mercurial-scm/hg: hgext/acl.py annotate

annotate hgext/acl.py @ 16956:c49cf339b5bb

acl: use of "!" prefix in user or group names The "!" prefix allows you to prevent anyone except a given user or group to push changesets in a given branch or path. This patch enables a use case suggested by a user (Julien Bonnet): There's a branch that only a given user (or group) should be able to push to, and you don't want to restrict access to any other branch that may be created. With the "!" prefix, you simply deny access to "!givenuser" (or "!@givengroup").

author	Elifarley Callado Coelho Cruz
date	Mon, 28 May 2012 19:45:15 -0300
parents	363bde4224c8
children	d7b608149f6c

rev	line source
2344 ae12e5a2c4a3 add acl extension, to limit who can push to subdirs of central repo. Vadim Gelfer <vadim.gelfer@gmail.com> parents: diff changeset	1 # acl.py - changeset access control for mercurial
ae12e5a2c4a3 add acl extension, to limit who can push to subdirs of central repo. Vadim Gelfer <vadim.gelfer@gmail.com> parents: diff changeset	2 #
ae12e5a2c4a3 add acl extension, to limit who can push to subdirs of central repo. Vadim Gelfer <vadim.gelfer@gmail.com> parents: diff changeset	3 # Copyright 2006 Vadim Gelfer <vadim.gelfer@gmail.com>
ae12e5a2c4a3 add acl extension, to limit who can push to subdirs of central repo. Vadim Gelfer <vadim.gelfer@gmail.com> parents: diff changeset	4 #
8225 46293a0c7e9f updated license to be explicit about GPL version 2 Martin Geisler <mg@lazybytes.net> parents: 8142 diff changeset	5 # This software may be used and distributed according to the terms of the
10263 25e572394f5c Update license to GPLv2+ Matt Mackall <mpm@selenic.com> parents: 10112 diff changeset	6 # GNU General Public License version 2 or any later version.
8873 e872ef2e6758 help: add/fix docstrings for a bunch of extensions Dirkjan Ochtman <dirkjan@ochtman.nl> parents: 8846 diff changeset	7
8935 f4f0e902b750 extensions: change descriptions for hook-providing extensions Dirkjan Ochtman <dirkjan@ochtman.nl> parents: 8894 diff changeset	8 '''hooks for controlling repository access
8873 e872ef2e6758 help: add/fix docstrings for a bunch of extensions Dirkjan Ochtman <dirkjan@ochtman.nl> parents: 8846 diff changeset	9
11095 d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	10 This hook makes it possible to allow or deny write access to given
d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	11 branches and paths of a repository when receiving incoming changesets
d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	12 via pretxnchangegroup and pretxncommit.
9250 00986b9ed649 acl: wrap docstrings at 70 characters Martin Geisler <mg@lazybytes.net> parents: 9201 diff changeset	13
00986b9ed649 acl: wrap docstrings at 70 characters Martin Geisler <mg@lazybytes.net> parents: 9201 diff changeset	14 The authorization is matched based on the local user name on the
00986b9ed649 acl: wrap docstrings at 70 characters Martin Geisler <mg@lazybytes.net> parents: 9201 diff changeset	15 system where the hook runs, and not the committer of the original
00986b9ed649 acl: wrap docstrings at 70 characters Martin Geisler <mg@lazybytes.net> parents: 9201 diff changeset	16 changeset (since the latter is merely informative).
8873 e872ef2e6758 help: add/fix docstrings for a bunch of extensions Dirkjan Ochtman <dirkjan@ochtman.nl> parents: 8846 diff changeset	17
9250 00986b9ed649 acl: wrap docstrings at 70 characters Martin Geisler <mg@lazybytes.net> parents: 9201 diff changeset	18 The acl hook is best used along with a restricted shell like hgsh,
11095 d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	19 preventing authenticating users from doing anything other than pushing
d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	20 or pulling. The hook is not safe to use if users have interactive
d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	21 shell access, as they can then disable the hook. Nor is it safe if
d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	22 remote users share an account, because then there is no way to
d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	23 distinguish them.
8873 e872ef2e6758 help: add/fix docstrings for a bunch of extensions Dirkjan Ochtman <dirkjan@ochtman.nl> parents: 8846 diff changeset	24
11092 2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	25 The order in which access checks are performed is:
11094 c7adea82d495 acl: fix reST syntax Martin Geisler <mg@aragost.com> parents: 11092 diff changeset	26
c7adea82d495 acl: fix reST syntax Martin Geisler <mg@aragost.com> parents: 11092 diff changeset	27 1) Deny list for branches (section ``acl.deny.branches``)
c7adea82d495 acl: fix reST syntax Martin Geisler <mg@aragost.com> parents: 11092 diff changeset	28 2) Allow list for branches (section ``acl.allow.branches``)
c7adea82d495 acl: fix reST syntax Martin Geisler <mg@aragost.com> parents: 11092 diff changeset	29 3) Deny list for paths (section ``acl.deny``)
c7adea82d495 acl: fix reST syntax Martin Geisler <mg@aragost.com> parents: 11092 diff changeset	30 4) Allow list for paths (section ``acl.allow``)
11042 d82f3651cd13 acl: updated doc string to reflect recent changes Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11041 diff changeset	31
11092 2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	32 The allow and deny sections take key-value pairs.
