From e9dac2e9ead1decb8abb1bf9df3cd638a2f5eb04 Mon Sep 17 00:00:00 2001
From: James Moger <james.moger@gitblit.com>
Date: Tue, 15 Oct 2013 08:13:04 -0400
Subject: [PATCH] Merge pull request #118 from Mrbytes/master
---
src/main/java/com/gitblit/models/UserModel.java | 186 +++++++++++++++++++++++++++++++--------------
1 files changed, 127 insertions(+), 59 deletions(-)
diff --git a/src/main/java/com/gitblit/models/UserModel.java b/src/main/java/com/gitblit/models/UserModel.java
index bec011d..b4fdb66 100644
--- a/src/main/java/com/gitblit/models/UserModel.java
+++ b/src/main/java/com/gitblit/models/UserModel.java
@@ -35,22 +35,23 @@
import com.gitblit.Constants.RegistrantType;
import com.gitblit.Constants.Unused;
import com.gitblit.utils.ArrayUtils;
+import com.gitblit.utils.ModelUtils;
import com.gitblit.utils.StringUtils;
/**
* UserModel is a serializable model class that represents a user and the user's
* restricted repository memberships. Instances of UserModels are also used as
* servlet user principals.
- *
+ *
* @author James Moger
- *
+ *
*/
public class UserModel implements Principal, Serializable, Comparable<UserModel> {
private static final long serialVersionUID = 1L;
public static final UserModel ANONYMOUS = new UserModel();
-
+
// field names are reflectively mapped in EditUser page
public String username;
public String password;
@@ -75,19 +76,23 @@
// non-persisted fields
public boolean isAuthenticated;
public AccountType accountType;
-
+
+ public UserPreferences userPreferences;
+
public UserModel(String username) {
this.username = username;
this.isAuthenticated = true;
this.accountType = AccountType.LOCAL;
+ this.userPreferences = new UserPreferences(this.username);
}
private UserModel() {
this.username = "$anonymous";
this.isAuthenticated = false;
this.accountType = AccountType.LOCAL;
+ this.userPreferences = new UserPreferences(this.username);
}
-
+
public boolean isLocalAccount() {
return accountType.isLocal();
}
@@ -95,7 +100,7 @@
/**
* This method does not take into consideration Ownership where the
* administrator has not explicitly granted access to the owner.
- *
+ *
* @param repositoryName
* @return
*/
@@ -124,7 +129,7 @@
}
return false;
}
-
+
@Deprecated
@Unused
public boolean hasRepository(String name) {
@@ -142,11 +147,11 @@
public void removeRepository(String name) {
removeRepositoryPermission(name);
}
-
+
/**
* Returns a list of repository permissions for this user exclusive of
* permissions inherited from team memberships.
- *
+ *
* @return the user's list of permissions
*/
public List<RegistrantAccessPermission> getRepositoryPermissions() {
@@ -173,7 +178,7 @@
list.add(new RegistrantAccessPermission(registrant, ap, pType, RegistrantType.REPOSITORY, source, mutable));
}
Collections.sort(list);
-
+
// include immutable team permissions, being careful to preserve order
Set<RegistrantAccessPermission> set = new LinkedHashSet<RegistrantAccessPermission>(list);
for (TeamModel team : teams) {
@@ -188,11 +193,11 @@
}
return new ArrayList<RegistrantAccessPermission>(set);
}
-
+
/**
* Returns true if the user has any type of specified access permission for
* this repository.
- *
+ *
* @param name
* @return true if user has a specified access permission for the repository
*/
@@ -214,11 +219,11 @@
}
return false;
}
-
+
/**
* Returns true if the user has an explicitly specified access permission for
* this repository.
- *
+ *
* @param name
* @return if the user has an explicitly specified access permission
*/
@@ -226,11 +231,11 @@
String repository = AccessPermission.repositoryFromRole(name).toLowerCase();
return permissions.containsKey(repository);
}
-
+
/**
* Returns true if the user's team memberships specify an access permission for
* this repository.
- *
+ *
* @param name
* @return if the user's team memberships specifi an access permission
*/
@@ -244,7 +249,7 @@
}
return false;
}
-
+
/**
* Adds a repository permission to the team.
