From 9a6a428bad30be341e4df2c6b0f77d9b9e9881ca Mon Sep 17 00:00:00 2001
From: James Moger <james.moger@gitblit.com>
Date: Thu, 2 May 2013 09:57:19 -0400
Subject: Improve effective permission determination

---
 src/main/java/com/gitblit/models/UserModel.java | 36 ++++++++++++++++++++-----
 1 file changed, 30 insertions(+), 6 deletions(-)

(limited to 'src/main/java/com/gitblit/models/UserModel.java')

diff --git a/src/main/java/com/gitblit/models/UserModel.java b/src/main/java/com/gitblit/models/UserModel.java
index bec011d9..5750d46a 100644
--- a/src/main/java/com/gitblit/models/UserModel.java
+++ b/src/main/java/com/gitblit/models/UserModel.java
@@ -281,7 +281,7 @@ public class UserModel implements Principal, Serializable, Comparable<UserModel>
 
 		if (AccessRestrictionType.NONE.equals(repository.accessRestriction)) {
 			// anonymous rewind
-			ap.permissionType = PermissionType.ADMINISTRATOR;
+			ap.permissionType = PermissionType.ANONYMOUS;
 			ap.permission = AccessPermission.REWIND;
 			return ap;
 		}
@@ -320,7 +320,7 @@ public class UserModel implements Principal, Serializable, Comparable<UserModel>
 		if (permissions.containsKey(repository.name.toLowerCase())) {
 			// exact repository permission specified, use it
 			AccessPermission p = permissions.get(repository.name.toLowerCase());
-			if (p != null) {
+			if (p != null && repository.accessRestriction.isValidPermission(p)) {
 				ap.permissionType = PermissionType.EXPLICIT;
 				ap.permission = p;
 				ap.mutable = true;
@@ -331,7 +331,7 @@ public class UserModel implements Principal, Serializable, Comparable<UserModel>
 			for (String key : permissions.keySet()) {
 				if (StringUtils.matchesIgnoreCase(repository.name, key)) {
 					AccessPermission p = permissions.get(key);
-					if (p != null) {
+					if (p != null && repository.accessRestriction.isValidPermission(p)) {
 						// take first match
 						ap.permissionType = PermissionType.REGEX;
 						ap.permission = p;
@@ -345,13 +345,37 @@ public class UserModel implements Principal, Serializable, Comparable<UserModel>
 		// try to find a team match
 		for (TeamModel team : teams) {
 			RegistrantAccessPermission p = team.getRepositoryPermission(repository);
-			if (p.permission.exceeds(ap.permission)) {
-				// use highest team permission
+			if (p.permission.exceeds(ap.permission) && PermissionType.ANONYMOUS != p.permissionType) {
+				// use highest team permission that is not an implicit permission
 				ap.permission = p.permission;
 				ap.source = team.name;
 				ap.permissionType = PermissionType.TEAM;
 			}
-		}		
+		}
+		
+		// still no explicit, regex, or team match, check for implicit permissions
+		if (AccessPermission.NONE == ap.permission) {
+			switch (repository.accessRestriction) {
+			case VIEW:
+				// no implicit permissions possible
+				break;
+			case CLONE:
+				// implied view permission
+				ap.permission = AccessPermission.VIEW;
+				ap.permissionType = PermissionType.ANONYMOUS;
+				break;
+			case PUSH:
+				// implied clone permission
+				ap.permission = AccessPermission.CLONE;
+				ap.permissionType = PermissionType.ANONYMOUS;
+				break;
+			case NONE:
+				// implied REWIND or CLONE if frozen
+				ap.permission = repository.isFrozen ? AccessPermission.CLONE : AccessPermission.REWIND;
+				ap.permissionType = PermissionType.ANONYMOUS;
+				break;
+			}
+		}
 		
 		return ap;
 	}
-- 
cgit v1.2.3