2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	33
11094 c7adea82d495 acl: fix reST syntax Martin Geisler <mg@aragost.com> parents: 11092 diff changeset	34 Branch-based Access Control
12778 dce09f82f619 help: different section separators Erik Zielke <ez@aragost.com> parents: 11423 diff changeset	35 ...........................
11092 2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	36
11095 d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	37 Use the ``acl.deny.branches`` and ``acl.allow.branches`` sections to
d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	38 have branch-based access control. Keys in these sections can be
d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	39 either:
11057 7f0796a0b35c acl: fix ReST syntax in docstring Martin Geisler <mg@lazybytes.net> parents: 11042 diff changeset	40
11095 d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	41 - a branch name, or
d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	42 - an asterisk, to match any branch;
11092 2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	43
2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	44 The corresponding values can be either:
11094 c7adea82d495 acl: fix reST syntax Martin Geisler <mg@aragost.com> parents: 11092 diff changeset	45
11095 d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	46 - a comma-separated list containing users and groups, or
d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	47 - an asterisk, to match anyone;
11042 d82f3651cd13 acl: updated doc string to reflect recent changes Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11041 diff changeset	48
11094 c7adea82d495 acl: fix reST syntax Martin Geisler <mg@aragost.com> parents: 11092 diff changeset	49 Path-based Access Control
12778 dce09f82f619 help: different section separators Erik Zielke <ez@aragost.com> parents: 11423 diff changeset	50 .........................
11092 2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	51
11095 d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	52 Use the ``acl.deny`` and ``acl.allow`` sections to have path-based
d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	53 access control. Keys in these sections accept a subtree pattern (with
d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	54 a glob syntax by default). The corresponding values follow the same
d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	55 syntax as the other sections above.
11092 2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	56
11094 c7adea82d495 acl: fix reST syntax Martin Geisler <mg@aragost.com> parents: 11092 diff changeset	57 Groups
12778 dce09f82f619 help: different section separators Erik Zielke <ez@aragost.com> parents: 11423 diff changeset	58 ......
11092 2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	59
11095 d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	60 Group names must be prefixed with an ``@`` symbol. Specifying a group
d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	61 name has the same effect as specifying all the users in that group.
8873 e872ef2e6758 help: add/fix docstrings for a bunch of extensions Dirkjan Ochtman <dirkjan@ochtman.nl> parents: 8846 diff changeset	62
11115 b3d5619f1f2b acl: update docstring to describe section [acl.groups] Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11114 diff changeset	63 You can define group members in the ``acl.groups`` section.
b3d5619f1f2b acl: update docstring to describe section [acl.groups] Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11114 diff changeset	64 If a group name is not defined there, and Mercurial is running under
b3d5619f1f2b acl: update docstring to describe section [acl.groups] Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11114 diff changeset	65 a Unix-like system, the list of users will be taken from the OS.
b3d5619f1f2b acl: update docstring to describe section [acl.groups] Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11114 diff changeset	66 Otherwise, an exception will be raised.
b3d5619f1f2b acl: update docstring to describe section [acl.groups] Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11114 diff changeset	67
11094 c7adea82d495 acl: fix reST syntax Martin Geisler <mg@aragost.com> parents: 11092 diff changeset	68 Example Configuration
12778 dce09f82f619 help: different section separators Erik Zielke <ez@aragost.com> parents: 11423 diff changeset	69 .....................
11094 c7adea82d495 acl: fix reST syntax Martin Geisler <mg@aragost.com> parents: 11092 diff changeset	70
c7adea82d495 acl: fix reST syntax Martin Geisler <mg@aragost.com> parents: 11092 diff changeset	71 ::
8873 e872ef2e6758 help: add/fix docstrings for a bunch of extensions Dirkjan Ochtman <dirkjan@ochtman.nl> parents: 8846 diff changeset	72
e872ef2e6758 help: add/fix docstrings for a bunch of extensions Dirkjan Ochtman <dirkjan@ochtman.nl> parents: 8846 diff changeset	73 [hooks]
11042 d82f3651cd13 acl: updated doc string to reflect recent changes Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11041 diff changeset	74
11092 2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	75 # Use this if you want to check access restrictions at commit time
11042 d82f3651cd13 acl: updated doc string to reflect recent changes Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11041 diff changeset	76 pretxncommit.acl = python:hgext.acl.hook
11423 776f9784b34b acl: delete trailing whitespace in docstring Martin Geisler <mg@lazybytes.net> parents: 11140 diff changeset	77
11095 d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	78 # Use this if you want to check access restrictions for pull, push,
d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	79 # bundle and serve.
