Mercurial > hg-stable
annotate hgext/acl.py @ 11115:b3d5619f1f2b
acl: update docstring to describe section [acl.groups]
author | Elifarley Callado Coelho Cruz <elifarley@gmail.com> |
---|---|
date | Thu, 06 May 2010 15:14:40 -0300 |
parents | 62714143742f |
children | 0b6fd18ab8af |
rev | line source |
---|---|
2344
ae12e5a2c4a3
add acl extension, to limit who can push to subdirs of central repo.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff
changeset
|
1 # acl.py - changeset access control for mercurial |
ae12e5a2c4a3
add acl extension, to limit who can push to subdirs of central repo.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff
changeset
|
2 # |
ae12e5a2c4a3
add acl extension, to limit who can push to subdirs of central repo.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff
changeset
|
3 # Copyright 2006 Vadim Gelfer <vadim.gelfer@gmail.com> |
ae12e5a2c4a3
add acl extension, to limit who can push to subdirs of central repo.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff
changeset
|
4 # |
8225
46293a0c7e9f
updated license to be explicit about GPL version 2
Martin Geisler <mg@lazybytes.net>
parents:
8142
diff
changeset
|
5 # This software may be used and distributed according to the terms of the |
10263 | 6 # GNU General Public License version 2 or any later version. |
8873
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
7 |
8935
f4f0e902b750
extensions: change descriptions for hook-providing extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8894
diff
changeset
|
8 '''hooks for controlling repository access |
8873
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
9 |
11095
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
10 This hook makes it possible to allow or deny write access to given |
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
11 branches and paths of a repository when receiving incoming changesets |
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
12 via pretxnchangegroup and pretxncommit. |
9250
00986b9ed649
acl: wrap docstrings at 70 characters
Martin Geisler <mg@lazybytes.net>
parents:
9201
diff
changeset
|
13 |
00986b9ed649
acl: wrap docstrings at 70 characters
Martin Geisler <mg@lazybytes.net>
parents:
9201
diff
changeset
|
14 The authorization is matched based on the local user name on the |
00986b9ed649
acl: wrap docstrings at 70 characters
Martin Geisler <mg@lazybytes.net>
parents:
9201
diff
changeset
|
15 system where the hook runs, and not the committer of the original |
00986b9ed649
acl: wrap docstrings at 70 characters
Martin Geisler <mg@lazybytes.net>
parents:
9201
diff
changeset
|
16 changeset (since the latter is merely informative). |
8873
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
17 |
9250
00986b9ed649
acl: wrap docstrings at 70 characters
Martin Geisler <mg@lazybytes.net>
parents:
9201
diff
changeset
|
18 The acl hook is best used along with a restricted shell like hgsh, |
11095
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
19 preventing authenticating users from doing anything other than pushing |
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
20 or pulling. The hook is not safe to use if users have interactive |
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
21 shell access, as they can then disable the hook. Nor is it safe if |
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
22 remote users share an account, because then there is no way to |
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
23 distinguish them. |
8873
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
24 |
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
25 The order in which access checks are performed is: |
11094 | 26 |
27 1) Deny list for branches (section ``acl.deny.branches``) | |
28 2) Allow list for branches (section ``acl.allow.branches``) | |
29 3) Deny list for paths (section ``acl.deny``) | |
30 4) Allow list for paths (section ``acl.allow``) | |
11042
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
31 |
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
32 The allow and deny sections take key-value pairs. |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
33 |
11094 | 34 Branch-based Access Control |
35 --------------------------- | |
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
36 |
11095
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
37 Use the ``acl.deny.branches`` and ``acl.allow.branches`` sections to |
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
38 have branch-based access control. Keys in these sections can be |
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
39 either: |
11057
7f0796a0b35c
acl: fix ReST syntax in docstring
Martin Geisler <mg@lazybytes.net>
parents:
11042
diff
changeset
|
40 |
11095
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
41 - a branch name, or |
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
42 - an asterisk, to match any branch; |
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
43 |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
44 The corresponding values can be either: |
11094 | 45 |
11095
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
46 - a comma-separated list containing users and groups, or |
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
47 - an asterisk, to match anyone; |
11042
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
48 |
11094 | 49 Path-based Access Control |
50 ------------------------- | |
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
51 |
11095
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
52 Use the ``acl.deny`` and ``acl.allow`` sections to have path-based |
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
53 access control. Keys in these sections accept a subtree pattern (with |
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
54 a glob syntax by default). The corresponding values follow the same |
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
55 syntax as the other sections above. |
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
56 |
11094 | 57 Groups |
58 ------ | |
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
59 |
11095
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
60 Group names must be prefixed with an ``@`` symbol. Specifying a group |
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
61 name has the same effect as specifying all the users in that group. |
8873
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
62 |
11115
b3d5619f1f2b
acl: update docstring to describe section [acl.groups]
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11114
diff
changeset
|
63 You can define group members in the ``acl.groups`` section. |
b3d5619f1f2b
acl: update docstring to describe section [acl.groups]
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11114
diff
changeset
|
64 If a group name is not defined there, and Mercurial is running under |
b3d5619f1f2b
acl: update docstring to describe section [acl.groups]
