diff options
| author | James Moger <james.moger@gitblit.com> | 2012-10-10 00:05:34 -0400 |
|---|---|---|
| committer | James Moger <james.moger@gitblit.com> | 2012-10-10 00:05:34 -0400 |
| commit | 20714aee0d2d2a989d93d6065e081aed8ac85fbf (patch) | |
| tree | ac1dfc4f2519b766ad1306a9fd2d2e8e9ecf8ac8 /src/com/gitblit/Constants.java | |
| parent | c890e1f7d3f5cd83025b1d993cedf4990de63897 (diff) | |
| download | gitblit-20714aee0d2d2a989d93d6065e081aed8ac85fbf.tar.gz gitblit-20714aee0d2d2a989d93d6065e081aed8ac85fbf.zip | |
Finer-grained repository access permissions (issue 36)
Implemented discrete repository access permissions to replace the
really primitive course-grained permissions used to this point. This
implementation allows for finer-grained access control, but still
falls short of integrated, branch-based permissions sought by some.
Access permissions follow the conventions established by Gitosis and
Gitolite so they should feel immediately comfortable to experienced
users. This permissions infrastructure is complete and works exactly as
expected. Unfortunately, there is no ui in this commit to change
permissions, that will be forthcoming. In the meantime, Gitblit
hot-reloads users.conf so the permissions can be manipulated at runtime
with a text editor.
The following per-repository permissions are now supported:
- V (view in web ui, RSS feeds, download zip)
- R (clone)
- RW (clone and push)
- RWC (clone and push with ref creation)
- RWD (clone and push with ref creation, deletion)
- RW+ (clone and push with ref creation, deletion, rewind)
And a users.conf entry looks something like this:
[user "hannibal"]
password = bossman
repository = RWD:topsecret.git
Diffstat (limited to 'src/com/gitblit/Constants.java')
| -rw-r--r-- | src/com/gitblit/Constants.java | 72 |
1 files changed, 72 insertions, 0 deletions
diff --git a/src/com/gitblit/Constants.java b/src/com/gitblit/Constants.java index c831c42d..ed48bd27 100644 --- a/src/com/gitblit/Constants.java +++ b/src/com/gitblit/Constants.java @@ -15,6 +15,10 @@ */
package com.gitblit;
+import java.lang.annotation.Documented;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+
/**
* Constant values used by Gitblit.
@@ -309,4 +313,72 @@ public class Constants { return null;
}
}
+
+ /**
+ * The access permissions available for a repository.
+ */
+ public static enum AccessPermission {
+ NONE("N"), VIEW("V"), CLONE("R"), PUSH("RW"), CREATE("RWC"), DELETE("RWD"), REWIND("RW+");
+
+ public static AccessPermission LEGACY = REWIND;
+
+ public final String code;
+
+ private AccessPermission(String code) {
+ this.code = code;
+ }
+
+ public boolean atLeast(AccessPermission perm) {
+ return ordinal() >= perm.ordinal();
+ }
+
+ public boolean exceeds(AccessPermission perm) {
+ return ordinal() > perm.ordinal();
+ }
+
+ public String asRole(String repository) {
+ return code + ":" + repository;
+ }
+
+ @Override
+ public String toString() {
+ return code;
+ }
+
+ public static AccessPermission permissionFromRole(String role) {
+ String [] fields = role.split(":", 2);
+ if (fields.length == 1) {
+ // legacy/undefined assume full permissions
+ return AccessPermission.LEGACY;
+ } else {
+ // code:repository
+ return AccessPermission.fromCode(fields[0]);
+ }
+ }
+
+ public static String repositoryFromRole(String role) {
+ String [] fields = role.split(":", 2);
+ if (fields.length == 1) {
+ // legacy/undefined assume full permissions
+ return role;
+ } else {
+ // code:repository
+ return fields[1];
+ }
+ }
+
+ public static AccessPermission fromCode(String code) {
+ for (AccessPermission perm : values()) {
+ if (perm.code.equalsIgnoreCase(code)) {
+ return perm;
+ }
+ }
+ return AccessPermission.NONE;
+ }
+ }
+
+ @Documented
+ @Retention(RetentionPolicy.RUNTIME)
+ public @interface Unused {
+ }
}
|