2018-11-28 20:26:14 +09:00
|
|
|
// Copyright 2018 The Gitea Authors. All rights reserved.
|
2022-11-28 03:20:29 +09:00
|
|
|
// SPDX-License-Identifier: MIT
|
2018-11-28 20:26:14 +09:00
|
|
|
|
2022-05-11 19:09:36 +09:00
|
|
|
package access
|
2018-11-28 20:26:14 +09:00
|
|
|
|
2019-04-23 05:40:51 +09:00
|
|
|
import (
|
2021-12-10 10:27:50 +09:00
|
|
|
"context"
|
2019-04-23 05:40:51 +09:00
|
|
|
"fmt"
|
|
|
|
|
2021-09-19 20:49:59 +09:00
|
|
|
"code.gitea.io/gitea/models/db"
|
2022-03-29 15:29:02 +09:00
|
|
|
"code.gitea.io/gitea/models/organization"
|
2021-11-28 20:58:28 +09:00
|
|
|
perm_model "code.gitea.io/gitea/models/perm"
|
2021-12-10 10:27:50 +09:00
|
|
|
repo_model "code.gitea.io/gitea/models/repo"
|
2021-11-10 04:57:58 +09:00
|
|
|
"code.gitea.io/gitea/models/unit"
|
2021-11-24 18:49:20 +09:00
|
|
|
user_model "code.gitea.io/gitea/models/user"
|
2019-04-23 05:40:51 +09:00
|
|
|
"code.gitea.io/gitea/modules/log"
|
|
|
|
)
|
|
|
|
|
2018-11-28 20:26:14 +09:00
|
|
|
// Permission contains all the permissions related variables to a repository for a user
|
|
|
|
type Permission struct {
|
2021-11-28 20:58:28 +09:00
|
|
|
AccessMode perm_model.AccessMode
|
2021-12-10 10:27:50 +09:00
|
|
|
Units []*repo_model.RepoUnit
|
2021-11-28 20:58:28 +09:00
|
|
|
UnitsMode map[unit.Type]perm_model.AccessMode
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
|
|
|
|
|
|
|
// IsOwner returns true if current user is the owner of repository.
|
|
|
|
func (p *Permission) IsOwner() bool {
|
2021-11-28 20:58:28 +09:00
|
|
|
return p.AccessMode >= perm_model.AccessModeOwner
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
|
|
|
|
|
|
|
// IsAdmin returns true if current user has admin or higher access of repository.
|
|
|
|
func (p *Permission) IsAdmin() bool {
|
2021-11-28 20:58:28 +09:00
|
|
|
return p.AccessMode >= perm_model.AccessModeAdmin
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
|
|
|
|
2023-12-21 05:44:55 +09:00
|
|
|
// IsGloballyWriteable returns true if the unit is writeable by all users of the instance.
|
|
|
|
func (p *Permission) IsGloballyWriteable(unitType unit.Type) bool {
|
|
|
|
for _, u := range p.Units {
|
|
|
|
if u.Type == unitType {
|
|
|
|
return u.DefaultPermissions == repo_model.UnitAccessModeWrite
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
2018-11-28 20:26:14 +09:00
|
|
|
// HasAccess returns true if the current user has at least read access to any unit of this repository
|
|
|
|
func (p *Permission) HasAccess() bool {
|
|
|
|
if p.UnitsMode == nil {
|
2021-11-28 20:58:28 +09:00
|
|
|
return p.AccessMode >= perm_model.AccessModeRead
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
|
|
|
return len(p.UnitsMode) > 0
|
|
|
|
}
|
|
|
|
|
|
|
|
// UnitAccessMode returns current user accessmode to the specify unit of the repository
|
2021-11-28 20:58:28 +09:00
|
|
|
func (p *Permission) UnitAccessMode(unitType unit.Type) perm_model.AccessMode {
|
2018-11-28 20:26:14 +09:00
|
|
|
if p.UnitsMode == nil {
|
|
|
|
for _, u := range p.Units {
|
|
|
|
if u.Type == unitType {
|
|
|
|
return p.AccessMode
|
|
|
|
}
|
|
|
|
}
|
2021-11-28 20:58:28 +09:00
|
|
|
return perm_model.AccessModeNone
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
|
|
|
return p.UnitsMode[unitType]
|
|
|
|
}
|
|
|
|
|
|
|
|
// CanAccess returns true if user has mode access to the unit of the repository
|
2021-11-28 20:58:28 +09:00
|
|
|
func (p *Permission) CanAccess(mode perm_model.AccessMode, unitType unit.Type) bool {
|
2018-11-28 20:26:14 +09:00
|
|
|
return p.UnitAccessMode(unitType) >= mode
|
|
|
|
}
|
|
|
|
|
|
|
|
// CanAccessAny returns true if user has mode access to any of the units of the repository
|
2021-11-28 20:58:28 +09:00
|
|
|
func (p *Permission) CanAccessAny(mode perm_model.AccessMode, unitTypes ...unit.Type) bool {
|
2018-11-28 20:26:14 +09:00
|
|
|
for _, u := range unitTypes {
|
|
|
|
if p.CanAccess(mode, u) {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
// CanRead returns true if user could read to this unit
|
2021-11-10 04:57:58 +09:00
|
|
|
func (p *Permission) CanRead(unitType unit.Type) bool {
|
2021-11-28 20:58:28 +09:00
|
|
|
return p.CanAccess(perm_model.AccessModeRead, unitType)
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
|
|
|
|
|
|
|
// CanReadAny returns true if user has read access to any of the units of the repository
|
2021-11-10 04:57:58 +09:00
|
|
|
func (p *Permission) CanReadAny(unitTypes ...unit.Type) bool {
|
2021-11-28 20:58:28 +09:00
|
|
|
return p.CanAccessAny(perm_model.AccessModeRead, unitTypes...)
