| Disable Functions: Path : /usr/lib64/python2.7/site-packages/hgext/ |
| Current File : //usr/lib64/python2.7/site-packages/hgext/acl.pyc |
� Hq�Qc @ sx d Z d d l m Z d d l m Z m Z d d l Z d d l Z d Z d � Z d � Z d � Z d d d � Z d S( s hooks for controlling repository access This hook makes it possible to allow or deny write access to given branches and paths of a repository when receiving incoming changesets via pretxnchangegroup and pretxncommit. The authorization is matched based on the local user name on the system where the hook runs, and not the committer of the original changeset (since the latter is merely informative). The acl hook is best used along with a restricted shell like hgsh, preventing authenticating users from doing anything other than pushing or pulling. The hook is not safe to use if users have interactive shell access, as they can then disable the hook. Nor is it safe if remote users share an account, because then there is no way to distinguish them. The order in which access checks are performed is: 1) Deny list for branches (section ``acl.deny.branches``) 2) Allow list for branches (section ``acl.allow.branches``) 3) Deny list for paths (section ``acl.deny``) 4) Allow list for paths (section ``acl.allow``) The allow and deny sections take key-value pairs. Branch-based Access Control --------------------------- Use the ``acl.deny.branches`` and ``acl.allow.branches`` sections to have branch-based access control. Keys in these sections can be either: - a branch name, or - an asterisk, to match any branch; The corresponding values can be either: - a comma-separated list containing users and groups, or - an asterisk, to match anyone; You can add the "!" prefix to a user or group name to invert the sense of the match. Path-based Access Control ------------------------- Use the ``acl.deny`` and ``acl.allow`` sections to have path-based access control. Keys in these sections accept a subtree pattern (with a glob syntax by default). The corresponding values follow the same syntax as the other sections above. Groups ------ Group names must be prefixed with an ``@`` symbol. Specifying a group name has the same effect as specifying all the users in that group. You can define group members in the ``acl.groups`` section. If a group name is not defined there, and Mercurial is running under a Unix-like system, the list of users will be taken from the OS. Otherwise, an exception will be raised. Example Configuration --------------------- :: [hooks] # Use this if you want to check access restrictions at commit time pretxncommit.acl = python:hgext.acl.hook # Use this if you want to check access restrictions for pull, push, # bundle and serve. pretxnchangegroup.acl = python:hgext.acl.hook [acl] # Allow or deny access for incoming changes only if their source is # listed here, let them pass otherwise. Source is "serve" for all # remote access (http or ssh), "push", "pull" or "bundle" when the # related commands are run locally. # Default: serve sources = serve [acl.deny.branches] # Everyone is denied to the frozen branch: frozen-branch = * # A bad user is denied on all branches: * = bad-user [acl.allow.branches] # A few users are allowed on branch-a: branch-a = user-1, user-2, user-3 # Only one user is allowed on branch-b: branch-b = user-1 # The super user is allowed on any branch: * = super-user # Everyone is allowed on branch-for-tests: branch-for-tests = * [acl.deny] # This list is checked first. If a match is found, acl.allow is not # checked. All users are granted access if acl.deny is not present. # Format for both lists: glob pattern = user, ..., @group, ... # To match everyone, use an asterisk for the user: # my/glob/pattern = * # user6 will not have write access to any file: ** = user6 # Group "hg-denied" will not have write access to any file: ** = @hg-denied # Nobody will be able to change "DONT-TOUCH-THIS.txt", despite # everyone being able to change all other files. See below. src/main/resources/DONT-TOUCH-THIS.txt = * [acl.allow] # if acl.allow is not present, all users are allowed by default # empty acl.allow = no users allowed # User "doc_writer" has write access to any file under the "docs" # folder: docs/** = doc_writer # User "jack" and group "designers" have write access to any file # under the "images" folder: images/** = jack, @designers # Everyone (except for "user6" and "@hg-denied" - see acl.deny above) # will have write access to any file under the "resources" folder # (except for 1 file. See acl.deny): src/main/resources/** = * .hgtags = release_engineer Examples using the "!" prefix ............................. Suppose there's a branch that only a given user (or group) should be able to push to, and you don't want to restrict access to any other branch that may be created. The "!" prefix allows you to prevent anyone except a given user or group to push changesets in a given branch or path. In the examples below, we will: 1) Deny access to branch "ring" to anyone but user "gollum" 2) Deny access to branch "lake" to anyone but members of the group "hobbit" 3) Deny access to a file to anyone but user "gollum" :: [acl.allow.branches] # Empty [acl.deny.branches] # 1) only 'gollum' can commit to branch 'ring'; # 'gollum' and anyone else can still commit to any other branch. ring = !gollum # 2) only members of the group 'hobbit' can commit to branch 'lake'; # 'hobbit' members and anyone else can still commit to any other branch. lake = !@hobbit # You can also deny access based on file paths: [acl.allow] # Empty [acl.deny] # 3) only 'gollum' can change the file below; # 'gollum' and anyone else can still change any other file. /misty/mountains/cave/ring = !gollum i����( t _( t utilt matchNt internalc C so | j d | � } | r | S| j d | � y t j | � SWn* t k rj t j t d � | � � n Xd S( Ns acl.groupss& acl: "%s" not defined in [acl.groups] s group '%s' is undefined( t configlistt debugR t groupmemberst KeyErrort AbortR ( t uit groupt hgrcusers( ( s/ /usr/lib64/python2.7/site-packages/hgext/acl.pyt _getusers� s c C s� | d k r t Sx� | j d d � j � D]� } | j d � r� | d } | j d � rd | | k s� | j d � r� | t | | d � k r� t Sq) | | k s� | j d � r) | t | | d � k r) t Sq) Wt S( Nt *t ,t t !i t @( t Truet replacet splitt startswithR t False( R t usert usersorgroupst ug( ( s/ /usr/lib64/python2.7/site-packages/hgext/acl.pyt _usermatch� s ( (c s� | j | � s$ | j d | � d Sg | j | � D]$ \ } } t | | | � r4 | ^ q4 � | j d | t � � | f � | s� � r� d � k r� t j S� f d � St j S� r� t j | j d � � St j S( s/ return tuple of (match function, list enabled).s acl: %s not enabled s( acl: %s enabled, %d entries for user %s R c s | � k S( N( ( t b( t pats( s/ /usr/lib64/python2.7/site-packages/hgext/acl.pyt <lambda> s t N( t has_sectionR t Nonet configitemsR t lenR t alwayst neverR t root( R t repoR t keyt patt users( ( R s/ /usr/lib64/python2.7/site-packages/hgext/acl.pyt buildmatch� s c K s� | d k r( t j t d � | � � n | d k rj | | j d d d � j � k rj | j d | � d Sd } | d k r� d | k r� | d j d � } | d d k r� | d j d � r� t j | d � } q� n | d k r� t j � } n | j d | � | j d d � } | r@| j | d d d d d d g �n t | d | d � } t | d | d � } t | | | d � } t | | | d � } xTt | | t | � � D]9} | | } | j � } | r| | � rt j t d � | | | f � � n | r9| | � r9t j t d � | | | f � � n | j d | | f � x� | j � D]u } | r�| | � r�t j t d � | | | f � � n | r]| | � r]t j t d � | | | f � � q]q]W| j d | � q�Wd S( Nt pretxnchangegroupt pretxncommitsI config error - hook type "%s" cannot stop incoming changesets nor commitst aclt sourcest serves) acl: changes have source "%s" - skipping t urlt :i t remotei t httpi s# acl: checking access for user "%s" t configt sectionss acl.groupss acl.allow.branchess acl.deny.branchess acl.allows acl.denys5 acl: user "%s" denied on branch "%s" (changeset "%s")s: acl: user "%s" not allowed on branch "%s" (changeset "%s")s0 acl: branch access granted: "%s" on branch "%s" s. acl: user "%s" denied on "%s" (changeset "%s")s3 acl: user "%s" not allowed on "%s" (changeset "%s")s acl: path access granted: "%s" ( R+ R, ( R R R R4 R R R R t urllibt unquotet getpasst getusert readconfigR* t xrangeR" t brancht files( R R& t hooktypet nodet sourcet kwargsR R0 t cfgt allowbranchest denybranchest allowt denyt revt ctxR< t f( ( s/ /usr/lib64/python2.7/site-packages/hgext/acl.pyt hook sT !# ( t __doc__t mercurial.i18nR t mercurialR R R8 R6 t testedwithR R R* R RJ ( ( ( s/ /usr/lib64/python2.7/site-packages/hgext/acl.pyt <module>� s