* <p>
@@ -261,15 +266,21 @@
repositories.add(repository);
permissions.put(repository, permission);
}
-
+
public AccessPermission removeRepositoryPermission(String name) {
String repository = AccessPermission.repositoryFromRole(name).toLowerCase();
repositories.remove(repository);
return permissions.remove(repository);
}
-
+
public void setRepositoryPermission(String repository, AccessPermission permission) {
- permissions.put(repository.toLowerCase(), permission);
+ if (permission == null) {
+ // remove the permission
+ permissions.remove(repository.toLowerCase());
+ } else {
+ // set the new permission
+ permissions.put(repository.toLowerCase(), permission);
+ }
}
public RegistrantAccessPermission getRepositoryPermission(RepositoryModel repository) {
@@ -279,17 +290,30 @@
ap.permission = AccessPermission.NONE;
ap.mutable = false;
+ // determine maximum permission for the repository
+ final AccessPermission maxPermission =
+ (repository.isFrozen || !repository.isBare) ?
+ AccessPermission.CLONE : AccessPermission.REWIND;
+
if (AccessRestrictionType.NONE.equals(repository.accessRestriction)) {
// anonymous rewind
- ap.permissionType = PermissionType.ADMINISTRATOR;
- ap.permission = AccessPermission.REWIND;
+ ap.permissionType = PermissionType.ANONYMOUS;
+ if (AccessPermission.REWIND.atMost(maxPermission)) {
+ ap.permission = AccessPermission.REWIND;
+ } else {
+ ap.permission = maxPermission;
+ }
return ap;
}
// administrator
if (canAdmin()) {
ap.permissionType = PermissionType.ADMINISTRATOR;
- ap.permission = AccessPermission.REWIND;
+ if (AccessPermission.REWIND.atMost(maxPermission)) {
+ ap.permission = AccessPermission.REWIND;
+ } else {
+ ap.permission = maxPermission;
+ }
if (!canAdmin) {
// administator permission from team membership
for (TeamModel team : teams) {
@@ -301,28 +325,40 @@
}
return ap;
}
-
+
// repository owner - either specified owner or personal repository
if (repository.isOwner(username) || repository.isUsersPersonalRepository(username)) {
ap.permissionType = PermissionType.OWNER;
- ap.permission = AccessPermission.REWIND;
+ if (AccessPermission.REWIND.atMost(maxPermission)) {
+ ap.permission = AccessPermission.REWIND;
+ } else {
+ ap.permission = maxPermission;
+ }
return ap;
}
-
+
if (AuthorizationControl.AUTHENTICATED.equals(repository.authorizationControl) && isAuthenticated) {
// AUTHENTICATED is a shortcut for authorizing all logged-in users RW+ access
- ap.permission = AccessPermission.REWIND;
+ if (AccessPermission.REWIND.atMost(maxPermission)) {
+ ap.permission = AccessPermission.REWIND;
+ } else {
+ ap.permission = maxPermission;
+ }
return ap;
}
-
+
// explicit user permission OR user regex match is used
// if that fails, then the best team permission is used
if (permissions.containsKey(repository.name.toLowerCase())) {
// exact repository permission specified, use it
AccessPermission p = permissions.get(repository.name.toLowerCase());
- if (p != null) {
+ if (p != null && repository.accessRestriction.isValidPermission(p)) {
ap.permissionType = PermissionType.EXPLICIT;
- ap.permission = p;
+ if (p.atMost(maxPermission)) {
+ ap.permission = p;
+ } else {
+ ap.permission = maxPermission;
+ }
ap.mutable = true;
return ap;
}
@@ -331,31 +367,59 @@
for (String key : permissions.keySet()) {
if (StringUtils.matchesIgnoreCase(repository.name, key)) {
AccessPermission p = permissions.get(key);
- if (p != null) {
+ if (p != null && repository.accessRestriction.isValidPermission(p)) {
// take first match
ap.permissionType = PermissionType.REGEX;
- ap.permission = p;
+ if (p.atMost(maxPermission)) {
+ ap.permission = p;
+ } else {
+ ap.permission = maxPermission;
+ }
ap.source = key;
return ap;
}
}
}
}
-
+
// try to find a team match
for (TeamModel team : teams) {
RegistrantAccessPermission p = team.getRepositoryPermission(repository);
- if (p.permission.exceeds(ap.permission)) {
- // use highest team permission
+ if (p.permission.atMost(maxPermission) && p.permission.exceeds(ap.permission) && PermissionType.ANONYMOUS != p.permissionType) {
+ // use highest team permission that is not an implicit permission
ap.permission = p.permission;
ap.source = team.name;
ap.permissionType = PermissionType.TEAM;
}
- }
-
+ }
+
+ // still no explicit, regex, or team match, check for implicit permissions
+ if (AccessPermission.NONE == ap.permission) {
+ switch (repository.accessRestriction) {
+ case VIEW:
+ // no implicit permissions possible
+ break;
+ case CLONE:
+ // implied view permission
+ ap.permission = AccessPermission.VIEW;
+ ap.permissionType = PermissionType.ANONYMOUS;
+ break;
+ case PUSH:
+ // implied clone permission
+ ap.permission = AccessPermission.CLONE;
+ ap.permissionType = PermissionType.ANONYMOUS;
+ break;
+ case NONE:
+ // implied REWIND or CLONE
+ ap.permission = maxPermission;
+ ap.permissionType = PermissionType.ANONYMOUS;
+ break;
+ }
+ }
+
return ap;
}
-
+
protected boolean canAccess(RepositoryModel repository, AccessRestrictionType ifRestriction, AccessPermission requirePermission) {
if (repository.accessRestriction.atLeast(ifRestriction)) {
RegistrantAccessPermission ap = getRepositoryPermission(repository);
@@ -363,11 +427,11 @@
}
return true;
}
-
+
public boolean canView(RepositoryModel repository) {
return canAccess(repository, AccessRestrictionType.VIEW, AccessPermission.VIEW);
}
-
+
public boolean canView(RepositoryModel repository, String ref) {
// Default UserModel doesn't implement ref-level security.