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
|
|
|
|
|
|
|
// CanReadIssuesOrPulls returns true if isPull is true and user could read pull requests and
|
|
|
|
// returns true if isPull is false and user could read to issues
|
|
|
|
func (p *Permission) CanReadIssuesOrPulls(isPull bool) bool {
|
|
|
|
if isPull {
|
2021-11-10 04:57:58 +09:00
|
|
|
return p.CanRead(unit.TypePullRequests)
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
2021-11-10 04:57:58 +09:00
|
|
|
return p.CanRead(unit.TypeIssues)
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
|
|
|
|
|
|
|
// CanWrite returns true if user could write to this unit
|
2021-11-10 04:57:58 +09:00
|
|
|
func (p *Permission) CanWrite(unitType unit.Type) bool {
|
2021-11-28 20:58:28 +09:00
|
|
|
return p.CanAccess(perm_model.AccessModeWrite, unitType)
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
|
|
|
|
|
|
|
// CanWriteIssuesOrPulls returns true if isPull is true and user could write to pull requests and
|
|
|
|
// returns true if isPull is false and user could write to issues
|
|
|
|
func (p *Permission) CanWriteIssuesOrPulls(isPull bool) bool {
|
|
|
|
if isPull {
|
2021-11-10 04:57:58 +09:00
|
|
|
return p.CanWrite(unit.TypePullRequests)
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
2021-11-10 04:57:58 +09:00
|
|
|
return p.CanWrite(unit.TypeIssues)
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
|
|
|
|
Rewrite logger system (#24726)
## ⚠️ Breaking
The `log.<mode>.<logger>` style config has been dropped. If you used it,
please check the new config manual & app.example.ini to make your
instance output logs as expected.
Although many legacy options still work, it's encouraged to upgrade to
the new options.
The SMTP logger is deleted because SMTP is not suitable to collect logs.
If you have manually configured Gitea log options, please confirm the
logger system works as expected after upgrading.
## Description
Close #12082 and maybe more log-related issues, resolve some related
FIXMEs in old code (which seems unfixable before)
Just like rewriting queue #24505 : make code maintainable, clear legacy
bugs, and add the ability to support more writers (eg: JSON, structured
log)
There is a new document (with examples): `logging-config.en-us.md`
This PR is safer than the queue rewriting, because it's just for
logging, it won't break other logic.
## The old problems
The logging system is quite old and difficult to maintain:
* Unclear concepts: Logger, NamedLogger, MultiChannelledLogger,
SubLogger, EventLogger, WriterLogger etc
* Some code is diffuclt to konw whether it is right:
`log.DelNamedLogger("console")` vs `log.DelNamedLogger(log.DEFAULT)` vs
`log.DelLogger("console")`
* The old system heavily depends on ini config system, it's difficult to
create new logger for different purpose, and it's very fragile.
* The "color" trick is difficult to use and read, many colors are
unnecessary, and in the future structured log could help
* It's difficult to add other log formats, eg: JSON format
* The log outputer doesn't have full control of its goroutine, it's
difficult to make outputer have advanced behaviors
* The logs could be lost in some cases: eg: no Fatal error when using
CLI.
* Config options are passed by JSON, which is quite fragile.
* INI package makes the KEY in `[log]` section visible in `[log.sub1]`
and `[log.sub1.subA]`, this behavior is quite fragile and would cause
more unclear problems, and there is no strong requirement to support
`log.<mode>.<logger>` syntax.
