Fork to maintain patches against the official gitea for https://code.ceondo.com https://github.com/go-gitea/gitea

access.go 7.0KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269
  1. // Copyright 2014 The Gogs Authors. All rights reserved.
  2. // Use of this source code is governed by a MIT-style
  3. // license that can be found in the LICENSE file.
  4. package models
  5. import "fmt"
  6. // AccessMode specifies the users access mode
  7. type AccessMode int
  8. const (
  9. // AccessModeNone no access
  10. AccessModeNone AccessMode = iota // 0
  11. // AccessModeRead read access
  12. AccessModeRead // 1
  13. // AccessModeWrite write access
  14. AccessModeWrite // 2
  15. // AccessModeAdmin admin access
  16. AccessModeAdmin // 3
  17. // AccessModeOwner owner access
  18. AccessModeOwner // 4
  19. )
  20. func (mode AccessMode) String() string {
  21. switch mode {
  22. case AccessModeRead:
  23. return "read"
  24. case AccessModeWrite:
  25. return "write"
  26. case AccessModeAdmin:
  27. return "admin"
  28. case AccessModeOwner:
  29. return "owner"
  30. default:
  31. return "none"
  32. }
  33. }
  34. // ParseAccessMode returns corresponding access mode to given permission string.
  35. func ParseAccessMode(permission string) AccessMode {
  36. switch permission {
  37. case "write":
  38. return AccessModeWrite
  39. case "admin":
  40. return AccessModeAdmin
  41. default:
  42. return AccessModeRead
  43. }
  44. }
  45. // Access represents the highest access level of a user to the repository. The only access type
  46. // that is not in this table is the real owner of a repository. In case of an organization
  47. // repository, the members of the owners team are in this table.
  48. type Access struct {
  49. ID int64 `xorm:"pk autoincr"`
  50. UserID int64 `xorm:"UNIQUE(s)"`
  51. RepoID int64 `xorm:"UNIQUE(s)"`
  52. Mode AccessMode
  53. }
  54. func accessLevel(e Engine, userID int64, repo *Repository) (AccessMode, error) {
  55. mode := AccessModeNone
  56. if !repo.IsPrivate {
  57. mode = AccessModeRead
  58. }
  59. if userID == 0 {
  60. return mode, nil
  61. }
  62. if userID == repo.OwnerID {
  63. return AccessModeOwner, nil
  64. }
  65. a := &Access{UserID: userID, RepoID: repo.ID}
  66. if has, err := e.Get(a); !has || err != nil {
  67. return mode, err
  68. }
  69. return a.Mode, nil
  70. }
  71. // AccessLevel returns the Access a user has to a repository. Will return NoneAccess if the
  72. // user does not have access.
  73. func AccessLevel(userID int64, repo *Repository) (AccessMode, error) {
  74. return accessLevel(x, userID, repo)
  75. }
  76. func hasAccess(e Engine, userID int64, repo *Repository, testMode AccessMode) (bool, error) {
  77. mode, err := accessLevel(e, userID, repo)
  78. return testMode <= mode, err
  79. }
  80. // HasAccess returns true if user has access to repo
  81. func HasAccess(userID int64, repo *Repository, testMode AccessMode) (bool, error) {
  82. return hasAccess(x, userID, repo, testMode)
  83. }
  84. type repoAccess struct {
  85. Access `xorm:"extends"`
  86. Repository `xorm:"extends"`
  87. }
  88. func (repoAccess) TableName() string {
  89. return "access"
  90. }
  91. // GetRepositoryAccesses finds all repositories with their access mode where a user has access but does not own.
  92. func (user *User) GetRepositoryAccesses() (map[*Repository]AccessMode, error) {
  93. rows, err := x.
  94. Join("INNER", "repository", "repository.id = access.repo_id").
  95. Where("access.user_id = ?", user.ID).
  96. And("repository.owner_id <> ?", user.ID).
  97. Rows(new(repoAccess))
  98. if err != nil {
  99. return nil, err
  100. }
  101. defer rows.Close()
  102. var repos = make(map[*Repository]AccessMode, 10)
  103. var ownerCache = make(map[int64]*User, 10)
  104. for rows.Next() {
  105. var repo repoAccess
  106. err = rows.Scan(&repo)
  107. if err != nil {
  108. return nil, err
  109. }
  110. var ok bool
  111. if repo.Owner, ok = ownerCache[repo.OwnerID]; !ok {
  112. if err = repo.GetOwner(); err != nil {
  113. return nil, err
  114. }
  115. ownerCache[repo.OwnerID] = repo.Owner
  116. }
  117. repos[&repo.Repository] = repo.Access.Mode
  118. }
  119. return repos, nil
  120. }
  121. // GetAccessibleRepositories finds repositories which the user has access but does not own.
