mbbx6spp-gitauth 0.0.5.2

data/lib/gitauth/client.rb

@@ -0,0 +1,95 @@
+#--
+#   Copyright (C) 2009 Brown Beagle Software
+#   Copyright (C) 2009 Darcy Laycock <sutto@sutto.net>
+#   Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+#   Copyright (C) 2007, 2008 Johan Sørensen <johan@johansorensen.com>
+#   Copyright (C) 2008 Tor Arne Vestbø <tavestbo@trolltech.com>
+#
+#   This program is free software: you can redistribute it and/or modify
+#   it under the terms of the GNU Affero General Public License as published by
+#   the Free Software Foundation, either version 3 of the License, or
+#   (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be useful,
+#   but WITHOUT ANY WARRANTY; without even the implied warranty of
+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#   GNU Affero General Public License for more details.
+#
+#   You should have received a copy of the GNU Affero General Public License
+#   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#++
+
+module GitAuth
+  class Client
+    include GitAuth::Loggable
+    
+    attr_accessor :user, :command
+    
+    def initialize(user_name, command)
+      logger.debug "Initializing client with command: #{command.inspect} and user name #{user_name.inspect}"
+      @callbacks = Hash.new { |h,k| h[k] = [] }
+      @user      = GitAuth::User.get(user_name.to_s.strip)
+      @command   = command
+    end
+    
+    def exit_with_error(error)
+      logger.warn "Exiting with error: #{error}"
+      $stderr.puts error
+      exit! 1
+    end
+    
+    def run!
+      if @user.nil?
+        exit_with_error "An invalid user / key was used. Please ensure it is setup with GitAuth"
+      elsif @command.to_s.strip.empty?
+        if user.shell_accessible?
+          exec(ENV["SHELL"])
+        else
+          exit_with_error "SSH_ORIGINAL_COMMAND is needed, mmmkay?"
+        end
+      else
+        command   = Command.parse(@command)
+        repo      = command.bad? ? nil : Repo.get(extract_repo_name(command))
+        if command.bad?
+          if user.shell_accessible?
+            exec(@command)
+          else
+            exit_with_error "Invalid ssh command - Access Denied"
+          end
+        elsif repo.nil?
+          exit_with_error "Unable to push to a non-existant repository"
+        elsif user.can_execute?(command, repo)
+          git_shell_argument = "#{command.verb} '#{repo.real_path}'"
+          logger.info "Running command: #{git_shell_argument} for user: #{@user.name}"
+          exec("git-shell", "-c", git_shell_argument)
+        else
+          exit_with_error "Unable to execute command on this repository"
+        end
+      end
+    rescue Exception => e
+      logger.fatal "Exception: #{e.class.name}: #{e.message}"
+      e.backtrace.each do |l|
+        logger.fatal "  => #{l}"
+      end
+      exit_with_error "Exception raised - Please check your gitauth log / contact an administrator"
+    end
+    
+    def self.start!(user, command)
+      # Gitorious does it so I should too!
+      File.umask(0022)
+      # Setup models etc
+      GitAuth.prepare
+      # Finally, create and initialize
+      client = self.new(user, command)
+      yield client if block_given?
+      client.run!
+    end
+    
+    protected
+    
+    def extract_repo_name(command)
+      command.path
+    end
+    
+  end
+end

