access.go 6.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242
  1. // Copyright 2014 The Gogs Authors. All rights reserved.
  2. // Use of this source code is governed by a MIT-style
  3. // license that can be found in the LICENSE file.
  4. package models
  5. import (
  6. "fmt"
  7. log "gopkg.in/clog.v1"
  8. "github.com/gogs/gogs/models/errors"
  9. )
  10. type AccessMode int
  11. const (
  12. ACCESS_MODE_NONE AccessMode = iota // 0
  13. ACCESS_MODE_READ // 1
  14. ACCESS_MODE_WRITE // 2
  15. ACCESS_MODE_ADMIN // 3
  16. ACCESS_MODE_OWNER // 4
  17. )
  18. func (mode AccessMode) String() string {
  19. switch mode {
  20. case ACCESS_MODE_READ:
  21. return "read"
  22. case ACCESS_MODE_WRITE:
  23. return "write"
  24. case ACCESS_MODE_ADMIN:
  25. return "admin"
  26. case ACCESS_MODE_OWNER:
  27. return "owner"
  28. default:
  29. return "none"
  30. }
  31. }
  32. // ParseAccessMode returns corresponding access mode to given permission string.
  33. func ParseAccessMode(permission string) AccessMode {
  34. switch permission {
  35. case "write":
  36. return ACCESS_MODE_WRITE
  37. case "admin":
  38. return ACCESS_MODE_ADMIN
  39. default:
  40. return ACCESS_MODE_READ
  41. }
  42. }
  43. // Access represents the highest access level of a user to the repository. The only access type
  44. // that is not in this table is the real owner of a repository. In case of an organization
  45. // repository, the members of the owners team are in this table.
  46. type Access struct {
  47. ID int64
  48. UserID int64 `xorm:"UNIQUE(s)"`
  49. RepoID int64 `xorm:"UNIQUE(s)"`
  50. Mode AccessMode
  51. }
  52. func accessLevel(e Engine, userID int64, repo *Repository) (AccessMode, error) {
  53. mode := ACCESS_MODE_NONE
  54. // Everyone has read access to public repository
  55. if !repo.IsPrivate {
  56. mode = ACCESS_MODE_READ
  57. }
  58. if userID <= 0 {
  59. return mode, nil
  60. }
  61. if userID == repo.OwnerID {
  62. return ACCESS_MODE_OWNER, nil
  63. }
  64. access := &Access{
  65. UserID: userID,
  66. RepoID: repo.ID,
  67. }
  68. if has, err := e.Get(access); !has || err != nil {
  69. return mode, err
  70. }
  71. return access.Mode, nil
  72. }
  73. // AccessLevel returns the Access a user has to a repository. Will return NoneAccess if the
  74. // user does not have access.
  75. func AccessLevel(userID int64, repo *Repository) (AccessMode, error) {
  76. return accessLevel(x, userID, repo)
  77. }
  78. func hasAccess(e Engine, userID int64, repo *Repository, testMode AccessMode) (bool, error) {
  79. mode, err := accessLevel(e, userID, repo)
  80. return mode >= testMode, err
  81. }
  82. // HasAccess returns true if someone has the request access level. User can be nil!
  83. func HasAccess(userID int64, repo *Repository, testMode AccessMode) (bool, error) {
  84. return hasAccess(x, userID, repo, testMode)
  85. }
  86. // GetRepositoryAccesses finds all repositories with their access mode where a user has access but does not own.
  87. func (u *User) GetRepositoryAccesses() (map[*Repository]AccessMode, error) {
  88. accesses := make([]*Access, 0, 10)
  89. if err := x.Find(&accesses, &Access{UserID: u.ID}); err != nil {
  90. return nil, err
  91. }
  92. repos := make(map[*Repository]AccessMode, len(accesses))
  93. for _, access := range accesses {
  94. repo, err := GetRepositoryByID(access.RepoID)
  95. if err != nil {
  96. if errors.IsRepoNotExist(err) {
  97. log.Error(2, "GetRepositoryByID: %v", err)
  98. continue
  99. }
  100. return nil, err
  101. }
  102. if repo.OwnerID == u.ID {
  103. continue
  104. }
  105. repos[repo] = access.Mode
  106. }
  107. return repos, nil
  108. }
  109. // GetAccessibleRepositories finds repositories which the user has access but does not own.
  110. // If limit is smaller than 1 means returns all found results.
