#! /usr/bin/env python3.3
"""Wrapper for 'p4 protect' table."""
import logging
import os
import P4
from p4gf_path import enquote, dequote
import p4gf_const
import p4gf_util
from p4gf_l10n import _, NTR
LOG = logging.getLogger(__name__)
# privilege level constants
LIST = NTR('list')
READ = NTR('read')
OPEN = NTR('open')
WRITE = NTR('write')
ADMIN = NTR('admin')
SUPER = NTR('super')
REVIEW = NTR('review')
BRANCH = NTR('branch')
# Granting privilege N implicitly grants privilege N-1 and all those
# before it.
ORDER = [LIST, READ, OPEN, WRITE, ADMIN, SUPER]
# 'review' permission grants 'read' and thus 'list'.
REVIEW_GRANT = [LIST, READ, REVIEW]
# In case you feel like iterating.
KNOWN = [LIST, READ, OPEN, WRITE, ADMIN, SUPER, REVIEW, BRANCH]
WILDCARDS = ['...', '*'] + ['%%{}'.format(n) for n in range(0, 10)]
def permission_includes(granted, requested):
"""Does the granted permission level include the requested permission?
Most granted permissions include all those before them.
See 'p4 help protect'
Does not work so good for '=branch' permission, which can only be
denied, and if denied, prohibits "files as a source for 'p4
integrate'" which is beyond permission_includes()'s ability to
determine.
"""
# The usual sequence.
if (requested in ORDER) and (granted in ORDER):
return ORDER.index(requested) <= ORDER.index(granted)
# 'review' grants a subset of rights
if granted == REVIEW:
return requested in REVIEW_GRANT
# Granting specific permissions: '=write' grants 'write',
# and only 'review' grants 'review'.
if ( (granted == requested)
or (granted == '=' + requested)):
return True
if requested not in KNOWN:
raise RuntimeError(_('Unknown permission requested: {perm}').format(perm=requested))
return False
# pylint:disable=line-too-long
# Keep tabular code tabular.
#
# If this is the protects output for a user:
#
# write user * * //...
# list user flynn * -//...
# review user flynn * //depot/a/a2
#
# p4.run('protects', '-u', 'flynn', '//...')
#
# Returns a list like this:
# [
# { 'line': '1', 'perm': 'write' , 'user': '*', 'host': '*', 'depotFile': '//...'},
# {'unmap': '', 'line': '3', 'perm': 'list' , 'user': 'flynn', 'host': '*', 'depotFile': '//...'},
# { 'line': '4', 'perm': 'review', 'user': 'flynn', 'host': '*', 'depotFile': '//depot/a/a2'}
# ]
#
# Sam says "unmap" revokes ALL permissions for that path.
#
def _create_map_for_perm(protects_dict_list, requested_perm):
"""Return a new MapApi instance that maps in all of
protects_dict_list depotFile lines that grant the requested_perm
and excludes all lines that exclude it.
"""
# Build a list of matching lines.
lines = []
for pd in protects_dict_list:
if 'unmap' in pd: # Unmapping ANY permission unmaps ALL permissions
lines.append('-' + pd['depotFile'])
continue
if permission_includes(pd['perm'], requested_perm):
lines.append(pd['depotFile'])
# P4.Map() requires space-riddled paths to be quoted paths
# to avoid accidentally splitting a # single path into lhs/rhs.
quoted = [enquote(x) for x in lines]
mapapi = P4.Map(quoted)
return mapapi
def create_read_permissions_list(protects_dict_list, requested_perm=READ):
"""The results are used to test for repo read permissions
and as such are filtered to serve the algorithm.
Return a list of depotFile from protects_dict_list depotFile which grant the requested_perm.
Return exclusion lines which which do not start with '=' except
those which start with '=requested_perm'.
Additionally exclude list inclusions.
"""
# Build a list of matching lines.
lines = []
for pd in protects_dict_list:
# skip all =perm unless it matches the requested perm
if (pd['perm'].startswith('=') and
pd['perm'] != "=" + requested_perm): # eg: "=read user x * -//path/"
continue
if 'unmap' in pd: # Unmapping ANY permission unmaps ALL permissions
lines.append('-' + pd['depotFile'])
continue
if permission_includes(pd['perm'], requested_perm):
if pd['perm'] != 'list': # skip list inclusions
lines.append(pd['depotFile'])
quoted = [enquote(x) for x in lines]
return quoted
class Protect:
"""A wrapped MapApi instance that knows how to tell if a sequence of
'p4 protects' lines grants a requested permission on a depotFile.
"""
def __init__(self, protects=None):
# Ordered list of dicts, the result of 'p4 protects ...'.
if protects is None:
protects = []
self._protects_dict_list = protects
# Lazy-created MapApi instances.
# Key = requested permission, Val = Map instance.
self._perm_to_mapapi = {}
@classmethod
def from_protects(cls, protects_dict_list):
"""Create and return a new Protect instance seeded with the
result of p4.run('protects',...)
