hooks/update

   1 #!/bin/sh
   2 #
   3 # Currently, we just confine the mob user to the mob branch here.
   4 #
   5 # TODO: Generalized branches push permissions support.
   6
   7 set -e
   8
   9 if ! [ -x /usr/bin/perl ]; then
  10         # We are INSIDE the chroot
  11
  12         reporoot=/@jailreporoot@
  13         webadmurl=@webadmurl@
  14         mob=@mob@
  15         proj="$(pwd)"; proj="${proj#$reporoot/}"
  16         mobdir=
  17         case "$proj" in *?/mob)
  18                 mobdir=1
  19                 proj="${proj%/mob}"
  20         esac
  21         projbare="${proj%.git}"
  22
  23         if ! [ -f "$reporoot/$proj/.nofetch" ]; then
  24                 echo "The $proj project is a mirror and may not be pushed to, sorry" >&2
  25                 exit 3
  26         fi
  27
  28         if [ -n "$mobdir" -a "$mob" != "mob" ]; then
  29                 # Should only get here if there's a misconfiguration
  30                 echo "Personal mob branches are not supported" >&2
  31                 exit 3
  32         fi
  33         if [ -n "$mobdir" -a "$LOGNAME" = "mob" ]; then
  34                 # Should only get here if there's a misconfiguration
  35                 echo "The mob user may not use personal mob branches" >&2
  36                 exit 3
  37         fi
  38         if [ -n "$mobdir" -a ! -d "$reporoot/$proj/mob" ]; then
  39                 # Should only get here if there's a misconfiguration
  40                 echo "The project '$proj' does not support personal mob branches" >&2
  41                 exit 3
  42         fi
  43         if [ -n "$mobdir" ] && ! can_user_push "$projbare" mob; then
  44                 # Should only get here if there's a misconfiguration
  45                 echo "The user 'mob' does not have push permissions for project '$proj'" >&2
  46                 echo "You may adjust push permissions at $webadmurl/editproj.cgi?name=$proj" >&2
  47                 exit 3
  48         fi
  49         if [ -n "$mobdir" ]; then
  50                 # All personal mob refs must start with refs/heads/mob.$USER,
  51                 # refs/heads/mob_$USER/, refs/mob/mob.$USER or refs/mob/mob_$USER/
  52                 case "$1" in
  53                 "refs/heads/mob.$LOGNAME"       | \
  54                 "refs/heads/mob_$LOGNAME/"?*    | \
  55                 "refs/mob/mob.$LOGNAME"         | \
  56                 "refs/mob/mob_$LOGNAME/"?*      ) :;;
  57                 *)
  58                         echo "The user '$LOGNAME' does not have push permissions for project '$proj'." >&2
  59                         echo "However '$proj' allows pushes to personal mob branches w/o push perms." >&2
  60                         echo "The ref '$1' is not a valid personal mob branch ref name." >&2
  61                         echo "Valid personal mob branch ref names are one of the following:" >&2
  62                         echo "  refs/heads/mob.$LOGNAME or refs/mob/mob.$LOGNAME" >&2
  63                         echo "or refs that start with one of the following:" >&2
  64                         echo "  refs/heads/mob_$LOGNAME/ or refs/mob/mob_$LOGNAME/" >&2
  65                         echo "No other personal mob branch ref names may be pushed to, sorry." >&2
  66                         echo "You may adjust push permissions at $webadmurl/editproj.cgi?name=$proj" >&2
  67                         exit 3
  68                 esac
  69                 exit 0
  70         fi
  71
  72         if ! can_user_push "$projbare"; then
  73                 echo "The user '$LOGNAME' does not have push permissions for project '$proj'" >&2
  74                 echo "You may adjust push permissions at $webadmurl/editproj.cgi?name=$proj" >&2
  75                 exit 3
  76         fi
  77
  78         if [ "$mob" = "mob" -a "$LOGNAME" = "mob" ]; then
  79                 if [ x"$1" != x"refs/heads/mob" ]; then
  80                         echo "The mob user may push only to the 'mob' branch, sorry" >&2
  81                         exit 1
