annotate contrib/hg-ssh @ 27913:91ac8cb79125 stable

templates: use canvaswidth instead of fixed width for canvas (issue2683)

Before this patch, template files for "graph" web page use fixed width
size "480" for canvas element.

This causes pruned lanes and invisible vertexes, if there are 16 or
more vertical lanes at once. In such case, part of graph in right side
area over 480 is invisible, even though corresponded summary text
blocks are visible correctly.

This limitation isn't reasonable for workflow using many branches at
once (e.g. "one branch per issue" workflow).

There were changes below related to width of canvas:

  - 7359cb753a54 (templates: widen the graph canvas (issue2683)),
    released as a part of Mercurial 1.8.2

    According to the description, this assumed that 15 parallel
    branches was enough for ordinary workflow, and bumped width of
    canvas up from 224 to 480.

  - d490edc71146 (hgweb: make graph data suitable for template usage),
    released as a part of Mercurial 2.3

    This introduced "canvaswidth" template keyword as a part of
    refactoring around graph rendering.

    But 'width="480"' of canvas element in template files wasn't
    replaced by 'width="{canvaswidth}"' in it (or subsequent one).

This patch uses dynamic value "{canvaswidth}" instead of fixed width
size "480" for canvas element.

This is posted for "stable", because:

  - this is re-fixing issue2683

  - this is simple enough for stable

  - using "{canvaswidth}" doesn't require any additional cost

    Calculation of canvaswidth is already implied as a part of "graph"
    web command.

#!/usr/bin/env python
#
# Copyright 2005-2007 by Intevation GmbH <[e-mail]>
#
# Author(s):
# Thomas Arendsen Hein <[e-mail]>
#
# This software may be used and distributed according to the terms of the
# GNU General Public License version 2 or any later version.

"""
hg-ssh - a wrapper for ssh access to a limited set of mercurial repos

To be used in ~/.ssh/authorized_keys with the "command" option, see sshd(8):
command="hg-ssh path/to/repo1 /path/to/repo2 ~/repo3 ~user/repo4" ssh-dss ...
(probably together with these other useful options:
 no-port-forwarding,no-X11-forwarding,no-agent-forwarding)

This allows pull/push over ssh from/to the repositories given as arguments.

If all your repositories are subdirectories of a common directory, you can
allow shorter paths with:
command="cd path/to/my/repositories && hg-ssh repo1 subdir/repo2"

You can use pattern matching of your normal shell, e.g.:
command="cd repos && hg-ssh user/thomas/* projects/{mercurial,foo}"

You can also add a --read-only flag to allow read-only access to a key, e.g.:
command="hg-ssh --read-only repos/*"
"""

# enable importing on demand to reduce startup time
from mercurial import demandimport; demandimport.enable()

from mercurial import dispatch

import sys, os, shlex

def main():
    cwd = os.getcwd()
    readonly = False
    args = sys.argv[1:]
    while len(args):
        if args[0] == '--read-only':
            readonly = True
            args.pop(0)
        else:
            break
    allowed_paths = [os.path.normpath(os.path.join(cwd,
                                                   os.path.expanduser(path)))
                     for path in args]
    orig_cmd = os.getenv('SSH_ORIGINAL_COMMAND', '?')
    try:
        cmdargv = shlex.split(orig_cmd)
    except ValueError, e:
        sys.stderr.write('Illegal command "%s": %s\n' % (orig_cmd, e))
        sys.exit(255)

    if cmdargv[:2] == ['hg', '-R'] and cmdargv[3:] == ['serve', '--stdio']:
        path = cmdargv[2]
        repo = os.path.normpath(os.path.join(cwd, os.path.expanduser(path)))
        if repo in allowed_paths:
            cmd = ['-R', repo, 'serve', '--stdio']
            if readonly:
                cmd += [
                    '--config',
                    'hooks.pretxnopen.hg-ssh=python:__main__.rejectpush',
                    '--config',
                    'hooks.prepushkey.hg-ssh=python:__main__.rejectpush'
                    ]
            dispatch.dispatch(dispatch.request(cmd))
        else:
            sys.stderr.write('Illegal repository "%s"\n' % repo)
            sys.exit(255)
    else:
        sys.stderr.write('Illegal command "%s"\n' % orig_cmd)
        sys.exit(255)

def rejectpush(ui, **kwargs):
    ui.warn("Permission denied\n")
    # mercurial hooks use unix process conventions for hook return values
    # so a truthy return means failure
    return True

if __name__ == '__main__':
    main()