Examples with PermissionRule com.google.gerrit.entities.PermissionRule used on opensource projects

Example 6 with PermissionRule

use of com.google.gerrit.entities.PermissionRule in project gerrit by GerritCodeReview.

the class ContributorAgreementsChecker method check.

/**
 * Checks if the user has signed a contributor agreement for the project.
 *
 * @throws AuthException if the user has not signed a contributor agreement for the project
 * @throws IOException if project states could not be loaded
 */
public void check(Project.NameKey project, CurrentUser user) throws IOException, AuthException {
    metrics.claCheckCount.increment();
    ProjectState projectState = projectCache.get(project).orElseThrow(() -> new IOException("Can't load " + project));
    if (!projectState.is(BooleanProjectConfig.USE_CONTRIBUTOR_AGREEMENTS)) {
        return;
    }
    if (!user.isIdentifiedUser()) {
        throw new AuthException("Must be logged in to verify Contributor Agreement");
    }
    IdentifiedUser iUser = user.asIdentifiedUser();
    Collection<ContributorAgreement> contributorAgreements = projectCache.getAllProjects().getConfig().getContributorAgreements().values();
    List<UUID> okGroupIds = new ArrayList<>();
    for (ContributorAgreement ca : contributorAgreements) {
        List<AccountGroup.UUID> groupIds;
        groupIds = okGroupIds;
        // matchProjects defaults to match all projects when missing.
        List<String> matchProjectsRegexes = ca.getMatchProjectsRegexes();
        if (!matchProjectsRegexes.isEmpty() && !projectMatchesAnyPattern(project.get(), matchProjectsRegexes)) {
            // Doesn't match, isn't checked.
            continue;
        }
        // excludeProjects defaults to exclude no projects when missing.
        List<String> excludeProjectsRegexes = ca.getExcludeProjectsRegexes();
        if (!excludeProjectsRegexes.isEmpty() && projectMatchesAnyPattern(project.get(), excludeProjectsRegexes)) {
            // Matches, isn't checked.
            continue;
        }
        for (PermissionRule rule : ca.getAccepted()) {
            if ((rule.getAction() == Action.ALLOW) && (rule.getGroup() != null) && (rule.getGroup().getUUID() != null)) {
                groupIds.add(AccountGroup.uuid(rule.getGroup().getUUID().get()));
            }
        }
    }
    if (!okGroupIds.isEmpty() && !iUser.getEffectiveGroups().containsAnyOf(okGroupIds)) {
        final StringBuilder msg = new StringBuilder();
        msg.append("No Contributor Agreement on file for user ").append(iUser.getNameEmail()).append(" (id=").append(iUser.getAccountId()).append(")");
        msg.append(urlFormatter.get().getSettingsUrl("Agreements").orElse(""));
        throw new AuthException(msg.toString());
    }
}

Example 7 with PermissionRule

use of com.google.gerrit.entities.PermissionRule in project gerrit by GerritCodeReview.

the class AccountLimits method toRange.

private static PermissionRange toRange(String permissionName, List<PermissionRule> ruleList) {
    int min = 0;
    int max = 0;
    if (ruleList.isEmpty()) {
        PermissionRange.WithDefaults defaultRange = GlobalCapability.getRange(permissionName);
        if (defaultRange != null) {
            min = defaultRange.getDefaultMin();
            max = defaultRange.getDefaultMax();
        }
    } else {
        for (PermissionRule rule : ruleList) {
            min = Math.min(min, rule.getMin());
            max = Math.max(max, rule.getMax());
        }
    }
    return new PermissionRange(permissionName, min, max);
}

Example 8 with PermissionRule

use of com.google.gerrit.entities.PermissionRule in project gerrit by GerritCodeReview.

the class AccountLimits method getQueueType.

/**
 * Returns which priority queue the user's tasks should be submitted to.
 */
public QueueProvider.QueueType getQueueType() {
    // If a non-generic group (that is not Anonymous Users or Registered Users)
    // grants us INTERACTIVE permission, use the INTERACTIVE queue even if
    // BATCH was otherwise granted. This allows site administrators to grant
    // INTERACTIVE to Registered Users, and BATCH to 'CI Servers' and have
    // the 'CI Servers' actually use the BATCH queue while everyone else gets
    // to use the INTERACTIVE queue without additional grants.
    // 
    GroupMembership groups = user.getEffectiveGroups();
    boolean batch = false;
    for (PermissionRule r : capabilities.priority) {
        if (match(groups, r)) {
            switch(r.getAction()) {
                case INTERACTIVE:
                    if (!SystemGroupBackend.isAnonymousOrRegistered(r.getGroup())) {
                        return QueueProvider.QueueType.INTERACTIVE;
                    }
                    break;
                case BATCH:
                    batch = true;
                    break;
                case ALLOW:
                case BLOCK:
                case DENY:
                    break;
            }
        }
    }
    if (batch) {
        // If any of our groups matched to the BATCH queue, use it.
        return QueueProvider.QueueType.BATCH;
    }
    return QueueProvider.QueueType.INTERACTIVE;
}

Example 9 with PermissionRule

use of com.google.gerrit.entities.PermissionRule in project gerrit by GerritCodeReview.

the class ProjectConfig method replace.

public void replace(ContributorAgreement section) {
    ContributorAgreement.Builder ca = section.toBuilder();
    ca.setAutoVerify(resolve(section.getAutoVerify()));
    ImmutableList.Builder<PermissionRule> newRules = ImmutableList.builder();
    for (PermissionRule rule : section.getAccepted()) {
        newRules.add(rule.toBuilder().setGroup(resolve(rule.getGroup())).build());
    }
    ca.setAccepted(newRules.build());
    contributorAgreements.put(section.getName(), ca.build());
}

Example 10 with PermissionRule

use of com.google.gerrit.entities.PermissionRule in project gerrit by GerritCodeReview.

the class ProjectConfig method loadPermissionRules.

private void loadPermissionRules(Config rc, String section, String subsection, String varName, Permission.Builder perm, boolean useRange) {
    for (String ruleString : rc.getStringList(section, subsection, varName)) {
        PermissionRule rule;
        try {
            rule = PermissionRule.fromString(ruleString, useRange);
        } catch (IllegalArgumentException notRule) {
            error(String.format("Invalid rule in %s.%s: %s", section + (subsection != null ? "." + subsection : ""), varName, notRule.getMessage()));
            continue;
        }
        GroupReference ref = groupList.byName(rule.getGroup().getName());
        if (ref == null) {
            // The group wasn't mentioned in the groups table, so there is
            // no valid UUID for it. Pool the reference anyway so at least
            // all rules in the same file share the same GroupReference.
            // 
            ref = groupList.resolve(rule.getGroup());
            error(String.format("group \"%s\" not in %s", ref.getName(), GroupList.FILE_NAME));
        }
        perm.add(rule.toBuilder().setGroup(ref));
    }
}