Files
@ f734d107296e
Branch filter:
Location: kallithea/docs/usage/general.rst
f734d107296e
6.7 KiB
text/prs.fallenstein.rst
auth: for default permissions, use existing explicit query result values instead of following dot references in ORM result objects
There has been reports of spurious crashes on resolving references like
.repository from Permissions:
File ".../kallithea/lib/auth.py", line 678, in __wrapper
if self.check_permissions(user):
File ".../kallithea/lib/auth.py", line 718, in check_permissions
return user.has_repository_permission_level(repo_name, self.required_perm)
File ".../kallithea/lib/auth.py", line 450, in has_repository_permission_level
actual_perm = self.permissions['repositories'].get(repo_name)
File ".../kallithea/lib/vcs/utils/lazy.py", line 41, in __get__
value = self._func(obj)
File ".../kallithea/lib/auth.py", line 442, in permissions
return self.__get_perms(user=self, cache=False)
File ".../kallithea/lib/auth.py", line 498, in __get_perms
return compute(user_id, user_is_admin)
File ".../kallithea/lib/auth.py", line 190, in _cached_perms_data
r_k = perm.UserRepoToPerm.repository.repo_name
File ".../sqlalchemy/orm/attributes.py", line 285, in __get__
return self.impl.get(instance_state(instance), dict_)
File ".../sqlalchemy/orm/attributes.py", line 721, in get
value = self.callable_(state, passive)
File ".../sqlalchemy/orm/strategies.py", line 710, in _load_for_state
% (orm_util.state_str(state), self.key)
sqlalchemy.orm.exc.DetachedInstanceError: Parent instance <UserRepoToPerm at ...> is not bound to a Session; lazy load operation of attribute 'repository' cannot proceed (Background on this error at: http://sqlalche.me/e/bhk3)
Permissions are cached between requests: SA result records are stored in in
beaker.cache.sql_cache_short and resued in following requests after the initial
session as been removed. References in Permission objects would usually give
lazy lookup ... but not outside the original session, where we would get an
error like this.
Permissions are indeed implemented/used incorrectly. That might explain a part
of the problem. Even if not fully explaining or fixing this problem, it is
still worth fixing:
Permissions are fetched from the database using Session().query with multiple
class/table names (joined together in way that happens to match the references
specified in the table definitions) - including Repository. The results are
thus "structs" with selected objects. If repositories always were retrieved
using this selected repository, everything would be fine. In some places, this
was what we did.
But in some places, the code happened to do what was more intuitive: just use
.repository and rely on "lazy" resolving. SA was not aware that this one
already was present in the result struct, and would try to fetch it again. Best
case, that could be inefficient. Worst case, it would fail as we see here.
Fix this by only querying from one table but use the "joinedload" option to
also fetch other referenced tables in the same select. (This might
inefficiently return the main record multiple times ... but that was already
the case with the previous approach.)
