( )⚙ D4008 exchange: move narrow acl functionality into core

This is an archive of the discontinued Mercurial Phabricator instance.

Differential D4008

exchange: move narrow acl functionality into core
ClosedPublic

Authored by indygreg on Aug 1 2018, 1:03 PM.

Details

Reviewers
durin42
Group Reviewers
hg-reviewers
Commits
rHG3e7387337a3c: exchange: move narrow acl functionality into core
rHG57b1bf50a533: exchange: move narrow acl functionality into core
rHG461e7b1f6ad0: exchange: move narrow acl functionality into core
Summary

This function is called by the custom changegroup generation code
in the narrow extension. I want to move that changegroup code into
core. That means we need to move this function.

The code is kinda hacky in that assumes existence of REMOTE_USER,
which is only present on authenticated HTTP requests. I've added
a comment indicating that.

Diff Detail

Repository
rHG Mercurial
Lint
Lint Skipped
Unit
Unit Tests Skipped

Event Timeline

indygreg created this revision.Aug 1 2018, 1:03 PM
durin42 accepted this revision.Aug 1 2018, 4:49 PM
This revision is now accepted and ready to land.Aug 1 2018, 4:49 PM
Closed by commit rHG461e7b1f6ad0: exchange: move narrow acl functionality into core (authored by indygreg). · Explain WhyAug 1 2018, 5:24 PM
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathPackages
Mhgext/narrow/narrowbundle2.py (38 lines)
Mmercurial/exchange.py (43 lines)

Diff 9700

hgext/narrow/narrowbundle2.py

cg = _packellipsischangegroup( cg = _packellipsischangegroup(
repo, common, newmatch, relevant_nodes, ellipsisroots, repo, common, newmatch, relevant_nodes, ellipsisroots,
visitnodes, depth, source, version) visitnodes, depth, source, version)
part = bundler.newpart('changegroup', data=cg) part = bundler.newpart('changegroup', data=cg)
part.addparam('version', version) part.addparam('version', version)
if 'treemanifest' in repo.requirements: if 'treemanifest' in repo.requirements:
part.addparam('treemanifest', '1') part.addparam('treemanifest', '1')
def applyacl_narrow(repo, kwargs):
ui = repo.ui
username = ui.shortuser(ui.environ.get('REMOTE_USER') or ui.username())
user_includes = ui.configlist(
_NARROWACL_SECTION, username + '.includes',
ui.configlist(_NARROWACL_SECTION, 'default.includes'))
user_excludes = ui.configlist(
_NARROWACL_SECTION, username + '.excludes',
ui.configlist(_NARROWACL_SECTION, 'default.excludes'))
if not user_includes:
raise error.Abort(_("{} configuration for user {} is empty")
.format(_NARROWACL_SECTION, username))
user_includes = [
'path:.' if p == '*' else 'path:' + p for p in user_includes]
user_excludes = [
'path:.' if p == '*' else 'path:' + p for p in user_excludes]
req_includes = set(kwargs.get(r'includepats', []))
req_excludes = set(kwargs.get(r'excludepats', []))
req_includes, req_excludes, invalid_includes = narrowspec.restrictpatterns(
req_includes, req_excludes, user_includes, user_excludes)
if invalid_includes:
raise error.Abort(
_("The following includes are not accessible for {}: {}")
.format(username, invalid_includes))
new_args = {}
new_args.update(kwargs)
new_args['includepats'] = req_includes
if req_excludes:
new_args['excludepats'] = req_excludes
return new_args
@bundle2.parthandler(_SPECPART, (_SPECPART_INCLUDE, _SPECPART_EXCLUDE)) @bundle2.parthandler(_SPECPART, (_SPECPART_INCLUDE, _SPECPART_EXCLUDE))
def _handlechangespec_2(op, inpart): def _handlechangespec_2(op, inpart):
includepats = set(inpart.params.get(_SPECPART_INCLUDE, '').splitlines()) includepats = set(inpart.params.get(_SPECPART_INCLUDE, '').splitlines())
excludepats = set(inpart.params.get(_SPECPART_EXCLUDE, '').splitlines()) excludepats = set(inpart.params.get(_SPECPART_EXCLUDE, '').splitlines())
if not changegroup.NARROW_REQUIREMENT in op.repo.requirements: if not changegroup.NARROW_REQUIREMENT in op.repo.requirements:
op.repo.requirements.add(changegroup.NARROW_REQUIREMENT) op.repo.requirements.add(changegroup.NARROW_REQUIREMENT)
op.repo._writerequirements() op.repo._writerequirements()
op.repo.setnarrowpats(includepats, excludepats) op.repo.setnarrowpats(includepats, excludepats)
getbundleargs['known'] = 'csv' getbundleargs['known'] = 'csv'
# Extend changegroup serving to handle requests from narrow clients. # Extend changegroup serving to handle requests from narrow clients.
origcgfn = exchange.getbundle2partsmapping['changegroup'] origcgfn = exchange.getbundle2partsmapping['changegroup']
def wrappedcgfn(*args, **kwargs): def wrappedcgfn(*args, **kwargs):
repo = args[1] repo = args[1]
if repo.ui.has_section(_NARROWACL_SECTION): if repo.ui.has_section(_NARROWACL_SECTION):
getbundlechangegrouppart_narrow( getbundlechangegrouppart_narrow(
*args, **applyacl_narrow(repo, kwargs)) *args, **exchange.applynarrowacl(repo, kwargs))
elif kwargs.get(r'narrow', False): elif kwargs.get(r'narrow', False):
getbundlechangegrouppart_narrow(*args, **kwargs) getbundlechangegrouppart_narrow(*args, **kwargs)
else: else:
origcgfn(*args, **kwargs) origcgfn(*args, **kwargs)
exchange.getbundle2partsmapping['changegroup'] = wrappedcgfn exchange.getbundle2partsmapping['changegroup'] = wrappedcgfn
# Extend changegroup receiver so client can fixup after widen requests. # Extend changegroup receiver so client can fixup after widen requests.
origcghandler = bundle2.parthandlermapping['changegroup'] origcghandler = bundle2.parthandlermapping['changegroup']
def wrappedcghandler(op, inpart): def wrappedcghandler(op, inpart):
origcghandler(op, inpart) origcghandler(op, inpart)
if util.safehasattr(op, '_widen_bundle'): if util.safehasattr(op, '_widen_bundle'):
handlechangegroup_widen(op, inpart) handlechangegroup_widen(op, inpart)
wrappedcghandler.params = origcghandler.params wrappedcghandler.params = origcghandler.params
bundle2.parthandlermapping['changegroup'] = wrappedcghandler bundle2.parthandlermapping['changegroup'] = wrappedcghandler

