Added Git Daemon support

6 files changed, 737 insertions, 0 deletions

diff --git a/src/main/java/com/gitblit/git/GitDaemon.java b/src/main/java/com/gitblit/git/GitDaemon.java
new file mode 100644
index 00000000..8ec05631
--- /dev/null
+++ b/src/main/java/com/gitblit/git/GitDaemon.java
@@ -0,0 +1,64 @@
+/*

+ * Copyright 2013 gitblit.com.

+ *

+ * Licensed under the Apache License, Version 2.0 (the "License");

+ * you may not use this file except in compliance with the License.

+ * You may obtain a copy of the License at

+ *

+ *     http://www.apache.org/licenses/LICENSE-2.0

+ *

+ * Unless required by applicable law or agreed to in writing, software

+ * distributed under the License is distributed on an "AS IS" BASIS,

+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

+ * See the License for the specific language governing permissions and

+ * limitations under the License.

+ */

+package com.gitblit.git;

+

+import java.io.File;

+import java.net.InetSocketAddress;

+

+import org.eclipse.jgit.transport.Daemon;

+import org.eclipse.jgit.transport.DaemonClient;

+

+import com.gitblit.utils.StringUtils;

+

+/**

+ * Gitblit's Git Daemon ignores any and all per-repository daemon settings

+ * and integrates into Gitblit's security model.

+ * 

+ * @author James Moger

+ *

+ */

+public class GitDaemon extends Daemon {

+

+	/**

+	 * Construct the Gitblit Git daemon.

+	 * 

+	 * @param bindInterface

+	 *            the ip address of the interface to bind

+	 * @param port

+	 *            the port to serve on

+	 * @param folder

+	 *            the folder to serve from

+	 */

+	public GitDaemon(String bindInterface, int port, File folder) {

+		super(StringUtils.isEmpty(bindInterface) ? new InetSocketAddress(port) : new InetSocketAddress(bindInterface, port));

+		

+		// set the repository resolver and pack factories

+		setRepositoryResolver(new RepositoryResolver<DaemonClient>(folder));

+		setUploadPackFactory(new GitblitUploadPackFactory<DaemonClient>());

+		setReceivePackFactory(new GitblitReceivePackFactory<DaemonClient>());

+		

+		// configure the git daemon to ignore the per-repository settings,

+		// daemon.uploadpack and daemon.receivepack

+		getService("git-upload-pack").setOverridable(false);

+		getService("git-receive-pack").setOverridable(false);

+		

+		// enable both the upload and receive services and let the resolver,

+		// pack factories, and receive hook handle security

+		getService("git-upload-pack").setEnabled(true);

+		getService("git-receive-pack").setEnabled(true);

+	}

+	

+}

diff --git a/src/main/java/com/gitblit/git/GitServlet.java b/src/main/java/com/gitblit/git/GitServlet.java
new file mode 100644
index 00000000..5a401066
--- /dev/null
+++ b/src/main/java/com/gitblit/git/GitServlet.java
@@ -0,0 +1,42 @@
+/*

+ * Copyright 2011 gitblit.com.

+ *

+ * Licensed under the Apache License, Version 2.0 (the "License");

+ * you may not use this file except in compliance with the License.

+ * You may obtain a copy of the License at

+ *

+ *     http://www.apache.org/licenses/LICENSE-2.0

+ *

+ * Unless required by applicable law or agreed to in writing, software

+ * distributed under the License is distributed on an "AS IS" BASIS,

+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

+ * See the License for the specific language governing permissions and

+ * limitations under the License.

+ */

+package com.gitblit.git;

+

+import javax.servlet.ServletConfig;

+import javax.servlet.ServletException;

+import javax.servlet.http.HttpServletRequest;

+

+import com.gitblit.GitBlit;

+

+/**

+ * The GitServlet provides http/https access to Git repositories.

+ * Access to this servlet is protected by the GitFilter.