## The new design
See `logger.go` for documents.
## Screenshot
<details>
![image](https://github.com/go-gitea/gitea/assets/2114189/4462d713-ba39-41f5-bb08-de912e67e1ff)
![image](https://github.com/go-gitea/gitea/assets/2114189/b188035e-f691-428b-8b2d-ff7b2199b2f9)
![image](https://github.com/go-gitea/gitea/assets/2114189/132e9745-1c3b-4e00-9e0d-15eaea495dee)
</details>
## TODO
* [x] add some new tests
* [x] fix some tests
* [x] test some sub-commands (manually ....)
---------
Co-authored-by: Jason Song <i@wolfogre.com>
Co-authored-by: delvh <dev.lh@web.de>
Co-authored-by: Giteabot <teabot@gitea.io>
2023-05-22 07:35:11 +09:00
|
|
|
func (p *Permission) LogString() string {
|
|
|
|
format := "<Permission AccessMode=%s, %d Units, %d UnitsMode(s): [ "
|
|
|
|
args := []any{p.AccessMode.String(), len(p.Units), len(p.UnitsMode)}
|
|
|
|
|
|
|
|
for i, unit := range p.Units {
|
|
|
|
config := ""
|
|
|
|
if unit.Config != nil {
|
|
|
|
configBytes, err := unit.Config.ToDB()
|
|
|
|
config = string(configBytes)
|
|
|
|
if err != nil {
|
|
|
|
config = err.Error()
|
2019-04-23 05:40:51 +09:00
|
|
|
}
|
|
|
|
}
|
Rewrite logger system (#24726)
## ⚠️ Breaking
The `log.<mode>.<logger>` style config has been dropped. If you used it,
please check the new config manual & app.example.ini to make your
instance output logs as expected.
Although many legacy options still work, it's encouraged to upgrade to
the new options.
The SMTP logger is deleted because SMTP is not suitable to collect logs.
If you have manually configured Gitea log options, please confirm the
logger system works as expected after upgrading.
## Description
Close #12082 and maybe more log-related issues, resolve some related
FIXMEs in old code (which seems unfixable before)
Just like rewriting queue #24505 : make code maintainable, clear legacy
bugs, and add the ability to support more writers (eg: JSON, structured
log)
There is a new document (with examples): `logging-config.en-us.md`
This PR is safer than the queue rewriting, because it's just for
logging, it won't break other logic.
## The old problems
The logging system is quite old and difficult to maintain:
* Unclear concepts: Logger, NamedLogger, MultiChannelledLogger,
SubLogger, EventLogger, WriterLogger etc
* Some code is diffuclt to konw whether it is right:
`log.DelNamedLogger("console")` vs `log.DelNamedLogger(log.DEFAULT)` vs
`log.DelLogger("console")`
* The old system heavily depends on ini config system, it's difficult to
create new logger for different purpose, and it's very fragile.
* The "color" trick is difficult to use and read, many colors are
unnecessary, and in the future structured log could help
* It's difficult to add other log formats, eg: JSON format
* The log outputer doesn't have full control of its goroutine, it's
difficult to make outputer have advanced behaviors
* The logs could be lost in some cases: eg: no Fatal error when using
CLI.
* Config options are passed by JSON, which is quite fragile.
* INI package makes the KEY in `[log]` section visible in `[log.sub1]`
and `[log.sub1.subA]`, this behavior is quite fragile and would cause
more unclear problems, and there is no strong requirement to support
`log.<mode>.<logger>` syntax.
## The new design
See `logger.go` for documents.
## Screenshot
<details>
![image](https://github.com/go-gitea/gitea/assets/2114189/4462d713-ba39-41f5-bb08-de912e67e1ff)
![image](https://github.com/go-gitea/gitea/assets/2114189/b188035e-f691-428b-8b2d-ff7b2199b2f9)
![image](https://github.com/go-gitea/gitea/assets/2114189/132e9745-1c3b-4e00-9e0d-15eaea495dee)
</details>
## TODO
* [x] add some new tests
* [x] fix some tests
* [x] test some sub-commands (manually ....)
---------
Co-authored-by: Jason Song <i@wolfogre.com>
Co-authored-by: delvh <dev.lh@web.de>
Co-authored-by: Giteabot <teabot@gitea.io>
2023-05-22 07:35:11 +09:00
|
|
|
format += "\nUnits[%d]: ID: %d RepoID: %d Type: %s Config: %s"
|
|
|
|
args = append(args, i, unit.ID, unit.RepoID, unit.Type.LogString(), config)
|
|
|
|
}
|
|
|
|
for key, value := range p.UnitsMode {
|
|
|
|
format += "\nUnitMode[%-v]: %-v"
|
|
|
|
args = append(args, key.LogString(), value.LogString())
|
2019-04-23 05:40:51 +09:00
|
|
|
}
|
Rewrite logger system (#24726)
## ⚠️ Breaking
The `log.<mode>.<logger>` style config has been dropped. If you used it,
please check the new config manual & app.example.ini to make your
instance output logs as expected.