8873 e872ef2e6758 help: add/fix docstrings for a bunch of extensions Dirkjan Ochtman <dirkjan@ochtman.nl> parents: 8846 diff changeset	80 pretxnchangegroup.acl = python:hgext.acl.hook
e872ef2e6758 help: add/fix docstrings for a bunch of extensions Dirkjan Ochtman <dirkjan@ochtman.nl> parents: 8846 diff changeset	81
e872ef2e6758 help: add/fix docstrings for a bunch of extensions Dirkjan Ochtman <dirkjan@ochtman.nl> parents: 8846 diff changeset	82 [acl]
11131 0b6fd18ab8af acl: clarify acl.sources, fix typo Patrick Mezard <pmezard@gmail.com> parents: 11115 diff changeset	83 # Allow or deny access for incoming changes only if their source is
0b6fd18ab8af acl: clarify acl.sources, fix typo Patrick Mezard <pmezard@gmail.com> parents: 11115 diff changeset	84 # listed here, let them pass otherwise. Source is "serve" for all
0b6fd18ab8af acl: clarify acl.sources, fix typo Patrick Mezard <pmezard@gmail.com> parents: 11115 diff changeset	85 # remote access (http or ssh), "push", "pull" or "bundle" when the
0b6fd18ab8af acl: clarify acl.sources, fix typo Patrick Mezard <pmezard@gmail.com> parents: 11115 diff changeset	86 # related commands are run locally.
0b6fd18ab8af acl: clarify acl.sources, fix typo Patrick Mezard <pmezard@gmail.com> parents: 11115 diff changeset	87 # Default: serve
8893 cc0593af30d4 acl: help improvements C?dric Duval <cedricduval@free.fr> parents: 8873 diff changeset	88 sources = serve
8873 e872ef2e6758 help: add/fix docstrings for a bunch of extensions Dirkjan Ochtman <dirkjan@ochtman.nl> parents: 8846 diff changeset	89
11423 776f9784b34b acl: delete trailing whitespace in docstring Martin Geisler <mg@lazybytes.net> parents: 11140 diff changeset	90 [acl.deny.branches]
776f9784b34b acl: delete trailing whitespace in docstring Martin Geisler <mg@lazybytes.net> parents: 11140 diff changeset	91
776f9784b34b acl: delete trailing whitespace in docstring Martin Geisler <mg@lazybytes.net> parents: 11140 diff changeset	92 # Everyone is denied to the frozen branch:
776f9784b34b acl: delete trailing whitespace in docstring Martin Geisler <mg@lazybytes.net> parents: 11140 diff changeset	93 frozen-branch = *
776f9784b34b acl: delete trailing whitespace in docstring Martin Geisler <mg@lazybytes.net> parents: 11140 diff changeset	94
776f9784b34b acl: delete trailing whitespace in docstring Martin Geisler <mg@lazybytes.net> parents: 11140 diff changeset	95 # A bad user is denied on all branches:
776f9784b34b acl: delete trailing whitespace in docstring Martin Geisler <mg@lazybytes.net> parents: 11140 diff changeset	96 * = bad-user
776f9784b34b acl: delete trailing whitespace in docstring Martin Geisler <mg@lazybytes.net> parents: 11140 diff changeset	97
776f9784b34b acl: delete trailing whitespace in docstring Martin Geisler <mg@lazybytes.net> parents: 11140 diff changeset	98 [acl.allow.branches]
776f9784b34b acl: delete trailing whitespace in docstring Martin Geisler <mg@lazybytes.net> parents: 11140 diff changeset	99
776f9784b34b acl: delete trailing whitespace in docstring Martin Geisler <mg@lazybytes.net> parents: 11140 diff changeset	100 # A few users are allowed on branch-a:
776f9784b34b acl: delete trailing whitespace in docstring Martin Geisler <mg@lazybytes.net> parents: 11140 diff changeset	101 branch-a = user-1, user-2, user-3
776f9784b34b acl: delete trailing whitespace in docstring Martin Geisler <mg@lazybytes.net> parents: 11140 diff changeset	102
776f9784b34b acl: delete trailing whitespace in docstring Martin Geisler <mg@lazybytes.net> parents: 11140 diff changeset	103 # Only one user is allowed on branch-b:
776f9784b34b acl: delete trailing whitespace in docstring Martin Geisler <mg@lazybytes.net> parents: 11140 diff changeset	104 branch-b = user-1
776f9784b34b acl: delete trailing whitespace in docstring Martin Geisler <mg@lazybytes.net> parents: 11140 diff changeset	105
776f9784b34b acl: delete trailing whitespace in docstring Martin Geisler <mg@lazybytes.net> parents: 11140 diff changeset	106 # The super user is allowed on any branch:
776f9784b34b acl: delete trailing whitespace in docstring Martin Geisler <mg@lazybytes.net> parents: 11140 diff changeset	107 * = super-user
776f9784b34b acl: delete trailing whitespace in docstring Martin Geisler <mg@lazybytes.net> parents: 11140 diff changeset	108
776f9784b34b acl: delete trailing whitespace in docstring Martin Geisler <mg@lazybytes.net> parents: 11140 diff changeset	109 # Everyone is allowed on branch-for-tests:
776f9784b34b acl: delete trailing whitespace in docstring Martin Geisler <mg@lazybytes.net> parents: 11140 diff changeset	110 branch-for-tests = *
11092 2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	111
11042 d82f3651cd13 acl: updated doc string to reflect recent changes Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11041 diff changeset	112 [acl.deny]
11095 d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	113 # This list is checked first. If a match is found, acl.allow is not
d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	114 # checked. All users are granted access if acl.deny is not present.