  122. // If limit is smaller than 1 means returns all found results.
  123. func (user *User) GetAccessibleRepositories(limit int) (repos []*Repository, _ error) {
  124. sess := x.
  125. Where("owner_id !=? ", user.ID).
  126. Desc("updated_unix")
  127. if limit > 0 {
  128. sess.Limit(limit)
  129. repos = make([]*Repository, 0, limit)
  130. } else {
  131. repos = make([]*Repository, 0, 10)
  132. }
  133. return repos, sess.
  134. Join("INNER", "access", "access.user_id = ? AND access.repo_id = repository.id", user.ID).
  135. Find(&repos)
  136. }
  137. func maxAccessMode(modes ...AccessMode) AccessMode {
  138. max := AccessModeNone
  139. for _, mode := range modes {
  140. if mode > max {
  141. max = mode
  142. }
  143. }
  144. return max
  145. }
  146. // FIXME: do cross-comparison so reduce deletions and additions to the minimum?
  147. func (repo *Repository) refreshAccesses(e Engine, accessMap map[int64]AccessMode) (err error) {
  148. minMode := AccessModeRead
  149. if !repo.IsPrivate {
  150. minMode = AccessModeWrite
  151. }
  152. newAccesses := make([]Access, 0, len(accessMap))
  153. for userID, mode := range accessMap {
  154. if mode < minMode {
  155. continue
  156. }
  157. newAccesses = append(newAccesses, Access{
  158. UserID: userID,
  159. RepoID: repo.ID,
  160. Mode: mode,
  161. })
  162. }
  163. // Delete old accesses and insert new ones for repository.
  164. if _, err = e.Delete(&Access{RepoID: repo.ID}); err != nil {
  165. return fmt.Errorf("delete old accesses: %v", err)
  166. } else if _, err = e.Insert(newAccesses); err != nil {
  167. return fmt.Errorf("insert new accesses: %v", err)
  168. }
  169. return nil
  170. }
  171. // refreshCollaboratorAccesses retrieves repository collaborations with their access modes.
  172. func (repo *Repository) refreshCollaboratorAccesses(e Engine, accessMap map[int64]AccessMode) error {
  173. collaborations, err := repo.getCollaborations(e)
  174. if err != nil {
  175. return fmt.Errorf("getCollaborations: %v", err)
  176. }
  177. for _, c := range collaborations {
  178. accessMap[c.UserID] = c.Mode
  179. }
  180. return nil
  181. }
  182. // recalculateTeamAccesses recalculates new accesses for teams of an organization
  183. // except the team whose ID is given. It is used to assign a team ID when
  184. // remove repository from that team.
  185. func (repo *Repository) recalculateTeamAccesses(e Engine, ignTeamID int64) (err error) {
  186. accessMap := make(map[int64]AccessMode, 20)
  187. if err = repo.getOwner(e); err != nil {
  188. return err
  189. } else if !repo.Owner.IsOrganization() {
  190. return fmt.Errorf("owner is not an organization: %d", repo.OwnerID)
  191. }
  192. if err = repo.refreshCollaboratorAccesses(e, accessMap); err != nil {
  193. return fmt.Errorf("refreshCollaboratorAccesses: %v", err)
  194. }
  195. if err = repo.Owner.getTeams(e); err != nil {
  196. return err
  197. }
  198. for _, t := range repo.Owner.Teams {
  199. if t.ID == ignTeamID {
  200. continue
  201. }
  202. // Owner team gets owner access, and skip for teams that do not
  203. // have relations with repository.
  204. if t.IsOwnerTeam() {
  205. t.Authorize = AccessModeOwner
  206. } else if !t.hasRepository(e, repo.ID) {
  207. continue
  208. }
  209. if err = t.getMembers(e); err != nil {
  210. return fmt.Errorf("getMembers '%d': %v", t.ID, err)
  211. }
  212. for _, m := range t.Members {
  213. accessMap[m.ID] = maxAccessMode(accessMap[m.ID], t.Authorize)
  214. }
  215. }
  216. return repo.refreshAccesses(e, accessMap)
  217. }
  218. func (repo *Repository) recalculateAccesses(e Engine) error {
  219. if repo.Owner.IsOrganization() {
  220. return repo.recalculateTeamAccesses(e, 0)
  221. }
  222. accessMap := make(map[int64]AccessMode, 20)
  223. if err := repo.refreshCollaboratorAccesses(e, accessMap); err != nil {
  224. return fmt.Errorf("refreshCollaboratorAccesses: %v", err)
  225. }
  226. return repo.refreshAccesses(e, accessMap)
  227. }
  228. // RecalculateAccesses recalculates all accesses for repository.
  229. func (repo *Repository) RecalculateAccesses() error {
  230. return repo.recalculateAccesses(x)
  231. }