Although many legacy options still work, it's encouraged to upgrade to
the new options.
The SMTP logger is deleted because SMTP is not suitable to collect logs.
If you have manually configured Gitea log options, please confirm the
logger system works as expected after upgrading.
## Description
Close #12082 and maybe more log-related issues, resolve some related
FIXMEs in old code (which seems unfixable before)
Just like rewriting queue #24505 : make code maintainable, clear legacy
bugs, and add the ability to support more writers (eg: JSON, structured
log)
There is a new document (with examples): `logging-config.en-us.md`
This PR is safer than the queue rewriting, because it's just for
logging, it won't break other logic.
## The old problems
The logging system is quite old and difficult to maintain:
* Unclear concepts: Logger, NamedLogger, MultiChannelledLogger,
SubLogger, EventLogger, WriterLogger etc
* Some code is diffuclt to konw whether it is right:
`log.DelNamedLogger("console")` vs `log.DelNamedLogger(log.DEFAULT)` vs
`log.DelLogger("console")`
* The old system heavily depends on ini config system, it's difficult to
create new logger for different purpose, and it's very fragile.
* The "color" trick is difficult to use and read, many colors are
unnecessary, and in the future structured log could help
* It's difficult to add other log formats, eg: JSON format
* The log outputer doesn't have full control of its goroutine, it's
difficult to make outputer have advanced behaviors
* The logs could be lost in some cases: eg: no Fatal error when using
CLI.
* Config options are passed by JSON, which is quite fragile.
* INI package makes the KEY in `[log]` section visible in `[log.sub1]`
and `[log.sub1.subA]`, this behavior is quite fragile and would cause
more unclear problems, and there is no strong requirement to support
`log.<mode>.<logger>` syntax.
## The new design
See `logger.go` for documents.
## Screenshot
<details>
![image](https://github.com/go-gitea/gitea/assets/2114189/4462d713-ba39-41f5-bb08-de912e67e1ff)
![image](https://github.com/go-gitea/gitea/assets/2114189/b188035e-f691-428b-8b2d-ff7b2199b2f9)
![image](https://github.com/go-gitea/gitea/assets/2114189/132e9745-1c3b-4e00-9e0d-15eaea495dee)
</details>
## TODO
* [x] add some new tests
* [x] fix some tests
* [x] test some sub-commands (manually ....)
---------
Co-authored-by: Jason Song <i@wolfogre.com>
Co-authored-by: delvh <dev.lh@web.de>
Co-authored-by: Giteabot <teabot@gitea.io>
2023-05-22 07:35:11 +09:00
|
|
|
format += " ]>"
|
|
|
|
return fmt.Sprintf(format, args...)
|
2019-04-23 05:40:51 +09:00
|
|
|
}
|
|
|
|
|
2018-11-28 20:26:14 +09:00
|
|
|
// GetUserRepoPermission returns the user permissions to the repository
|
2023-07-05 00:52:33 +09:00
|
|
|
func GetUserRepoPermission(ctx context.Context, repo *repo_model.Repository, user *user_model.User) (Permission, error) {
|
|
|
|
var perm Permission
|
2019-04-23 05:40:51 +09:00
|
|
|
if log.IsTrace() {
|
|
|
|
defer func() {
|
|
|
|
if user == nil {
|
|
|
|
log.Trace("Permission Loaded for anonymous user in %-v:\nPermissions: %-+v",
|
|
|
|
repo,
|
|
|
|
perm)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
log.Trace("Permission Loaded for %-v in %-v:\nPermissions: %-+v",
|
|
|
|
user,
|
|
|
|
repo,
|
|
|
|
perm)
|
|
|
|
}()
|
|
|
|
}
|
2022-04-29 00:45:33 +09:00
|
|
|
|
2018-11-28 20:26:14 +09:00
|
|
|
// anonymous user visit private repo.
|
|
|
|
// TODO: anonymous user visit public unit of private repo???
|
|
|
|
if user == nil && repo.IsPrivate {
|
2021-11-28 20:58:28 +09:00
|
|
|
perm.AccessMode = perm_model.AccessModeNone
|
2023-07-05 00:52:33 +09:00
|
|
|
return perm, nil
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
|
|
|
|
2023-07-05 00:52:33 +09:00
|
|
|
var isCollaborator bool
|
|
|
|
var err error
|
2019-05-17 00:48:40 +09:00
|
|
|
if user != nil {
|
2023-07-05 00:52:33 +09:00
|
|
|
isCollaborator, err = repo_model.IsCollaborator(ctx, repo.ID, user.ID)
|
2019-05-17 00:48:40 +09:00
|
|
|
if err != nil {
|
|
|
|
return perm, err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-07-05 00:52:33 +09:00
|
|
|
if err := repo.LoadOwner(ctx); err != nil {
|
|
|
|
return perm, err
|
2020-01-12 18:36:21 +09:00
|
|
|
}
|
|
|
|
|
2021-07-08 20:38:13 +09:00
|
|
|
// Prevent strangers from checking out public repo of private organization/users
|
2021-06-27 04:53:14 +09:00
|
|
|
// Allow user if they are collaborator of a repo within a private user or a private organization but not a member of the organization itself
|
2023-07-05 00:52:33 +09:00
|
|
|
if !organization.HasOrgOrUserVisible(ctx, repo.Owner, user) && !isCollaborator {
|
2021-11-28 20:58:28 +09:00
|
|
|
perm.AccessMode = perm_model.AccessModeNone
|
2023-07-05 00:52:33 +09:00
|
|
|
return perm, nil
|
2019-04-26 03:59:10 +09:00
|
|
|
}
|
|
|
|
|
2023-07-05 00:52:33 +09:00
|
|
|
if err := repo.LoadUnits(ctx); err != nil {
|
|
|
|
return perm, err
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
|
|
|
|
|
|
|
perm.Units = repo.Units
|
|
|
|
|
|
|
|
// anonymous visit public repo
|
|
|
|
if user == nil {
|
2021-11-28 20:58:28 +09:00
|
|
|
perm.AccessMode = perm_model.AccessModeRead
|
2023-07-05 00:52:33 +09:00
|
|
|
return perm, nil
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
|
|
|
|
|
|
|
// Admin or the owner has super access to the repository
|
|
|
|
if user.IsAdmin || user.ID == repo.OwnerID {
|
2021-11-28 20:58:28 +09:00
|
|
|
perm.AccessMode = perm_model.AccessModeOwner
|
2023-07-05 00:52:33 +09:00
|
|
|
return perm, nil
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
|
|
|
|
|
|
|
// plain user
|
2022-05-20 23:08:52 +09:00
|
|
|
perm.AccessMode, err = accessLevel(ctx, user, repo)
|
2018-11-28 20:26:14 +09:00
|
|
|
if err != nil {
|
2023-07-05 00:52:33 +09:00
|
|
|
return perm, err
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
|
|
|
|
2023-07-05 00:52:33 +09:00
|
|
|
if err := repo.LoadOwner(ctx); err != nil {
|
|
|
|
return perm, err
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
2023-12-21 05:44:55 +09:00
|
|
|
|
2018-11-28 20:26:14 +09:00
|
|
|
if !repo.Owner.IsOrganization() {
|
2023-12-21 05:44:55 +09:00
|
|
|
// for a public repo, different repo units may have different default
|
|
|
|
// permissions for non-restricted users.
