u'bl\xe5b\xe6rgr\xf8d'

        >>> GitSshHandler.make(shlex.split('''git-upload-pack "/foo'bar"''')).repo_name

        u"foo'bar"

        >>> GitSshHandler.make(shlex.split("git-receive-pack '/foo'")).repo_name

        u'foo'

        >>> GitSshHandler.make(shlex.split("git-receive-pack '/foo'")).verb

        'git-receive-pack'

        >>> GitSshHandler.make(shlex.split("/bin/git-upload-pack '/foo'")) # ssh-serve will report 'SSH command %r is not supported'

        >>> GitSshHandler.make(shlex.split('''git-upload-pack /foo bar''')) # ssh-serve will report 'SSH command %r is not supported'

        >>> shlex.split("git-upload-pack '/foo'bar' x") # ssh-serve will report: Error parsing SSH command "...": No closing quotation

        Traceback (most recent call last):

        ValueError: No closing quotation

        >>> GitSshHandler.make(shlex.split('hg -R foo serve --stdio')) # not handled here

        """

        if (len(ssh_command_parts) == 2 and

            ssh_command_parts[0] in ['git-upload-pack', 'git-receive-pack'] and

            ssh_command_parts[1].startswith('/')

        ):

            return cls(safe_unicode(ssh_command_parts[1][1:]), ssh_command_parts[0])

        return None

    def __init__(self, repo_name, verb):

        self.verb = verb

    def _serve(self):

        if self.verb == 'git-upload-pack': # action 'pull'

            # base class called set_hook_environment - action is hardcoded to 'pull'

            log_pull_action(ui=make_ui(), repo=self.db_repo.scm_instance._repo)

        else: # probably verb 'git-receive-pack', action 'push'

            if not self.allow_push:

                self.exit('Push access to %r denied' % safe_str(self.repo_name))

            # Note: push logging is handled by Git post-receive hook

        # git shell is not a real shell but use shell inspired quoting *inside* the argument.

        # Per https://github.com/git/git/blob/v2.22.0/quote.c#L12 :

        # The path must be "'" quoted, but "'" and "!" must exit the quoting and be "\" escaped

        quoted_abspath = "'%s'" % self.db_repo.repo_full_path.replace("'", r"'\''").replace("!", r"'\!'")

        newcmd = ['git', 'shell', '-c', "%s %s" % (self.verb, quoted_abspath)]

        log.debug('Serving: %s', newcmd)

        os.execvp(newcmd[0], newcmd)

        self.exit("Failed to exec 'git' as %s" % newcmd)

    @classmethod

    def make(cls, ssh_command_parts):

        r"""

        >>> import shlex

        >>> MercurialSshHandler.make(shlex.split('hg -R "foo bar" serve --stdio')).repo_name

        u'foo bar'

        >>> MercurialSshHandler.make(shlex.split(' hg -R blåbærgrød serve --stdio ')).repo_name

        u'bl\xe5b\xe6rgr\xf8d'

        >>> MercurialSshHandler.make(shlex.split('''hg -R 'foo"bar' serve --stdio''')).repo_name

        u'foo"bar'

        >>> MercurialSshHandler.make(shlex.split('/bin/hg -R "foo" serve --stdio'))

        >>> MercurialSshHandler.make(shlex.split('''hg -R "foo"bar" serve --stdio''')) # ssh-serve will report: Error parsing SSH command "...": invalid syntax

        Traceback (most recent call last):

        ValueError: No closing quotation

        >>> MercurialSshHandler.make(shlex.split('git-upload-pack "/foo"')) # not handled here

        """

        if ssh_command_parts[:2] == ['hg', '-R'] and ssh_command_parts[3:] == ['serve', '--stdio']:

            return cls(safe_unicode(ssh_command_parts[2]))

        return None

    def _serve(self):

        # Note: we want a repo with config based on .hg/hgrc and can thus not use self.db_repo.scm_instance._repo.ui

        baseui = make_ui(repo_path=self.db_repo.repo_full_path)

        if not self.allow_push:

            baseui.setconfig('hooks', 'pretxnopen._ssh_reject', 'python:kallithea.lib.hooks.rejectpush')

            baseui.setconfig('hooks', 'prepushkey._ssh_reject', 'python:kallithea.lib.hooks.rejectpush')

        repo = hg.repository(baseui, safe_str(self.db_repo.repo_full_path))

        log.debug("Starting Mercurial sshserver for %s", self.db_repo.repo_full_path)

        sshserver(baseui, repo).serve_forever()

class BaseSshHandler(object):

    # Protocol for setting properties:

    # Set by sub class:

    #   vcs_type: 'hg' or 'git'

    # Set by make() / __init__():

    #   repo_name: requested repo name - only validated by serve()

    # Set by serve() - must not be accessed before:

    #   db_repo: repository db object

    #   authuser: user that has been authenticated - like request.authuser ... which isn't used here

    #   allow_push: false for read-only access to the repo

    # Set defaults, in case .exit should be called early

    vcs_type = None

    repo_name = None

    @staticmethod

    def make(ssh_command):

        """Factory function. Given a command as invoked over SSH (and preserved

        in SSH_ORIGINAL_COMMAND when run as authorized_keys command), return a

        handler if the command looks ok, else return None.

        """

        raise NotImplementedError

    def serve(self, user_id, key_id, client_ip):

        """Verify basic sanity of the repository, and that the user is

        valid and has access - then serve the native VCS protocol for

        repository access."""

        dbuser = User.get(user_id)

        if dbuser is None:

            self.exit('User %r not found' % user_id)

        self.authuser = AuthUser.make(dbuser=dbuser, ip_addr=client_ip)

        log.info('Authorized user %s from SSH %s trusting user id %s and key id %s for %r', dbuser, client_ip, user_id, key_id, self.repo_name)

        if self.authuser is None: # not ok ... but already kind of authenticated by SSH ... but not really not authorized ...

            self.exit('User %s from %s cannot be authorized' % (dbuser.username, client_ip))

        ssh_key = UserSshKeys.get(key_id)

        if ssh_key is None:

            self.exit('SSH key %r not found' % key_id)

        ssh_key.last_seen = datetime.datetime.now()

        Session().commit()

        if HasPermissionAnyMiddleware('repository.write',

                                      'repository.admin')(self.authuser, self.repo_name):

            self.allow_push = True

        elif HasPermissionAnyMiddleware('repository.read')(self.authuser, self.repo_name):

            self.allow_push = False

        else: