kallithea Changeset - b5551ad26fa3

Changeset - b5551ad26fa3

Parent rev.

Child rev.

[Not reviewed]

default

0 3 0

Søren Løvborg - 9 years ago 2017-01-04 23:01:48
sorenl@unity3d.com

vcs: dedup auth code between Hg and Git middleware

There's a lot of verbatim duplicated code in the Hg and Git VCS
middleware. This attempts to deduplicate a bit of it.

The _authorize function is a bit awkward, but for now the goal is simply
to remove duplicated code, not improving program structure and design.

As such, the code in _authorize is almost a verbatim copy of the code
removed in the two controllers.

3 files changed with 81 insertions and 118 deletions:

kallithea/lib/base.py

kallithea/lib/middleware/simplegit.py

kallithea/lib/middleware/simplehg.py

0 comments (0 inline, 0 general)

kallithea/lib/base.py

➞

Show inline comments

@@ @@ -176,22 +176,97 @@ class BasicAuth(paste.auth.basic.AuthBas @@
         return self.build_authentication()
     __call__ = authenticate
 class BaseVCSController(object):
     """Base controller for handling Mercurial/Git protocol requests
     (coming from a VCS client, and not a browser).
     """
     def __init__(self, application, config):
         self.application = application
         self.config = config
         # base path of repo locations
         self.basepath = self.config['base_path']
         # authenticate this VCS request using the authentication modules
         self.authenticate = BasicAuth('', auth_modules.authenticate,
                                       config.get('auth_ret_code'))
     def _authorize(self, environ, start_response, action, repo_name, ip_addr):
         """Authenticate and authorize user.
         Since we're dealing with a VCS client and not a browser, we only
         support HTTP basic authentication, either directly via raw header
         inspection, or by using container authentication to delegate the
         authentication to the web server.
         Returns (user, None) on successful authentication and authorization.
         Returns (None, wsgi_app) to send the wsgi_app response to the client.
         """
         anonymous_user = User.get_default_user(cache=True)
         user = anonymous_user
         if anonymous_user.active:
             # ONLY check permissions if the user is activated
             anonymous_perm = self._check_permission(action, anonymous_user,
                                                     repo_name, ip_addr)
         else:
             anonymous_perm = False
         if not anonymous_user.active or not anonymous_perm:
             if not anonymous_user.active:
                 log.debug('Anonymous access is disabled, running '
                           'authentication')
             if not anonymous_perm:
                 log.debug('Not enough credentials to access this '
                           'repository as anonymous user')
             username = None
             #==============================================================
             # DEFAULT PERM FAILED OR ANONYMOUS ACCESS IS DISABLED SO WE
             # NEED TO AUTHENTICATE AND ASK FOR AUTH USER PERMISSIONS
             #==============================================================
             # try to auth based on environ, container auth methods
             log.debug('Running PRE-AUTH for container based authentication')
             pre_auth = auth_modules.authenticate('', '', environ)
             if pre_auth is not None and pre_auth.get('username'):
                 username = pre_auth['username']
             log.debug('PRE-AUTH got %s as username', username)
             # If not authenticated by the container, running basic auth
             if not username:
                 self.authenticate.realm = \
                     safe_str(self.config['realm'])
                 result = self.authenticate(environ)
                 if isinstance(result, str):
                     paste.httpheaders.AUTH_TYPE.update(environ, 'basic')
                     paste.httpheaders.REMOTE_USER.update(environ, result)
                     username = result
                 else:
                     return None, result.wsgi_application
             #==============================================================
             # CHECK PERMISSIONS FOR THIS REQUEST USING GIVEN USERNAME
             #==============================================================
             try:
                 user = User.get_by_username_or_email(username)
                 if user is None or not user.active:
                     return None, webob.exc.HTTPForbidden()
             except Exception:
                 log.error(traceback.format_exc())
                 return None, webob.exc.HTTPInternalServerError()
             #check permissions for this repository
             perm = self._check_permission(action, user, repo_name, ip_addr)
             if not perm:
                 return None, webob.exc.HTTPForbidden()
         return user, None
     def _handle_request(self, environ, start_response):
         raise NotImplementedError()
     def _get_by_id(self, repo_name):
         """
         Gets a special pattern _<ID> from clone url and tries to replace it