data/lib/gitauth/command.rb

@@ -0,0 +1,101 @@
+#--
+#   Copyright (C) 2009 Brown Beagle Software
+#   Copyright (C) 2009 Darcy Laycock <sutto@sutto.net>
+#   Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+#   Copyright (C) 2007, 2008 Johan Sørensen <johan@johansorensen.com>
+#   Copyright (C) 2008 Tim Dysinger <tim@dysinger.net>
+#   Copyright (C) 2008 Tor Arne Vestbø <tavestbo@trolltech.com>
+#
+#   This program is free software: you can redistribute it and/or modify
+#   it under the terms of the GNU Affero General Public License as published by
+#   the Free Software Foundation, either version 3 of the License, or
+#   (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be useful,
+#   but WITHOUT ANY WARRANTY; without even the implied warranty of
+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#   GNU Affero General Public License for more details.
+#
+#   You should have received a copy of the GNU Affero General Public License
+#   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#++
+
+# This along with the associated gitauth-shell command are inspired by
+# (and essentially, derived from) gitosis (http://eagain.net/gitweb/?p=gitosis.git)
+# and gitorius (http://gitorius.org)
+# Gitosis is of this writing licensed under the GPLv2 and is copyright (c) Tommi Virtanen
+# and can be found at http://eagain.net/gitweb/?p=gitosis.git
+# GitAuth::Command is licensed under the same license
+
+module GitAuth
+  class Command
+    
+    # Standard Commands
+    READ_COMMANDS  = ["git-upload-pack", "git upload-pack"]
+    WRITE_COMMANDS = ["git-receive-pack", "git receive-pack"]
+    PATH_REGEXP    = /^'([\w\_\-\~\.\+\/]+\/)?([\w\_\-\.\+]+(\.git)?)'$/i.freeze
+    
+    attr_reader :path, :verb, :command
+    
+    def initialize(command)
+      @command     = command
+      @verb        = nil
+      @argument    = nil
+      @path        = nil
+      @bad_command = true
+    end
+    
+    def bad?
+      @bad_command
+    end
+    
+    def write?
+      !bad? && @verb_type == :write
+    end
+    
+    def read?
+      !bad? && !write?
+    end
+    
+    def process
+      return if @command.include?("\n") || @command !~ /^git[ \-]/i
+      @verb, @argument = split_command
+      return if @argument.nil? || @argument.is_a?(Array) 
+      # Check if it's read / write
+      if READ_COMMANDS.include?(@verb)
+        @verb_type = :read
+      elsif WRITE_COMMANDS.include?(@verb)
+        @verb_type = :write
+      else
+        return
+      end
+      if PATH_REGEXP =~ @argument
+        @path = $2
+        return unless @path
+      else
+        return
+      end
+      @bad_command = false
+    end
+    
+    def self.parse(command)
+      command = self.new(command)
+      command.process
+      command
+    end
+    
+    protected
+    
+    def split_command
+      parts = @command.split(" ")
+      if parts.size == 3
+        ["#{parts[0]} #{parts[1]}", parts[2]]
+      elsif parts.size == 2
+        parts
+      else
+        raise BadCommandError
+      end
+    end
+    
+  end
+end

data/lib/gitauth/group.rb

@@ -0,0 +1,87 @@
+#--
+#   Copyright (C) 2009 Brown Beagle Software
+#   Copyright (C) 2009 Darcy Laycock <sutto@sutto.net>
+#
+#   This program is free software: you can redistribute it and/or modify
+#   it under the terms of the GNU Affero General Public License as published by
+#   the Free Software Foundation, either version 3 of the License, or
+#   (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be useful,
+#   but WITHOUT ANY WARRANTY; without even the implied warranty of
+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#   GNU Affero General Public License for more details.
+#
+#   You should have received a copy of the GNU Affero General Public License
+#   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#++
+
+
+module GitAuth
+  class Group < SaveableClass(:groups)
+    include GitAuth::Loggable
+    
+    attr_accessor :name, :members
+    
+    def initialize(name)
+      @name  = name
+      @members = []
+    end
+    
+    def destroy!
+      GitAuth::Repo.all.each { |r| r.remove_permissions_for(self) }
+      self.class.all.each { |r| r.remove_member(self) }
+      self.class.all.reject! { |g| g == self }
+      GitAuth::Repo.save!
+      self.class.save!
+    end
+    
+    def add_member(member)
+      return if member == self
+      @members << member.to_s
+      @members.uniq!
+    end
+    
+    def remove_member(member)
+      @members.reject! { |m| m == member.to_s }
+    end
+    
+    def ==(group)
+      group.is_a?(Group) && group.name == self.name
+    end
+    
+    def member?(user_or_group, recurse = false, level = 0)
+      member = @members.include?(user_or_group.to_s)
+      Thread.current[:checked_groups] = [] if level == 0
+      if !member
+        return false if level > 0 && Thread.current[:checked_groups].include?(self)
+        Thread.current[:checked_groups] << self
+        member = recurse && @members.map { |m| Group.get(m) }.compact.any? { |g| g.member?(user_or_group, true, level + 1) } 
+      end
+      Thread.current[:checked_groups] = nil if level == 0
+      return member
+    end
+    
+    def to_s
+      "@#{name}"
+    end
+    
+    def self.create(name)
+      name = name.to_s.strip.gsub(/^@/, "")
+      return false if name.empty? || name !~ /^([\w\_\-\.]+)$/
+      self.add_item self.new(name)
+      return true
+    end
+    
+    def self.get(name)
+      logger.debug "Getting group named #{name.inspect}"
+      real_name = name.to_s.gsub(/^@/, "")
+      self.all.detect { |g| g.name == real_name }
+    end
+    
+    def self.group?(name)
+      name.to_s =~ /^@/ && !get(name).nil?
+    end
+    
+  end
+end