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11114
diff
changeset
|
65 a Unix-like system, the list of users will be taken from the OS. |
b3d5619f1f2b
acl: update docstring to describe section [acl.groups]
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11114
diff
changeset
|
66 Otherwise, an exception will be raised. |
b3d5619f1f2b
acl: update docstring to describe section [acl.groups]
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11114
diff
changeset
|
67 |
11094 | 68 Example Configuration |
69 --------------------- | |
70 | |
71 :: | |
8873
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
72 |
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
73 [hooks] |
11042
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
74 |
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
75 # Use this if you want to check access restrictions at commit time |
11042
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
76 pretxncommit.acl = python:hgext.acl.hook |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
77 |
11095
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
78 # Use this if you want to check access restrictions for pull, push, |
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
79 # bundle and serve. |
8873
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
80 pretxnchangegroup.acl = python:hgext.acl.hook |
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
81 |
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
82 [acl] |
11095
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
83 # Check whether the source of incoming changes is in this list where |
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
84 # "serve" == ssh or http, and "push", "pull" and "bundle" are the |
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
85 # corresponding hg commands. |
8893 | 86 sources = serve |
8873
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
87 |
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
88 [acl.deny.branches] |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
89 |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
90 # Everyone is denied to the frozen branch: |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
91 frozen-branch = * |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
92 |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
93 # A bad user is denied on all branches: |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
94 * = bad-user |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
95 |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
96 [acl.allow.branches] |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
97 |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
98 # A few users are allowed on branch-a: |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
99 branch-a = user-1, user-2, user-3 |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
100 |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
101 # Only one user is allowed on branch-b: |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
102 branch-b = user-1 |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
103 |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
104 # The super user is allowed on any branch: |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
105 * = super-user |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
106 |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
107 # Everyone is allowed on branch-for-tests: |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
108 branch-for-tests = * |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
109 |
11042
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
110 [acl.deny] |
11095
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
111 # This list is checked first. If a match is found, acl.allow is not |
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
112 # checked. All users are granted access if acl.deny is not present. |
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
113 # Format for both lists: glob pattern = user, ..., @group, ... |
11042
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
114 |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
115 # To match everyone, use an asterisk for the user: |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
116 # my/glob/pattern = * |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
117 |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
118 # user6 will not have write access to any file: |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
119 ** = user6 |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
120 |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
121 # Group "hg-denied" will not have write access to any file: |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
122 ** = @hg-denied |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
123 |
11095
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
124 # Nobody will be able to change "DONT-TOUCH-THIS.txt", despite |
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
125 # everyone being able to change all other files. See below. |
11042
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
126 src/main/resources/DONT-TOUCH-THIS.txt = * |
8873
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
127 |
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
128 [acl.allow] |
11042
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
129 # if acl.allow not present, all users allowed by default |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
130 # empty acl.allow = no users allowed |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
131 |
11095
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
132 # User "doc_writer" has write access to any file under the "docs" |
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
133 # folder: |
8873
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
134 docs/** = doc_writer |
11042
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
135 |
11095
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
136 # User "jack" and group "designers" have write access to any file |
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
137 # under the "images" folder: |
11042
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
138 images/** = jack, @designers |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
139 |
11095
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
140 # Everyone (except for "user6" - see acl.deny above) will have write |
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
141 # access to any file under the "resources" folder (except for 1 |
d56124931909
acl: more consistent docstring
Martin Geisler <mg@aragost.com>
parents:
11094
diff
changeset
|
142 # file. See acl.deny): |
11042
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
143 src/main/resources/** = * |
d82f3651cd13
acl: updated doc string to reflect recent changes
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11041
diff
changeset
|
144 |