kallithea/lib/middleware/simplegit.py

➞

Show inline comments

@@ @@ -92,70 +92,15 @@ class SimpleGit(BaseVCSController): @@
         #======================================================================
         action = self.__get_action(environ)
         #======================================================================
         # CHECK PERMISSIONS
         #======================================================================
         anonymous_user = User.get_default_user(cache=True)
         user = anonymous_user
         if anonymous_user.active:
             # ONLY check permissions if the user is activated
             anonymous_perm = self._check_permission(action, anonymous_user,
                                                     repo_name, ip_addr)
         else:
             anonymous_perm = False
         if not anonymous_user.active or not anonymous_perm:
             if not anonymous_user.active:
                 log.debug('Anonymous access is disabled, running '
                           'authentication')
             if not anonymous_perm:
                 log.debug('Not enough credentials to access this '
                           'repository as anonymous user')
             username = None
             #==============================================================
             # DEFAULT PERM FAILED OR ANONYMOUS ACCESS IS DISABLED SO WE
             # NEED TO AUTHENTICATE AND ASK FOR AUTH USER PERMISSIONS
             #==============================================================
             # try to auth based on environ, container auth methods
             log.debug('Running PRE-AUTH for container based authentication')
             pre_auth = auth_modules.authenticate('', '', environ)
             if pre_auth is not None and pre_auth.get('username'):
                 username = pre_auth['username']
             log.debug('PRE-AUTH got %s as username', username)
             # If not authenticated by the container, running basic auth
             if not username:
                 self.authenticate.realm = \
                     safe_str(self.config['realm'])
                 result = self.authenticate(environ)
                 if isinstance(result, str):
                     AUTH_TYPE.update(environ, 'basic')
                     REMOTE_USER.update(environ, result)
                     username = result
                 else:
                     return result.wsgi_application(environ, start_response)
             #==============================================================
             # CHECK PERMISSIONS FOR THIS REQUEST USING GIVEN USERNAME
             #==============================================================
             try:
                 user = User.get_by_username_or_email(username)
                 if user is None or not user.active:
                     return HTTPForbidden()(environ, start_response)
             except Exception:
                 log.error(traceback.format_exc())
                 return HTTPInternalServerError()(environ, start_response)
             #check permissions for this repository
             perm = self._check_permission(action, user, repo_name, ip_addr)
             if not perm:
                 return HTTPForbidden()(environ, start_response)
         user, response_app = self._authorize(environ, start_response, action, repo_name, ip_addr)
         if response_app is not None:
             return response_app(environ, start_response)
         # extras are injected into UI object and later available
         # in hooks executed by kallithea
         from kallithea import CONFIG
         server_url = get_server_url(environ)
         extras = {

kallithea/lib/middleware/simplehg.py

➞

Show inline comments

@@ @@ -29,24 +29,22 @@ Original author and date, and relevant c @@
 import os
 import logging
 import traceback
 from paste.httpheaders import REMOTE_USER, AUTH_TYPE
 from webob.exc import HTTPNotFound, HTTPForbidden, HTTPInternalServerError, \
     HTTPNotAcceptable, HTTPBadRequest
 from kallithea.model.db import User
 from kallithea.lib.utils2 import safe_str, safe_unicode, fix_PATH, get_server_url, \
     _set_extras
 from kallithea.lib.base import BaseVCSController, WSGIResultCloseCallback
 from kallithea.lib.utils import make_ui, is_valid_repo, ui_sections
 from kallithea.lib.vcs.utils.hgcompat import RepoError, hgweb_mod
 from kallithea.lib.exceptions import HTTPLockedRC
 from kallithea.lib import auth_modules
 log = logging.getLogger(__name__)
 def is_mercurial(environ):
     """
@@ @@ -100,70 +98,15 @@ class SimpleHg(BaseVCSController): @@
         except HTTPBadRequest as e:
             return e(environ, start_response)
         #======================================================================
         # CHECK PERMISSIONS
         #======================================================================
         anonymous_user = User.get_default_user(cache=True)
         user = anonymous_user
         if anonymous_user.active:
             # ONLY check permissions if the user is activated
             anonymous_perm = self._check_permission(action, anonymous_user,
                                                     repo_name, ip_addr)
         else:
             anonymous_perm = False
         if not anonymous_user.active or not anonymous_perm:
             if not anonymous_user.active:
                 log.debug('Anonymous access is disabled, running '
                           'authentication')
             if not anonymous_perm:
                 log.debug('Not enough credentials to access this '
                           'repository as anonymous user')
             username = None
             #==============================================================
             # DEFAULT PERM FAILED OR ANONYMOUS ACCESS IS DISABLED SO WE
             # NEED TO AUTHENTICATE AND ASK FOR AUTH USER PERMISSIONS
             #==============================================================
             # try to auth based on environ, container auth methods
             log.debug('Running PRE-AUTH for container based authentication')
             pre_auth = auth_modules.authenticate('', '', environ)
             if pre_auth is not None and pre_auth.get('username'):
                 username = pre_auth['username']
             log.debug('PRE-AUTH got %s as username', username)
             # If not authenticated by the container, running basic auth
             if not username:
                 self.authenticate.realm = \
                     safe_str(self.config['realm'])
                 result = self.authenticate(environ)
                 if isinstance(result, str):
                     AUTH_TYPE.update(environ, 'basic')
                     REMOTE_USER.update(environ, result)
                     username = result
                 else:
                     return result.wsgi_application(environ, start_response)
             #==============================================================
             # CHECK PERMISSIONS FOR THIS REQUEST USING GIVEN USERNAME
             #==============================================================
             try:
                 user = User.get_by_username_or_email(username)
                 if user is None or not user.active:
                     return HTTPForbidden()(environ, start_response)
             except Exception:
                 log.error(traceback.format_exc())
                 return HTTPInternalServerError()(environ, start_response)
             #check permissions for this repository
             perm = self._check_permission(action, user, repo_name, ip_addr)
             if not perm:
                 return HTTPForbidden()(environ, start_response)
         user, response_app = self._authorize(environ, start_response, action, repo_name, ip_addr)
         if response_app is not None:
             return response_app(environ, start_response)
         # extras are injected into mercurial UI object and later available
         # in hg hooks executed by kallithea
         from kallithea import CONFIG
         server_url = get_server_url(environ)
         extras = {

0 comments (0 inline, 0 general)