Examples with PermissionDeniedException com.google.gerrit.common.errors.PermissionDeniedException used on opensource projects

Example 1 with PermissionDeniedException

use of com.google.gerrit.common.errors.PermissionDeniedException in project gerrit by GerritCodeReview.

the class ProjectAccessHandler method call.

@Override
public final T call() throws NoSuchProjectException, IOException, ConfigInvalidException, InvalidNameException, NoSuchGroupException, OrmException, UpdateParentFailedException, PermissionDeniedException, PermissionBackendException {
    final ProjectControl projectControl = projectControlFactory.controlFor(projectName);
    Capable r = projectControl.canPushToAtLeastOneRef();
    if (r != Capable.OK) {
        throw new PermissionDeniedException(r.getMessage());
    }
    try (MetaDataUpdate md = metaDataUpdateFactory.create(projectName)) {
        ProjectConfig config = ProjectConfig.read(md, base);
        Set<String> toDelete = scanSectionNames(config);
        for (AccessSection section : mergeSections(sectionList)) {
            String name = section.getName();
            if (AccessSection.GLOBAL_CAPABILITIES.equals(name)) {
                if (checkIfOwner && !projectControl.isOwner()) {
                    continue;
                }
                replace(config, toDelete, section);
            } else if (AccessSection.isValid(name)) {
                if (checkIfOwner && !projectControl.controlForRef(name).isOwner()) {
                    continue;
                }
                RefPattern.validate(name);
                replace(config, toDelete, section);
            }
        }
        for (String name : toDelete) {
            if (AccessSection.GLOBAL_CAPABILITIES.equals(name)) {
                if (!checkIfOwner || projectControl.isOwner()) {
                    config.remove(config.getAccessSection(name));
                }
            } else if (!checkIfOwner || projectControl.controlForRef(name).isOwner()) {
                config.remove(config.getAccessSection(name));
            }
        }
        boolean parentProjectUpdate = false;
        if (!config.getProject().getNameKey().equals(allProjects) && !config.getProject().getParent(allProjects).equals(parentProjectName)) {
            parentProjectUpdate = true;
            try {
                setParent.get().validateParentUpdate(projectControl, MoreObjects.firstNonNull(parentProjectName, allProjects).get(), checkIfOwner);
            } catch (AuthException e) {
                throw new UpdateParentFailedException("You are not allowed to change the parent project since you are " + "not an administrator. You may save the modifications for review " + "so that an administrator can approve them.", e);
            } catch (ResourceConflictException | UnprocessableEntityException e) {
                throw new UpdateParentFailedException(e.getMessage(), e);
            }
            config.getProject().setParentName(parentProjectName);
        }
        if (message != null && !message.isEmpty()) {
            if (!message.endsWith("\n")) {
                message += "\n";
            }
            md.setMessage(message);
        } else {
            md.setMessage("Modify access rules\n");
        }
        return updateProjectConfig(projectControl, config, md, parentProjectUpdate);
    } catch (RepositoryNotFoundException notFound) {
        throw new NoSuchProjectException(projectName);
    }
}

Example 2 with PermissionDeniedException

use of com.google.gerrit.common.errors.PermissionDeniedException in project gerrit by GerritCodeReview.

the class ReviewProjectAccess method updateProjectConfig.

// TODO(dborowitz): Hack MetaDataUpdate so it can be created within a BatchUpdate and we can avoid
// calling setUpdateRef(false).
@SuppressWarnings("deprecation")
@Override
protected Change.Id updateProjectConfig(ProjectControl projectControl, ProjectConfig config, MetaDataUpdate md, boolean parentProjectUpdate) throws IOException, OrmException, PermissionDeniedException {
    RefControl refsMetaConfigControl = projectControl.controlForRef(RefNames.REFS_CONFIG);
    if (!refsMetaConfigControl.isVisible()) {
        throw new PermissionDeniedException(RefNames.REFS_CONFIG + " not visible");
    }
    if (!projectControl.isOwner() && !refsMetaConfigControl.canUpload()) {
        throw new PermissionDeniedException("cannot upload to " + RefNames.REFS_CONFIG);
    }
    md.setInsertChangeId(true);
    Change.Id changeId = new Change.Id(seq.nextChangeId());
    RevCommit commit = config.commitToNewRef(md, new PatchSet.Id(changeId, Change.INITIAL_PATCH_SET_ID).toRefName());
    if (commit.getId().equals(base)) {
        return null;
    }
    try (ObjectInserter objInserter = md.getRepository().newObjectInserter();
        ObjectReader objReader = objInserter.newReader();
        RevWalk rw = new RevWalk(objReader);
        BatchUpdate bu = updateFactory.create(db, config.getProject().getNameKey(), projectControl.getUser(), TimeUtil.nowTs())) {
        bu.setRepository(md.getRepository(), rw, objInserter);
        bu.insertChange(changeInserterFactory.create(changeId, commit, RefNames.REFS_CONFIG).setValidate(false).setUpdateRef(// Created by commitToNewRef.
        false));
        bu.execute();
    } catch (UpdateException | RestApiException e) {
        throw new IOException(e);
    }
    ChangeResource rsrc;
    try {
        rsrc = changes.parse(changeId);
    } catch (ResourceNotFoundException e) {
        throw new IOException(e);
    }
    addProjectOwnersAsReviewers(rsrc);
    if (parentProjectUpdate) {
        addAdministratorsAsReviewers(rsrc);
    }
    return changeId;
}

