2010-06-12 07:33:53 +02:00
|
|
|
# vim: syn=sh:
|
|
|
|
|
for bc in 0 1
|
|
|
|
|
do
|
|
|
|
|
cd $TESTDIR
|
2010-06-18 18:13:53 +02:00
|
|
|
$TESTDIR/rollback || die "rollback failed"
|
2010-06-12 07:33:53 +02:00
|
|
|
editrc GL_WILDREPOS 1
|
|
|
|
|
editrc GL_BIG_CONFIG $bc
|
|
|
|
|
|
|
|
|
|
# ----------
|
|
|
|
|
|
|
|
|
|
name "INTERNAL"
|
|
|
|
|
echo "
|
|
|
|
|
@staff = u1 u2 u3
|
2010-07-24 15:53:31 +02:00
|
|
|
@gfoo = foo/CREATOR/.+
|
|
|
|
|
repo @gfoo
|
2010-06-12 07:33:53 +02:00
|
|
|
C = u1
|
|
|
|
|
RW+ = CREATOR
|
|
|
|
|
RW = WRITERS
|
|
|
|
|
- = @staff
|
|
|
|
|
" | ugc
|
|
|
|
|
|
|
|
|
|
cd ~/td
|
|
|
|
|
runlocal git clone u1:foo/u1/bar
|
make REPO_BASE absolute early
$ENV{GL_REPO_BASE_ABS} is meant to point to the same directory as
$REPO_BASE, except it is meant to be passed to hooks, ADCs and other
child programs. And since you can't be sure where the child program
starts in, this became an absolute path.
Gradually, however, I started using it wherever I needed an absolute
path (mostly in code that jumps around various directories to do stuff).
Which is silly, because there's no reason $REPO_BASE cannot also be made
an absolute, even if the rc file has a relative path.
So that's what I did now: made $REPO_BASE absolute very early on, and
then systematically changed all uses of the longer form to the shorter
form when appropriate. And so the only thing we now use the longer one
for is to pass to child programs.
(Implementation note: The actual change is not very big, but while I was
about it I decided to make the test suite able to test with an absolute
REPO_BASE also, which is why the commit seems so large.)
----
This all started with a complaint from Damien Regad. He had an
extremely odd setup where his bashrc changed PWD to something other than
$HOME before anything else ran. This caused those two variables to
beceom inconsistent, and he had a 1-line fix he wanted me to apply.
I generally don't like making special fixes for for non-standard setups,
and anyway all he had to do was set the full path to REPO_BASE in the rc
file to get around this. Which is what I told him and he very politely
left it at that.
However, this did get me thinking, and I soon realised I was needlessly
conflating "relative versus absolute" with "able to be passed to child
programs". Fixing that solved his problem also, as a side-effect.
So I guess this is all thanks to Damien!
2011-03-18 06:29:52 +01:00
|
|
|
expect "Initialized empty Git repository in $TEST_BASE_FULL/foo/u1/bar.git/"
|
2010-06-12 07:33:53 +02:00
|
|
|
|
|
|
|
|
cd bar
|
|
|
|
|
mdc u1file1
|
|
|
|
|
runlocal git push origin master
|
|
|
|
|
expect "To u1:foo/u1/bar"
|
|
|
|
|
expect "\[new branch\] master -> master"
|
|
|
|
|
echo RW u2 | runlocal ssh u1 setperms foo/u1/bar
|
|
|
|
|
runlocal ssh u1 getperms foo/u1/bar
|
custom perm categories in setperms (WARNING: PLEASE READ FULL COMMIT MESSAGE)
THE COMPILED CONFIG FILE FORMAT CHANGES WITH THIS VERSION. PLEASE DO
NOT MIX VERSIONS OR DOWNGRADE. Upgrading using normal gitolite upgrade
means should be fine, though.
Originally, we only allowed "R" and "RW" as categories of users supplied
to the `setperms` command. These map respectively to "READERS" and
"WRITERS" in the access rules.