+ * 

+ * @author James Moger

+ * 

+ */

+public class GitServlet extends org.eclipse.jgit.http.server.GitServlet {

+

+	private static final long serialVersionUID = 1L;

+

+	@Override

+	public void init(ServletConfig config) throws ServletException {

+		setRepositoryResolver(new RepositoryResolver<HttpServletRequest>(GitBlit.getRepositoriesFolder()));

+		setUploadPackFactory(new GitblitUploadPackFactory<HttpServletRequest>());

+		setReceivePackFactory(new GitblitReceivePackFactory<HttpServletRequest>());

+		super.init(config);

+	}

+}

diff --git a/src/main/java/com/gitblit/git/GitblitReceivePackFactory.java b/src/main/java/com/gitblit/git/GitblitReceivePackFactory.java
new file mode 100644
index 00000000..8b8ef0e4
--- /dev/null
+++ b/src/main/java/com/gitblit/git/GitblitReceivePackFactory.java
@@ -0,0 +1,106 @@
+/*
+ * Copyright 2011 gitblit.com.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.gitblit.git;
+
+import javax.servlet.http.HttpServletRequest;
+
+import org.eclipse.jgit.lib.PersonIdent;
+import org.eclipse.jgit.lib.Repository;
+import org.eclipse.jgit.transport.DaemonClient;
+import org.eclipse.jgit.transport.ReceivePack;
+import org.eclipse.jgit.transport.resolver.ReceivePackFactory;
+import org.eclipse.jgit.transport.resolver.ServiceNotAuthorizedException;
+import org.eclipse.jgit.transport.resolver.ServiceNotEnabledException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.gitblit.GitBlit;
+import com.gitblit.models.RepositoryModel;
+import com.gitblit.models.UserModel;
+import com.gitblit.utils.HttpUtils;
+
+/**
+ * The receive pack factory creates a receive pack which accepts pushes from
+ * clients.
+ * 
+ * @author James Moger
+ *
+ * @param <X> the connection type
+ */
+public class GitblitReceivePackFactory<X> implements ReceivePackFactory<X> {
+
+	protected final Logger logger = LoggerFactory.getLogger(GitblitReceivePackFactory.class);
+	
+	@Override
+	public ReceivePack create(X req, Repository db)
+			throws ServiceNotEnabledException, ServiceNotAuthorizedException {
+
+		final ReceivePack rp = new ReceivePack(db);
+		UserModel user = UserModel.ANONYMOUS;
+		String origin = "";
+		String gitblitUrl = "";
+		int timeout = 0;
+		
+		// XXX extract the repository name from the config
+		// the name is injected by GitRepositoryResolver
+		String repositoryName = db.getConfig().getString("gitblit", null, "repositoryName");
+		
+		
+		if (req instanceof HttpServletRequest) {
+			// http/https request may or may not be authenticated 
+			HttpServletRequest request = (HttpServletRequest) req;
+			origin = request.getRemoteHost();
+			gitblitUrl = HttpUtils.getGitblitURL(request);
+
+			// determine pushing user
+			String username = request.getRemoteUser();
+			if (username != null && !"".equals(username)) {
+				user = GitBlit.self().getUserModel(username);
+				if (user == null) {
+					// anonymous push, create a temporary usermodel
+					user = new UserModel(username);
+				}
+			}
+		} else if (req instanceof DaemonClient) {
+			// git daemon request is alway anonymous
+			DaemonClient client = (DaemonClient) req;
+			origin = client.getRemoteAddress().getHostAddress();
+			// set timeout from Git daemon
+			timeout = client.getDaemon().getTimeout();
+		}
+
+		// set pushing user identity for reflog
+		rp.setRefLogIdent(new PersonIdent(user.username, user.username + "@" + origin));
+		rp.setTimeout(timeout);
+		
+		// set advanced ref permissions
+		RepositoryModel repository = GitBlit.self().getRepositoryModel(repositoryName);
+		rp.setAllowCreates(user.canCreateRef(repository));
+		rp.setAllowDeletes(user.canDeleteRef(repository));
+		rp.setAllowNonFastForwards(user.canRewindRef(repository));
+
+		// setup the receive hook
+		ReceiveHook hook = new ReceiveHook();
+		hook.user = user;
+		hook.repository = repository;
+		hook.gitblitUrl = gitblitUrl;
+
+		rp.setPreReceiveHook(hook);
+		rp.setPostReceiveHook(hook);
+
+		return rp;
+	}
+}
diff --git a/src/main/java/com/gitblit/git/GitblitUploadPackFactory.java b/src/main/java/com/gitblit/git/GitblitUploadPackFactory.java
new file mode 100644
index 00000000..85750f84
--- /dev/null
+++ b/src/main/java/com/gitblit/git/GitblitUploadPackFactory.java
@@ -0,0 +1,99 @@
+/*
+ * Copyright 2011 gitblit.com.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.gitblit.git;
+
+import java.util.Map;
+
+import javax.servlet.http.HttpServletRequest;
+
+import org.eclipse.jgit.lib.Ref;
+import org.eclipse.jgit.lib.Repository;
+import org.eclipse.jgit.transport.DaemonClient;
+import org.eclipse.jgit.transport.RefFilter;
+import org.eclipse.jgit.transport.UploadPack;
+import org.eclipse.jgit.transport.resolver.ServiceNotAuthorizedException;
+import org.eclipse.jgit.transport.resolver.ServiceNotEnabledException;
+import org.eclipse.jgit.transport.resolver.UploadPackFactory;
+
+import com.gitblit.GitBlit;
+import com.gitblit.models.UserModel;
+import com.gitblit.utils.IssueUtils;
+import com.gitblit.utils.PushLogUtils;
+
+/**
+ * The upload pack factory creates an upload pack which controls what refs are
+ * advertised to cloning/pulling clients.
+ * 
+ * @author James Moger
+ * 
+ * @param <X> the connection type
+ */
+public class GitblitUploadPackFactory<X> implements UploadPackFactory<X> {
+
+	@Override
+	public UploadPack create(X req, Repository db)
+			throws ServiceNotEnabledException, ServiceNotAuthorizedException {
+
+		UserModel user = UserModel.ANONYMOUS;
+		int timeout = 0;
+
+		if (req instanceof HttpServletRequest) {
+			// http/https request may or may not be authenticated 
+			user = GitBlit.self().authenticate((HttpServletRequest) req);
+			if (user == null) {
+				user = UserModel.ANONYMOUS;
+			}
+		} else if (req instanceof DaemonClient) {
+			// git daemon request is always anonymous
+			DaemonClient client = (DaemonClient) req;
+			// set timeout from Git daemon
+			timeout = client.getDaemon().getTimeout();
+		}
+
+		RefFilter refFilter = new UserRefFilter(user);
+		UploadPack up = new UploadPack(db);
+		up.setRefFilter(refFilter);
+		up.setTimeout(timeout);
+		
+		return up;
+	}
+
+	/**
+	 * Restricts advertisement of certain refs based on the permission of the
+	 * requesting user.
+	 */
+	public static class UserRefFilter implements RefFilter {
+		
+		final UserModel user;
+		
+		public UserRefFilter(UserModel user) {
+			this.user = user;
+		}
+		
+		@Override
+		public Map<String, Ref> filter(Map<String, Ref> refs) {
+			if (user.canAdmin()) {
+				// admins can see all refs
+				return refs;
+			}
+
+			// normal users can not clone gitblit refs
+			refs.remove(IssueUtils.GB_ISSUES);
+			refs.remove(PushLogUtils.GB_PUSHES);
+			return refs;
+		}
+	}
+}
diff --git a/src/main/java/com/gitblit/git/ReceiveHook.java b/src/main/java/com/gitblit/git/ReceiveHook.java
new file mode 100644
index 00000000..a961f5a6
--- /dev/null
+++ b/src/main/java/com/gitblit/git/ReceiveHook.java
@@ -0,0 +1,321 @@
+/*

+ * Copyright 2011 gitblit.com.

+ *

+ * Licensed under the Apache License, Version 2.0 (the "License");

+ * you may not use this file except in compliance with the License.

+ * You may obtain a copy of the License at

+ *

+ *     http://www.apache.org/licenses/LICENSE-2.0

+ *

+ * Unless required by applicable law or agreed to in writing, software

+ * distributed under the License is distributed on an "AS IS" BASIS,

+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

+ * See the License for the specific language governing permissions and

+ * limitations under the License.

+ */

+package com.gitblit.git;

+

+import groovy.lang.Binding;

+import groovy.util.GroovyScriptEngine;

+

+import java.io.File;

+import java.io.IOException;

+import java.text.MessageFormat;

+import java.util.Collection;

+import java.util.LinkedHashSet;

+import java.util.List;

+import java.util.Set;

+

+import org.eclipse.jgit.lib.PersonIdent;

+import org.eclipse.jgit.revwalk.RevCommit;

+import org.eclipse.jgit.transport.PostReceiveHook;

+import org.eclipse.jgit.transport.PreReceiveHook;

+import org.eclipse.jgit.transport.ReceiveCommand;

+import org.eclipse.jgit.transport.ReceiveCommand.Result;

+import org.eclipse.jgit.transport.ReceivePack;

+import org.slf4j.Logger;

+import org.slf4j.LoggerFactory;

+

+import com.gitblit.Constants.AccessRestrictionType;

+import com.gitblit.GitBlit;

+import com.gitblit.Keys;

+import com.gitblit.client.Translation;

+import com.gitblit.models.RepositoryModel;

+import com.gitblit.models.UserModel;

+import com.gitblit.utils.ClientLogger;

+import com.gitblit.utils.JGitUtils;

+import com.gitblit.utils.PushLogUtils;

+import com.gitblit.utils.StringUtils;

+

+/**

+ * The Gitblit receive hook allows for special processing on push events.

+ * That might include rejecting writes to specific branches or executing a

+ * script.

+ * 

+ * @author James Moger

+ * 

+ */

+public class ReceiveHook implements PreReceiveHook, PostReceiveHook {

+

+	protected final Logger logger = LoggerFactory.getLogger(ReceiveHook.class);

+

+	protected UserModel user;

+	

+	protected RepositoryModel repository;

+

+	protected String gitblitUrl;

+

+	private GroovyScriptEngine gse;

+

+	private File groovyDir;

+

+	public ReceiveHook() {

+		groovyDir = GitBlit.getGroovyScriptsFolder();

+		try {

+			// set Grape root

+			File grapeRoot = GitBlit.getFileOrFolder(Keys.groovy.grapeFolder, "${baseFolder}/groovy/grape").getAbsoluteFile();

+			grapeRoot.mkdirs();

+			System.setProperty("grape.root", grapeRoot.getAbsolutePath());

+

+			gse = new GroovyScriptEngine(groovyDir.getAbsolutePath());			

+		} catch (IOException e) {

+			//throw new ServletException("Failed to instantiate Groovy Script Engine!", e);

+		}

+	}

+

+	/**

+	 * Instrumentation point where the incoming push event has been parsed,

+	 * validated, objects created BUT refs have not been updated. You might

+	 * use this to enforce a branch-write permissions model.

+	 */

+	@Override

+	public void onPreReceive(ReceivePack rp, Collection<ReceiveCommand> commands) {

+		if (repository.isFrozen) {

+			// repository is frozen/readonly

+			String reason = MessageFormat.format("Gitblit does not allow pushes to \"{0}\" because it is frozen!", repository.name);

+			logger.warn(reason);

+			for (ReceiveCommand cmd : commands) {

+				cmd.setResult(Result.REJECTED_OTHER_REASON, reason);

+			}

+			return;

+		}

+		

+		if (!repository.isBare) {

+			// repository has a working copy

+			String reason = MessageFormat.format("Gitblit does not allow pushes to \"{0}\" because it has a working copy!", repository.name);

+			logger.warn(reason);

+			for (ReceiveCommand cmd : commands) {

+				cmd.setResult(Result.REJECTED_OTHER_REASON, reason);

+			}

+			return;

+		}

+

+		if (!user.canPush(repository)) {

+			// user does not have push permissions

+			String reason = MessageFormat.format("User \"{0}\" does not have push permissions for \"{1}\"!", user.username, repository.name);

+			logger.warn(reason);

+			for (ReceiveCommand cmd : commands) {

+				cmd.setResult(Result.REJECTED_OTHER_REASON, reason);

+			}

+			return;

+		}

+

+		if (repository.accessRestriction.atLeast(AccessRestrictionType.PUSH) && repository.verifyCommitter) {

+			// enforce committer verification

+			if (StringUtils.isEmpty(user.emailAddress)) {

+				// emit warning if user does not have an email address 

+				logger.warn(MessageFormat.format("Consider setting an email address for {0} ({1}) to improve committer verification.", user.getDisplayName(), user.username));

+			}

+

+			// Optionally enforce that the committer of the left parent chain

+			// match the account being used to push the commits.

+			// 

+			// This requires all merge commits are executed with the "--no-ff"

+			// option to force a merge commit even if fast-forward is possible.

+			// This ensures that the chain of left parents has the commit

+			// identity of the merging user.

+			boolean allRejected = false;

+			for (ReceiveCommand cmd : commands) {

+				try {

+					List<RevCommit> commits = JGitUtils.getRevLog(rp.getRepository(), cmd.getOldId().name(), cmd.getNewId().name());

+					for (RevCommit commit : commits) {

+						PersonIdent committer = commit.getCommitterIdent();

+						if (!user.is(committer.getName(), committer.getEmailAddress())) {

+							String reason;

+							if (StringUtils.isEmpty(user.emailAddress)) {

+								// account does not have en email address

+								reason = MessageFormat.format("{0} by {1} <{2}> was not committed by {3} ({4})", commit.getId().name(), committer.getName(), StringUtils.isEmpty(committer.getEmailAddress()) ? "?":committer.getEmailAddress(), user.getDisplayName(), user.username);

+							} else {

+								// account has an email address

+								reason = MessageFormat.format("{0} by {1} <{2}> was not committed by {3} ({4}) <{5}>", commit.getId().name(), committer.getName(), StringUtils.isEmpty(committer.getEmailAddress()) ? "?":committer.getEmailAddress(), user.getDisplayName(), user.username, user.emailAddress);

+							}

+							logger.warn(reason);

+							cmd.setResult(Result.REJECTED_OTHER_REASON, reason);

+							allRejected &= true;

+							break;

+						} else {

+							allRejected = false;

+						}

+					}

+				} catch (Exception e) {

+					logger.error("Failed to verify commits were made by pushing user", e);

+				}

+			}

+

+			if (allRejected) {

+				// all ref updates rejected, abort

+				return;

+			}

+		}

+

+		Set<String> scripts = new LinkedHashSet<String>();

+		scripts.addAll(GitBlit.self().getPreReceiveScriptsInherited(repository));

+		scripts.addAll(repository.preReceiveScripts);

+		runGroovy(repository, user, commands, rp, scripts);

+		for (ReceiveCommand cmd : commands) {

+			if (!Result.NOT_ATTEMPTED.equals(cmd.getResult())) {

+				logger.warn(MessageFormat.format("{0} {1} because \"{2}\"", cmd.getNewId()

+						.getName(), cmd.getResult(), cmd.getMessage()));

+			}

+		}

+	}

+

+	/**

+	 * Instrumentation point where the incoming push has been applied to the

+	 * repository. This is the point where we would trigger a Jenkins build

+	 * or send an email.

+	 */

+	@Override

+	public void onPostReceive(ReceivePack rp, Collection<ReceiveCommand> commands) {

+		if (commands.size() == 0) {

+			logger.debug("skipping post-receive hooks, no refs created, updated, or removed");

+			return;

+		}

+

+		// log ref changes

+		for (ReceiveCommand cmd : commands) {

+			if (Result.OK.equals(cmd.getResult())) {

+				// add some logging for important ref changes

+				switch (cmd.getType()) {

+				case DELETE:

+					logger.info(MessageFormat.format("{0} DELETED {1} in {2} ({3})", user.username, cmd.getRefName(), repository.name, cmd.getOldId().name()));

+					break;

+				case CREATE:

+					logger.info(MessageFormat.format("{0} CREATED {1} in {2}", user.username, cmd.getRefName(), repository.name));

+					break;

+				case UPDATE:

+					logger.info(MessageFormat.format("{0} UPDATED {1} in {2} (from {3} to {4})", user.username, cmd.getRefName(), repository.name, cmd.getOldId().name(), cmd.getNewId().name()));

+					break;

+				case UPDATE_NONFASTFORWARD:

+					logger.info(MessageFormat.format("{0} UPDATED NON-FAST-FORWARD {1} in {2} (from {3} to {4})", user.username, cmd.getRefName(), repository.name, cmd.getOldId().name(), cmd.getNewId().name()));

+					break;

+				default:

+					break;

+				}

+			}

+		}

+

+		if (repository.useIncrementalPushTags) {

+			// tag each pushed branch tip

+			String emailAddress = user.emailAddress == null ? rp.getRefLogIdent().getEmailAddress() : user.emailAddress;

+			PersonIdent userIdent = new PersonIdent(user.getDisplayName(), emailAddress);

+

+			for (ReceiveCommand cmd : commands) {

+				if (!cmd.getRefName().startsWith("refs/heads/")) {

+					// only tag branch ref changes

+					continue;

+				}

+

+				if (!ReceiveCommand.Type.DELETE.equals(cmd.getType())

+						&& ReceiveCommand.Result.OK.equals(cmd.getResult())) {

+					String objectId = cmd.getNewId().getName();

+					String branch = cmd.getRefName().substring("refs/heads/".length());

+					// get translation based on the server's locale setting

+					String template = Translation.get("gb.incrementalPushTagMessage");

+					String msg = MessageFormat.format(template, branch);

+					String prefix;

+					if (StringUtils.isEmpty(repository.incrementalPushTagPrefix)) {

+						prefix = GitBlit.getString(Keys.git.defaultIncrementalPushTagPrefix, "r");

+					} else {

+						prefix = repository.incrementalPushTagPrefix;

+					}

+

+					JGitUtils.createIncrementalRevisionTag(

+							rp.getRepository(),

+							objectId,

+							userIdent,

+							prefix,

+							"0",

+							msg);

+				}

+			}				

+		}

+

+		// update push log

+		try {

+			PushLogUtils.updatePushLog(user, rp.getRepository(), commands);

+			logger.debug(MessageFormat.format("{0} push log updated", repository.name));

+		} catch (Exception e) {

+			logger.error(MessageFormat.format("Failed to update {0} pushlog", repository.name), e);

+		}

+

+		// run Groovy hook scripts 

+		Set<String> scripts = new LinkedHashSet<String>();

+		scripts.addAll(GitBlit.self().getPostReceiveScriptsInherited(repository));

+		scripts.addAll(repository.postReceiveScripts);

+		runGroovy(repository, user, commands, rp, scripts);

+	}

+

+	/**

+	 * Runs the specified Groovy hook scripts.

+	 * 

+	 * @param repository

+	 * @param user

+	 * @param commands

+	 * @param scripts

+	 */

+	protected void runGroovy(RepositoryModel repository, UserModel user,

+			Collection<ReceiveCommand> commands, ReceivePack rp, Set<String> scripts) {

+		if (scripts == null || scripts.size() == 0) {

+			// no Groovy scripts to execute

+			return;

+		}

+

+		Binding binding = new Binding();

+		binding.setVariable("gitblit", GitBlit.self());

+		binding.setVariable("repository", repository);

+		binding.setVariable("receivePack", rp);

+		binding.setVariable("user", user);

+		binding.setVariable("commands", commands);

+		binding.setVariable("url", gitblitUrl);

+		binding.setVariable("logger", logger);

+		binding.setVariable("clientLogger", new ClientLogger(rp));

+		for (String script : scripts) {

+			if (StringUtils.isEmpty(script)) {

+				continue;

+			}

+			// allow script to be specified without .groovy extension

+			// this is easier to read in the settings

+			File file = new File(groovyDir, script);

+			if (!file.exists() && !script.toLowerCase().endsWith(".groovy")) {

+				file = new File(groovyDir, script + ".groovy");

