Examples with AccessPermission com.gitblit.Constants.AccessPermission used on opensource projects

Example 6 with AccessPermission

use of com.gitblit.Constants.AccessPermission in project gitblit by gitblit.

the class ServicesManager method getRepositoryUrls.

/**
	 * Returns a list of repository URLs and the user access permission.
	 *
	 * @param request
	 * @param user
	 * @param repository
	 * @return a list of repository urls
	 */
@Override
public List<RepositoryUrl> getRepositoryUrls(HttpServletRequest request, UserModel user, RepositoryModel repository) {
    if (user == null) {
        user = UserModel.ANONYMOUS;
    }
    String username = StringUtils.encodeUsername(UserModel.ANONYMOUS.equals(user) ? "" : user.username);
    List<RepositoryUrl> list = new ArrayList<RepositoryUrl>();
    // http/https url
    if (settings.getBoolean(Keys.git.enableGitServlet, true) && settings.getBoolean(Keys.web.showHttpServletUrls, true)) {
        AccessPermission permission = user.getRepositoryPermission(repository).permission;
        if (permission.exceeds(AccessPermission.NONE)) {
            String repoUrl = getRepositoryUrl(request, username, repository);
            Transport transport = Transport.fromUrl(repoUrl);
            if (permission.atLeast(AccessPermission.PUSH) && !acceptsPush(transport)) {
                // downgrade the repo permission for this transport
                // because it is not an acceptable PUSH transport
                permission = AccessPermission.CLONE;
            }
            list.add(new RepositoryUrl(repoUrl, permission));
        }
    }
    // ssh daemon url
    String sshDaemonUrl = getSshDaemonUrl(request, user, repository);
    if (!StringUtils.isEmpty(sshDaemonUrl) && settings.getBoolean(Keys.web.showSshDaemonUrls, true)) {
        AccessPermission permission = user.getRepositoryPermission(repository).permission;
        if (permission.exceeds(AccessPermission.NONE)) {
            if (permission.atLeast(AccessPermission.PUSH) && !acceptsPush(Transport.SSH)) {
                // downgrade the repo permission for this transport
                // because it is not an acceptable PUSH transport
                permission = AccessPermission.CLONE;
            }
            list.add(new RepositoryUrl(sshDaemonUrl, permission));
        }
    }
    // git daemon url
    String gitDaemonUrl = getGitDaemonUrl(request, user, repository);
    if (!StringUtils.isEmpty(gitDaemonUrl) && settings.getBoolean(Keys.web.showGitDaemonUrls, true)) {
        AccessPermission permission = getGitDaemonAccessPermission(user, repository);
        if (permission.exceeds(AccessPermission.NONE)) {
            if (permission.atLeast(AccessPermission.PUSH) && !acceptsPush(Transport.GIT)) {
                // downgrade the repo permission for this transport
                // because it is not an acceptable PUSH transport
                permission = AccessPermission.CLONE;
            }
            list.add(new RepositoryUrl(gitDaemonUrl, permission));
        }
    }
    // add all other urls
    // {0} = repository
    // {1} = username
    boolean advertisePermsForOther = settings.getBoolean(Keys.web.advertiseAccessPermissionForOtherUrls, false);
    for (String url : settings.getStrings(Keys.web.otherUrls)) {
        String externalUrl = null;
        if (url.contains("{1}")) {
            // external url requires username, only add url IF we have one
            if (StringUtils.isEmpty(username)) {
                continue;
            } else {
                externalUrl = MessageFormat.format(url, repository.name, username);
            }
        } else {
            // external url does not require username, just do repo name formatting
            externalUrl = MessageFormat.format(url, repository.name);
        }
        AccessPermission permission = null;
        if (advertisePermsForOther) {
            permission = user.getRepositoryPermission(repository).permission;
            if (permission.exceeds(AccessPermission.NONE)) {
                Transport transport = Transport.fromUrl(externalUrl);
                if (permission.atLeast(AccessPermission.PUSH) && !acceptsPush(transport)) {
                    // downgrade the repo permission for this transport
                    // because it is not an acceptable PUSH transport
                    permission = AccessPermission.CLONE;
                }
            }
        }
        list.add(new RepositoryUrl(externalUrl, permission));
    }
    // sort transports by highest permission and then by transport security
    Collections.sort(list, new Comparator<RepositoryUrl>() {

        @Override
        public int compare(RepositoryUrl o1, RepositoryUrl o2) {
            if (o1.hasPermission() && !o2.hasPermission()) {
                // prefer known permission items over unknown
                return -1;
            } else if (!o1.hasPermission() && o2.hasPermission()) {
                // prefer known permission items over unknown
                return 1;
            } else if (!o1.hasPermission() && !o2.hasPermission()) {
                // sort by Transport ordinal
                return o1.transport.compareTo(o2.transport);
            } else if (o1.permission.exceeds(o2.permission)) {
                // prefer highest permission
                return -1;
            } else if (o2.permission.exceeds(o1.permission)) {
                // prefer highest permission
                return 1;
            }
            // prefer more secure transports
            return o1.transport.compareTo(o2.transport);
        }
    });
    // consider the user's transport preference
    RepositoryUrl preferredUrl = null;
    Transport preferredTransport = user.getPreferences().getTransport();
    if (preferredTransport != null) {
        Iterator<RepositoryUrl> itr = list.iterator();
        while (itr.hasNext()) {
            RepositoryUrl url = itr.next();
            if (url.transport.equals(preferredTransport)) {
                itr.remove();
                preferredUrl = url;
                break;
            }
        }
    }
    if (preferredUrl != null) {
        list.add(0, preferredUrl);
    }
    return list;
}

