access.go 3.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162
  1. // Copyright 2014 The Gogs Authors. All rights reserved.
  2. // Use of this source code is governed by a MIT-style
  3. // license that can be found in the LICENSE file.
  4. package models
  5. type AccessMode int
  6. const (
  7. ACCESS_MODE_NONE AccessMode = iota
  8. ACCESS_MODE_READ
  9. ACCESS_MODE_WRITE
  10. ACCESS_MODE_ADMIN
  11. ACCESS_MODE_OWNER
  12. )
  13. // Access represents the highest access level of a user to the repository. The only access type
  14. // that is not in this table is the real owner of a repository. In case of an organization
  15. // repository, the members of the owners team are in this table.
  16. type Access struct {
  17. ID int64 `xorm:"pk autoincr"`
  18. UserID int64 `xorm:"UNIQUE(s)"`
  19. RepoID int64 `xorm:"UNIQUE(s)"`
  20. Mode AccessMode
  21. }
  22. // Return the Access a user has to a repository. Will return NoneAccess if the
  23. // user does not have access. User can be nil!
  24. func AccessLevel(u *User, r *Repository) (AccessMode, error) {
  25. mode := ACCESS_MODE_NONE
  26. if !r.IsPrivate {
  27. mode = ACCESS_MODE_READ
  28. }
  29. if u != nil {
  30. if u.Id == r.OwnerId {
  31. return ACCESS_MODE_OWNER, nil
  32. }
  33. a := &Access{UserID: u.Id, RepoID: r.Id}
  34. if has, err := x.Get(a); !has || err != nil {
  35. return mode, err
  36. }
  37. return a.Mode, nil
  38. }
  39. return mode, nil
  40. }
  41. // HasAccess returns true if someone has the request access level. User can be nil!
  42. func HasAccess(u *User, r *Repository, testMode AccessMode) (bool, error) {
  43. mode, err := AccessLevel(u, r)
  44. return testMode <= mode, err
  45. }
  46. // GetAccessibleRepositories finds all repositories where a user has access to,
  47. // besides his own.
  48. func (u *User) GetAccessibleRepositories() (map[*Repository]AccessMode, error) {
  49. accesses := make([]*Access, 0, 10)
  50. if err := x.Find(&accesses, &Access{UserID: u.Id}); err != nil {
  51. return nil, err
  52. }
  53. repos := make(map[*Repository]AccessMode, len(accesses))
  54. for _, access := range accesses {
  55. repo, err := GetRepositoryById(access.RepoID)
  56. if err != nil {
  57. return nil, err
  58. }
  59. if err = repo.GetOwner(); err != nil {
  60. return nil, err
  61. } else if repo.OwnerId == u.Id {
  62. continue
  63. }
  64. repos[repo] = access.Mode
  65. }
  66. return repos, nil
  67. }
  68. func maxAccessMode(modes ...AccessMode) AccessMode {
  69. max := ACCESS_MODE_NONE
  70. for _, mode := range modes {
  71. if mode > max {
  72. max = mode
  73. }
  74. }
  75. return max
  76. }
  77. func (repo *Repository) recalculateTeamAccesses(e Engine, mode AccessMode) error {
  78. return nil
  79. }
  80. func (repo *Repository) recalculateAccesses(e Engine) error {
  81. accessMap := make(map[int64]AccessMode, 20)
  82. // Give all collaborators write access
  83. collaborators, err := repo.getCollaborators(e)
  84. if err != nil {
  85. return err
  86. }
  87. for _, c := range collaborators {
  88. accessMap[c.Id] = ACCESS_MODE_WRITE
  89. }
  90. if err := repo.getOwner(e); err != nil {
  91. return err
  92. }
  93. if repo.Owner.IsOrganization() {
  94. if err = repo.Owner.getTeams(e); err != nil {
  95. return err
  96. }
  97. for _, team := range repo.Owner.Teams {
  98. if !(team.IsOwnerTeam() || team.HasRepository(repo)) {
  99. continue
  100. } else if team.IsOwnerTeam() {
  101. team.Authorize = ACCESS_MODE_OWNER
  102. }
  103. if err = team.getMembers(e); err != nil {
  104. return err
  105. }
  106. for _, u := range team.Members {
  107. accessMap[u.Id] = maxAccessMode(accessMap[u.Id], team.Authorize)
  108. }
  109. }
  110. }
  111. minMode := ACCESS_MODE_READ
  112. if !repo.IsPrivate {
  113. minMode = ACCESS_MODE_WRITE
  114. }
  115. newAccesses := make([]Access, 0, len(accessMap))
  116. for userID, mode := range accessMap {
  117. if mode < minMode {
  118. continue
  119. }
  120. newAccesses = append(newAccesses, Access{
  121. UserID: userID,
  122. RepoID: repo.Id,
  123. Mode: mode,
  124. })
  125. }
  126. // Delete old accesses and insert new ones for repository.
  127. if _, err = e.Delete(&Access{RepoID: repo.Id}); err != nil {
  128. return err
  129. } else if _, err = e.Insert(newAccesses); err != nil {
  130. return err
  131. }
  132. return nil
  133. }
  134. // RecalculateAccesses recalculates all accesses for repository.
  135. func (r *Repository) RecalculateAccesses() error {
  136. return r.recalculateAccesses(x)
  137. }