|
|
|
|
if !repo.IsPrivate && !user.IsRestricted && len(repo.Units) > 0 {
|
|
|
|
perm.UnitsMode = make(map[unit.Type]perm_model.AccessMode)
|
|
|
|
for _, u := range repo.Units {
|
|
|
|
if _, ok := perm.UnitsMode[u.Type]; !ok {
|
|
|
|
perm.UnitsMode[u.Type] = u.DefaultPermissions.ToAccessMode(perm.AccessMode)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-07-05 00:52:33 +09:00
|
|
|
return perm, nil
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
|
|
|
|
2021-11-28 20:58:28 +09:00
|
|
|
perm.UnitsMode = make(map[unit.Type]perm_model.AccessMode)
|
2018-11-28 20:26:14 +09:00
|
|
|
|
|
|
|
// Collaborators on organization
|
2023-07-05 00:52:33 +09:00
|
|
|
if isCollaborator {
|
2018-11-28 20:26:14 +09:00
|
|
|
for _, u := range repo.Units {
|
|
|
|
perm.UnitsMode[u.Type] = perm.AccessMode
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// get units mode from teams
|
2022-03-29 15:29:02 +09:00
|
|
|
teams, err := organization.GetUserRepoTeams(ctx, repo.OwnerID, user.ID, repo.ID)
|
2018-11-28 20:26:14 +09:00
|
|
|
if err != nil {
|
2023-07-05 00:52:33 +09:00
|
|
|
return perm, err
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
|
|
|
|
2019-02-23 01:14:45 +09:00
|
|
|
// if user in an owner team
|
|
|
|
for _, team := range teams {
|
2022-01-05 12:37:00 +09:00
|
|
|
if team.AccessMode >= perm_model.AccessModeAdmin {
|
2021-11-28 20:58:28 +09:00
|
|
|
perm.AccessMode = perm_model.AccessModeOwner
|
2019-02-23 01:14:45 +09:00
|
|
|
perm.UnitsMode = nil
|
2023-07-05 00:52:33 +09:00
|
|
|
return perm, nil
|
2019-02-23 01:14:45 +09:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-11-28 20:26:14 +09:00
|
|
|
for _, u := range repo.Units {
|
|
|
|
var found bool
|
|
|
|
for _, team := range teams {
|
2022-12-10 11:46:31 +09:00
|
|
|
teamMode := team.UnitAccessMode(ctx, u.Type)
|
2022-01-05 12:37:00 +09:00
|
|
|
if teamMode > perm_model.AccessModeNone {
|
2018-11-28 20:26:14 +09:00
|
|
|
m := perm.UnitsMode[u.Type]
|
2022-01-05 12:37:00 +09:00
|
|
|
if m < teamMode {
|
|
|
|
perm.UnitsMode[u.Type] = teamMode
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
|
|
|
found = true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-12-21 05:44:55 +09:00
|
|
|
// for a public repo on an organization, a non-restricted user should
|
|
|
|
// have the same permission on non-team defined units as the default
|
|
|
|
// permissions for the repo unit.
|
2020-01-14 02:33:46 +09:00
|
|
|
if !found && !repo.IsPrivate && !user.IsRestricted {
|
2018-11-28 20:26:14 +09:00
|
|
|
if _, ok := perm.UnitsMode[u.Type]; !ok {
|
2023-12-21 05:44:55 +09:00
|
|
|
perm.UnitsMode[u.Type] = u.DefaultPermissions.ToAccessMode(perm_model.AccessModeRead)
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// remove no permission units
|
2021-12-10 10:27:50 +09:00
|
|
|
perm.Units = make([]*repo_model.RepoUnit, 0, len(repo.Units))
|
2018-11-28 20:26:14 +09:00
|
|
|
for t := range perm.UnitsMode {
|
|
|
|
for _, u := range repo.Units {
|
|
|
|
if u.Type == t {
|
|
|
|
perm.Units = append(perm.Units, u)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-06-20 19:02:49 +09:00
|
|
|
return perm, err
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
|
|
|
|
2020-11-29 00:52:29 +09:00
|
|
|
// IsUserRealRepoAdmin check if this user is real repo admin
|
2023-10-03 19:30:41 +09:00
|
|
|
func IsUserRealRepoAdmin(ctx context.Context, repo *repo_model.Repository, user *user_model.User) (bool, error) {
|
2020-11-29 00:52:29 +09:00
|
|
|
if repo.OwnerID == user.ID {
|
|
|
|
return true, nil
|
|
|
|
}
|
|
|
|
|
2023-10-03 19:30:41 +09:00
|
|
|
if err := repo.LoadOwner(ctx); err != nil {
|
2020-11-29 00:52:29 +09:00
|
|
|
return false, err
|
|
|
|
}
|
|
|
|
|
2023-10-03 19:30:41 +09:00
|
|
|
accessMode, err := accessLevel(ctx, user, repo)
|
2020-11-29 00:52:29 +09:00
|
|
|
if err != nil {
|
|
|
|
return false, err
|
|
|
|
}
|
|
|
|
|
2021-11-28 20:58:28 +09:00
|
|
|
return accessMode >= perm_model.AccessModeAdmin, nil
|
2020-11-29 00:52:29 +09:00
|
|
|
}
|
|
|
|
|
2020-01-11 16:29:34 +09:00
|
|
|
// IsUserRepoAdmin return true if user has admin right of a repo
|
2022-05-20 23:08:52 +09:00
|
|
|
func IsUserRepoAdmin(ctx context.Context, repo *repo_model.Repository, user *user_model.User) (bool, error) {
|
2018-11-28 20:26:14 +09:00
|
|
|
if user == nil || repo == nil {
|
|
|
|
return false, nil
|
|
|
|
}
|
|
|
|
if user.IsAdmin {
|
|
|
|
return true, nil
|
|
|
|
}
|
|
|
|
|
2022-05-20 23:08:52 +09:00
|
|
|
mode, err := accessLevel(ctx, user, repo)
|
2018-11-28 20:26:14 +09:00
|
|
|
if err != nil {
|
|
|
|
return false, err
|
|
|
|
}
|
2021-11-28 20:58:28 +09:00
|
|
|
if mode >= perm_model.AccessModeAdmin {
|
2018-11-28 20:26:14 +09:00
|
|
|
return true, nil
|
|
|
|
}
|
|
|
|
|
2022-03-29 15:29:02 +09:00
|
|
|
teams, err := organization.GetUserRepoTeams(ctx, repo.OwnerID, user.ID, repo.ID)
|
2018-11-28 20:26:14 +09:00
|
|
|
if err != nil {
|
|
|
|
return false, err
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, team := range teams {
|
2022-01-05 12:37:00 +09:00
|
|
|
if team.AccessMode >= perm_model.AccessModeAdmin {
|
2018-11-28 20:26:14 +09:00
|
|
|
return true, nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return false, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// AccessLevel returns the Access a user has to a repository. Will return NoneAccess if the
|
|
|
|
// user does not have access.