d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	115 # Format for both lists: glob pattern = user, ..., @group, ...
11042 d82f3651cd13 acl: updated doc string to reflect recent changes Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11041 diff changeset	116
d82f3651cd13 acl: updated doc string to reflect recent changes Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11041 diff changeset	117 # To match everyone, use an asterisk for the user:
d82f3651cd13 acl: updated doc string to reflect recent changes Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11041 diff changeset	118 # my/glob/pattern = *
d82f3651cd13 acl: updated doc string to reflect recent changes Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11041 diff changeset	119
d82f3651cd13 acl: updated doc string to reflect recent changes Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11041 diff changeset	120 # user6 will not have write access to any file:
d82f3651cd13 acl: updated doc string to reflect recent changes Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11041 diff changeset	121 ** = user6
d82f3651cd13 acl: updated doc string to reflect recent changes Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11041 diff changeset	122
d82f3651cd13 acl: updated doc string to reflect recent changes Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11041 diff changeset	123 # Group "hg-denied" will not have write access to any file:
d82f3651cd13 acl: updated doc string to reflect recent changes Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11041 diff changeset	124 ** = @hg-denied
d82f3651cd13 acl: updated doc string to reflect recent changes Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11041 diff changeset	125
11095 d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	126 # Nobody will be able to change "DONT-TOUCH-THIS.txt", despite
d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	127 # everyone being able to change all other files. See below.
11042 d82f3651cd13 acl: updated doc string to reflect recent changes Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11041 diff changeset	128 src/main/resources/DONT-TOUCH-THIS.txt = *
8873 e872ef2e6758 help: add/fix docstrings for a bunch of extensions Dirkjan Ochtman <dirkjan@ochtman.nl> parents: 8846 diff changeset	129
e872ef2e6758 help: add/fix docstrings for a bunch of extensions Dirkjan Ochtman <dirkjan@ochtman.nl> parents: 8846 diff changeset	130 [acl.allow]
11131 0b6fd18ab8af acl: clarify acl.sources, fix typo Patrick Mezard <pmezard@gmail.com> parents: 11115 diff changeset	131 # if acl.allow is not present, all users are allowed by default
11042 d82f3651cd13 acl: updated doc string to reflect recent changes Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11041 diff changeset	132 # empty acl.allow = no users allowed
d82f3651cd13 acl: updated doc string to reflect recent changes Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11041 diff changeset	133
11095 d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	134 # User "doc_writer" has write access to any file under the "docs"
d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	135 # folder:
8873 e872ef2e6758 help: add/fix docstrings for a bunch of extensions Dirkjan Ochtman <dirkjan@ochtman.nl> parents: 8846 diff changeset	136 docs/** = doc_writer
11042 d82f3651cd13 acl: updated doc string to reflect recent changes Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11041 diff changeset	137
11095 d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	138 # User "jack" and group "designers" have write access to any file
d56124931909 acl: more consistent docstring Martin Geisler <mg@aragost.com> parents: 11094 diff changeset	139 # under the "images" folder:
11042 d82f3651cd13 acl: updated doc string to reflect recent changes Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11041 diff changeset	140 images/** = jack, @designers
d82f3651cd13 acl: updated doc string to reflect recent changes Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11041 diff changeset	141
16499 0b463f52b948 doc: fix explanation comment in acl extension FUJIWARA Katsunori <foozy@lares.dti.ne.jp> parents: 15207 diff changeset	142 # Everyone (except for "user6" and "@hg-denied" - see acl.deny above)
0b463f52b948 doc: fix explanation comment in acl extension FUJIWARA Katsunori <foozy@lares.dti.ne.jp> parents: 15207 diff changeset	143 # will have write access to any file under the "resources" folder
0b463f52b948 doc: fix explanation comment in acl extension FUJIWARA Katsunori <foozy@lares.dti.ne.jp> parents: 15207 diff changeset	144 # (except for 1 file. See acl.deny):