  82                 fi
  83                 if [ x"$2" = x"0000000000000000000000000000000000000000" ]; then
  84                         echo "The mob user may not _create_ the 'mob' branch, sorry" >&2
  85                         exit 2
  86                 fi
  87                 if [ x"$3" = x"0000000000000000000000000000000000000000" ]; then
  88                         echo "The mob user may not _delete_ the 'mob' branch, smch, sorry"
  89                         exit 3
  90                 fi
  91         fi
  92
  93         if [ "$mob" = "mob" ]; then
  94                 case "$1" in
  95                 "refs/heads/mob."?* | "refs/heads/mob_"?*)
  96                         echo "Use of the ref '$1' is reserved for personal mob branch" >&2
  97                         echo "users who do not have push permission to project '$proj'." >&2
  98                         echo "Users with push permission may only access the personal" >&2
  99                         echo "mob branches using refs that start with 'refs/mob/'." >&2
 100                         exit 3
 101                 esac
 102         fi
 103
 104         exit 0
 105 fi
 106
 107 # We are NOT inside the chroot
 108
 109 . @basedir@/shlib.sh
 110
 111 if [ "$cfg_permission_control" = "Hooks" ]; then
 112         # We have some permission control to do!
 113         proj="$(pwd)"; proj="${proj#$cfg_reporoot/}"; projbare="${proj%.git}"
 114         # XXX: Sanity check on project name and $USER here? Seems superfluous.
 115         if ! perl -I@basedir@ -MGirocco::Project -e 'exit(1) unless Girocco::Project->load("'$projbare'")->can_user_push("'$USER'")'; then
 116                 echo "The user '$USER' does not have push permissions for project '$proj'" >&2
 117                 echo "You may adjust push permissions at $cfg_webadmurl/editproj.cgi?name=$proj" >&2
 118                 exit 3
 119         fi
 120 fi
 121
 122 if [ -n "$GIT_PROJECT_ROOT" ]; then
 123         # We are doing a smart HTTP push
 124
 125         proj="$(pwd)"; proj="${proj#$cfg_reporoot/}"
 126         mobdir=
 127         case "$proj" in *?/mob)
 128                 mobdir=1
 129                 proj="${proj%/mob}"
 130         esac
 131         projbare="${proj%.git}"
 132
 133         if ! [ -f "$cfg_reporoot/$proj/.nofetch" ]; then
 134                 echo "The $proj project is a mirror and may not be pushed to, sorry" >&2
 135                 exit 3
 136         fi
 137
 138         authuser="${REMOTE_USER#/UID=}"
 139         authuuid="${authuser}"
 140         authuser="${authuser%/dnQualifier=*}"
 141         authuuid="${authuuid#$authuser}"
 142         authuuid="${authuuid#/dnQualifier=}"
 143         if [ -z "$authuser" ]; then
 144                 echo "Only authenticated users may push, sorry" >&2
 145                 exit 3
 146         fi
 147
 148         if [ -n "$mobdir" -a "$cfg_mob" != "mob" ]; then
 149                 # Should only get here if there's a misconfiguration
 150                 echo "Personal mob branches are not supported" >&2
 151                 exit 3
 152         fi
 153         if [ -n "$mobdir" -a "$authuser" = "mob" ]; then
 154                 # Should only get here if there's a misconfiguration
 155                 echo "The mob user may not use personal mob branches" >&2
 156                 exit 3
 157         fi
 158         if [ -n "$mobdir" -a ! -d "$cfg_reporoot/$proj/mob" ]; then
 159                 # Should only get here if there's a misconfiguration
 160                 echo "The project '$proj' does not support personal mob branches" >&2
 161                 exit 3
 162         fi
 163         if [ -n "$mobdir" ] && ! perl -I@basedir@ -MGirocco::Project -e 'exit(1) unless Girocco::Project->load("'$projbare'")->can_user_push("'mob'")'; then
 164                 # Should only get here if there's a misconfiguration
 165                 echo "The user 'mob' does not have push permissions for project '$proj'" >&2
 166                 echo "You may adjust push permissions at $cfg_webadmurl/editproj.cgi?name=$proj" >&2
