6 # GNU General Public License version 2 or any later version. |
6 # GNU General Public License version 2 or any later version. |
7 |
7 |
8 '''hooks for controlling repository access |
8 '''hooks for controlling repository access |
9 |
9 |
10 This hook makes it possible to allow or deny write access to portions |
10 This hook makes it possible to allow or deny write access to portions |
11 of a repository when receiving incoming changesets. |
11 of a repository when receiving incoming changesets via pretxnchangegroup and |
|
12 pretxncommit. |
12 |
13 |
13 The authorization is matched based on the local user name on the |
14 The authorization is matched based on the local user name on the |
14 system where the hook runs, and not the committer of the original |
15 system where the hook runs, and not the committer of the original |
15 changeset (since the latter is merely informative). |
16 changeset (since the latter is merely informative). |
16 |
17 |
19 pushing or pulling. The hook is not safe to use if users have |
20 pushing or pulling. The hook is not safe to use if users have |
20 interactive shell access, as they can then disable the hook. |
21 interactive shell access, as they can then disable the hook. |
21 Nor is it safe if remote users share an account, because then there |
22 Nor is it safe if remote users share an account, because then there |
22 is no way to distinguish them. |
23 is no way to distinguish them. |
23 |
24 |
24 To use this hook, configure the acl extension in your hgrc like this:: |
25 The deny list is checked before the allow list is. |
|
26 |
|
27 The allow and deny sections take key-value pairs, having a subtree pattern |
|
28 as key (with a glob syntax by default). The corresponding value can be either: |
|
29 1) an asterisk, to match everyone; |
|
30 2) a comma-separated list containing users and groups. |
|
31 |
|
32 Group names must be prefixed with an @ symbol. |
|
33 Specifying a group name has the same effect as specifying all the users in |
|
34 that group. |
|
35 The set of users for a group is taken from "grp.getgrnam" |
|
36 (see http://docs.python.org/library/grp.html#grp.getgrnam). |
|
37 |
|
38 To use this hook, configure the acl extension in your hgrc like this: |
25 |
39 |
26 [extensions] |
40 [extensions] |
27 acl = |
41 acl = |
28 |
42 |
29 [hooks] |
43 [hooks] |
|
44 |
|
45 # Use this if you want to check access restrictions at commit time |
|
46 pretxncommit.acl = python:hgext.acl.hook |
|
47 |
|
48 # Use this if you want to check access restrictions for pull, push, bundle |
|
49 # and serve. |
30 pretxnchangegroup.acl = python:hgext.acl.hook |
50 pretxnchangegroup.acl = python:hgext.acl.hook |
31 |
51 |
32 [acl] |
52 [acl] |
33 # Check whether the source of incoming changes is in this list |
53 # Check whether the source of incoming changes is in this list |
34 # ("serve" == ssh or http, "push", "pull", "bundle") |
54 # ("serve" == ssh or http, "push", "pull", "bundle") |
35 sources = serve |
55 sources = serve |
36 |
56 |
37 The allow and deny sections take a subtree pattern as key (with a glob |
57 [acl.deny] |
38 syntax by default), and a comma separated list of users as the |
58 # This list is checked first. If a match is found, 'acl.allow' will not be |
39 corresponding value. The deny list is checked before the allow list |
59 # checked. |
40 is. :: |
60 # if acl.deny is not present, no users denied by default |
|
61 # empty acl.deny = all users allowed |
|
62 # Format for both lists: glob pattern = user4, user5, @group1 |
|
63 |
|
64 # To match everyone, use an asterisk for the user: |
|
65 # my/glob/pattern = * |
|
66 |
|
67 # user6 will not have write access to any file: |
|
68 ** = user6 |
|
69 |
|
70 # Group "hg-denied" will not have write access to any file: |
|
71 ** = @hg-denied |
|
72 |
|
73 # Nobody will be able to change "DONT-TOUCH-THIS.txt", despite everyone being |
|
74 # able to change all other files. See below. |
|
75 src/main/resources/DONT-TOUCH-THIS.txt = * |
41 |
76 |
42 [acl.allow] |
77 [acl.allow] |
43 # If acl.allow is not present, all users are allowed by default. |
78 # if acl.allow not present, all users allowed by default |
44 # An empty acl.allow section means no users allowed. |
79 # empty acl.allow = no users allowed |
|
80 |
|
81 # User "doc_writer" has write access to any file under the "docs" folder: |
45 docs/** = doc_writer |
82 docs/** = doc_writer |
|
83 |
|
84 # User "jack" and group "designers" have write access to any file under the |
|
85 # "images" folder: |
|
86 images/** = jack, @designers |
|
87 |
|
88 # Everyone (except for "user6" - see "acl.deny" above) will have write access |
|
89 to any file under the "resources" folder (except for 1 file. See "acl.deny"): |
|
90 src/main/resources/** = * |
|
91 |
46 .hgtags = release_engineer |
92 .hgtags = release_engineer |
47 |
93 |
48 [acl.deny] |
|
49 # If acl.deny is not present, no users are refused by default. |
|
50 # An empty acl.deny section means all users allowed. |
|
51 glob pattern = user4, user5 |
|
52 ** = user6 |
|
53 ''' |
94 ''' |
54 |
95 |
55 from mercurial.i18n import _ |
96 from mercurial.i18n import _ |
56 from mercurial import util, match |
97 from mercurial import util, match |
57 import getpass, urllib, grp |
98 import getpass, urllib, grp |