8873
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
145 .hgtags = release_engineer |
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
146 |
e872ef2e6758
help: add/fix docstrings for a bunch of extensions
Dirkjan Ochtman <dirkjan@ochtman.nl>
parents:
8846
diff
changeset
|
147 ''' |
2344
ae12e5a2c4a3
add acl extension, to limit who can push to subdirs of central repo.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff
changeset
|
148 |
3891 | 149 from mercurial.i18n import _ |
8566
744d6322b05b
match: change all users of util.matcher to match.match
Matt Mackall <mpm@selenic.com>
parents:
8225
diff
changeset
|
150 from mercurial import util, match |
11041
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
151 import getpass, urllib, grp |
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
152 |
11114
62714143742f
acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11095
diff
changeset
|
153 def _getusers(ui, group): |
62714143742f
acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11095
diff
changeset
|
154 |
62714143742f
acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11095
diff
changeset
|
155 # First, try to use group definition from section [acl.groups] |
62714143742f
acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11095
diff
changeset
|
156 hgrcusers = ui.configlist('acl.groups', group) |
62714143742f
acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11095
diff
changeset
|
157 if hgrcusers: |
62714143742f
acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11095
diff
changeset
|
158 return hgrcusers |
62714143742f
acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11095
diff
changeset
|
159 |
62714143742f
acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11095
diff
changeset
|
160 ui.debug('acl: "%s" not defined in [acl.groups]\n' % group) |
62714143742f
acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11095
diff
changeset
|
161 # If no users found in group definition, get users from OS-level group |
11041
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
162 return grp.getgrnam(group).gr_mem |
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
163 |
11114
62714143742f
acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11095
diff
changeset
|
164 def _usermatch(ui, user, usersorgroups): |
11041
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
165 |
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
166 if usersorgroups == '*': |
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
167 return True |
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
168 |
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
169 for ug in usersorgroups.replace(',', ' ').split(): |
11114
62714143742f
acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11095
diff
changeset
|
170 if user == ug or ug.find('@') == 0 and user in _getusers(ui, ug[1:]): |
11041
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
171 return True |
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
172 |
623fe42a649e
acl: add support for OS-level groups using @group syntax
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10955
diff
changeset
|
173 return False |
2344
ae12e5a2c4a3
add acl extension, to limit who can push to subdirs of central repo.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff
changeset
|
174 |
6766 | 175 def buildmatch(ui, repo, user, key): |
176 '''return tuple of (match function, list enabled).''' | |
177 if not ui.has_section(key): | |
9467
4c041f1ee1b4
do not attempt to translate ui.debug output
Martin Geisler <mg@lazybytes.net>
parents:
9250
diff
changeset
|
178 ui.debug('acl: %s not enabled\n' % key) |
6766 | 179 return None |
2344
ae12e5a2c4a3
add acl extension, to limit who can push to subdirs of central repo.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff
changeset
|
180 |
6766 | 181 pats = [pat for pat, users in ui.configitems(key) |
11114
62714143742f
acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11095
diff
changeset
|
182 if _usermatch(ui, user, users)] |
9467
4c041f1ee1b4
do not attempt to translate ui.debug output
Martin Geisler <mg@lazybytes.net>
parents:
9250
diff
changeset
|
183 ui.debug('acl: %s enabled, %d entries for user %s\n' % |
6766 | 184 (key, len(pats), user)) |
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
185 |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
186 if not repo: |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
187 if pats: |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
188 return lambda b: '*' in pats or b in pats |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
189 return lambda b: False |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
190 |
6766 | 191 if pats: |
8567
fea40a677d43
match: add some default args
Matt Mackall <mpm@selenic.com>
parents:
8566
diff
changeset
|
192 return match.match(repo.root, '', pats) |
8682 | 193 return match.exact(repo.root, '', []) |
8566
744d6322b05b
match: change all users of util.matcher to match.match
Matt Mackall <mpm@selenic.com>
parents:
8225
diff
changeset
|
194 |
2344
ae12e5a2c4a3
add acl extension, to limit who can push to subdirs of central repo.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff
changeset
|
195 |
ae12e5a2c4a3
add acl extension, to limit who can push to subdirs of central repo.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff
changeset
|
196 def hook(ui, repo, hooktype, node=None, source=None, **kwargs): |
10955
470a6ace7574
Added support for 'pretxncommit', so that one can call the ACL hook at
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10801
diff
changeset
|
197 if hooktype not in ['pretxnchangegroup', 'pretxncommit']: |
2344
ae12e5a2c4a3
add acl extension, to limit who can push to subdirs of central repo.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff
changeset
|
198 raise util.Abort(_('config error - hook type "%s" cannot stop ' |
10955
470a6ace7574
Added support for 'pretxncommit', so that one can call the ACL hook at
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10801
diff
changeset
|
199 'incoming changesets nor commits') % hooktype) |
470a6ace7574
Added support for 'pretxncommit', so that one can call the ACL hook at
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10801
diff
changeset
|
200 if (hooktype == 'pretxnchangegroup' and |
470a6ace7574
Added support for 'pretxncommit', so that one can call the ACL hook at
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
10801
diff
changeset
|
201 source not in ui.config('acl', 'sources', 'serve').split()): |
9467
4c041f1ee1b4
do not attempt to translate ui.debug output
Martin Geisler <mg@lazybytes.net>
parents:
9250
diff
changeset
|
202 ui.debug('acl: changes have source "%s" - skipping\n' % source) |
2344
ae12e5a2c4a3
add acl extension, to limit who can push to subdirs of central repo.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff
changeset
|
203 return |
ae12e5a2c4a3
add acl extension, to limit who can push to subdirs of central repo.