  111. func (user *User) GetAccessibleRepositories(limit int) (repos []*Repository, _ error) {
  112. sess := x.Where("owner_id !=? ", user.ID).Desc("updated_unix")
  113. if limit > 0 {
  114. sess.Limit(limit)
  115. repos = make([]*Repository, 0, limit)
  116. } else {
  117. repos = make([]*Repository, 0, 10)
  118. }
  119. return repos, sess.Join("INNER", "access", "access.user_id = ? AND access.repo_id = repository.id", user.ID).Find(&repos)
  120. }
  121. func maxAccessMode(modes ...AccessMode) AccessMode {
  122. max := ACCESS_MODE_NONE
  123. for _, mode := range modes {
  124. if mode > max {
  125. max = mode
  126. }
  127. }
  128. return max
  129. }
  130. // FIXME: do corss-comparison so reduce deletions and additions to the minimum?
  131. func (repo *Repository) refreshAccesses(e Engine, accessMap map[int64]AccessMode) (err error) {
  132. newAccesses := make([]Access, 0, len(accessMap))
  133. for userID, mode := range accessMap {
  134. newAccesses = append(newAccesses, Access{
  135. UserID: userID,
  136. RepoID: repo.ID,
  137. Mode: mode,
  138. })
  139. }
  140. // Delete old accesses and insert new ones for repository.
  141. if _, err = e.Delete(&Access{RepoID: repo.ID}); err != nil {
  142. return fmt.Errorf("delete old accesses: %v", err)
  143. } else if _, err = e.Insert(newAccesses); err != nil {
  144. return fmt.Errorf("insert new accesses: %v", err)
  145. }
  146. return nil
  147. }
  148. // refreshCollaboratorAccesses retrieves repository collaborations with their access modes.
  149. func (repo *Repository) refreshCollaboratorAccesses(e Engine, accessMap map[int64]AccessMode) error {
  150. collaborations, err := repo.getCollaborations(e)
  151. if err != nil {
  152. return fmt.Errorf("getCollaborations: %v", err)
  153. }
  154. for _, c := range collaborations {
  155. accessMap[c.UserID] = c.Mode
  156. }
  157. return nil
  158. }
  159. // recalculateTeamAccesses recalculates new accesses for teams of an organization
  160. // except the team whose ID is given. It is used to assign a team ID when
  161. // remove repository from that team.
  162. func (repo *Repository) recalculateTeamAccesses(e Engine, ignTeamID int64) (err error) {
  163. accessMap := make(map[int64]AccessMode, 20)
  164. if err = repo.getOwner(e); err != nil {
  165. return err
  166. } else if !repo.Owner.IsOrganization() {
  167. return fmt.Errorf("owner is not an organization: %d", repo.OwnerID)
  168. }
  169. if err = repo.refreshCollaboratorAccesses(e, accessMap); err != nil {
  170. return fmt.Errorf("refreshCollaboratorAccesses: %v", err)
  171. }
  172. if err = repo.Owner.getTeams(e); err != nil {
  173. return err
  174. }
  175. for _, t := range repo.Owner.Teams {
  176. if t.ID == ignTeamID {
  177. continue
  178. }
  179. // Owner team gets owner access, and skip for teams that do not
  180. // have relations with repository.
  181. if t.IsOwnerTeam() {
  182. t.Authorize = ACCESS_MODE_OWNER
  183. } else if !t.hasRepository(e, repo.ID) {
  184. continue
  185. }
  186. if err = t.getMembers(e); err != nil {
  187. return fmt.Errorf("getMembers '%d': %v", t.ID, err)
  188. }
  189. for _, m := range t.Members {
  190. accessMap[m.ID] = maxAccessMode(accessMap[m.ID], t.Authorize)
  191. }
  192. }
  193. return repo.refreshAccesses(e, accessMap)
  194. }
  195. func (repo *Repository) recalculateAccesses(e Engine) error {
  196. if repo.Owner.IsOrganization() {
  197. return repo.recalculateTeamAccesses(e, 0)
  198. }
  199. accessMap := make(map[int64]AccessMode, 10)
  200. if err := repo.refreshCollaboratorAccesses(e, accessMap); err != nil {
  201. return fmt.Errorf("refreshCollaboratorAccesses: %v", err)
  202. }
  203. return repo.refreshAccesses(e, accessMap)
  204. }
  205. // RecalculateAccesses recalculates all accesses for repository.
  206. func (repo *Repository) RecalculateAccesses() error {
  207. return repo.recalculateAccesses(x)
  208. }