Implemented exclusion (X) permission

diff --git a/docs/01_setup.mkd b/docs/01_setup.mkd
index 6d015a3e12e04a6f47d94cc3a8d093710ee03802..c19f7fb1971bf4d825a44a7e8fa7d249ef89e25c 100644 (file)
--- a/docs/01_setup.mkd
+++ b/docs/01_setup.mkd
@@ -266,7 +266,26 @@ These permission codes are combined with the repository path to create a user pe
 \r
 Gitblit also supports *case-insensitive* regex matching for repository permissions.  The following permission grants push privileges to all repositories in the *mygroup* folder.\r
 \r
-    RW:mygroup/[a-z0-9-~_\\./]+\r
+    RW:mygroup/.*\r
+\r
+##### Exclusions\r
+\r
+When using regex matching it may also be useful to exclude specific repositories or to exclude regex repository matches.  You may specify the **X** permission for exclusion.  The following example grants clone permission to all repositories except the repositories in mygroup.  The user/team will have no access whatsoever to these repositories.\r
+\r
+    X:mygroup/.*\r
+    R:.*\r
+\r
+##### Order is Important\r
+\r
+The preceding example should suggest that order of permissions is important with regex matching.  Here are the rules for determining the permission that is applied to a repository request:\r
+\r
+1. If the user is an admin or repository owner, then RW+\r
+2. Else if user has an explicit permission, use that\r
+3. Else check for the first regex match in user permissions\r
+4. Else check for the HIGHEST permission from team memberships\r
+    1. If the team is an admin team, then RW+\r
+    2. Else if a team has an explicit permission, use that\r
+    3. Else check for the first regex match in team permissions\r
 \r
 #### No-So-Discrete Permissions (Gitblit <= v1.1.0)\r
 \r

diff --git a/src/com/gitblit/Constants.java b/src/com/gitblit/Constants.java
index 970c3db51594c7054ba682c0f9b7249fa2e47118..33cf2873e1481b726a136721cf630cdf0709e1be 100644 (file)
--- a/src/com/gitblit/Constants.java
+++ b/src/com/gitblit/Constants.java
@@ -319,9 +319,9 @@ public class Constants {
         * The access permissions available for a repository. \r
         */\r
        public static enum AccessPermission {\r
-               NONE("N"), VIEW("V"), CLONE("R"), PUSH("RW"), CREATE("RWC"), DELETE("RWD"), REWIND("RW+");\r
+               NONE("N"), EXCLUDE("X"), VIEW("V"), CLONE("R"), PUSH("RW"), CREATE("RWC"), DELETE("RWD"), REWIND("RW+");\r
                \r
-               public static final AccessPermission [] NEWPERMISSIONS = { VIEW, CLONE, PUSH, CREATE, DELETE, REWIND };\r
+               public static final AccessPermission [] NEWPERMISSIONS = { EXCLUDE, VIEW, CLONE, PUSH, CREATE, DELETE, REWIND };\r
                \r
                public static AccessPermission LEGACY = REWIND;\r
                \r

diff --git a/src/com/gitblit/wicket/GitBlitWebApp.properties b/src/com/gitblit/wicket/GitBlitWebApp.properties
index 41cbdd462a7af1e4554f1526f7ed81e1ffc35e12..09ee929ba1c344ce5c2e2e803188f2903a3fb553 100644 (file)
--- a/src/com/gitblit/wicket/GitBlitWebApp.properties
+++ b/src/com/gitblit/wicket/GitBlitWebApp.properties
@@ -348,7 +348,8 @@ gb.repositoryPermissions = repository permissions
 gb.userPermissions = user permissions\r
 gb.teamPermissions = team permissions\r
 gb.add = add\r
-gb.noPermission = NO ACCESS\r
+gb.noPermission = DELETE PERMISSION\r
+gb.excludePermission = {0} (exclude)\r
 gb.viewPermission = {0} (view)\r
 gb.clonePermission = {0} (clone)\r
 gb.pushPermission = {0} (push)\r

diff --git a/src/com/gitblit/wicket/pages/BasePage.java b/src/com/gitblit/wicket/pages/BasePage.java
index 48a872a814be39c7f07e1238f90693290040c25e..dcca361915d79f9da3bed4922e8ba40f54561d04 100644 (file)
--- a/src/com/gitblit/wicket/pages/BasePage.java
+++ b/src/com/gitblit/wicket/pages/BasePage.java
@@ -212,6 +212,9 @@ public abstract class BasePage extends WebPage {
                        case NONE:\r
                                map.put(type, MessageFormat.format(getString("gb.noPermission"), type.code));\r
                                break;\r
+                       case EXCLUDE:\r
+                               map.put(type, MessageFormat.format(getString("gb.excludePermission"), type.code));\r
+                               break;\r
                        case VIEW:\r
                                map.put(type, MessageFormat.format(getString("gb.viewPermission"), type.code));\r
                                break;\r

diff --git a/tests/com/gitblit/tests/PermissionsTest.java b/tests/com/gitblit/tests/PermissionsTest.java
index befd36036d3bdc2bf3798267ee58e8b9a0a867fd..b6ffa626e5b03d6a50a74ab7b7dffaee7d6125a6 100644 (file)
--- a/tests/com/gitblit/tests/PermissionsTest.java
+++ b/tests/com/gitblit/tests/PermissionsTest.java
@@ -2533,6 +2533,32 @@ public class PermissionsTest extends Assert {
                assertFalse("user CAN delete!", user.canDelete(personal));
                assertFalse("user CAN edit!", user.canEdit(personal));
        }
+       
+       @Test
+       public void testExclusion() throws Exception {
+               RepositoryModel personal = new RepositoryModel("~ubercool/_my-r/e~po.git", null, null, new Date());
+               personal.authorizationControl = AuthorizationControl.NAMED;
+               personal.accessRestriction = AccessRestrictionType.VIEW;
+
+               UserModel user = new UserModel("test");
+               user.setRepositoryPermission("~ubercool/.*", AccessPermission.EXCLUDE);
+               user.setRepositoryPermission(".*", AccessPermission.PUSH);
+               
+               // has EXCLUDE access because first match is EXCLUDE permission
+               assertTrue("user DOES NOT HAVE a repository permission!", user.hasRepositoryPermission(personal.name));
+               assertFalse("user CAN NOT view!", user.canView(personal));
+               assertFalse("user CAN NOT clone!", user.canClone(personal));
+               assertFalse("user CAN push!", user.canPush(personal));
+                               
+               assertFalse("user CAN create ref!", user.canCreateRef(personal));
+               assertFalse("user CAN delete ref!", user.canDeleteRef(personal));
+               assertFalse("user CAN rewind ref!", user.canRewindRef(personal));
+
+               assertFalse("user CAN fork!", user.canFork(personal));
+                               
+               assertFalse("user CAN delete!", user.canDelete(personal));
+               assertFalse("user CAN edit!", user.canEdit(personal));
+       }
 
        @Test
        public void testAdminTeamInheritance() throws Exception {