#! /usr/bin/env python3.3 """Create, modify, and query Perforce groups for user membership.""" import logging import p4gf_const import p4gf_p4key as P4Key from p4gf_l10n import _, NTR import p4gf_util # Keys for Perforce spec 'group' KEY_OWNERS = NTR('Owners') KEY_SUBGROUPS = NTR('Subgroups') KEY_USERS = NTR('Users') KEY_GROUP = NTR('Group') PERM_PULL = NTR('pull') PERM_PUSH = NTR('push') PERM_TO_GROUP = {PERM_PULL : p4gf_const.P4GF_GROUP_PULL, PERM_PUSH : p4gf_const.P4GF_GROUP_PUSH } PERM_TO_GROUP_REPO = {PERM_PULL : p4gf_const.P4GF_GROUP_REPO_PULL, PERM_PUSH : p4gf_const.P4GF_GROUP_REPO_PUSH } DEFAULT_PERM = PERM_PUSH SPEC_TYPE_GROUP = NTR('group') LOG = logging.getLogger(__name__) ### Promote to p4gf_spec_writer.py class SpecWriter: """An object that knows when a value has changed and thus needs to be saved.""" def __init__(self, p4, spec_type, name=None): self._p4 = p4 self._spec_type = spec_type self._spec = None self._needs_write = False if name: self.fetch(name) def _fetch_spec(self, spec_type, spec_id): """Read one spec and return it.""" return p4gf_util.first_dict(self._p4.run(spec_type, "-o", spec_id)) def fetch(self, name): """Read from Perforce. Usually getting a default or empty spec, sometimes picking up some values or changes forced by a customer-installed server trigger, sometimes finding an existing spec chock full of values that the customer would rather keep. """ self._spec = self._fetch_spec(self._spec_type, name) self._needs_write = False return self._spec def needs_write(self): """Have we changed anything that needs writing?""" return self._needs_write def write_if(self): """Write, only if necessary.""" if self._needs_write: return self.write() return None def write(self): """Write, unconditionally. You probably want to call write_if().""" p4 = self._p4 LOG.debug("SpecWriter.write({})".format(self._spec_type)) p4.input = self._spec return p4.run(self._spec_type, "-i") def force_list_element(self, key, element): """Make sure that exists as a list and contains .""" if key not in self._spec: self._spec[key] = [element] self._needs_write = True return True if element not in self._spec[key]: self._spec[key].append(element) self._needs_write = True return True # Already had it, nothing changed return False ### Add force_value(key, value) later if you actually need it. class GroupWriter(SpecWriter): """A SpecWriter that understands 'p4 group' and its -a/-A rules. Rather than running the rather expensive 'p4 groups' command just to detect whether or not we need to create this group, we instead look at the value for field 'Owners': if our caller changes it via force_list_element(), then our caller is most likely creating this group from scratch, and needs to be an Owner. Good enough for our needs, and avoids a call to 'p4 groups'. """ def __init__(self, p4, name=None): """After override.""" SpecWriter.__init__(self, p4, SPEC_TYPE_GROUP, name) self._owner_changed = False self._other_changed = False if LOG.isEnabledFor(logging.DEBUG): r = p4.run('groups') n = {g['group']: 1 for g in r if g['group'].startswith('git-fusion-')} LOG.debug3('GroupWriter.__init__() current git-fusion-* groups are...