author | Elifarley Callado Coelho Cruz <elifarley@gmail.com> |
Tue, 04 May 2010 08:37:20 -0300 | |
changeset 11092 | 2dd91779eb27 |
parent 11058 | f6dcbeb5babe |
child 11094 | c7adea82d495 |
permissions | -rw-r--r-- |
2344
ae12e5a2c4a3
add acl extension, to limit who can push to subdirs of central repo.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff
changeset
|
1 |
# acl.py - changeset access control for mercurial |
ae12e5a2c4a3
add acl extension, to limit who can push to subdirs of central repo.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff
changeset
|
2 |
# |
ae12e5a2c4a3
add acl extension, to limit who can push to subdirs of central repo.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff
changeset
|
3 |
# Copyright 2006 Vadim Gelfer <vadim.gelfer@gmail.com> |
ae12e5a2c4a3
add acl extension, to limit who can push to subdirs of central repo.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff
changeset
|
4 |
# |
8225
46293a0c7e9f
updated license to be explicit about GPL version 2
Martin Geisler <mg@lazybytes.net>
parents:
8142
diff
changeset
|
5 |
# This software may be used and distributed according to the terms of the |
10263 | 6 |
# GNU General Public License version 2 or any later version. |
8873
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
7 |
|
8935
f4f0e902b750
extensions: change descriptions for hook-providing extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8894
diff
changeset
|
8 |
'''hooks for controlling repository access |
8873
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
9 |
|
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
10 |
This hook makes it possible to allow or deny write access to given branches and |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
11 |
paths of a repository when receiving incoming changesets via pretxnchangegroup |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
12 |
and pretxncommit. |
9250
00986b9ed649
acl: wrap docstrings at 70 characters
Martin Geisler <mg@lazybytes.net>
parents:
9201
diff
changeset
|
13 |
|
00986b9ed649
acl: wrap docstrings at 70 characters
Martin Geisler <mg@lazybytes.net>
parents:
9201
diff
changeset
|
14 |
The authorization is matched based on the local user name on the |
00986b9ed649
acl: wrap docstrings at 70 characters
Martin Geisler <mg@lazybytes.net>
parents:
9201
diff
changeset
|
15 |
system where the hook runs, and not the committer of the original |
00986b9ed649
acl: wrap docstrings at 70 characters
Martin Geisler <mg@lazybytes.net>
parents:
9201
diff
changeset
|
16 |
changeset (since the latter is merely informative). |
8873
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
17 |
|
9250
00986b9ed649
acl: wrap docstrings at 70 characters
Martin Geisler <mg@lazybytes.net>
parents:
9201
diff
changeset
|
18 |
The acl hook is best used along with a restricted shell like hgsh, |
00986b9ed649
acl: wrap docstrings at 70 characters
Martin Geisler <mg@lazybytes.net>
parents:
9201
diff
changeset
|
19 |
preventing authenticating users from doing anything other than |
00986b9ed649
acl: wrap docstrings at 70 characters
Martin Geisler <mg@lazybytes.net>
parents:
9201
diff
changeset
|
20 |
pushing or pulling. The hook is not safe to use if users have |
00986b9ed649
acl: wrap docstrings at 70 characters
Martin Geisler <mg@lazybytes.net>
parents:
9201
diff
changeset
|
21 |
interactive shell access, as they can then disable the hook. |
00986b9ed649
acl: wrap docstrings at 70 characters
Martin Geisler <mg@lazybytes.net>
parents:
9201
diff
changeset
|
22 |
Nor is it safe if remote users share an account, because then there |
00986b9ed649
acl: wrap docstrings at 70 characters
Martin Geisler <mg@lazybytes.net>
parents:
9201
diff
changeset
|
23 |
is no way to distinguish them. |
8873
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
24 |
|
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
25 |
The order in which access checks are performed is: |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
26 |
1) Deny list for branches (section [acl.deny.branches]) |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
27 |
2) Allow list for branches (section [acl.allow.branches]) |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
28 |
3) Deny list for paths (section [acl.deny]) |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
29 |
4) Allow list for paths (section [acl.allow]) |
11042
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
30 |
|
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
31 |
The allow and deny sections take key-value pairs. |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
32 |
|
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
33 |
--- Branch-based Access Control --- |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
34 |
|
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
35 |
Use the [acl.deny.branches] and [acl.allow.branches] sections to have |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
36 |
branch-based access control. |
11057
7f0796a0b35c
acl: fix ReST syntax in docstring
Martin Geisler <mg@lazybytes.net>
parents:
11042
diff
changeset
|
37 |
|
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
38 |
Keys in these sections can be either: |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
39 |
1) a branch name |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
40 |
2) an asterisk, to match any branch; |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
41 |
|
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
42 |
The corresponding values can be either: |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
43 |
1) a comma-separated list containing users and groups. |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
44 |
2) an asterisk, to match anyone; |
11042
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
45 |
|
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
46 |