Now:
- we prefer READERS instead of R and WRITERS instead of RW
- we allow the admin to define other categories as she wishes
(example: MANAGERS, TESTERS, etc). These do not have abbreviations,
however, so they must be supplied in full.
PLEASE, *PLEASE*, read the section in doc/wildcard-repositories.mkd for
more info. This is a VERY powerful feature and if you're not careful
you could mess up the ACLs nicely.
Backward compat note: you can continue to use the "R" and "RW"
categories when running the "setperms" command, and gitolite will
internally convert them to READERS and WRITERS categories.
----
implementation notes:
- new RC var called GL_WILDREPOS_PERM_CATS that is a space-sep list of
the allowed categories in a gl-perms file; defaults to "R RW" if not
specified
- wild_repo_rights no longer returns $c, $r, $wC, where $r = $user if
"R $user", $r = '@all' if "R @all", and similarly with $w and "RW".
Instead it returns $c and a new hash that effectively gives the same
info, but expanded to include any other valid categories (listed in
GL_WILDREPOS_PERM_CATS)
- consequently, the arguments that parse_acl takes also change the
same way
- (side note: R and RW are quietly converted to READERS and WRITERS;
however, new categories that you define yourself do not have
abbreviations)
- setperms validates perms to make sure only allowed categories are
used; however even if someone changed them behind the scenes,
wild_repo_rights will also check. This is necessary in case the
admin tightened up GL_WILDREPOS_PERM_CATS after someone had already
setperms-d his repos.
- as a bonus, we eliminate all the post-Dumper shenanigans, at least
for READERS and WRITERS. Those two now look, to the compile script,
just like any other usernames.
2010-11-06 06:16:17 +01:00
|
|
|
expect "WRITERS u2"
|
2010-06-12 07:33:53 +02:00
|
|
|
name "expand"
|
|
|
|
|
runlocal ssh u2 expand
|
2010-08-24 10:04:27 +02:00
|
|
|
expect "R W .(u1).foo/u1/bar"
|
2010-06-12 07:33:53 +02:00
|
|
|
|
|
|
|
|
name "push"
|
|
|
|
|
cd ~/td
|
|
|
|
|
runlocal git clone u2:foo/u1/bar u2bar
|
2011-11-27 04:13:36 +01:00
|
|
|
expect "Cloning into 'u2bar'..."
|
2010-06-12 07:33:53 +02:00
|
|
|
cd u2bar
|
|
|
|
|
mdc u2file1
|
|
|
|
|
runlocal git push
|
|
|
|
|
expect "master -> master"
|
|
|
|
|
notexpect "DENIED"
|
|
|
|
|
notexpect "failed to push"
|
|
|
|
|
|
|
|
|
|
name "INTERNAL"
|
|
|
|
|
|
|
|
|
|
cd $TESTDIR
|
2010-06-18 18:13:53 +02:00
|
|
|
$TESTDIR/rollback || die "rollback failed"
|
2010-06-12 07:33:53 +02:00
|
|
|
editrc GL_WILDREPOS 1
|
|
|
|
|
editrc GL_BIG_CONFIG $bc
|
|
|
|
|
|
|
|
|
|
# ----------
|
|
|
|
|
|
|
|
|
|
name "INTERNAL"
|
|
|
|
|
echo "
|
|
|
|
|
@staff = u1 u2 u3
|
2010-07-24 15:53:31 +02:00
|
|
|
@gfoo = foo/CREATOR/.+
|
|
|
|
|
repo @gfoo
|
2010-06-12 07:33:53 +02:00
|
|
|
C = u1
|
|
|
|
|
RW+ = CREATOR
|
|
|
|
|
- = @staff
|
|
|
|
|
RW = WRITERS
|
|
|
|
|
" | ugc -r
|
|
|
|
|
|
|
|
|
|
cd ~/td
|
|
|
|
|
runlocal git clone u1:foo/u1/bar
|
2011-11-27 04:13:36 +01:00
|
|
|
expect "Cloning into 'bar'..."
