047790140a
THE COMPILED CONFIG FILE FORMAT CHANGES WITH THIS VERSION. PLEASE DO
NOT MIX VERSIONS OR DOWNGRADE. Upgrading using normal gitolite upgrade
means should be fine, though.
Originally, we only allowed "R" and "RW" as categories of users supplied
to the `setperms` command. These map respectively to "READERS" and
"WRITERS" in the access rules.
Now:
- we prefer READERS instead of R and WRITERS instead of RW
- we allow the admin to define other categories as she wishes
(example: MANAGERS, TESTERS, etc). These do not have abbreviations,
however, so they must be supplied in full.
PLEASE, *PLEASE*, read the section in doc/wildcard-repositories.mkd for
more info. This is a VERY powerful feature and if you're not careful
you could mess up the ACLs nicely.
Backward compat note: you can continue to use the "R" and "RW"
categories when running the "setperms" command, and gitolite will
internally convert them to READERS and WRITERS categories.
----
implementation notes:
- new RC var called GL_WILDREPOS_PERM_CATS that is a space-sep list of
the allowed categories in a gl-perms file; defaults to "R RW" if not
specified
- wild_repo_rights no longer returns $c, $r, $wC, where $r = $user if
"R $user", $r = '@all' if "R @all", and similarly with $w and "RW".
Instead it returns $c and a new hash that effectively gives the same
info, but expanded to include any other valid categories (listed in
GL_WILDREPOS_PERM_CATS)
- consequently, the arguments that parse_acl takes also change the
same way
- (side note: R and RW are quietly converted to READERS and WRITERS;
however, new categories that you define yourself do not have
abbreviations)
- setperms validates perms to make sure only allowed categories are
used; however even if someone changed them behind the scenes,
wild_repo_rights will also check. This is necessary in case the
admin tightened up GL_WILDREPOS_PERM_CATS after someone had already
setperms-d his repos.
- as a bonus, we eliminate all the post-Dumper shenanigans, at least
for READERS and WRITERS. Those two now look, to the compile script,
just like any other usernames.
74 lines
2 KiB
Plaintext
74 lines
2 KiB
Plaintext
# vim: syn=sh:
|
|
for bc in 0 1
|
|
do
|
|
cd $TESTDIR
|
|
$TESTDIR/rollback || die "rollback failed"
|
|
editrc GL_WILDREPOS 1
|
|
editrc GL_BIG_CONFIG $bc
|
|
|
|
name "INTERNAL"
|
|
echo "
|
|
@leads = u1 u2
|
|
@devs = u1 u2 u3 u4
|
|
|
|
@gbar = bar/CREATOR/..*
|
|
repo @gbar
|
|
C = @leads
|
|
RW+ = CREATOR
|
|
RW = WRITERS
|
|
R = READERS
|
|
" | ugc
|
|
name "nothing set yet"
|
|
expect_push_ok "master -> master"
|
|
|
|
name "u1 auto-creates a repo"
|
|
runlocal git ls-remote u1:bar/u1/try1
|
|
expect "Initialized empty Git repository in /home/gitolite-test/repositories/bar/u1/try1.git/"
|
|
name "default permissions for u2 and u4"
|
|
runlocal ssh u1 expand
|
|
expect R.*W.*u1.*bar/u1/try1
|
|
runlocal ssh u2 expand
|
|
notexpect R.*W.*u1.*bar/u1/try1
|
|
runlocal ssh u4 expand
|
|
notexpect R.*W.*u1.*bar/u1/try1
|
|
|
|
name "@leads can RW try1"
|
|
echo RW @leads | runlocal ssh u1 setperms bar/u1/try1
|
|
expect "WRITERS @leads"
|
|
runlocal ssh u1 expand
|
|
expect R.*W.*u1.*bar/u1/try1
|
|
runlocal ssh u2 expand
|
|
expect R.*W.*u1.*bar/u1/try1
|
|
runlocal ssh u4 expand
|
|
notexpect R.*W.*u1.*bar/u1/try1
|
|
|
|
name "@devs can R try1"
|
|
echo R @devs | runlocal ssh u1 setperms bar/u1/try1
|
|
expect "READERS @devs"
|
|
notexpect "RW @leads"
|
|
notexpect "WRITERS @leads"
|
|
runlocal ssh u1 expand
|
|
expect R.*W.*u1.*bar/u1/try1
|
|
runlocal ssh u2 expand
|
|
notexpect R.*W.*u1.*bar/u1/try1
|
|
expect R.*u1.*bar/u1/try1
|
|
runlocal ssh u4 expand
|
|
notexpect R.*W.*u1.*bar/u1/try1
|
|
expect R.*u1.*bar/u1/try1
|
|
|
|
name "combo of previous 2"
|
|
printf "R @devs\nRW @leads\n" | runlocal ssh u1 setperms bar/u1/try1
|
|
expect "READERS @devs"
|
|
expect "WRITERS @leads"
|
|
runlocal ssh u1 expand
|
|
expect R.*W.*u1.*bar/u1/try1
|
|
runlocal ssh u2 expand
|
|
expect R.*W.*u1.*bar/u1/try1
|
|
runlocal ssh u4 expand
|
|
notexpect R.*W.*u1.*bar/u1/try1
|
|
expect R.*u1.*bar/u1/try1
|
|
|
|
name "INTERNAL"
|
|
|
|
done
|