This change is thus doing multiple things with circular dependencies that can't
be split up in minor parts without taking detours:
The existing repository join like:
.join((Repository, UserGroupRepoToPerm.repository_id == Repository.repo_id))
is thus replaced by:
.options(joinedload(UserGroupRepoToPerm.repository))
Since we only are doing Session.query() on one table, the results will be of
that type instead of "structs" with multiple objects. If only querying for
UserRepoToPerm this means:
- perm.UserRepoToPerm.repository becomes perm.repository
- perm.Permission.permission_name looked at the explicitly queried Permission
in the result struct - instead it should look in the the dereferenced
repository as perm.permission.permission_name
There has been reports of spurious crashes on resolving references like
.repository from Permissions:
File ".../kallithea/lib/auth.py", line 678, in __wrapper
if self.check_permissions(user):
File ".../kallithea/lib/auth.py", line 718, in check_permissions
return user.has_repository_permission_level(repo_name, self.required_perm)
File ".../kallithea/lib/auth.py", line 450, in has_repository_permission_level
actual_perm = self.permissions['repositories'].get(repo_name)
File ".../kallithea/lib/vcs/utils/lazy.py", line 41, in __get__
value = self._func(obj)
File ".../kallithea/lib/auth.py", line 442, in permissions
return self.__get_perms(user=self, cache=False)
File ".../kallithea/lib/auth.py", line 498, in __get_perms
return compute(user_id, user_is_admin)
File ".../kallithea/lib/auth.py", line 190, in _cached_perms_data
r_k = perm.UserRepoToPerm.repository.repo_name
File ".../sqlalchemy/orm/attributes.py", line 285, in __get__
return self.impl.get(instance_state(instance), dict_)
File ".../sqlalchemy/orm/attributes.py", line 721, in get
value = self.callable_(state, passive)
File ".../sqlalchemy/orm/strategies.py", line 710, in _load_for_state
% (orm_util.state_str(state), self.key)
sqlalchemy.orm.exc.DetachedInstanceError: Parent instance <UserRepoToPerm at ...> is not bound to a Session; lazy load operation of attribute 'repository' cannot proceed (Background on this error at: http://sqlalche.me/e/bhk3)
Permissions are cached between requests: SA result records are stored in in
beaker.cache.sql_cache_short and resued in following requests after the initial
session as been removed. References in Permission objects would usually give
lazy lookup ... but not outside the original session, where we would get an
error like this.
Permissions are indeed implemented/used incorrectly. That might explain a part
of the problem. Even if not fully explaining or fixing this problem, it is
still worth fixing:
Permissions are fetched from the database using Session().query with multiple
class/table names (joined together in way that happens to match the references
specified in the table definitions) - including Repository. The results are
thus "structs" with selected objects. If repositories always were retrieved
using this selected repository, everything would be fine. In some places, this
was what we did.
But in some places, the code happened to do what was more intuitive: just use
.repository and rely on "lazy" resolving. SA was not aware that this one
already was present in the result struct, and would try to fetch it again. Best
case, that could be inefficient. Worst case, it would fail as we see here.
Fix this by only querying from one table but use the "joinedload" option to
also fetch other referenced tables in the same select. (This might
inefficiently return the main record multiple times ... but that was already
the case with the previous approach.)
This change is thus doing multiple things with circular dependencies that can't
be split up in minor parts without taking detours:
The existing repository join like:
.join((Repository, UserGroupRepoToPerm.repository_id == Repository.repo_id))
is thus replaced by:
.options(joinedload(UserGroupRepoToPerm.repository))
Since we only are doing Session.query() on one table, the results will be of
that type instead of "structs" with multiple objects. If only querying for
UserRepoToPerm this means:
- perm.UserRepoToPerm.repository becomes perm.repository
- perm.Permission.permission_name looked at the explicitly queried Permission
in the result struct - instead it should look in the the dereferenced
repository as perm.permission.permission_name
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 | .. _general:
=======================
General Kallithea usage
=======================
Repository deletion
-------------------
When an admin or owner deletes a repository, Kallithea does
not physically delete said repository from the filesystem, but instead
renames it in a special way so that it is not possible to push, clone
or access the repository.
There is a special command for cleaning up such archived repositories::
kallithea-cli repo-purge-deleted -c my.ini --older-than=30d
This command scans for archived repositories that are older than
30 days, displays them, and asks if you want to delete them (unless given
the ``--no-ask`` flag). If you host a large amount of repositories with
forks that are constantly being deleted, it is recommended that you run this
command via crontab.
It is worth noting that even if someone is given administrative access to
Kallithea and deletes a repository, you can easily restore such an action by
renaming the repository directory, removing the ``rm__<date>`` prefix.
File view: follow current branch
--------------------------------
In the file view, left and right arrows allow to jump to the previous and next
revision. Depending on the way revisions were created in the repository, this
could jump to a different branch. When the checkbox ``Follow current branch``
is checked, these arrows will only jump to revisions on the same branch as the
currently visible revision. So for example, if someone is viewing files in the
``beta`` branch and marks the `Follow current branch` checkbox, the < and >
arrows will only show revisions on the ``beta`` branch.
Changelog features
------------------
The core feature of a repository's ``changelog`` page is to show the revisions
in a repository. However, there are several other features available from the
changelog.