|
2010-06-12 07:33:53 +02:00
|
|
|
|
|
|
|
|
cd bar
|
|
|
|
|
mdc u1file1
|
|
|
|
|
runlocal git push origin master
|
|
|
|
|
expect "To u1:foo/u1/bar"
|
|
|
|
|
expect "\[new branch\] master -> master"
|
|
|
|
|
echo RW u2 | runlocal ssh u1 setperms foo/u1/bar
|
|
|
|
|
runlocal ssh u1 getperms foo/u1/bar
|
custom perm categories in setperms (WARNING: PLEASE READ FULL COMMIT MESSAGE)
THE COMPILED CONFIG FILE FORMAT CHANGES WITH THIS VERSION. PLEASE DO
NOT MIX VERSIONS OR DOWNGRADE. Upgrading using normal gitolite upgrade
means should be fine, though.
Originally, we only allowed "R" and "RW" as categories of users supplied
to the `setperms` command. These map respectively to "READERS" and
"WRITERS" in the access rules.
Now:
- we prefer READERS instead of R and WRITERS instead of RW
- we allow the admin to define other categories as she wishes
(example: MANAGERS, TESTERS, etc). These do not have abbreviations,
however, so they must be supplied in full.
PLEASE, *PLEASE*, read the section in doc/wildcard-repositories.mkd for
more info. This is a VERY powerful feature and if you're not careful
you could mess up the ACLs nicely.
Backward compat note: you can continue to use the "R" and "RW"
categories when running the "setperms" command, and gitolite will
internally convert them to READERS and WRITERS categories.
----
implementation notes:
- new RC var called GL_WILDREPOS_PERM_CATS that is a space-sep list of
the allowed categories in a gl-perms file; defaults to "R RW" if not
specified
- wild_repo_rights no longer returns $c, $r, $wC, where $r = $user if
"R $user", $r = '@all' if "R @all", and similarly with $w and "RW".
Instead it returns $c and a new hash that effectively gives the same
info, but expanded to include any other valid categories (listed in
GL_WILDREPOS_PERM_CATS)
- consequently, the arguments that parse_acl takes also change the
same way
- (side note: R and RW are quietly converted to READERS and WRITERS;
however, new categories that you define yourself do not have
abbreviations)
- setperms validates perms to make sure only allowed categories are
used; however even if someone changed them behind the scenes,
wild_repo_rights will also check. This is necessary in case the
admin tightened up GL_WILDREPOS_PERM_CATS after someone had already
setperms-d his repos.
- as a bonus, we eliminate all the post-Dumper shenanigans, at least
for READERS and WRITERS. Those two now look, to the compile script,
just like any other usernames.
2010-11-06 06:16:17 +01:00
|
|
|
expect "WRITERS u2"
|
2010-06-12 07:33:53 +02:00
|
|
|
name "expand"
|
|
|
|
|
runlocal ssh u2 expand
|
2010-08-24 10:04:27 +02:00
|
|
|
expect " R W .(u1).foo/u1/bar"
|
2010-06-12 07:33:53 +02:00
|
|
|
|
|
|
|
|
name "push"
|
|
|
|
|
cd ~/td
|
|
|
|
|
runlocal git clone u2:foo/u1/bar u2bar
|
2011-11-27 04:13:36 +01:00
|
|
|
expect "Cloning into 'u2bar'..."
|
2010-06-12 07:33:53 +02:00
|
|
|
cd u2bar
|
|
|
|
|
mdc u2file1
|
|
|
|
|
runlocal git push
|
2011-10-18 04:33:05 +02:00
|
|
|
expect "remote: W refs/heads/master foo/u1/bar u2 DENIED by refs/.\*"
|
2010-06-12 07:33:53 +02:00
|
|
|
|
|
|
|
|
name INTERNAL
|
|
|
|
|
done
|