Example 7 with AccessPermission

use of com.gitblit.Constants.AccessPermission in project gitblit by gitblit.

the class TeamModel method getRepositoryPermission.

public RegistrantAccessPermission getRepositoryPermission(RepositoryModel repository) {
    RegistrantAccessPermission ap = new RegistrantAccessPermission();
    ap.registrant = name;
    ap.registrantType = RegistrantType.TEAM;
    ap.permission = AccessPermission.NONE;
    ap.mutable = false;
    // determine maximum permission for the repository
    final AccessPermission maxPermission = (repository.isFrozen || !repository.isBare || repository.isMirror) ? AccessPermission.CLONE : AccessPermission.REWIND;
    if (AccessRestrictionType.NONE.equals(repository.accessRestriction)) {
        // anonymous rewind
        ap.permissionType = PermissionType.ANONYMOUS;
        if (AccessPermission.REWIND.atMost(maxPermission)) {
            ap.permission = AccessPermission.REWIND;
        } else {
            ap.permission = maxPermission;
        }
        return ap;
    }
    if (canAdmin) {
        ap.permissionType = PermissionType.ADMINISTRATOR;
        if (AccessPermission.REWIND.atMost(maxPermission)) {
            ap.permission = AccessPermission.REWIND;
        } else {
            ap.permission = maxPermission;
        }
        return ap;
    }
    if (permissions.containsKey(repository.name.toLowerCase())) {
        // exact repository permission specified
        AccessPermission p = permissions.get(repository.name.toLowerCase());
        if (p != null && repository.accessRestriction.isValidPermission(p)) {
            ap.permissionType = PermissionType.EXPLICIT;
            if (p.atMost(maxPermission)) {
                ap.permission = p;
            } else {
                ap.permission = maxPermission;
            }
            ap.mutable = true;
            return ap;
        }
    } else {
        // search for case-insensitive regex permission match
        for (String key : permissions.keySet()) {
            if (StringUtils.matchesIgnoreCase(repository.name, key)) {
                AccessPermission p = permissions.get(key);
                if (p != null && repository.accessRestriction.isValidPermission(p)) {
                    // take first match
                    ap.permissionType = PermissionType.REGEX;
                    if (p.atMost(maxPermission)) {
                        ap.permission = p;
                    } else {
                        ap.permission = maxPermission;
                    }
                    ap.source = key;
                    return ap;
                }
            }
        }
    }
    // still no explicit or regex, check for implicit permissions
    if (AccessPermission.NONE == ap.permission) {
        switch(repository.accessRestriction) {
            case VIEW:
                // no implicit permissions possible
                break;
            case CLONE:
                // implied view permission
                ap.permission = AccessPermission.VIEW;
                ap.permissionType = PermissionType.ANONYMOUS;
                break;
            case PUSH:
                // implied clone permission
                ap.permission = AccessPermission.CLONE;
                ap.permissionType = PermissionType.ANONYMOUS;
                break;
            case NONE:
                // implied REWIND or CLONE
                ap.permission = maxPermission;
                ap.permissionType = PermissionType.ANONYMOUS;
                break;
        }
    }
    return ap;
}

Example 8 with AccessPermission

use of com.gitblit.Constants.AccessPermission in project gitblit by gitblit.

the class TeamModel method getRepositoryPermissions.

/**
	 * Returns a list of repository permissions for this team.
	 *
	 * @return the team's list of permissions
	 */
public List<RegistrantAccessPermission> getRepositoryPermissions() {
    List<RegistrantAccessPermission> list = new ArrayList<RegistrantAccessPermission>();
    if (canAdmin) {
        // team has REWIND access to all repositories
        return list;
    }
    for (Map.Entry<String, AccessPermission> entry : permissions.entrySet()) {
        String registrant = entry.getKey();
        String source = null;
        boolean editable = true;
        PermissionType pType = PermissionType.EXPLICIT;
        if (StringUtils.findInvalidCharacter(registrant) != null) {
            // a regex will have at least 1 invalid character
            pType = PermissionType.REGEX;
            source = registrant;
        }
        list.add(new RegistrantAccessPermission(registrant, entry.getValue(), pType, RegistrantType.REPOSITORY, source, editable));
    }
    Collections.sort(list);
    return list;
}

Example 9 with AccessPermission

use of com.gitblit.Constants.AccessPermission in project gitblit by gitblit.

the class TeamModel method addRepositoryPermission.