--- Path-based Access Control --- |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
47 |
|
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
48 |
Use the [acl.deny] and [acl.allow] sections to have path-based access control. |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
49 |
Keys in these sections accept a subtree pattern (with a glob syntax by default). |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
50 |
The corresponding values follow the same syntax as the other sections above. |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
51 |
|
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
52 |
--- Groups --- |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
53 |
|
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
54 |
Group names must be prefixed with an @ symbol. |
11042
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
55 |
Specifying a group name has the same effect as specifying all the users in |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
56 |
that group. |
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
57 |
The set of users for a group is taken from "grp.getgrnam" |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
58 |
(see http://docs.python.org/library/grp.html#grp.getgrnam). |
8873
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
59 |
|
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
60 |
--- Example Configuration --- |
8873
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
61 |
|
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
62 |
[hooks] |
11042
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
63 |
|
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
64 |
# Use this if you want to check access restrictions at commit time |
11042
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
65 |
pretxncommit.acl = python:hgext.acl.hook |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
66 |
|
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
67 |
# Use this if you want to check access restrictions for pull, push, bundle |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
68 |
# and serve. |
8873
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
69 |
pretxnchangegroup.acl = python:hgext.acl.hook |
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
70 |
|
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
71 |
[acl] |
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
72 |
# Check whether the source of incoming changes is in this list |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
73 |
# ("serve" == ssh or http, "push", "pull", "bundle") |
8893 | 74 |
sources = serve |
8873
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
75 |
|
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
76 |
[acl.deny.branches] |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
77 |
|
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
78 |
# Everyone is denied to the frozen branch: |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
79 |
frozen-branch = * |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
80 |
|
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
81 |
# A bad user is denied on all branches: |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
82 |
* = bad-user |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
83 |
|
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
84 |
[acl.allow.branches] |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
85 |
|
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
86 |
# A few users are allowed on branch-a: |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
87 |
branch-a = user-1, user-2, user-3 |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
88 |
|
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
89 |
# Only one user is allowed on branch-b: |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
90 |
branch-b = user-1 |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
91 |
|
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
92 |
# The super user is allowed on any branch: |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
93 |
* = super-user |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
94 |
|
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
95 |
# Everyone is allowed on branch-for-tests: |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
96 |
branch-for-tests = * |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
97 |
|
11042
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
98 |
[acl.deny] |
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
99 |
# If a match is found, "acl.allow" will not be checked. |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
100 |
# if acl.deny is not present, no users denied by default |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
101 |
# empty acl.deny = all users allowed |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
102 |
# Format for both lists: glob pattern = user4, user5, @group1 |
11042
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
103 |
|
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
104 |
# To match everyone, use an asterisk for the user: |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
105 |
# my/glob/pattern = * |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
106 |
|
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
107 |
# user6 will not have write access to any file: |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
108 |
** = user6 |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
109 |
|
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
110 |
# Group "hg-denied" will not have write access to any file: |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
111 |
** = @hg-denied |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
112 |
|
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
113 |
# Nobody will be able to change "DONT-TOUCH-THIS.txt", despite everyone being |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
114 |