mercurial/exchange.py

from . import ( from . import (
bookmarks as bookmod, bookmarks as bookmod,
bundle2, bundle2,
changegroup, changegroup,
discovery, discovery,
error, error,
lock as lockmod, lock as lockmod,
logexchange, logexchange,
narrowspec,
obsolete, obsolete,
phases, phases,
pushkey, pushkey,
pycompat, pycompat,
scmutil, scmutil,
sslutil, sslutil,
streamclone, streamclone,
url as urlmod, url as urlmod,
data = util.b85decode(remoteobs[key]) data = util.b85decode(remoteobs[key])
version, newmarks = obsolete._readmarkers(data) version, newmarks = obsolete._readmarkers(data)
markers += newmarks markers += newmarks
if markers: if markers:
pullop.repo.obsstore.add(tr, markers) pullop.repo.obsstore.add(tr, markers)
pullop.repo.invalidatevolatilesets() pullop.repo.invalidatevolatilesets()
return tr return tr
def applynarrowacl(repo, kwargs):
"""Apply narrow fetch access control.
This massages the named arguments for getbundle wire protocol commands
so requested data is filtered through access control rules.
"""
ui = repo.ui
# TODO this assumes existence of HTTP and is a layering violation.
username = ui.shortuser(ui.environ.get('REMOTE_USER') or ui.username())
user_includes = ui.configlist(
_NARROWACL_SECTION, username + '.includes',
ui.configlist(_NARROWACL_SECTION, 'default.includes'))
user_excludes = ui.configlist(
_NARROWACL_SECTION, username + '.excludes',
ui.configlist(_NARROWACL_SECTION, 'default.excludes'))
if not user_includes:
raise error.Abort(_("{} configuration for user {} is empty")
.format(_NARROWACL_SECTION, username))
user_includes = [
'path:.' if p == '*' else 'path:' + p for p in user_includes]
user_excludes = [
'path:.' if p == '*' else 'path:' + p for p in user_excludes]
req_includes = set(kwargs.get(r'includepats', []))
req_excludes = set(kwargs.get(r'excludepats', []))
req_includes, req_excludes, invalid_includes = narrowspec.restrictpatterns(
req_includes, req_excludes, user_includes, user_excludes)
if invalid_includes:
raise error.Abort(
_("The following includes are not accessible for {}: {}")
.format(username, invalid_includes))
new_args = {}
new_args.update(kwargs)
new_args['includepats'] = req_includes
if req_excludes:
new_args['excludepats'] = req_excludes
return new_args
def caps20to10(repo, role): def caps20to10(repo, role):
"""return a set with appropriate options to use bundle20 during getbundle""" """return a set with appropriate options to use bundle20 during getbundle"""
caps = {'HG20'} caps = {'HG20'}
capsblob = bundle2.encodecaps(bundle2.getrepocaps(repo, role=role)) capsblob = bundle2.encodecaps(bundle2.getrepocaps(repo, role=role))
caps.add('bundle2=' + urlreq.quote(capsblob)) caps.add('bundle2=' + urlreq.quote(capsblob))
return caps return caps
# List of names of steps to perform for a bundle2 for getbundle, order matters. # List of names of steps to perform for a bundle2 for getbundle, order matters.