|
2022-11-19 17:12:33 +09:00
|
|
|
func AccessLevel(ctx context.Context, user *user_model.User, repo *repo_model.Repository) (perm_model.AccessMode, error) { //nolint
|
|
|
|
return AccessLevelUnit(ctx, user, repo, unit.TypeCode)
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
|
|
|
|
2019-10-28 11:11:50 +09:00
|
|
|
// AccessLevelUnit returns the Access a user has to a repository's. Will return NoneAccess if the
|
|
|
|
// user does not have access.
|
2022-11-19 17:12:33 +09:00
|
|
|
func AccessLevelUnit(ctx context.Context, user *user_model.User, repo *repo_model.Repository, unitType unit.Type) (perm_model.AccessMode, error) { //nolint
|
2022-04-28 20:48:48 +09:00
|
|
|
perm, err := GetUserRepoPermission(ctx, repo, user)
|
2018-11-28 20:26:14 +09:00
|
|
|
if err != nil {
|
2021-11-28 20:58:28 +09:00
|
|
|
return perm_model.AccessModeNone, err
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
2019-03-24 18:08:45 +09:00
|
|
|
return perm.UnitAccessMode(unitType), nil
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
|
|
|
|
2022-05-11 19:09:36 +09:00
|
|
|
// HasAccessUnit returns true if user has testMode to the unit of the repository
|
|
|
|
func HasAccessUnit(ctx context.Context, user *user_model.User, repo *repo_model.Repository, unitType unit.Type, testMode perm_model.AccessMode) (bool, error) {
|
2022-11-19 17:12:33 +09:00
|
|
|
mode, err := AccessLevelUnit(ctx, user, repo, unitType)
|
2018-11-28 20:26:14 +09:00
|
|
|
return testMode <= mode, err
|
|
|
|
}
|
|
|
|
|
2019-10-25 23:46:37 +09:00
|
|
|
// CanBeAssigned return true if user can be assigned to issue or pull requests in repo
|
|
|
|
// Currently any write access (code, issues or pr's) is assignable, to match assignee list in user interface.
|
2018-11-28 20:26:14 +09:00
|
|
|
// FIXME: user could send PullRequest also could be assigned???
|
2022-05-11 19:09:36 +09:00
|
|
|
func CanBeAssigned(ctx context.Context, user *user_model.User, repo *repo_model.Repository, _ bool) (bool, error) {
|
2019-10-25 23:46:37 +09:00
|
|
|
if user.IsOrganization() {
|
|
|
|
return false, fmt.Errorf("Organization can't be added as assignee [user_id: %d, repo_id: %d]", user.ID, repo.ID)
|
|
|
|
}
|
2022-04-28 20:48:48 +09:00
|
|
|
perm, err := GetUserRepoPermission(ctx, repo, user)
|
2019-10-25 23:46:37 +09:00
|
|
|
if err != nil {
|
|
|
|
return false, err
|
|
|
|
}
|
2021-11-28 20:58:28 +09:00
|
|
|
return perm.CanAccessAny(perm_model.AccessModeWrite, unit.TypeCode, unit.TypeIssues, unit.TypePullRequests), nil
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
|
|
|
|
2022-05-11 19:09:36 +09:00
|
|
|
// HasAccess returns true if user has access to repo
|
|
|
|
func HasAccess(ctx context.Context, userID int64, repo *repo_model.Repository) (bool, error) {
|
2021-11-24 18:49:20 +09:00
|
|
|
var user *user_model.User
|
2018-11-28 20:26:14 +09:00
|
|
|
var err error
|
|
|
|
if userID > 0 {
|
2022-12-03 11:48:26 +09:00
|
|
|
user, err = user_model.GetUserByID(ctx, userID)
|
2018-11-28 20:26:14 +09:00
|
|
|
if err != nil {
|
|
|
|
return false, err
|
|
|
|
}
|
|
|
|
}
|
2022-04-28 20:48:48 +09:00
|
|
|
perm, err := GetUserRepoPermission(ctx, repo, user)
|
2018-11-28 20:26:14 +09:00
|
|
|
if err != nil {
|
|
|
|
return false, err
|
|
|
|
}
|
|
|
|
return perm.HasAccess(), nil
|
|
|
|
}
|
|
|
|
|
2022-05-11 19:09:36 +09:00
|
|
|
// getUsersWithAccessMode returns users that have at least given access mode to the repository.