Branch filter
By default, the changelog shows revisions from all branches in the
repository. Use the branch filter to restrict to a given branch.
Viewing a changeset
A particular changeset can be opened by clicking on either the changeset
hash or the commit message, or by ticking the checkbox and clicking the
``Show selected changeset`` button at the top.
Viewing all changes between two changesets
To get a list of all changesets between two selected changesets, along with
the changes in each one of them, tick the checkboxes of the first and
last changeset in the desired range and click the ``Show selected changesets``
button at the top. You can only show the range between the first and last
checkbox (no cherry-picking).
From that page, you can proceed to viewing the overall delta between the
selected changesets, by clicking the ``Compare revisions`` button.
Creating a pull request
You can create a new pull request for the changes of a particular changeset
(and its ancestors) by selecting it and clicking the ``Open new pull request
for selected changesets`` button.
Permanent repository URLs
-------------------------
Due to the complicated nature of repository grouping, URLs of repositories
can often change. For example, a repository originally accessible from::
http://kallithea.example.com/repo_name
would get a new URL after moving it to test_group::
http://kallithea.example.com/test_group/repo_name
Such moving of a repository to a group can be an issue for build systems and
other scripts where the repository paths are hardcoded. To mitigate this,
Kallithea provides permanent URLs using the repository ID prefixed with an
underscore. In all Kallithea URLs, for example those for the changelog and the
file view, a repository name can be replaced by this ``_ID`` string. Since IDs
are always the same, moving the repository to a different group will not affect
such URLs.
In the example, the repository could also be accessible as::
http://kallithea.example.com/_<ID>
The ID of a given repository can be shown from the repository ``Summary`` page,
by selecting the ``Show by ID`` button next to ``Clone URL``.
Email notifications
-------------------
With email settings properly configured in the Kallithea
configuration file, Kallithea will send emails on user registration and when
errors occur.
Emails are also sent for comments on changesets. In this case, an email is sent
to the committer of the changeset (if known to Kallithea), to all reviewers of
the pull request (if applicable) and to all people mentioned in the comment
using @mention notation.
Trending source files
---------------------
Trending source files are calculated based on a predefined dictionary of known
types and extensions. If an extension is missing or you would like to scan
custom files, it is possible to extend the ``LANGUAGES_EXTENSIONS_MAP``
dictionary located in ``kallithea/config/conf.py`` with new types.
Cloning remote repositories
---------------------------
Kallithea has the ability to clone repositories from given remote locations.
Currently it supports the following options:
- hg -> hg clone
- svn -> hg clone
- git -> git clone
.. note:: svn -> hg cloning requires the ``hgsubversion`` library to be
installed.
If you need to clone repositories that are protected via basic authentication,
you can pass the credentials in the URL, e.g.
``http://user:passw@remote.example.com/repo``. Kallithea will then try to login and
clone using the given credentials. Please note that the given credentials will
be stored as plaintext inside the database. However, the authentication
information will not be shown in the clone URL on the summary page.
Specific features configurable in the Admin settings
----------------------------------------------------
In general, the Admin settings should be self-explanatory and will not be
described in more detail in this documentation. However, there are a few
features that merit further explanation.
Repository extra fields
^^^^^^^^^^^^^^^^^^^^^^^
In the *Visual* tab, there is an option "Use repository extra
fields", which allows to set custom fields for each repository in the system.
Once enabled site-wide, the custom fields can be edited per-repository under
*Options* | *Settings* | *Extra Fields*.
Example usage of such fields would be to define company-specific information
into repositories, e.g., defining a ``repo_manager`` key that would give info
about a manager of each repository. There's no limit for adding custom fields.
Newly created fields are accessible via the API.
Meta tagging
^^^^^^^^^^^^
In the *Visual* tab, option "Stylify recognised meta tags" will cause Kallithea
to turn certain text fragments in repository and repository group
descriptions into colored tags. Currently recognised tags are::
[featured]
[stale]
[dead]
[lang => lang]
[license => License]
[requires => Repo]
[recommends => Repo]
[see => URI]
|