11042 d82f3651cd13 acl: updated doc string to reflect recent changes Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11041 diff changeset	145 src/main/resources/** = *
d82f3651cd13 acl: updated doc string to reflect recent changes Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11041 diff changeset	146
8873 e872ef2e6758 help: add/fix docstrings for a bunch of extensions Dirkjan Ochtman <dirkjan@ochtman.nl> parents: 8846 diff changeset	147 .hgtags = release_engineer
e872ef2e6758 help: add/fix docstrings for a bunch of extensions Dirkjan Ochtman <dirkjan@ochtman.nl> parents: 8846 diff changeset	148
e872ef2e6758 help: add/fix docstrings for a bunch of extensions Dirkjan Ochtman <dirkjan@ochtman.nl> parents: 8846 diff changeset	149 '''
2344 ae12e5a2c4a3 add acl extension, to limit who can push to subdirs of central repo. Vadim Gelfer <vadim.gelfer@gmail.com> parents: diff changeset	150
3891 6b4127c7d52a Simplify i18n imports Matt Mackall <mpm@selenic.com> parents: 3877 diff changeset	151 from mercurial.i18n import _
8566 744d6322b05b match: change all users of util.matcher to match.match Matt Mackall <mpm@selenic.com> parents: 8225 diff changeset	152 from mercurial import util, match
11138 99eee847beaa acl: grp module is not available on windows Patrick Mezard <pmezard@gmail.com> parents: 11131 diff changeset	153 import getpass, urllib
11041 623fe42a649e acl: add support for OS-level groups using @group syntax Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 10955 diff changeset	154
16743 38caf405d010 hgext: mark all first-party extensions as such Augie Fackler <raf@durin42.com> parents: 16499 diff changeset	155 testedwith = 'internal'
38caf405d010 hgext: mark all first-party extensions as such Augie Fackler <raf@durin42.com> parents: 16499 diff changeset	156
11114 62714143742f acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11095 diff changeset	157 def _getusers(ui, group):
62714143742f acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11095 diff changeset	158
62714143742f acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11095 diff changeset	159 # First, try to use group definition from section [acl.groups]
62714143742f acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11095 diff changeset	160 hgrcusers = ui.configlist('acl.groups', group)
62714143742f acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11095 diff changeset	161 if hgrcusers:
62714143742f acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11095 diff changeset	162 return hgrcusers
62714143742f acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11095 diff changeset	163
62714143742f acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11095 diff changeset	164 ui.debug('acl: "%s" not defined in [acl.groups]\n' % group)
62714143742f acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11095 diff changeset	165 # If no users found in group definition, get users from OS-level group
11140 1f26cf0a3663 acl: improve undefined group error handling Patrick Mezard <pmezard@gmail.com> parents: 11138 diff changeset	166 try:
1f26cf0a3663 acl: improve undefined group error handling Patrick Mezard <pmezard@gmail.com> parents: 11138 diff changeset	167 return util.groupmembers(group)
1f26cf0a3663 acl: improve undefined group error handling Patrick Mezard <pmezard@gmail.com> parents: 11138 diff changeset	168 except KeyError:
1f26cf0a3663 acl: improve undefined group error handling Patrick Mezard <pmezard@gmail.com> parents: 11138 diff changeset	169 raise util.Abort(_("group '%s' is undefined") % group)
11041 623fe42a649e acl: add support for OS-level groups using @group syntax Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 10955 diff changeset	170
11114 62714143742f acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11095 diff changeset	171 def _usermatch(ui, user, usersorgroups):
11041 623fe42a649e acl: add support for OS-level groups using @group syntax Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 10955 diff changeset	172
623fe42a649e acl: add support for OS-level groups using @group syntax Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 10955 diff changeset	173 if usersorgroups == '*':
623fe42a649e acl: add support for OS-level groups using @group syntax Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 10955 diff changeset	174 return True
623fe42a649e acl: add support for OS-level groups using @group syntax Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 10955 diff changeset	175
623fe42a649e acl: add support for OS-level groups using @group syntax Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 10955 diff changeset	176 for ug in usersorgroups.replace(',', ' ').split():
16956 c49cf339b5bb acl: use of "!" prefix in user or group names Elifarley Callado Coelho Cruz parents: 16767 diff changeset	177
