(!!) neat little 'access' command...
...makes it sooo much eaier to check access rights from external scripts
This commit is contained in:
Sitaram Chamarty
parent
9a8a86306b
commit
fb332a6c76
53
src/commands/access
Executable file
53
src/commands/access
Executable file
|
|
@ -0,0 +1,53 @@
|
||||||
|
#!/usr/bin/perl
|
||||||
|
use strict;
|
||||||
|
use warnings;
|
||||||
|
|
||||||
|
use lib $ENV{GL_BINDIR};
|
||||||
|
use Gitolite::Rc;
|
||||||
|
use Gitolite::Common;
|
||||||
|
use Gitolite::Conf::Load;
|
||||||
|
|
||||||
|
=for usage
|
||||||
|
Usage: gitolite access [-q] <repo> <user> <perm> <ref>
|
||||||
|
|
||||||
|
Check access rights for arguments given. With '-q', returns only an exit code
|
||||||
|
(shell truth, not perl truth -- 0 is success, any non-0 is failure).
|
||||||
|
|
||||||
|
- repo: mandatory
|
||||||
|
- user: mandatory
|
||||||
|
- perm: defauts to '+'. Valid values: R, W, +, C, D, M
|
||||||
|
- ref: defauts to 'any'. See notes below
|
||||||
|
|
||||||
|
Notes:
|
||||||
|
|
||||||
|
- ref: Any fully qualified ref ('refs/heads/master', not 'master') is fine.
|
||||||
|
The 'any' ref is special -- it ignores deny rules (see docs for what this
|
||||||
|
means and exceptions).
|
||||||
|
=cut
|
||||||
|
|
||||||
|
# TODO: deal with "C", call it ^C
|
||||||
|
|
||||||
|
usage() if not @ARGV or $ARGV[0] eq '-h';
|
||||||
|
my $quiet = 0;
|
||||||
|
if ( $ARGV[0] eq '-q' ) { $quiet = 1; shift @ARGV; }
|
||||||
|
|
||||||
|
my ( $repo, $user, $aa, $ref ) = @ARGV;
|
||||||
|
$aa ||= '+';
|
||||||
|
$ref ||= 'any';
|
||||||
|
# XXX the 4th one below might need fine tuning
|
||||||
|
_die "invalid repo name" if not( $repo and $repo =~ $REPONAME_PATT );
|
||||||
|
_die "invalid user name" if not( $user and $user =~ $USERNAME_PATT );
|
||||||
|
_die "invalid perm" if not( $aa and $aa =~ /^(R|W|\+|C|D|M)$/ );
|
||||||
|
_die "invalid ref name" if not( $ref and $ref =~ $REPONAME_PATT );
|
||||||
|
|
||||||
|
my $ret = '';
|
||||||
|
|
||||||
|
$ret = access( $repo, $user, $aa, $ref );
|
||||||
|
|
||||||
|
if ($ret =~ /DENIED/) {
|
||||||
|
print "$ret\n" unless $quiet;
|
||||||
|
exit 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
print "$ret\n" unless $quiet;
|
||||||
|
exit 0;
|
||||||
152
t/access.t
Executable file
152
t/access.t
Executable file
|
|
@ -0,0 +1,152 @@
|
||||||
|
#!/usr/bin/perl
|
||||||
|
use strict;
|
||||||
|
use warnings;
|
||||||
|
|
||||||
|
# this is hardcoded; change it if needed
|
||||||
|
use lib "src";
|
||||||
|
use Gitolite::Test;
|
||||||
|
|
||||||
|
# basic tests
|
||||||
|
# ----------------------------------------------------------------------
|
||||||
|
|
||||||
|
try "plan 185";
|
||||||
|
|
||||||
|
confreset;confadd '
|
||||||
|
@admins = admin dev1
|
||||||
|
repo gitolite-admin
|
||||||
|
RW+ = admin
|
||||||
|
|
||||||
|
repo testing
|
||||||
|
RW+ = @all
|
||||||
|
|
||||||
|
@g1 = t1
|
||||||
|
repo @g1
|
||||||
|
R = u2
|
||||||
|
RW = u3
|
||||||
|
RW+ = u4
|
||||||
|
';
|
||||||
|
|
||||||
|
try "ADMIN_PUSH set1; !/FATAL/" or die text();
|
||||||
|
|
||||||
|
try "
|
||||||
|
|
||||||
|
gitolite access -q t1 u1; !ok; !/./
|
||||||
|
gitolite access -q t1 u1 R; !ok; !/./
|
||||||
|
gitolite access -q t1 u1 W; !ok; !/./
