access.go 5.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194
  1. // Copyright 2014 The Gogs Authors. All rights reserved.
  2. // Use of this source code is governed by a MIT-style
  3. // license that can be found in the LICENSE file.
  4. package models
  5. import (
  6. "fmt"
  7. )
  8. type AccessMode int
  9. const (
  10. ACCESS_MODE_NONE AccessMode = iota
  11. ACCESS_MODE_READ
  12. ACCESS_MODE_WRITE
  13. ACCESS_MODE_ADMIN
  14. ACCESS_MODE_OWNER
  15. )
  16. // Access represents the highest access level of a user to the repository. The only access type
  17. // that is not in this table is the real owner of a repository. In case of an organization
  18. // repository, the members of the owners team are in this table.
  19. type Access struct {
  20. ID int64 `xorm:"pk autoincr"`
  21. UserID int64 `xorm:"UNIQUE(s)"`
  22. RepoID int64 `xorm:"UNIQUE(s)"`
  23. Mode AccessMode
  24. }
  25. func accessLevel(e Engine, u *User, repo *Repository) (AccessMode, error) {
  26. mode := ACCESS_MODE_NONE
  27. if !repo.IsPrivate {
  28. mode = ACCESS_MODE_READ
  29. }
  30. if u != nil {
  31. if u.Id == repo.OwnerId {
  32. return ACCESS_MODE_OWNER, nil
  33. }
  34. a := &Access{UserID: u.Id, RepoID: repo.Id}
  35. if has, err := e.Get(a); !has || err != nil {
  36. return mode, err
  37. }
  38. return a.Mode, nil
  39. }
  40. return mode, nil
  41. }
  42. // AccessLevel returns the Access a user has to a repository. Will return NoneAccess if the
  43. // user does not have access. User can be nil!
  44. func AccessLevel(u *User, repo *Repository) (AccessMode, error) {
  45. return accessLevel(x, u, repo)
  46. }
  47. func hasAccess(e Engine, u *User, repo *Repository, testMode AccessMode) (bool, error) {
  48. mode, err := accessLevel(e, u, repo)
  49. return testMode <= mode, err
  50. }
  51. // HasAccess returns true if someone has the request access level. User can be nil!
  52. func HasAccess(u *User, repo *Repository, testMode AccessMode) (bool, error) {
  53. return hasAccess(x, u, repo, testMode)
  54. }
  55. // GetAccessibleRepositories finds all repositories where a user has access to,
  56. // besides his own.
  57. func (u *User) GetAccessibleRepositories() (map[*Repository]AccessMode, error) {
  58. accesses := make([]*Access, 0, 10)
  59. if err := x.Find(&accesses, &Access{UserID: u.Id}); err != nil {
  60. return nil, err
  61. }
  62. repos := make(map[*Repository]AccessMode, len(accesses))
  63. for _, access := range accesses {
  64. repo, err := GetRepositoryById(access.RepoID)
  65. if err != nil {
  66. return nil, err
  67. }
  68. if err = repo.GetOwner(); err != nil {
  69. return nil, err
  70. } else if repo.OwnerId == u.Id {
  71. continue
  72. }
  73. repos[repo] = access.Mode
  74. }
  75. // FIXME: should we generate an ordered list here? Random looks weird.
  76. return repos, nil
  77. }
  78. func maxAccessMode(modes ...AccessMode) AccessMode {
  79. max := ACCESS_MODE_NONE
  80. for _, mode := range modes {
  81. if mode > max {
  82. max = mode
  83. }
  84. }
  85. return max
  86. }
  87. // FIXME: do corss-comparison so reduce deletions and additions to the minimum?
  88. func (repo *Repository) refreshAccesses(e Engine, accessMap map[int64]AccessMode) (err error) {
  89. minMode := ACCESS_MODE_READ
  90. if !repo.IsPrivate {
  91. minMode = ACCESS_MODE_WRITE
  92. }
  93. newAccesses := make([]Access, 0, len(accessMap))
  94. for userID, mode := range accessMap {
  95. if mode < minMode {
  96. continue
  97. }
  98. newAccesses = append(newAccesses, Access{
  99. UserID: userID,
  100. RepoID: repo.Id,
  101. Mode: mode,
  102. })
  103. }
  104. // Delete old accesses and insert new ones for repository.
  105. if _, err = e.Delete(&Access{RepoID: repo.Id}); err != nil {
  106. return fmt.Errorf("delete old accesses: %v", err)
  107. } else if _, err = e.Insert(newAccesses); err != nil {
  108. return fmt.Errorf("insert new accesses: %v", err)
  109. }
  110. return nil
  111. }
  112. // FIXME: should be able to have read-only access.
  113. // Give all collaborators write access.
  114. func (repo *Repository) refreshCollaboratorAccesses(e Engine, accessMap map[int64]AccessMode) error {
  115. collaborators, err := repo.getCollaborators(e)
  116. if err != nil {
  117. return fmt.Errorf("getCollaborators: %v", err)
  118. }
  119. for _, c := range collaborators {
  120. accessMap[c.Id] = ACCESS_MODE_WRITE
  121. }
  122. return nil
  123. }
  124. // recalculateTeamAccesses recalculates new accesses for teams of an organization
  125. // except the team whose ID is given. It is used to assign a team ID when
  126. // remove repository from that team.
  127. func (repo *Repository) recalculateTeamAccesses(e Engine, ignTeamID int64) (err error) {
  128. accessMap := make(map[int64]AccessMode, 20)
  129. if err = repo.refreshCollaboratorAccesses(e, accessMap); err != nil {
  130. return fmt.Errorf("refreshCollaboratorAccesses: %v", err)
  131. }
  132. if err = repo.getOwner(e); err != nil {
  133. return err
  134. }
  135. if repo.Owner.IsOrganization() {
  136. if err = repo.Owner.getTeams(e); err != nil {
  137. return err
  138. }
  139. for _, t := range repo.Owner.Teams {
  140. if t.ID == ignTeamID {
  141. continue
  142. }
  143. if t.IsOwnerTeam() {
  144. t.Authorize = ACCESS_MODE_OWNER
  145. }
  146. if err = t.getMembers(e); err != nil {
  147. return fmt.Errorf("getMembers '%d': %v", t.ID, err)
  148. }
  149. for _, m := range t.Members {
  150. accessMap[m.Id] = maxAccessMode(accessMap[m.Id], t.Authorize)
  151. }
  152. }
  153. }
  154. return repo.refreshAccesses(e, accessMap)
  155. }
  156. func (repo *Repository) recalculateAccesses(e Engine) error {
  157. accessMap := make(map[int64]AccessMode, 20)
  158. if err := repo.refreshCollaboratorAccesses(e, accessMap); err != nil {
  159. return fmt.Errorf("refreshCollaboratorAccesses: %v", err)
  160. }
  161. return repo.refreshAccesses(e, accessMap)
  162. }
  163. // RecalculateAccesses recalculates all accesses for repository.
  164. func (r *Repository) RecalculateAccesses() error {
  165. return r.recalculateAccesses(x)
  166. }