c49cf339b5bb acl: use of "!" prefix in user or group names Elifarley Callado Coelho Cruz parents: 16767 diff changeset	178 if ug.startswith('!'):
c49cf339b5bb acl: use of "!" prefix in user or group names Elifarley Callado Coelho Cruz parents: 16767 diff changeset	179 # Test for excluded user or group. Format:
c49cf339b5bb acl: use of "!" prefix in user or group names Elifarley Callado Coelho Cruz parents: 16767 diff changeset	180 # if ug is a user name: !username
c49cf339b5bb acl: use of "!" prefix in user or group names Elifarley Callado Coelho Cruz parents: 16767 diff changeset	181 # if ug is a group name: !@groupname
c49cf339b5bb acl: use of "!" prefix in user or group names Elifarley Callado Coelho Cruz parents: 16767 diff changeset	182 ug = ug[1:]
c49cf339b5bb acl: use of "!" prefix in user or group names Elifarley Callado Coelho Cruz parents: 16767 diff changeset	183 if not ug.startswith('@') and user != ug \
c49cf339b5bb acl: use of "!" prefix in user or group names Elifarley Callado Coelho Cruz parents: 16767 diff changeset	184 or ug.startswith('@') and user not in _getusers(ui, ug[1:]):
c49cf339b5bb acl: use of "!" prefix in user or group names Elifarley Callado Coelho Cruz parents: 16767 diff changeset	185 return True
c49cf339b5bb acl: use of "!" prefix in user or group names Elifarley Callado Coelho Cruz parents: 16767 diff changeset	186
c49cf339b5bb acl: use of "!" prefix in user or group names Elifarley Callado Coelho Cruz parents: 16767 diff changeset	187 # Test for user or group. Format:
c49cf339b5bb acl: use of "!" prefix in user or group names Elifarley Callado Coelho Cruz parents: 16767 diff changeset	188 # if ug is a user name: username
c49cf339b5bb acl: use of "!" prefix in user or group names Elifarley Callado Coelho Cruz parents: 16767 diff changeset	189 # if ug is a group name: @groupname
c49cf339b5bb acl: use of "!" prefix in user or group names Elifarley Callado Coelho Cruz parents: 16767 diff changeset	190 elif user == ug \
c49cf339b5bb acl: use of "!" prefix in user or group names Elifarley Callado Coelho Cruz parents: 16767 diff changeset	191 or ug.startswith('@') and user in _getusers(ui, ug[1:]):
11041 623fe42a649e acl: add support for OS-level groups using @group syntax Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 10955 diff changeset	192 return True
623fe42a649e acl: add support for OS-level groups using @group syntax Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 10955 diff changeset	193
623fe42a649e acl: add support for OS-level groups using @group syntax Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 10955 diff changeset	194 return False
2344 ae12e5a2c4a3 add acl extension, to limit who can push to subdirs of central repo. Vadim Gelfer <vadim.gelfer@gmail.com> parents: diff changeset	195
6766 e81d2bd66908 acl: refactoring Matt Mackall <mpm@selenic.com> parents: 6750 diff changeset	196 def buildmatch(ui, repo, user, key):
e81d2bd66908 acl: refactoring Matt Mackall <mpm@selenic.com> parents: 6750 diff changeset	197 '''return tuple of (match function, list enabled).'''
e81d2bd66908 acl: refactoring Matt Mackall <mpm@selenic.com> parents: 6750 diff changeset	198 if not ui.has_section(key):
9467 4c041f1ee1b4 do not attempt to translate ui.debug output Martin Geisler <mg@lazybytes.net> parents: 9250 diff changeset	199 ui.debug('acl: %s not enabled\n' % key)
6766 e81d2bd66908 acl: refactoring Matt Mackall <mpm@selenic.com> parents: 6750 diff changeset	200 return None
2344 ae12e5a2c4a3 add acl extension, to limit who can push to subdirs of central repo. Vadim Gelfer <vadim.gelfer@gmail.com> parents: diff changeset	201
6766 e81d2bd66908 acl: refactoring Matt Mackall <mpm@selenic.com> parents: 6750 diff changeset	202 pats = [pat for pat, users in ui.configitems(key)
11114 62714143742f acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11095 diff changeset	203 if _usermatch(ui, user, users)]
9467 4c041f1ee1b4 do not attempt to translate ui.debug output Martin Geisler <mg@lazybytes.net> parents: 9250 diff changeset	204 ui.debug('acl: %s enabled, %d entries for user %s\n' %
6766 e81d2bd66908 acl: refactoring Matt Mackall <mpm@selenic.com> parents: 6750 diff changeset	205 (key, len(pats), user))
11092 2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	206
16765 754e98e0a615 acl: added some comments to easily identify branch- and path-based verifications Elifarley Callado Coelho Cruz parents: 16764 diff changeset	207 # Branch-based ACL
11092 2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	208 if not repo:
2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	209 if pats:
16766 9d778f80ad2a acl: perform some computations earlier, so that returned lambda functions are simpler Elifarley Callado Coelho Cruz parents: 16765 diff changeset	210 # If there's an asterisk (meaning "any branch"), always return True;
9d778f80ad2a acl: perform some computations earlier, so that returned lambda functions are simpler Elifarley Callado Coelho Cruz parents: 16765 diff changeset	211 # Otherwise, test if b is in pats
9d778f80ad2a acl: perform some computations earlier, so that returned lambda functions are simpler Elifarley Callado Coelho Cruz parents: 16765 diff changeset	212 if '*' in pats:
9d778f80ad2a acl: perform some computations earlier, so that returned lambda functions are simpler Elifarley Callado Coelho Cruz parents: 16765 diff changeset	213 return util.always
9d778f80ad2a acl: perform some computations earlier, so that returned lambda functions are simpler Elifarley Callado Coelho Cruz parents: 16765 diff changeset	214 return lambda b: b in pats
16764 ffb68b9dbaa9 acl: 'util.never' used Elifarley Callado Coelho Cruz parents: 16763 diff changeset	215 return util.never
11092 2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	216
16765 754e98e0a615 acl: added some comments to easily identify branch- and path-based verifications Elifarley Callado Coelho Cruz parents: 16764 diff changeset	217 # Path-based ACL
6766 e81d2bd66908 acl: refactoring Matt Mackall <mpm@selenic.com> parents: 6750 diff changeset	218 if pats:
8567 fea40a677d43 match: add some default args Matt Mackall <mpm@selenic.com> parents: 8566 diff changeset	219 return match.match(repo.root, '', pats)
16767 363bde4224c8 acl: 'util.never' can be used instead of a more complex expression Elifarley Callado Coelho Cruz parents: 16766 diff changeset	220 return util.never
2344 ae12e5a2c4a3 add acl extension, to limit who can push to subdirs of central repo. Vadim Gelfer <vadim.gelfer@gmail.com> parents: diff changeset	221
ae12e5a2c4a3 add acl extension, to limit who can push to subdirs of central repo. Vadim Gelfer <vadim.gelfer@gmail.com> parents: diff changeset	222 def hook(ui, repo, hooktype, node=None, source=None, **kwargs):
10955 470a6ace7574 Added support for 'pretxncommit', so that one can call the ACL hook at Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 10801 diff changeset	223 if hooktype not in ['pretxnchangegroup', 'pretxncommit']:
2344 ae12e5a2c4a3 add acl extension, to limit who can push to subdirs of central repo. Vadim Gelfer <vadim.gelfer@gmail.com> parents: diff changeset	224 raise util.Abort(_('config error - hook type "%s" cannot stop '
10955 470a6ace7574 Added support for 'pretxncommit', so that one can call the ACL hook at Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 10801 diff changeset	225 'incoming changesets nor commits') % hooktype)
470a6ace7574 Added support for 'pretxncommit', so that one can call the ACL hook at Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 10801 diff changeset	226 if (hooktype == 'pretxnchangegroup' and
470a6ace7574 Added support for 'pretxncommit', so that one can call the ACL hook at Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 10801 diff changeset	227 source not in ui.config('acl', 'sources', 'serve').split()):
9467 4c041f1ee1b4 do not attempt to translate ui.debug output Martin Geisler <mg@lazybytes.net> parents: 9250 diff changeset	228 ui.debug('acl: changes have source "%s" - skipping\n' % source)
2344 ae12e5a2c4a3 add acl extension, to limit who can push to subdirs of central repo. Vadim Gelfer <vadim.gelfer@gmail.com> parents: diff changeset	229 return
ae12e5a2c4a3 add acl extension, to limit who can push to subdirs of central repo. Vadim Gelfer <vadim.gelfer@gmail.com> parents: diff changeset	230
8846 b30775386d40 acl: support for getting authenticated user from web server (issue298) Henrik Stuart <hg@hstuart.dk> parents: 8682 diff changeset	231 user = None
b30775386d40 acl: support for getting authenticated user from web server (issue298) Henrik Stuart <hg@hstuart.dk> parents: 8682 diff changeset	232 if source == 'serve' and 'url' in kwargs:
b30775386d40 acl: support for getting authenticated user from web server (issue298) Henrik Stuart <hg@hstuart.dk> parents: 8682 diff changeset	233 url = kwargs['url'].split(':')
b30775386d40 acl: support for getting authenticated user from web server (issue298) Henrik Stuart <hg@hstuart.dk> parents: 8682 diff changeset	234 if url[0] == 'remote' and url[1].startswith('http'):
9018 5ed463d0ebdb acl: read correct index into url for username (issue298) Henrik Stuart <hg@hstuart.dk> parents: 8935 diff changeset	235 user = urllib.unquote(url[3])
8846 b30775386d40 acl: support for getting authenticated user from web server (issue298) Henrik Stuart <hg@hstuart.dk> parents: 8682 diff changeset	236
b30775386d40 acl: support for getting authenticated user from web server (issue298) Henrik Stuart <hg@hstuart.dk> parents: 8682 diff changeset	237 if user is None:
b30775386d40 acl: support for getting authenticated user from web server (issue298) Henrik Stuart <hg@hstuart.dk> parents: 8682 diff changeset	238 user = getpass.getuser()
b30775386d40 acl: support for getting authenticated user from web server (issue298) Henrik Stuart <hg@hstuart.dk> parents: 8682 diff changeset	239
15207 0f7f9f06c759 acl: more descriptive error messages Elifarley Callado Coelho Cruz parents: 12778 diff changeset	240 ui.debug('acl: checking access for user "%s"\n' % user)
0f7f9f06c759 acl: more descriptive error messages Elifarley Callado Coelho Cruz parents: 12778 diff changeset	241
6766 e81d2bd66908 acl: refactoring Matt Mackall <mpm@selenic.com> parents: 6750 diff changeset	242 cfg = ui.config('acl', 'config')
e81d2bd66908 acl: refactoring Matt Mackall <mpm@selenic.com> parents: 6750 diff changeset	243 if cfg:
11114 62714143742f acl: support for group definitions in section [acl.groups], which take precedence over OS-level groups Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11095 diff changeset	244 ui.readconfig(cfg, sections = ['acl.groups', 'acl.allow.branches',
11092 2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	245 'acl.deny.branches', 'acl.allow', 'acl.deny'])
2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	246
2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	247 allowbranches = buildmatch(ui, None, user, 'acl.allow.branches')
2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	248 denybranches = buildmatch(ui, None, user, 'acl.deny.branches')
6766 e81d2bd66908 acl: refactoring Matt Mackall <mpm@selenic.com> parents: 6750 diff changeset	249 allow = buildmatch(ui, repo, user, 'acl.allow')
e81d2bd66908 acl: refactoring Matt Mackall <mpm@selenic.com> parents: 6750 diff changeset	250 deny = buildmatch(ui, repo, user, 'acl.deny')
e81d2bd66908 acl: refactoring Matt Mackall <mpm@selenic.com> parents: 6750 diff changeset	251
e81d2bd66908 acl: refactoring Matt Mackall <mpm@selenic.com> parents: 6750 diff changeset	252 for rev in xrange(repo[node], len(repo)):
e81d2bd66908 acl: refactoring Matt Mackall <mpm@selenic.com> parents: 6750 diff changeset	253 ctx = repo[rev]
11092 2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	254 branch = ctx.branch()
2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	255 if denybranches and denybranches(branch):
2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	256 raise util.Abort(_('acl: user "%s" denied on branch "%s"'
2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	257 ' (changeset "%s")')
2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	258 % (user, branch, ctx))
2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	259 if allowbranches and not allowbranches(branch):
2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	260 raise util.Abort(_('acl: user "%s" not allowed on branch "%s"'
2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	261 ' (changeset "%s")')
2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	262 % (user, branch, ctx))
2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	263 ui.debug('acl: branch access granted: "%s" on branch "%s"\n'
2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	264 % (ctx, branch))
2dd91779eb27 acl: add support for branch-based access control Elifarley Callado Coelho Cruz <elifarley@gmail.com> parents: 11058 diff changeset	265
6766 e81d2bd66908 acl: refactoring Matt Mackall <mpm@selenic.com> parents: 6750 diff changeset	266 for f in ctx.files():
e81d2bd66908 acl: refactoring Matt Mackall <mpm@selenic.com> parents: 6750 diff changeset	267 if deny and deny(f):
15207 0f7f9f06c759 acl: more descriptive error messages Elifarley Callado Coelho Cruz parents: 12778 diff changeset	268 raise util.Abort(_('acl: user "%s" denied on "%s"'
0f7f9f06c759 acl: more descriptive error messages Elifarley Callado Coelho Cruz parents: 12778 diff changeset	269 ' (changeset "%s")') % (user, f, ctx))
6766 e81d2bd66908 acl: refactoring Matt Mackall <mpm@selenic.com> parents: 6750 diff changeset	270 if allow and not allow(f):
15207 0f7f9f06c759 acl: more descriptive error messages Elifarley Callado Coelho Cruz parents: 12778 diff changeset	271 raise util.Abort(_('acl: user "%s" not allowed on "%s"'
0f7f9f06c759 acl: more descriptive error messages Elifarley Callado Coelho Cruz parents: 12778 diff changeset	272 ' (changeset "%s")') % (user, f, ctx))
0f7f9f06c759 acl: more descriptive error messages Elifarley Callado Coelho Cruz parents: 12778 diff changeset	273 ui.debug('acl: path access granted: "%s"\n' % ctx)

Mercurial > public > mercurial-scm > hg

annotate hgext/acl.py @ 16956:c49cf339b5bb