();
|
||||
}
|
||||
}
|
||||
|
||||
public class AccessSectionInfo {
|
||||
public Map<String, PermissionInfo> permissions;
|
||||
|
||||
public AccessSectionInfo(AccessSection section) {
|
||||
permissions = Maps.newHashMap();
|
||||
for (Permission p : section.getPermissions()) {
|
||||
permissions.put(p.getName(), new PermissionInfo(p));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public class PermissionInfo {
|
||||
public String label;
|
||||
public Boolean exclusive;
|
||||
public Map<String, PermissionRuleInfo> rules;
|
||||
|
||||
public PermissionInfo(Permission permission) {
|
||||
label = permission.getLabel();
|
||||
exclusive = toBoolean(permission.getExclusiveGroup());
|
||||
rules = Maps.newHashMap();
|
||||
for (PermissionRule r : permission.getRules()) {
|
||||
rules.put(r.getGroup().getUUID().get(), new PermissionRuleInfo(r));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public class PermissionRuleInfo {
|
||||
public PermissionRule.Action action;
|
||||
public Boolean force;
|
||||
public Integer min;
|
||||
public Integer max;
|
||||
|
||||
|
||||
public PermissionRuleInfo(PermissionRule rule) {
|
||||
action = rule.getAction();
|
||||
force = toBoolean(rule.getForce());
|
||||
if (hasRange(rule)) {
|
||||
min = rule.getMin();
|
||||
max = rule.getMax();
|
||||
}
|
||||
}
|
||||
|
||||
private boolean hasRange(PermissionRule rule) {
|
||||
return (!(rule.getMin() == null || rule.getMin() == 0))
|
||||
|| (!(rule.getMax() == null || rule.getMax() == 0));
|
||||
}
|
||||
}
|
||||
|
||||
private static Boolean toBoolean(boolean value) {
|
||||
return value ? true : null;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,29 @@
|
||||
// Copyright (C) 2013 The Android Open Source Project
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package com.google.gerrit.server.access;
|
||||
|
||||
import static com.google.gerrit.server.access.AccessResource.ACCESS_KIND;
|
||||
|
||||
import com.google.gerrit.extensions.registration.DynamicMap;
|
||||
import com.google.gerrit.extensions.restapi.RestApiModule;
|
||||
|
||||
public class Module extends RestApiModule {
|
||||
@Override
|
||||
protected void configure() {
|
||||
bind(AccessCollection.class);
|
||||
|
||||
DynamicMap.mapOf(binder(), ACCESS_KIND);
|
||||
}
|
||||
}
|
||||
@@ -238,6 +238,7 @@ public class GerritGlobalModule extends FactoryModule {
|
||||
bind(AccountControl.Factory.class);
|
||||
|
||||
install(new AuditModule());
|
||||
install(new com.google.gerrit.server.access.Module());
|
||||
install(new com.google.gerrit.server.account.Module());
|
||||
install(new com.google.gerrit.server.change.Module());
|
||||
install(new com.google.gerrit.server.config.Module());
|
||||
|
||||
@@ -70,6 +70,18 @@ public class ProjectControl {
|
||||
}
|
||||
return p.controlFor(user);
|
||||
}
|
||||
|
||||
public ProjectControl validateFor(Project.NameKey nameKey, int need,
|
||||
CurrentUser user) throws NoSuchProjectException, IOException {
|
||||
final ProjectControl c = controlFor(nameKey, user);
|
||||
if ((need & VISIBLE) == VISIBLE && c.isVisible()) {
|
||||
return c;
|
||||
}
|
||||
if ((need & OWNER) == OWNER && c.isOwner()) {
|
||||
return c;
|
||||
}
|
||||
throw new NoSuchProjectException(nameKey);
|
||||
}
|
||||
}
|
||||
|
||||
public static class Factory {
|
||||
|
||||
Reference in New Issue
Block a user