|
|
|
|
func getUsersWithAccessMode(ctx context.Context, repo *repo_model.Repository, mode perm_model.AccessMode) (_ []*user_model.User, err error) {
|
2023-02-18 21:11:03 +09:00
|
|
|
if err = repo.LoadOwner(ctx); err != nil {
|
2022-05-11 19:09:36 +09:00
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
e := db.GetEngine(ctx)
|
|
|
|
accesses := make([]*Access, 0, 10)
|
|
|
|
if err = e.Where("repo_id = ? AND mode >= ?", repo.ID, mode).Find(&accesses); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Leave a seat for owner itself to append later, but if owner is an organization
|
|
|
|
// and just waste 1 unit is cheaper than re-allocate memory once.
|
|
|
|
users := make([]*user_model.User, 0, len(accesses)+1)
|
|
|
|
if len(accesses) > 0 {
|
|
|
|
userIDs := make([]int64, len(accesses))
|
|
|
|
for i := 0; i < len(accesses); i++ {
|
|
|
|
userIDs[i] = accesses[i].UserID
|
|
|
|
}
|
|
|
|
|
|
|
|
if err = e.In("id", userIDs).Find(&users); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if !repo.Owner.IsOrganization() {
|
|
|
|
users = append(users, repo.Owner)
|
|
|
|
}
|
|
|
|
|
|
|
|
return users, nil
|
2018-11-28 20:26:14 +09:00
|
|
|
}
|
2020-01-05 10:23:29 +09:00
|
|
|
|
2021-12-13 00:48:20 +09:00
|
|
|
// GetRepoReaders returns all users that have explicit read access or higher to the repository.
|
2023-10-03 19:30:41 +09:00
|
|
|
func GetRepoReaders(ctx context.Context, repo *repo_model.Repository) (_ []*user_model.User, err error) {
|
|
|
|
return getUsersWithAccessMode(ctx, repo, perm_model.AccessModeRead)
|
2021-12-13 00:48:20 +09:00
|
|
|
}
|
|
|
|
|
|
|
|
// GetRepoWriters returns all users that have write access to the repository.
|
2023-10-03 19:30:41 +09:00
|
|
|
func GetRepoWriters(ctx context.Context, repo *repo_model.Repository) (_ []*user_model.User, err error) {
|
|
|
|
return getUsersWithAccessMode(ctx, repo, perm_model.AccessModeWrite)
|
2021-12-13 00:48:20 +09:00
|
|
|
}
|
|
|
|
|
|
|
|
// IsRepoReader returns true if user has explicit read access or higher to the repository.
|
2022-04-28 20:48:48 +09:00
|
|
|
func IsRepoReader(ctx context.Context, repo *repo_model.Repository, userID int64) (bool, error) {
|
2021-12-13 00:48:20 +09:00
|
|
|
if repo.OwnerID == userID {
|
|
|
|
return true, nil
|
|
|
|
}
|
2022-04-28 20:48:48 +09:00
|
|
|
return db.GetEngine(ctx).Where("repo_id = ? AND user_id = ? AND mode >= ?", repo.ID, userID, perm_model.AccessModeRead).Get(&Access{})
|
2021-12-13 00:48:20 +09:00
|
|
|
}
|
2022-08-25 11:31:57 +09:00
|
|
|
|
|
|
|
// CheckRepoUnitUser check whether user could visit the unit of this repository
|
|
|
|
func CheckRepoUnitUser(ctx context.Context, repo *repo_model.Repository, user *user_model.User, unitType unit.Type) bool {
|
|
|
|
if user != nil && user.IsAdmin {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
perm, err := GetUserRepoPermission(ctx, repo, user)
|
|
|
|
if err != nil {
|
|
|
|
log.Error("GetUserRepoPermission: %w", err)
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
return perm.CanRead(unitType)
|
|
|
|
}
|