"""
return cls(protects_dict_list)
def map_for_perm(self, requested_perm):
"""Return a MapApi instance that maps in all the paths that
grant the requested perm, and no paths that lack it or have had
that perm explicitly revoked through exclusion lines.
Lazy-create and cache these MapApi instances.
"""
mapapi = self._perm_to_mapapi.get(requested_perm)
if not mapapi:
mapapi = _create_map_for_perm(self._protects_dict_list, requested_perm)
self._perm_to_mapapi[requested_perm] = mapapi
return mapapi
def get_protects_dict(self):
"""Return the raw p4 protects dictionary list."""
return self._protects_dict_list
def get_remote_client_addr():
"""Retrieve the IP address from the remote client via environment variables.
(either SSH_CLIENT if using SSH or REMOTE_ADDR if using HTTP).
"""
client = os.environ.get('SSH_CLIENT')
if not client:
# HTTP uses a different environment variable which is simply the IP
# address, so return it as-is (i.e. it does not have spaces in it).
return os.environ.get('REMOTE_ADDR')
# Strip the stuff after the client address.
spc = client.find(' ')
if spc > 0:
return client[:spc]
return None
def _create_protect_for_user(p4, user, client_name=None):
"""Create a new Protect object from 'p4 protects -u <user>'.
If user is None, return empty Protect
If client_name, get the protections applied to the repo client
"""
if not user:
return Protect()
client = '//' + client_name + '/...' if client_name else None
info = p4gf_util.get_p4_info_and_configurables(p4)
if user == p4gf_const.P4GF_USER:
host = info['clientAddress']
else:
host = get_remote_client_addr()
if info['uses-proxy-prefix'] and info['dm.proxy.protects']:
host = 'proxy-' + host
LOG.debug('_create_protect_for_user() using host {} for user {} and client {}'.format(host, user, client))
if client:
r = p4.run('protects', '-u', user, '-h', host, client)
else:
r = p4.run('protects', '-u', user, '-h', host)
LOG.debug("protects = {}".format(r))
return Protect.from_protects(r)
class UserToProtect:
"""Caching/Factory object that maintains a cache of Protect objects.
Keeps one hash per requested user, and knows how to create Protect
objects on the fly if you ask for one it does not (yet) have cached.
"""
def __init__(self, p4):
self._p4 = p4
self._user_to_protect = {}
def user_to_protect(self, user):
"""Return a Protect object for user.
Return from cache if one already exists; create one via
'p4 protects -u <user>' if not.
"""
p = self._user_to_protect.get(user)
if not p:
p = _create_protect_for_user(self._p4, user)
self._user_to_protect[user] = p
return p
def user_view_to_protect(self, user, view):
"""Return a Protect object for user + //view/...
Not cached as is used only for initial read protection check
"""
return _create_protect_for_user(self._p4, user, client_name=view)
def _map_inclusion_can_bypass_files(mapapi):
"""Do any of the map's lines contain wildcards other than terminal ... ?
Any exclusions?
The optimization code can reliable tell if every file in
//depot/a/... is within //depot/..., but cannot reliable tell if
//depot/a/... is within //depot/*x or depot/*/foo/... . Yes it is
possible to enhance the optimization code to reliable deal with a
few more mapping permutations, but trailing ... is the biggest
benefit for the least complexity.
"""
for line in mapapi.lhs():
line = dequote(line)
# Exclusion?
if line.startswith('-'):
return False
# Trailing dot-dot-dot expected, supported.
# Remove so it does not trigger rejection.
if line.endswith('...'):
line = line[:-3]
# Any other wildcard? Going to have to run 'p4 files'. Sorry.
for wild in WILDCARDS:
if wild in line:
return False
return True
COMPLETELY_INCLUDED = NTR('completely_included')
COMPLETELY_EXCLUDED = NTR('completely_excluded')
UNKNOWN = NTR('unknown')
def map_includes_entire_view(mapapi, view_list):
"""Can we tell if the view is completely included in the map?
+++ This is a big optimization when it works: if we can
determine COMPLETELY_INCLUED or COMPLETELY_EXCLUDED, there is no
need to run 'p4 files //<client>/...' to check each file path
against protects.
COMPLETELY_INCLUDED : view is completely included, no exclusions or
omissions make it possible for any path in view to be excluded.
COMPLETELY_EXCLUDED : view does not overlap mapapi at all. No path
in view can be included.
UNKNOWN : exclusions, partial overlap, or wildcards other than
terminal ... make it impossible to tell from just a view list
whether all of the views _current_ files are included in the mapapi.
Must run 'p4 -c <client> files //<client>/...' and pump each returned
file path through mapapi to test for inclusion.
"""
view_mapapi = P4.Map(view_list)
if ( not _map_inclusion_can_bypass_files(mapapi)
or not _map_inclusion_can_bypass_files(view_mapapi)):
return UNKNOWN
included = []
excluded = []
for line in view_mapapi.lhs():
line = dequote(line)
if mapapi.includes(line):
included.append(line)
else:
excluded.append(line)
if included and not excluded:
return COMPLETELY_INCLUDED
if not included and excluded:
return COMPLETELY_EXCLUDED
return UNKNOWN