 167                 exit 3
 168         fi
 169         if [ -n "$mobdir" ]; then
 170                 # All personal mob refs must start with refs/heads/mob.$USER,
 171                 # refs/heads/mob_$USER/, refs/mob/mob.$USER or refs/mob/mob_$USER/
 172                 case "$1" in
 173                 "refs/heads/mob.$authuser"      | \
 174                 "refs/heads/mob_$authuser/"?*   | \
 175                 "refs/mob/mob.$authuser"        | \
 176                 "refs/mob/mob_$authuser/"?*     ) :;;
 177                 *)
 178                         echo "The user '$authuser' does not have push permissions for project '$proj'." >&2
 179                         echo "However '$proj' allows pushes to personal mob branches w/o push perms." >&2
 180                         echo "The ref '$1' is not a valid personal mob branch ref name." >&2
 181                         echo "Valid personal mob branch ref names are one of the following:" >&2
 182                         echo "  refs/heads/mob.$authuser or refs/mob/mob.$authuser" >&2
 183                         echo "or refs that start with one of the following:" >&2
 184                         echo "  refs/heads/mob_$authuser/ or refs/mob/mob_$authuser/" >&2
 185                         echo "No other personal mob branch ref names may be pushed to, sorry." >&2
 186                         echo "You may adjust push permissions at $cfg_webadmurl/editproj.cgi?name=$proj" >&2
 187                         exit 3
 188                 esac
 189                 exit 0
 190         fi
 191
 192         if perl -I@basedir@ -MGirocco::Project -MGirocco::User <<EOT; then :; else
 193                 my \$p = Girocco::Project->load('$projbare');
 194                 exit 1 unless \$p && \$p->can_user_push('$authuser');
 195                 exit 0 if \$Girocco::Config::mob eq 'mob' && '$authuser' eq 'mob';
 196                 my \$u = Girocco::User->load('$authuser');
 197                 exit 2 unless \$u && \$u->{uuid} eq '$authuuid';
 198                 exit 0
 199 EOT
 200                 if [ $? -eq 2 ]; then
 201                         echo "The user '$authuser' certificate being used is no longer valid." \
 202                         echo "You may download a new user certificate at $cfg_webadmurl/edituser.cgi"
 203                 else
 204                         echo "The user '$authuser' does not have push permissions for project '$proj'" >&2
 205                         echo "You may adjust push permissions at $cfg_webadmurl/editproj.cgi?name=$proj" >&2
 206                 fi
 207                 exit 3
 208         fi
 209
 210         if [ "$cfg_mob" = "mob" -a "$authuser" = "mob" ]; then
 211                 if [ x"$1" != x"refs/heads/mob" ]; then
 212                         echo "The mob user may push only to the 'mob' branch, sorry" >&2
 213                         exit 1
 214                 fi
 215                 if [ x"$2" = x"0000000000000000000000000000000000000000" ]; then
 216                         echo "The mob user may not _create_ the 'mob' branch, sorry" >&2
 217                         exit 2
 218                 fi
 219                 if [ x"$3" = x"0000000000000000000000000000000000000000" ]; then
 220                         echo "The mob user may not _delete_ the 'mob' branch, smch, sorry"
 221                         exit 3
 222                 fi
 223         fi
 224
 225         if [ "$cfg_mob" = "mob" ]; then
 226                 case "$1" in
 227                 "refs/heads/mob."?* | "refs/heads/mob_"?*)
 228                         echo "Use of the ref '$1' is reserved for personal mob branch" >&2
 229                         echo "users who do not have push permission to project '$proj'." >&2
 230                         echo "Users with push permission may only access the personal" >&2
 231                         echo "mob branches using refs that start with 'refs/mob/'." >&2
 232                         exit 3
 233                 esac
 234         fi
 235 fi
 236
 237 exit 0