Example 3 with PermissionDeniedException

use of com.google.gerrit.common.errors.PermissionDeniedException in project gerrit by GerritCodeReview.

the class BanCommit method ban.

public BanCommitResult ban(final ProjectControl projectControl, final List<ObjectId> commitsToBan, final String reason) throws PermissionDeniedException, IOException, ConcurrentRefUpdateException {
    if (!projectControl.isOwner()) {
        throw new PermissionDeniedException("Not project owner: not permitted to ban commits");
    }
    final BanCommitResult result = new BanCommitResult();
    NoteMap banCommitNotes = NoteMap.newEmptyMap();
    // Add a note for each banned commit to notes.
    final Project.NameKey project = projectControl.getProject().getNameKey();
    try (Repository repo = repoManager.openRepository(project);
        RevWalk revWalk = new RevWalk(repo);
        ObjectInserter inserter = repo.newObjectInserter()) {
        ObjectId noteId = null;
        for (final ObjectId commitToBan : commitsToBan) {
            try {
                revWalk.parseCommit(commitToBan);
            } catch (MissingObjectException e) {
            // Ignore exception, non-existing commits can be banned.
            } catch (IncorrectObjectTypeException e) {
                result.notACommit(commitToBan);
                continue;
            }
            if (noteId == null) {
                noteId = createNoteContent(reason, inserter);
            }
            banCommitNotes.set(commitToBan, noteId);
        }
        NotesBranchUtil notesBranchUtil = notesBranchUtilFactory.create(project, repo, inserter);
        NoteMap newlyCreated = notesBranchUtil.commitNewNotes(banCommitNotes, REFS_REJECT_COMMITS, createPersonIdent(), buildCommitMessage(commitsToBan, reason));
        for (Note n : banCommitNotes) {
            if (newlyCreated.contains(n)) {
                result.commitBanned(n);
            } else {
                result.commitAlreadyBanned(n);
            }
        }
        return result;
    }
}

Example 4 with PermissionDeniedException

use of com.google.gerrit.common.errors.PermissionDeniedException in project gerrit by GerritCodeReview.

the class BanCommit method apply.

@Override
public BanResultInfo apply(ProjectResource rsrc, Input input) throws UnprocessableEntityException, AuthException, ResourceConflictException, IOException {
    BanResultInfo r = new BanResultInfo();
    if (input != null && input.commits != null && !input.commits.isEmpty()) {
        List<ObjectId> commitsToBan = new ArrayList<>(input.commits.size());
        for (String c : input.commits) {
            try {
                commitsToBan.add(ObjectId.fromString(c));
            } catch (IllegalArgumentException e) {
                throw new UnprocessableEntityException(e.getMessage());
            }
        }
        try {
            BanCommitResult result = banCommit.ban(rsrc.getControl(), commitsToBan, input.reason);
            r.newlyBanned = transformCommits(result.getNewlyBannedCommits());
            r.alreadyBanned = transformCommits(result.getAlreadyBannedCommits());
            r.ignored = transformCommits(result.getIgnoredObjectIds());
        } catch (PermissionDeniedException e) {
            throw new AuthException(e.getMessage());
        } catch (ConcurrentRefUpdateException e) {
            throw new ResourceConflictException(e.getMessage(), e);
        }
    }
    return r;
}