|
||||||
|
gitolite access -q t1 u1 +; !ok; !/./
|
||||||
|
gitolite access -q t1 u2; !ok; !/./
|
||||||
|
gitolite access -q t1 u2 R; ok; !/./
|
||||||
|
gitolite access -q t1 u2 W; !ok; !/./
|
||||||
|
gitolite access -q t1 u2 +; !ok; !/./
|
||||||
|
gitolite access -q t1 u3; !ok; !/./
|
||||||
|
gitolite access -q t1 u3 R; ok; !/./
|
||||||
|
gitolite access -q t1 u3 W; ok; !/./
|
||||||
|
gitolite access -q t1 u3 +; !ok; !/./
|
||||||
|
gitolite access -q t1 u4; ok; !/./
|
||||||
|
gitolite access -q t1 u4 R; ok; !/./
|
||||||
|
gitolite access -q t1 u4 W; ok; !/./
|
||||||
|
gitolite access -q t1 u4 +; ok; !/./
|
||||||
|
|
||||||
|
gitolite access t1 u1; !ok; /\\+ any t1 u1 DENIED by fallthru/
|
||||||
|
gitolite access t1 u1 R; !ok; /R any t1 u1 DENIED by fallthru/
|
||||||
|
gitolite access t1 u1 W; !ok; /W any t1 u1 DENIED by fallthru/
|
||||||
|
gitolite access t1 u1 +; !ok; /\\+ any t1 u1 DENIED by fallthru/
|
||||||
|
gitolite access t1 u2; !ok; /\\+ any t1 u2 DENIED by fallthru/
|
||||||
|
gitolite access t1 u2 R; ok; /refs/\.\*/
|
||||||
|
gitolite access t1 u2 W; !ok; /W any t1 u2 DENIED by fallthru/
|
||||||
|
gitolite access t1 u2 +; !ok; /\\+ any t1 u2 DENIED by fallthru/
|
||||||
|
gitolite access t1 u3; !ok; /\\+ any t1 u3 DENIED by fallthru/
|
||||||
|
gitolite access t1 u3 R; ok; /refs/\.\*/
|
||||||
|
gitolite access t1 u3 W; ok; /refs/\.\*/
|
||||||
|
gitolite access t1 u3 +; !ok; /\\+ any t1 u3 DENIED by fallthru/
|
||||||
|
gitolite access t1 u4; ok; /refs/\.\*/
|
||||||
|
gitolite access t1 u4 R; ok; /refs/\.\*/
|
||||||
|
gitolite access t1 u4 W; ok; /refs/\.\*/
|
||||||
|
gitolite access t1 u4 +; ok; /refs/\.\*/
|
||||||
|
|
||||||
|
";
|
||||||
|
|
||||||
|
confreset;confadd '
|
||||||
|
@admins = admin dev1
|
||||||
|
repo gitolite-admin
|
||||||
|
RW+ = admin
|
||||||
|
|
||||||
|
@g1 = u1
|
||||||
|
@g2 = u2
|
||||||
|
@g3 = u3
|
||||||
|
@gaa = aa
|
||||||
|
repo @gaa
|
||||||
|
RW+ = @g1
|
||||||
|
RW = @g2
|
||||||
|
RW+ master = @g3
|
||||||
|
RW master = u4
|
||||||
|
- master = u5
|
||||||
|
RW+ dev = u5
|
||||||
|
RW = u5
|
||||||
|
';
|
||||||
|
|
||||||
|
try "ADMIN_PUSH set2; !/FATAL/" or die text();
|
||||||
|
|
||||||
|
try "
|
||||||
|
gitolite access \@gaa \@g1 + any ; ok; /refs/.*/; !/DENIED/
|
||||||
|
gitolite access aa \@g1 + refs/heads/master ; ok; /refs/.*/; !/DENIED/
|
||||||
|
gitolite access \@gaa \@g1 + refs/heads/next ; ok; /refs/.*/; !/DENIED/
|
||||||
|
gitolite access \@gaa \@g1 W refs/heads/next ; ok; /refs/.*/; !/DENIED/
|
||||||
|
gitolite access \@gaa u1 + refs/heads/dev ; ok; /refs/.*/; !/DENIED/
|
||||||
|
gitolite access \@gaa u1 + refs/heads/next ; ok; /refs/.*/; !/DENIED/
|
||||||
|
gitolite access aa u1 W refs/heads/next ; ok; /refs/.*/; !/DENIED/
|
||||||
|
gitolite access \@gaa \@g2 + refs/heads/master ; !ok; /\\+ refs/heads/master \@gaa \@g2 DENIED by fallthru/
|
||||||
|
gitolite access \@gaa \@g2 + refs/heads/next ; !ok; /\\+ refs/heads/next \@gaa \@g2 DENIED by fallthru/
|
||||||
|
gitolite access aa \@g2 W refs/heads/master ; ok; /refs/.*/; !/DENIED/
|
||||||
|
gitolite access aa u2 + any ; !ok; /\\+ any aa u2 DENIED by fallthru/
|
||||||
|