\n{}' .format('\n'.join(sorted(n.keys())))) def force_list_element(self, key, element): """After override to note if we changed Owners.""" value = SpecWriter.force_list_element(self, key, element) if value: if key == KEY_OWNERS: self._owner_changed = True else: self._other_changed = True return value def create_if(self): """call create() if necessary.""" if self.needs_create(): return self.create() return None def needs_create(self): """Are we the first to write to this group?""" return self._owner_changed def create(self): """Create the group with ourself as the owner. Don't bother setting all the fields: Owner is all we need for future 'p4 group -a' modification requests to succeed. """ invalidate_groups_i() spec_id = self._spec[KEY_GROUP] spec = self._fetch_spec(SPEC_TYPE_GROUP, spec_id) spec[KEY_OWNERS] = self._spec[KEY_OWNERS] self._p4.input = self._spec return self._p4.run(SPEC_TYPE_GROUP, "-i", "-A") def write(self): """Create before writing. Pass -a to modify existing group. Complete override. """ invalidate_groups_i() r = self.create_if() # +++ don't need to write if the only thing that changed was Owner. if not self._other_changed: return r # LOG.debug("GroupWriter.write() spec=\n{}".format(self._spec)) self._p4.input = self._spec return self._p4.run(self._spec_type, "-i", "-a") def create_global_perm(p4, perm): """Create git-fusion-pull or git-fusion-push.""" group_name = PERM_TO_GROUP[perm] spec = GroupWriter(p4, group_name) spec.force_list_element(KEY_OWNERS, p4gf_const.P4GF_USER) return spec.write_if() def create_repo_perm(p4, repo_name, perm): """Create git-fusion--pull or -push.""" group_name = PERM_TO_GROUP_REPO[perm].format(repo=repo_name) subgroup_name = PERM_TO_GROUP[perm] spec = GroupWriter(p4, group_name) spec.force_list_element(KEY_OWNERS, p4gf_const.P4GF_USER) spec.force_list_element(KEY_SUBGROUPS, subgroup_name) spec.write_if() def create_default_perm(p4, perm=DEFAULT_PERM): """Create the 'stick all users into this pull/push permission group' default p4key. If p4key already exists with non-zero value, leave it unchanged. """ p4key = P4Key.get(p4, p4gf_const.P4GF_P4KEY_PERMISSION_GROUP_DEFAULT) if p4key is not None and p4key != '0': # Somebody already set it. return False P4Key.set(p4, p4gf_const.P4GF_P4KEY_PERMISSION_GROUP_DEFAULT, perm) return True def _can_push(pull, push): """If a group grants pull but not push, then nope, no push for you. Even if some other group grants push. If the group grants nothing, return None. """ if pull and not push: return False if push: return True return None # Cache of p4user => `p4 groups -i {user}` results _GROUPS_I = {} def _groups_i(p4, p4user): """Run `p4 groups -i {p4user}` and return result. Cache results so we only run this once per user. """ if p4user not in _GROUPS_I: _GROUPS_I[p4user] = p4.run('groups', '-i', p4user) return _GROUPS_I[p4user] def invalidate_groups_i(): """The 'groups -i' cache is only valid until the next time you write a group spec. Also not valid between runs, so if you're a long-lived HTTP server process, call this before each fetch/push/whatever run. """ global _GROUPS_I _GROUPS_I = {} # Cache of git-fusion-permission-group-default _PERM_KEY_DEFAULT = None def _perm_key_default(p4): """Run `p4 key git-fusion-permission-group-default` to get default permissions. Once. """ global _PERM_KEY_DEFAULT if _PERM_KEY_DEFAULT is None: _PERM_KEY_DEFAULT = P4Key.get(p4, p4gf_const.P4GF_P4KEY_PERMISSION_GROUP_DEFAULT) return _PERM_KEY_DEFAULT # Convert True/False/None to 1/0/' ' for shorter printing. PERM_TO_CHAR = {True: '1', False: '0', None: ' '} class RepoPerm: """Struct containing a single user's permissions on a repo. Keeper of the actual pull/push authorization logic: if user is a member of pull/push group X, then user has pull/pull perm. Honors default p4key value, too. for_user_and_repo() is the factory. can_pull() and can_push() query for permission. write_if() writes user to appropriate repo group if necessary. """ def __init__(self): self.p4user_name = None self.repo_name = None self.repo_pull = None self.repo_push = None self.global_pull = None self.global_push = None self.default_pull = None self.default_push = None self.user_read_permission_checked = False self.user_perm_repo_pull = None