Examples with AccessSection com.google.gerrit.common.data.AccessSection used on opensource projects

Example 1 with AccessSection

use of com.google.gerrit.common.data.AccessSection in project gerrit by GerritCodeReview.

the class Schema_135 method migrateData.

@Override
protected void migrateData(ReviewDb db, UpdateUI ui) throws OrmException {
    try (Repository git = repoManager.openRepository(allProjectsName);
        MetaDataUpdate md = new MetaDataUpdate(GitReferenceUpdated.DISABLED, allProjectsName, git)) {
        ProjectConfig config = ProjectConfig.read(md);
        AccessSection meta = config.getAccessSection(RefNames.REFS_CONFIG, true);
        Permission createRefsMetaConfigPermission = meta.getPermission(Permission.CREATE, true);
        Set<GroupReference> groups = Stream.concat(config.getAccessSection(AccessSection.GLOBAL_CAPABILITIES, true).getPermission(GlobalCapability.ADMINISTRATE_SERVER, true).getRules().stream().map(PermissionRule::getGroup), Stream.of(systemGroupBackend.getGroup(PROJECT_OWNERS))).filter(g -> createRefsMetaConfigPermission.getRule(g) == null).collect(toSet());
        for (GroupReference group : groups) {
            createRefsMetaConfigPermission.add(new PermissionRule(config.resolve(group)));
        }
        md.getCommitBuilder().setAuthor(serverUser);
        md.getCommitBuilder().setCommitter(serverUser);
        md.setMessage(COMMIT_MSG);
        config.commit(md);
    } catch (ConfigInvalidException | IOException ex) {
        throw new OrmException(ex);
    }
}

Example 2 with AccessSection

use of com.google.gerrit.common.data.AccessSection in project gerrit by GerritCodeReview.

the class ProjectAccessEditor method setValue.

@Override
public void setValue(ProjectAccess value) {
    // possible to add permissions to it.
    if (editing && value.isOwnerOf(AccessSection.GLOBAL_CAPABILITIES) && value.getLocal(AccessSection.GLOBAL_CAPABILITIES) == null) {
        value.getLocal().add(0, new AccessSection(AccessSection.GLOBAL_CAPABILITIES));
    }
    this.value = value;
    Project.NameKey parent = value.getInheritsFrom();
    if (parent != null) {
        inheritsFrom.getStyle().setDisplay(Display.BLOCK);
        parentProject.setText(parent.get());
        //
        parentProject.setTargetHistoryToken(Dispatcher.toProjectAdmin(parent, ProjectScreen.ACCESS));
        parentProjectBox.setVisible(editing);
        parentProjectBox.setProject(value.getProjectName());
        parentProjectBox.setParentProject(value.getInheritsFrom());
        parentProject.setVisible(!parentProjectBox.isVisible());
    } else {
        inheritsFrom.getStyle().setDisplay(Display.NONE);
    }
    setUpWebLinks();
    addSection.setVisible(editing && (!value.getOwnerOf().isEmpty() || value.canUpload()));
}

Example 3 with AccessSection

use of com.google.gerrit.common.data.AccessSection in project gerrit by GerritCodeReview.

the class ProjectConfig method saveAccessSections.

private void saveAccessSections(Config rc, Set<AccountGroup.UUID> keepGroups) {
    AccessSection capability = accessSections.get(AccessSection.GLOBAL_CAPABILITIES);
    if (capability != null) {
        Set<String> have = new HashSet<>();
        for (Permission permission : sort(capability.getPermissions())) {
            have.add(permission.getName().toLowerCase());
            boolean needRange = GlobalCapability.hasRange(permission.getName());
            List<String> rules = new ArrayList<>();
            for (PermissionRule rule : sort(permission.getRules())) {
                GroupReference group = resolve(rule.getGroup());
                if (group.getUUID() != null) {
                    keepGroups.add(group.getUUID());
                }
                rules.add(rule.asString(needRange));
            }
            rc.setStringList(CAPABILITY, null, permission.getName(), rules);
        }
        for (String varName : rc.getNames(CAPABILITY)) {
            if (!have.contains(varName.toLowerCase())) {
                rc.unset(CAPABILITY, null, varName);
            }
        }
    } else {
        rc.unsetSection(CAPABILITY, null);
    }
    for (AccessSection as : sort(accessSections.values())) {
        String refName = as.getName();
        if (AccessSection.GLOBAL_CAPABILITIES.equals(refName)) {
            continue;
        }
        StringBuilder doNotInherit = new StringBuilder();
        for (Permission perm : sort(as.getPermissions())) {
            if (perm.getExclusiveGroup()) {
                if (0 < doNotInherit.length()) {
                    doNotInherit.append(' ');
                }
                doNotInherit.append(perm.getName());
            }
        }
        if (0 < doNotInherit.length()) {
            rc.setString(ACCESS, refName, KEY_GROUP_PERMISSIONS, doNotInherit.toString());
        } else {
            rc.unset(ACCESS, refName, KEY_GROUP_PERMISSIONS);
        }
        Set<String> have = new HashSet<>();
        for (Permission permission : sort(as.getPermissions())) {
            have.add(permission.getName().toLowerCase());
            boolean needRange = Permission.hasRange(permission.getName());
            List<String> rules = new ArrayList<>();
            for (PermissionRule rule : sort(permission.getRules())) {
                GroupReference group = resolve(rule.getGroup());
                if (group.getUUID() != null) {
                    keepGroups.add(group.getUUID());
                }
                rules.add(rule.asString(needRange));
            }
            rc.setStringList(ACCESS, refName, permission.getName(), rules);
        }
        for (String varName : rc.getNames(ACCESS, refName)) {
            if (isPermission(convertLegacyPermission(varName)) && !have.contains(varName.toLowerCase())) {
                rc.unset(ACCESS, refName, varName);
            }
        }
    }
    for (String name : rc.getSubsections(ACCESS)) {
        if (RefConfigSection.isValid(name) && !accessSections.containsKey(name)) {
            rc.unsetSection(ACCESS, name);
        }
    }
}