Vadim Gelfer <vadim.gelfer@gmail.com>
parents:
diff
changeset
|
204 |
8846
b30775386d40
acl: support for getting authenticated user from web server (issue298)
Henrik Stuart <hg@hstuart.dk>
parents:
8682
diff
changeset
|
205 user = None |
b30775386d40
acl: support for getting authenticated user from web server (issue298)
Henrik Stuart <hg@hstuart.dk>
parents:
8682
diff
changeset
|
206 if source == 'serve' and 'url' in kwargs: |
b30775386d40
acl: support for getting authenticated user from web server (issue298)
Henrik Stuart <hg@hstuart.dk>
parents:
8682
diff
changeset
|
207 url = kwargs['url'].split(':') |
b30775386d40
acl: support for getting authenticated user from web server (issue298)
Henrik Stuart <hg@hstuart.dk>
parents:
8682
diff
changeset
|
208 if url[0] == 'remote' and url[1].startswith('http'): |
9018
5ed463d0ebdb
acl: read correct index into url for username (issue298)
Henrik Stuart <hg@hstuart.dk>
parents:
8935
diff
changeset
|
209 user = urllib.unquote(url[3]) |
8846
b30775386d40
acl: support for getting authenticated user from web server (issue298)
Henrik Stuart <hg@hstuart.dk>
parents:
8682
diff
changeset
|
210 |
b30775386d40
acl: support for getting authenticated user from web server (issue298)
Henrik Stuart <hg@hstuart.dk>
parents:
8682
diff
changeset
|
211 if user is None: |
b30775386d40
acl: support for getting authenticated user from web server (issue298)
Henrik Stuart <hg@hstuart.dk>
parents:
8682
diff
changeset
|
212 user = getpass.getuser() |
b30775386d40
acl: support for getting authenticated user from web server (issue298)
Henrik Stuart <hg@hstuart.dk>
parents:
8682
diff
changeset
|
213 |
6766 | 214 cfg = ui.config('acl', 'config') |
215 if cfg: | |
11114
62714143742f
acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11095
diff
changeset
|
216 ui.readconfig(cfg, sections = ['acl.groups', 'acl.allow.branches', |
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
217 'acl.deny.branches', 'acl.allow', 'acl.deny']) |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
218 |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
219 allowbranches = buildmatch(ui, None, user, 'acl.allow.branches') |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
220 denybranches = buildmatch(ui, None, user, 'acl.deny.branches') |
6766 | 221 allow = buildmatch(ui, repo, user, 'acl.allow') |
222 deny = buildmatch(ui, repo, user, 'acl.deny') | |
223 | |
224 for rev in xrange(repo[node], len(repo)): | |
225 ctx = repo[rev] | |
11092
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
226 branch = ctx.branch() |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
227 if denybranches and denybranches(branch): |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
228 raise util.Abort(_('acl: user "%s" denied on branch "%s"' |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
229 ' (changeset "%s")') |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
230 % (user, branch, ctx)) |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
231 if allowbranches and not allowbranches(branch): |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
232 raise util.Abort(_('acl: user "%s" not allowed on branch "%s"' |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
233 ' (changeset "%s")') |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
234 % (user, branch, ctx)) |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
235 ui.debug('acl: branch access granted: "%s" on branch "%s"\n' |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
236 % (ctx, branch)) |
2dd91779eb27
acl: add support for branch-based access control
Elifarley Callado Coelho Cruz <elifarley@gmail.com>
parents:
11058
diff
changeset
|
237 |
6766 | 238 for f in ctx.files(): |
239 if deny and deny(f): | |
9467
4c041f1ee1b4
do not attempt to translate ui.debug output
Martin Geisler <mg@lazybytes.net>
parents:
9250
diff
changeset
|
240 ui.debug('acl: user %s denied on %s\n' % (user, f)) |
6766 | 241 raise util.Abort(_('acl: access denied for changeset %s') % ctx) |
242 if allow and not allow(f): | |
9467
4c041f1ee1b4
do not attempt to translate ui.debug output
Martin Geisler <mg@lazybytes.net>
parents:
9250
diff
changeset
|
243 ui.debug('acl: user %s not allowed on %s\n' % (user, f)) |
6766 | 244 raise util.Abort(_('acl: access denied for changeset %s') % ctx) |
9467
4c041f1ee1b4
do not attempt to translate ui.debug output
Martin Geisler <mg@lazybytes.net>
parents:
9250
diff
changeset
|
245 ui.debug('acl: allowing changeset %s\n' % ctx) |