+				if (file.exists()) {

+					script = file.getName();

+				}

+			}

+			try {

+				Object result = gse.run(script, binding);

+				if (result instanceof Boolean) {

+					if (!((Boolean) result)) {

+						logger.error(MessageFormat.format(

+								"Groovy script {0} has failed!  Hook scripts aborted.", script));

+						break;

+					}

+				}

+			} catch (Exception e) {

+				logger.error(

+						MessageFormat.format("Failed to execute Groovy script {0}", script), e);

+			}

+		}

+	}

+}
\ No newline at end of file
diff --git a/src/main/java/com/gitblit/git/RepositoryResolver.java b/src/main/java/com/gitblit/git/RepositoryResolver.java
new file mode 100644
index 00000000..fb5db712
--- /dev/null
+++ b/src/main/java/com/gitblit/git/RepositoryResolver.java
@@ -0,0 +1,105 @@
+/*
+ * Copyright 2013 gitblit.com.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.gitblit.git;
+
+import java.io.File;
+import java.io.IOException;
+import java.text.MessageFormat;
+
+import javax.servlet.http.HttpServletRequest;
+
+import org.eclipse.jgit.errors.RepositoryNotFoundException;
+import org.eclipse.jgit.lib.Repository;
+import org.eclipse.jgit.transport.DaemonClient;
+import org.eclipse.jgit.transport.resolver.FileResolver;
+import org.eclipse.jgit.transport.resolver.ServiceNotEnabledException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.gitblit.GitBlit;
+import com.gitblit.models.RepositoryModel;
+import com.gitblit.models.UserModel;
+
+/**
+ * Resolves repositories and grants export access.
+ * 
+ * @author James Moger
+ *
+ */
+public class RepositoryResolver<X> extends FileResolver<X> {
+
+	private final Logger logger = LoggerFactory.getLogger(RepositoryResolver.class);
+	
+	public RepositoryResolver(File repositoriesFolder) {
+		super(repositoriesFolder, true);
+	}
+
+	/**
+	 * Open the repository and inject the repository name into the settings.
+	 */
+	@Override
+	public Repository open(final X req, final String name)
+			throws RepositoryNotFoundException, ServiceNotEnabledException {
+		Repository repo = super.open(req, name);
+		// XXX Set repository name for the pack factories
+		// We do this because the JGit API does not have a consistent way to
+		// retrieve the repository name from the pack factories or the hooks.
+		repo.getConfig().setString("gitblit", null, "repositoryName", name);
+		return repo;
+	}
+	
+	/**
+	 * Check if this repository can be served by the requested client connection.
+	 */
+	@Override
+	protected boolean isExportOk(X req, String repositoryName, Repository db) throws IOException {
+		RepositoryModel model = GitBlit.self().getRepositoryModel(repositoryName);
+
+		String scheme = null;
+		UserModel user = null;
+		String origin = null;
+		
+		if (req instanceof DaemonClient) {
+			// git daemon request
+			// this is an anonymous/unauthenticated protocol
+			DaemonClient client = (DaemonClient) req;
+			scheme = "git";
+			origin = client.getRemoteAddress().toString();
+			user = UserModel.ANONYMOUS;
+		} else if (req instanceof HttpServletRequest) {
+			// http/https request
+			HttpServletRequest httpRequest = (HttpServletRequest) req;
+			scheme = httpRequest.getScheme(); 
+			origin = httpRequest.getRemoteAddr();
+			user = GitBlit.self().authenticate(httpRequest);
+			if (user == null) {
+				user = UserModel.ANONYMOUS;
+			}
+		}
+
+		if (user.canClone(model)) {
+			// user can access this git repo
+			logger.debug(MessageFormat.format("{0}:// access of {1} by {2} from {3} PERMITTED",
+					scheme, repositoryName, user.username, origin));
+			return true;
+		}
+		
+		// user can not access this git repo
+		logger.warn(MessageFormat.format("{0}:// access of {1} by {2} from {3} DENIED",
+				scheme, repositoryName, user.username, origin));
+		return false;
+	}
+}