gitolite access \@gaa u2 + refs/heads/master ; !ok; /\\+ refs/heads/master \@gaa u2 DENIED by fallthru/
|
||||||
|
gitolite access \@gaa u2 W refs/heads/master ; ok; /refs/.*/; !/DENIED/
|
||||||
|
gitolite access \@gaa \@g3 + refs/heads/master ; ok; /refs/heads/master/; !/DENIED/
|
||||||
|
gitolite access \@gaa \@g3 W refs/heads/next ; !ok; /W refs/heads/next \@gaa \@g3 DENIED by fallthru/
|
||||||
|
gitolite access \@gaa \@g3 W refs/heads/dev ; !ok; /W refs/heads/dev \@gaa \@g3 DENIED by fallthru/
|
||||||
|
gitolite access aa u3 + refs/heads/dev ; !ok; /\\+ refs/heads/dev aa u3 DENIED by fallthru/
|
||||||
|
gitolite access aa u3 + refs/heads/next ; !ok; /\\+ refs/heads/next aa u3 DENIED by fallthru/
|
||||||
|
gitolite access \@gaa u4 + refs/heads/master ; !ok; /\\+ refs/heads/master \@gaa u4 DENIED by fallthru/
|
||||||
|
gitolite access \@gaa u4 W refs/heads/master ; ok; /refs/heads/master/; !/DENIED/
|
||||||
|
gitolite access aa u4 + refs/heads/next ; !ok; /\\+ refs/heads/next aa u4 DENIED by fallthru/
|
||||||
|
gitolite access \@gaa u4 W refs/heads/next ; !ok; /W refs/heads/next \@gaa u4 DENIED by fallthru/
|
||||||
|
gitolite access \@gaa u5 R any ; ok; /refs/heads/dev/; !/DENIED/
|
||||||
|
gitolite access aa u5 R any ; ok; /refs/heads/dev/; !/DENIED/
|
||||||
|
gitolite access \@gaa u5 + refs/heads/dev ; ok; /refs/heads/dev/; !/DENIED/
|
||||||
|
gitolite access \@gaa u5 + refs/heads/master ; !ok; /\\+ refs/heads/master \@gaa u5 DENIED by refs/heads/master/
|
||||||
|
gitolite access aa u5 + refs/heads/next ; !ok; /\\+ refs/heads/next aa u5 DENIED by fallthru/
|
||||||
|
gitolite access \@gaa u5 R refs/heads/dev ; ok; /refs/heads/dev/; !/DENIED/
|
||||||
|
gitolite access \@gaa u5 R refs/heads/master ; !ok; /R refs/heads/master \@gaa u5 DENIED by refs/heads/master/
|
||||||
|
gitolite access \@gaa u5 R refs/heads/next ; ok; /refs/.*/; !/DENIED/
|
||||||
|
gitolite access aa u5 W refs/heads/dev ; ok; /refs/heads/dev/; !/DENIED/
|
||||||
|
gitolite access aa u5 W refs/heads/master ; !ok; /W refs/heads/master aa u5 DENIED by refs/heads/master/
|
||||||
|
gitolite access \@gaa u5 W refs/heads/next ; ok; /refs/.*/; !/DENIED/
|
||||||
|
";
|
||||||
|
|
||||||
|
confreset;confadd '
|
||||||
|
@admins = admin dev1
|
||||||
|
repo gitolite-admin
|
||||||
|
RW+ = admin
|
||||||
|
|
||||||
|
@gr1 = r1
|
||||||
|
repo @gr1
|
||||||
|
RW refs/heads/v[0-9] = u1
|
||||||
|
RW refs/heads = tester
|
||||||
|
|
||||||
|
@gr2 = r2
|
||||||
|
repo @gr2
|
||||||
|
RW refs/heads/v[0-9] = u1
|
||||||
|
- refs/heads/v[0-9] = tester
|
||||||
|
RW refs/heads = tester
|
||||||
|
';
|
||||||
|
|
||||||
|
try "ADMIN_PUSH set3; !/FATAL/" or die text();
|
||||||
|
|
||||||
|
try "
|
||||||
|
gitolite access \@gr2 tester W refs/heads/v1; !ok; /W refs/heads/v1 \@gr2 tester DENIED by refs/heads/v\\[0-9\\]/
|
||||||
|
gitolite access \@gr1 tester W refs/heads/v1; ok; /refs/heads/; !/DENIED/
|
||||||
|
gitolite access r1 tester W refs/heads/v1; ok; /refs/heads/; !/DENIED/
|
||||||
|
gitolite access r2 tester W refs/heads/v1; !ok; /W refs/heads/v1 r2 tester DENIED by refs/heads/v\\[0-9\\]/
|
||||||
|
gitolite access r2 tester W refs/heads/va; ok; /refs/heads/; !/DENIED/
|
||||||
|
";
|
||||||
|
|
||||||
Loading…
Reference in a new issue