# able to change all other files. See below. |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
115 |
src/main/resources/DONT-TOUCH-THIS.txt = * |
8873
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
116 |
|
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
117 |
[acl.allow] |
11042
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
118 |
# if acl.allow not present, all users allowed by default |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
119 |
# empty acl.allow = no users allowed |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
120 |
|
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
121 |
# User "doc_writer" has write access to any file under the "docs" folder: |
8873
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
122 |
docs/** = doc_writer |
11042
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
123 |
|
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
124 |
# User "jack" and group "designers" have write access to any file under the |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
125 |
# "images" folder: |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
126 |
images/** = jack, @designers |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
127 |
|
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
128 |
# Everyone (except for "user6" - see "acl.deny" above) will have write access |
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
129 |
to any file under the "resources" folder (except for 1 file. See "acl.deny"): |
11042
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
130 |
src/main/resources/** = * |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
131 |
|
8873
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
132 |
.hgtags = release_engineer |
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
133 |
|
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
134 |
''' |
2344
ae12e5a2c4a3
add acl extension, to limit who can push to subdirs of central repo.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff
changeset
|
135 |
|
3891 | 136 |
from mercurial.i18n import _ |
8566
744d6322b05b
match: change all users of util.matcher to match.match
Matt Mackall <mpm@selenic.com>
parents:
8225
diff
changeset
|
137 |
from mercurial import util, match |
11041
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
138 |
import getpass, urllib, grp |
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
139 |
|
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
140 |
def _getusers(group): |
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
141 |
return grp.getgrnam(group).gr_mem |
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
142 |
|
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
143 |
def _usermatch(user, usersorgroups): |
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
144 |
|
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
145 |
if usersorgroups == '*': |
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
146 |
return True |
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
147 |
|
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
148 |
for ug in usersorgroups.replace(',', ' ').split(): |
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
149 |
if user == ug or ug.find('@') == 0 and user in _getusers(ug[1:]): |
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
150 |
return True |
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
151 |
|
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
152 |
return False |
2344
ae12e5a2c4a3
add acl extension, to limit who can push to subdirs of central repo.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff
changeset
|
153 |
|
6766 | 154 |
def buildmatch(ui, repo, user, key): |
155 |
'''return tuple of (match function, list enabled).''' |
|
156 |
if not ui.has_section(key): |
|
9467
4c041f1ee1b4
do not attempt to translate ui.debug output
Martin Geisler <mg@lazybytes.net>
parents:
9250
diff
changeset
|
157 |
ui.debug('acl: %s not enabled\n' % key) |
6766 | 158 |
return None |
2344
ae12e5a2c4a3
add acl extension, to limit who can push to subdirs of central repo.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff
changeset
|
159 |
|
6766 | 160 |
pats = [pat for pat, users in ui.configitems(key) |
11041
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
161 |
if _usermatch(user, users)] |
9467
4c041f1ee1b4
do not attempt to translate ui.debug output
Martin Geisler <mg@lazybytes.net>
parents:
9250
diff
changeset
|
162 |
ui.debug('acl: %s enabled, %d entries for user %s\n' % |
6766 | 163 |
(key, len(pats), user)) |
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
164 |
|
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
165 |
if not repo: |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
166 |
if pats: |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
167 |
return lambda b: '*' in pats or b in pats |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
168 |
return lambda b: False |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
169 |
|
6766 | 170 |
if pats: |
8567
fea40a677d43
match: add some default args
Matt Mackall <mpm@selenic.com>
parents:
8566
diff
changeset
|
171 |
return match.match(repo.root, '', pats) |
8682 | 172 |
return match.exact(repo.root, '', []) |
8566
744d6322b05b
match: change all users of util.matcher to match.match
Matt Mackall <mpm@selenic.com>
parents:
8225
diff
changeset
|
173 |
|
2344
ae12e5a2c4a3
add acl extension, to limit who can push to subdirs of central repo.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff
changeset
|
174 |
|
ae12e5a2c4a3
add acl extension, to limit who can push to subdirs of central repo.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff
changeset
|
175 |
def hook(ui, repo, hooktype, node=None, source=None, **kwargs): |
10955
470a6ace7574
Added support for 'pretxncommit', so that one can call the ACL hook at