Example 4 with AccessSection

use of com.google.gerrit.common.data.AccessSection in project gerrit by GerritCodeReview.

the class ProjectConfig method getAccessSection.

public AccessSection getAccessSection(String name, boolean create) {
    AccessSection as = accessSections.get(name);
    if (as == null && create) {
        as = new AccessSection(name);
        accessSections.put(name, as);
    }
    return as;
}

Example 5 with AccessSection

use of com.google.gerrit.common.data.AccessSection in project gerrit by GerritCodeReview.

the class GetAccess method apply.

@Override
public ProjectAccessInfo apply(ProjectResource rsrc) throws ResourceNotFoundException, ResourceConflictException, IOException {
    // Load the current configuration from the repository, ensuring it's the most
    // recent version available. If it differs from what was in the project
    // state, force a cache flush now.
    //
    Project.NameKey projectName = rsrc.getNameKey();
    ProjectAccessInfo info = new ProjectAccessInfo();
    ProjectConfig config;
    ProjectControl pc = createProjectControl(projectName);
    RefControl metaConfigControl = pc.controlForRef(RefNames.REFS_CONFIG);
    try (MetaDataUpdate md = metaDataUpdateFactory.create(projectName)) {
        config = ProjectConfig.read(md);
        if (config.updateGroupNames(groupBackend)) {
            md.setMessage("Update group names\n");
            config.commit(md);
            projectCache.evict(config.getProject());
            pc = createProjectControl(projectName);
        } else if (config.getRevision() != null && !config.getRevision().equals(pc.getProjectState().getConfig().getRevision())) {
            projectCache.evict(config.getProject());
            pc = createProjectControl(projectName);
        }
    } catch (ConfigInvalidException e) {
        throw new ResourceConflictException(e.getMessage());
    } catch (RepositoryNotFoundException e) {
        throw new ResourceNotFoundException(rsrc.getName());
    }
    info.local = new HashMap<>();
    info.ownerOf = new HashSet<>();
    Map<AccountGroup.UUID, Boolean> visibleGroups = new HashMap<>();
    for (AccessSection section : config.getAccessSections()) {
        String name = section.getName();
        if (AccessSection.GLOBAL_CAPABILITIES.equals(name)) {
            if (pc.isOwner()) {
                info.local.put(name, createAccessSection(section));
                info.ownerOf.add(name);
            } else if (metaConfigControl.isVisible()) {
                info.local.put(section.getName(), createAccessSection(section));
            }
        } else if (RefConfigSection.isValid(name)) {
            RefControl rc = pc.controlForRef(name);
            if (rc.isOwner()) {
                info.local.put(name, createAccessSection(section));
                info.ownerOf.add(name);
            } else if (metaConfigControl.isVisible()) {
                info.local.put(name, createAccessSection(section));
            } else if (rc.isVisible()) {
                // Filter the section to only add rules describing groups that
                // are visible to the current-user. This includes any group the
                // user is a member of, as well as groups they own or that
                // are visible to all users.
                AccessSection dst = null;
                for (Permission srcPerm : section.getPermissions()) {
                    Permission dstPerm = null;
                    for (PermissionRule srcRule : srcPerm.getRules()) {
                        AccountGroup.UUID group = srcRule.getGroup().getUUID();
                        if (group == null) {
                            continue;
                        }
                        Boolean canSeeGroup = visibleGroups.get(group);
                        if (canSeeGroup == null) {
                            try {
                                canSeeGroup = groupControlFactory.controlFor(group).isVisible();
                            } catch (NoSuchGroupException e) {
                                canSeeGroup = Boolean.FALSE;
                            }
                            visibleGroups.put(group, canSeeGroup);
                        }
                        if (canSeeGroup) {
                            if (dstPerm == null) {
                                if (dst == null) {
                                    dst = new AccessSection(name);
                                    info.local.put(name, createAccessSection(dst));
                                }
                                dstPerm = dst.getPermission(srcPerm.getName(), true);
                            }
                            dstPerm.add(srcRule);
                        }
                    }
                }
            }
        }
    }
    if (info.ownerOf.isEmpty() && pc.isOwnerAnyRef()) {
        // Special case: If the section list is empty, this project has no current
        // access control information. Rely on what ProjectControl determines
        // is ownership, which probably means falling back to site administrators.
        info.ownerOf.add(AccessSection.ALL);
    }
    if (config.getRevision() != null) {
        info.revision = config.getRevision().name();
    }
    ProjectState parent = Iterables.getFirst(pc.getProjectState().parents(), null);
    if (parent != null) {
        info.inheritsFrom = projectJson.format(parent.getProject());
    }
    if (pc.getProject().getNameKey().equals(allProjectsName)) {
        if (pc.isOwner()) {
            info.ownerOf.add(AccessSection.GLOBAL_CAPABILITIES);
        }
    }
    info.isOwner = toBoolean(pc.isOwner());
    info.canUpload = toBoolean(pc.isOwner() || (metaConfigControl.isVisible() && metaConfigControl.canUpload()));
    info.canAdd = toBoolean(pc.canAddRefs());
    info.configVisible = pc.isOwner() || metaConfigControl.isVisible();
    return info;
}