self.error_msg = None def __str__(self): s = ( "user={user} repo={repo}" + " repo:{vpull}{vpush}" + " global:{gpull}{gpush}" + " default:{dpull}{dpush}").format( user = self.p4user_name, repo = self.repo_name, vpull = PERM_TO_CHAR[self.repo_pull], vpush = PERM_TO_CHAR[self.repo_push], gpull = PERM_TO_CHAR[self.global_pull], gpush = PERM_TO_CHAR[self.global_push], dpull = PERM_TO_CHAR[self.default_pull], dpush = PERM_TO_CHAR[self.default_push]) return s @staticmethod def for_user_and_repo(p4, p4user, repo_name, required_perm): """Factory to fetch user's permissions on a repo.""" LOG.debug("for_user_and_repo() {u} {r} {p}".format(u=p4user, r=repo_name, p=required_perm)) group_list = _groups_i(p4, p4user) group_dict = {group['group']: group for group in group_list} LOG.debug3("group_dict.keys()={}".format(group_dict.keys())) vp = RepoPerm() vp.p4user_name = p4user vp.repo_name = repo_name vp.repo_pull = p4gf_const.P4GF_GROUP_REPO_PULL.format(repo=repo_name) in group_dict vp.repo_push = p4gf_const.P4GF_GROUP_REPO_PUSH.format(repo=repo_name) in group_dict vp.global_pull = p4gf_const.P4GF_GROUP_PULL in group_dict vp.global_push = p4gf_const.P4GF_GROUP_PUSH in group_dict value = P4Key.get(p4, p4gf_const.P4GF_P4KEY_PERMISSION_GROUP_DEFAULT) if value == '0': value = DEFAULT_PERM vp.default_pull = value == PERM_PULL vp.default_push = value == PERM_PUSH LOG.debug("p4key={}".format(value)) LOG.debug(vp) return vp def can(self, perm): """Where perm is either 'pull' or 'push', call can_pull() or can_push().""" if perm == PERM_PULL: return self.can_pull() elif perm == PERM_PUSH: return self.can_push() raise RuntimeError(_('invalid permission {permission}').format(permission=perm)) def can_pull(self): """If any group grants pull or push permission, or we grant either permission by default, then yes, you may pull. """ return ( self.repo_pull or self.repo_push or self.global_pull or self.global_push or self.default_pull or self.default_push) def can_push(self): """If any group grants push permission, or we grant push permission by default, then yes, you may push. If a group grants pull but not push, then nope, no push for you, even if some other group grants push. """ if None != _can_push(self.repo_pull, self.repo_push): return _can_push(self.repo_pull, self.repo_push) if None != _can_push(self.global_pull, self.global_push): return _can_push(self.global_pull, self.global_push) if None != _can_push(self.default_pull, self.default_push): return _can_push(self.default_pull, self.default_push) return None def write_if(self, p4): """If this user's permission come only from the default p4key and not from group membership, write this user to the appropriate group for this repo.""" if self.needs_write(): self._write(p4) def perm(self): """Return best of PERM_PUSH, PERM_PULL, or None.""" if self.can_push(): return PERM_PUSH if self.can_pull(): return PERM_PULL return None def _write(self, p4): """Unconditionally add this user to the git-fusion--pull or git-fusion--push. """ _perm = self.perm() subgroup_name = PERM_TO_GROUP [_perm] group_name = PERM_TO_GROUP_REPO[_perm].format(repo=self.repo_name) spec = GroupWriter(p4, group_name) spec.force_list_element(KEY_OWNERS, p4gf_const.P4GF_USER) spec.force_list_element(KEY_SUBGROUPS, subgroup_name) spec.force_list_element(KEY_USERS, self.p4user_name) spec.write_if() def needs_write(self): """If we have no permissions granted by group membership, but at least one permission granted by default, then that default could be written to the group by adding this user to that group. """ return ( not self.repo_pull and not self.repo_push and not self.global_pull and not self.global_push and ( self.default_pull or self.default_push))