Examples with REFS_CACHE_AUTOMERGE com.google.gerrit.entities.RefNames.REFS_CACHE_AUTOMERGE used on opensource projects

Example 1 with REFS_CACHE_AUTOMERGE

use of com.google.gerrit.entities.RefNames.REFS_CACHE_AUTOMERGE in project gerrit by GerritCodeReview.

the class RefVisibilityControl method isVisible.

/**
 * Returns an authoritative answer if the ref is visible to the user. Does not have support for
 * tags and will throw a {@link PermissionBackendException} if asked for tags visibility.
 */
boolean isVisible(ProjectControl projectControl, String refName) throws PermissionBackendException {
    if (refName.startsWith(Constants.R_TAGS)) {
        throw new PermissionBackendException("can't check tags through RefVisibilityControl. Use PermissionBackend#filter instead.");
    }
    if (!RefNames.isGerritRef(refName)) {
        // refs/heads or another ref the user created. Apply the regular permissions with inheritance.
        return projectControl.controlForRef(refName).hasReadPermissionOnRef(false);
    }
    if (refName.startsWith(REFS_CACHE_AUTOMERGE)) {
        // Internal cache state that is accessible to no one.
        return false;
    }
    boolean hasAccessDatabase = permissionBackend.user(projectControl.getUser()).testOrFalse(GlobalPermission.ACCESS_DATABASE);
    if (hasAccessDatabase) {
        return true;
    }
    // Change and change edit visibility
    Change.Id changeId;
    if ((changeId = Change.Id.fromRef(refName)) != null) {
        // Change ref is visible only if the change is visible.
        ChangeData cd;
        try {
            cd = changeDataFactory.create(projectControl.getProject().getNameKey(), changeId);
            checkState(cd.change().getId().equals(changeId));
        } catch (StorageException e) {
            if (Throwables.getCausalChain(e).stream().anyMatch(e2 -> e2 instanceof NoSuchChangeException)) {
                // The change was deleted or is otherwise not accessible anymore.
                // If the caller can see all refs and is allowed to see private changes on refs/, allow
                // access. This is an escape hatch for receivers of "ref deleted" events.
                PermissionBackend.ForProject forProject = projectControl.asForProject();
                return forProject.test(ProjectPermission.READ) && forProject.ref("refs/").test(RefPermission.READ_PRIVATE_CHANGES);
            }
            throw new PermissionBackendException(e);
        }
        if (RefNames.isRefsEdit(refName)) {
            // Edits are visible only to the owning user, if change is visible.
            return visibleEdit(refName, projectControl, cd);
        }
        return projectControl.controlFor(cd).isVisible();
    }
    // Account visibility
    CurrentUser user = projectControl.getUser();
    Account.Id currentUserAccountId = user.isIdentifiedUser() ? user.getAccountId() : null;
    Account.Id accountId;
    if ((accountId = Account.Id.fromRef(refName)) != null) {
        // Account ref is visible only to the corresponding account.
        if (accountId.equals(currentUserAccountId)) {
            // refs, check if the user has read permissions.
            if (RefNames.isRefsDraftsComments(refName) || RefNames.isRefsStarredChanges(refName) || projectControl.controlForRef(refName).hasReadPermissionOnRef(true)) {
                return true;
            }
        }
        return false;
    }
    // Group visibility
    AccountGroup.UUID accountGroupUuid;
    if ((accountGroupUuid = AccountGroup.UUID.fromRef(refName)) != null) {
        // Group ref is visible only to the corresponding owner group.
        try {
            return projectControl.controlForRef(refName).hasReadPermissionOnRef(true) && groupControlFactory.controlFor(user, accountGroupUuid).isOwner();
        } catch (NoSuchGroupException e) {
            // The group is broken, but the ref is still around. Pretend the ref is not visible.
            logger.atWarning().withCause(e).log("Found group ref %s but group isn't parsable", refName);
            return false;
        }
    }
    // We are done checking all cases where we would allow access to Gerrit-managed refs. Deny
    // access in case we got this far.
    logger.atFine().log("Denying access to %s because user doesn't have access to this Gerrit ref", refName);
    return false;
}