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10801
diff
changeset
|
176 |
if hooktype not in ['pretxnchangegroup', 'pretxncommit']: |
2344
ae12e5a2c4a3
add acl extension, to limit who can push to subdirs of central repo.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff
changeset
|
177 |
raise util.Abort(_('config error - hook type "%s" cannot stop ' |
10955
470a6ace7574
Added support for 'pretxncommit', so that one can call the ACL hook at
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10801
diff
changeset
|
178 |
'incoming changesets nor commits') % hooktype) |
470a6ace7574
Added support for 'pretxncommit', so that one can call the ACL hook at
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10801
diff
changeset
|
179 |
if (hooktype == 'pretxnchangegroup' and |
470a6ace7574
Added support for 'pretxncommit', so that one can call the ACL hook at
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10801
diff
changeset
|
180 |
source not in ui.config('acl', 'sources', 'serve').split()): |
9467
4c041f1ee1b4
do not attempt to translate ui.debug output
Martin Geisler <mg@lazybytes.net>
parents:
9250
diff
changeset
|
181 |
ui.debug('acl: changes have source "%s" - skipping\n' % source) |
2344
ae12e5a2c4a3
add acl extension, to limit who can push to subdirs of central repo.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff
changeset
|
182 |
return |
ae12e5a2c4a3
add acl extension, to limit who can push to subdirs of central repo.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff
changeset
|
183 |
|
8846
b30775386d40
acl: support for getting authenticated user from web server (issue298)
Henrik Stuart <hg@hstuart.dk>
parents:
8682
diff
changeset
|
184 |
user = None |
b30775386d40
acl: support for getting authenticated user from web server (issue298)
Henrik Stuart <hg@hstuart.dk>
parents:
8682
diff
changeset
|
185 |
if source == 'serve' and 'url' in kwargs: |
b30775386d40
acl: support for getting authenticated user from web server (issue298)
Henrik Stuart <hg@hstuart.dk>
parents:
8682
diff
changeset
|
186 |
url = kwargs['url'].split(':') |
b30775386d40
acl: support for getting authenticated user from web server (issue298)
Henrik Stuart <hg@hstuart.dk>
parents:
8682
diff
changeset
|
187 |
if url[0] == 'remote' and url[1].startswith('http'): |
9018
5ed463d0ebdb
acl: read correct index into url for username (issue298)
Henrik Stuart <hg@hstuart.dk>
parents:
8935
diff
changeset
|
188 |
user = urllib.unquote(url[3]) |
8846
b30775386d40
acl: support for getting authenticated user from web server (issue298)
Henrik Stuart <hg@hstuart.dk>
parents:
8682
diff
changeset
|
189 |
|
b30775386d40
acl: support for getting authenticated user from web server (issue298)
Henrik Stuart <hg@hstuart.dk>
parents:
8682
diff
changeset
|
190 |
if user is None: |
b30775386d40
acl: support for getting authenticated user from web server (issue298)
Henrik Stuart <hg@hstuart.dk>
parents:
8682
diff
changeset
|
191 |
user = getpass.getuser() |
b30775386d40
acl: support for getting authenticated user from web server (issue298)
Henrik Stuart <hg@hstuart.dk>
parents:
8682
diff
changeset
|
192 |
|
6766 | 193 |
cfg = ui.config('acl', 'config') |
194 |
if cfg: |
|
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
195 |
ui.readconfig(cfg, sections = ['acl.allow.branches', |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
196 |
'acl.deny.branches', 'acl.allow', 'acl.deny']) |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
197 |
|
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
198 |
allowbranches = buildmatch(ui, None, user, 'acl.allow.branches') |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
199 |
denybranches = buildmatch(ui, None, user, 'acl.deny.branches') |
6766 | 200 |
allow = buildmatch(ui, repo, user, 'acl.allow') |
201 |
deny = buildmatch(ui, repo, user, 'acl.deny') |
|
202 |
||
203 |
for rev in xrange(repo[node], len(repo)): |
|
204 |
ctx = repo[rev] |
|
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
205 |
branch = ctx.branch() |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
206 |
if denybranches and denybranches(branch): |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
207 |
raise util.Abort(_('acl: user "%s" denied on branch "%s"' |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
208 |
' (changeset "%s")') |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
209 |
% (user, branch, ctx)) |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
210 |
if allowbranches and not allowbranches(branch): |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
211 |
raise util.Abort(_('acl: user "%s" not allowed on branch "%s"' |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
212 |
' (changeset "%s")') |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
213 |
% (user, branch, ctx)) |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
214 |
ui.debug('acl: branch access granted: "%s" on branch "%s"\n' |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
215 |
% (ctx, branch)) |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
216 |
|
6766 | 217 |
for f in ctx.files(): |
218 |
if deny and deny(f): |
|
9467
4c041f1ee1b4
do not attempt to translate ui.debug output
Martin Geisler <mg@lazybytes.net>
parents:
9250
diff
changeset
|
219 |
ui.debug('acl: user %s denied on %s\n' % (user, f)) |
6766 | 220 |
raise util.Abort(_('acl: access denied for changeset %s') % ctx) |
221 |
if allow and not allow(f): |
|
9467
4c041f1ee1b4
do not attempt to translate ui.debug output
Martin Geisler <mg@lazybytes.net>
parents:
9250
diff
changeset
|
222 |
ui.debug('acl: user %s not allowed on %s\n' % (user, f)) |
6766 | 223 |
raise util.Abort(_('acl: access denied for changeset %s') % ctx) |
9467
4c041f1ee1b4
do not attempt to translate ui.debug output
Martin Geisler <mg@lazybytes.net>
parents:
9250
diff
changeset
|
224 |
ui.debug('acl: allowing changeset %s\n' % ctx) |