/**
	 * Adds a repository permission to the team.
	 * <p>
	 * Role may be formatted as:
	 * <ul>
	 * <li> myrepo.git <i>(this is implicitly RW+)</i>
	 * <li> RW+:myrepo.git
	 * </ul>
	 * @param role
	 */
public void addRepositoryPermission(String role) {
    AccessPermission permission = AccessPermission.permissionFromRole(role);
    String repository = AccessPermission.repositoryFromRole(role).toLowerCase();
    repositories.add(repository);
    permissions.put(repository, permission);
}

Example 10 with AccessPermission

use of com.gitblit.Constants.AccessPermission in project gitblit by gitblit.

the class UserModel method getRepositoryPermission.

public RegistrantAccessPermission getRepositoryPermission(RepositoryModel repository) {
    RegistrantAccessPermission ap = new RegistrantAccessPermission();
    ap.registrant = username;
    ap.registrantType = RegistrantType.USER;
    ap.permission = AccessPermission.NONE;
    ap.mutable = false;
    // determine maximum permission for the repository
    final AccessPermission maxPermission = (repository.isFrozen || !repository.isBare || repository.isMirror) ? AccessPermission.CLONE : AccessPermission.REWIND;
    if (AccessRestrictionType.NONE.equals(repository.accessRestriction)) {
        // anonymous rewind
        ap.permissionType = PermissionType.ANONYMOUS;
        if (AccessPermission.REWIND.atMost(maxPermission)) {
            ap.permission = AccessPermission.REWIND;
        } else {
            ap.permission = maxPermission;
        }
        return ap;
    }
    // administrator
    if (canAdmin()) {
        ap.permissionType = PermissionType.ADMINISTRATOR;
        if (AccessPermission.REWIND.atMost(maxPermission)) {
            ap.permission = AccessPermission.REWIND;
        } else {
            ap.permission = maxPermission;
        }
        if (!canAdmin) {
            // administator permission from team membership
            for (TeamModel team : teams) {
                if (team.canAdmin) {
                    ap.source = team.name;
                    break;
                }
            }
        }
        return ap;
    }
    // repository owner - either specified owner or personal repository
    if (repository.isOwner(username) || repository.isUsersPersonalRepository(username)) {
        ap.permissionType = PermissionType.OWNER;
        if (AccessPermission.REWIND.atMost(maxPermission)) {
            ap.permission = AccessPermission.REWIND;
        } else {
            ap.permission = maxPermission;
        }
        return ap;
    }
    if (AuthorizationControl.AUTHENTICATED.equals(repository.authorizationControl) && isAuthenticated) {
        // AUTHENTICATED is a shortcut for authorizing all logged-in users RW+ access
        if (AccessPermission.REWIND.atMost(maxPermission)) {
            ap.permission = AccessPermission.REWIND;
        } else {
            ap.permission = maxPermission;
        }
        return ap;
    }
    // if that fails, then the best team permission is used
    if (permissions.containsKey(repository.name.toLowerCase())) {
        // exact repository permission specified, use it
        AccessPermission p = permissions.get(repository.name.toLowerCase());
        if (p != null && repository.accessRestriction.isValidPermission(p)) {
            ap.permissionType = PermissionType.EXPLICIT;
            if (p.atMost(maxPermission)) {
                ap.permission = p;
            } else {
                ap.permission = maxPermission;
            }
            ap.mutable = true;
            return ap;
        }
    } else {
        // search for case-insensitive regex permission match
        for (String key : permissions.keySet()) {
            if (StringUtils.matchesIgnoreCase(repository.name, key)) {
                AccessPermission p = permissions.get(key);
                if (p != null && repository.accessRestriction.isValidPermission(p)) {
                    // take first match
                    ap.permissionType = PermissionType.REGEX;
                    if (p.atMost(maxPermission)) {
                        ap.permission = p;
                    } else {
                        ap.permission = maxPermission;
                    }
                    ap.source = key;
                    return ap;
                }
            }
        }
    }
    // try to find a team match
    for (TeamModel team : teams) {
        RegistrantAccessPermission p = team.getRepositoryPermission(repository);
        if (p.permission.atMost(maxPermission) && p.permission.exceeds(ap.permission) && PermissionType.ANONYMOUS != p.permissionType) {
            // use highest team permission that is not an implicit permission
            ap.permission = p.permission;
            ap.source = team.name;
            ap.permissionType = PermissionType.TEAM;
        }
    }
    // still no explicit, regex, or team match, check for implicit permissions
    if (AccessPermission.NONE == ap.permission) {
        switch(repository.accessRestriction) {
            case VIEW:
                // no implicit permissions possible
                break;
            case CLONE:
                // implied view permission
                ap.permission = AccessPermission.VIEW;
                ap.permissionType = PermissionType.ANONYMOUS;
                break;
            case PUSH:
                // implied clone permission
                ap.permission = AccessPermission.CLONE;
                ap.permissionType = PermissionType.ANONYMOUS;
                break;
            case NONE:
                // implied REWIND or CLONE
                ap.permission = maxPermission;
                ap.permissionType = PermissionType.ANONYMOUS;
                break;
        }
    }
    return ap;
}