// Other Realms (i.e. Gerrit) may override this method.
@@ -422,19 +486,19 @@
}
return canClone(repository);
}
-
+
public boolean canDelete(RepositoryModel model) {
return canAdmin() || model.isUsersPersonalRepository(username);
}
-
+
public boolean canEdit(RepositoryModel model) {
return canAdmin() || model.isUsersPersonalRepository(username) || model.isOwner(username);
}
-
+
/**
* This returns true if the user has fork privileges or the user has fork
* privileges because of a team membership.
- *
+ *
* @return true if the user can fork
*/
public boolean canFork() {
@@ -454,7 +518,7 @@
/**
* This returns true if the user has admin privileges or the user has admin
* privileges because of a team membership.
- *
+ *
* @return true if the user can admin
*/
public boolean canAdmin() {
@@ -474,7 +538,7 @@
/**
* This returns true if the user has create privileges or the user has create
* privileges because of a team membership.
- *
+ *
* @return true if the user can admin
*/
public boolean canCreate() {
@@ -490,10 +554,10 @@
}
return false;
}
-
+
/**
* Returns true if the user is allowed to create the specified repository.
- *
+ *
* @param repository
* @return true if the user can create the repository
*/
@@ -504,7 +568,7 @@
}
if (canCreate) {
String projectPath = StringUtils.getFirstPathElement(repository);
- if (!StringUtils.isEmpty(projectPath) && projectPath.equalsIgnoreCase("~" + username)) {
+ if (!StringUtils.isEmpty(projectPath) && projectPath.equalsIgnoreCase(getPersonalPath())) {
// personal repository
return true;
}
@@ -537,23 +601,27 @@
public String getName() {
return username;
}
-
+
public String getDisplayName() {
if (StringUtils.isEmpty(displayName)) {
return username;
}
return displayName;
}
-
+
public String getPersonalPath() {
- return "~" + username;
+ return ModelUtils.getPersonalPath(username);
}
-
+
+ public UserPreferences getPreferences() {
+ return userPreferences;
+ }
+
@Override
public int hashCode() {
return username.hashCode();
}
-
+
@Override
public boolean equals(Object o) {
if (o instanceof UserModel) {
@@ -571,10 +639,10 @@
public int compareTo(UserModel o) {
return username.compareTo(o.username);
}
-
+
/**
* Returns true if the name/email pair match this user account.
- *
+ *
* @param name
* @param email
* @return true, if the name and email address match this account
@@ -599,15 +667,15 @@
}
return nameVerified && emailVerified;
}
-
+
@Deprecated
public boolean hasBranchPermission(String repositoryName, String branch) {
// Default UserModel doesn't implement branch-level security. Other Realms (i.e. Gerrit) may override this method.
return hasRepositoryPermission(repositoryName) || hasTeamRepositoryPermission(repositoryName);
}
-
+
public boolean isMyPersonalRepository(String repository) {
String projectPath = StringUtils.getFirstPathElement(repository);
- return !StringUtils.isEmpty(projectPath) && projectPath.equalsIgnoreCase("~" + username);
+ return !StringUtils.isEmpty(projectPath) && projectPath.equalsIgnoreCase(getPersonalPath());
}
}
--
Gitblit v1.9.1