data/lib/gitauth/message.rb

@@ -0,0 +1,69 @@
+#--
+#   Copyright (C) 2009 Brown Beagle Software
+#   Copyright (C) 2009 Darcy Laycock <sutto@sutto.net>
+#
+#   This program is free software: you can redistribute it and/or modify
+#   it under the terms of the GNU Affero General Public License as published by
+#   the Free Software Foundation, either version 3 of the License, or
+#   (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be useful,
+#   but WITHOUT ANY WARRANTY; without even the implied warranty of
+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#   GNU Affero General Public License for more details.
+#
+#   You should have received a copy of the GNU Affero General Public License
+#   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#++
+
+require 'yaml'
+
+module GitAuth
+  class Message
+    
+    TEMPLATES = YAML.load_file(BASE_DIR.join("resources", "messages.yml"))
+    
+    attr_accessor :type, :name, :message, :variables
+    
+    def initialize(type, name, variables = {})
+      @type      = type
+      @name      = name
+      @variables = {}
+      variables.each_pair { |k,v| @variables[k.to_s] = v }
+      auto_set_message!
+    end
+    
+    def success?
+      @type.to_sym == :notice
+    end
+    
+    def error?
+      @type.to_sym == :error
+    end
+    
+    class << self
+      # Handy accessor / generate methods
+      # for a given error code.
+      
+      def error(name = :unknown)
+        new(:error, name)
+      end
+    
+      def notice(name = :unknown)
+        new(:notice, name)
+      end
+    
+      def warning(name = :unknown)
+        new(:warning, name)
+      end
+    end
+    
+    protected
+    
+    def auto_set_message!
+      raw_message = (TEMPLATES[@type.to_s] || {})[@name.to_s] || ""
+      @message = raw_message.gsub(/\:(\w+)/i) { |v| @variables[$1] || "" }
+    end
+    
+  end
+end

data/lib/gitauth/repo.rb

@@ -0,0 +1,155 @@
+#--
+#   Copyright (C) 2009 Brown Beagle Software
+#   Copyright (C) 2009 Darcy Laycock <sutto@sutto.net>
+#
+#   This program is free software: you can redistribute it and/or modify
+#   it under the terms of the GNU Affero General Public License as published by
+#   the Free Software Foundation, either version 3 of the License, or
+#   (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be useful,
+#   but WITHOUT ANY WARRANTY; without even the implied warranty of
+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#   GNU Affero General Public License for more details.
+#
+#   You should have received a copy of the GNU Affero General Public License
+#   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#++
+
+require 'fileutils'
+module GitAuth
+  class Repo < SaveableClass(:repositories)
+    include GitAuth::Loggable
+    
+    NAME_RE = /^([\w\_\-\.\+]+(\.git)?)$/i
+    
+    def self.get(name)
+      logger.debug "Getting Repo w/ name: '#{name}'"
+      (all || []).detect { |r| r.name == name }
+    end
+    
+    def self.create(name, path = name)
+      return false if name.nil? || path.nil?
+      return false if self.get(name) || self.all.any? { |r| r.path == path } || name !~ NAME_RE || path !~ NAME_RE
+      repository = new(name, path)
+      return false unless repository.create_repo!
+      add_item(repository)
+      repository
+    end
+    
+    attr_accessor :name, :path, :permissions
+    
+    def initialize(name, path, auto_create = false)
+      @name, @path = name, path
+      @permissions = {}
+    end
+    
+    def ==(other)
+      other.is_a?(Repo) && other.name == name && other.path == path
+    end
+    
+    def writeable_by(whom)
+      add_permissions :write, whom
+    end
+    
+    def readable_by(whom)
+      add_permissions :read, whom
+    end
+    
+    def update_permissions!(user, permissions = [])
+      remove_permissions_for(user)
+      writeable_by(user) if permissions.include?("write")
+      readable_by(user)  if permissions.include?("read")
+      self.class.save!
+    end
+    
+    def writeable_by?(user_or_group)
+      has_permissions_for :write, user_or_group
+    end
+    
+    def readable_by?(user_or_group)
+      has_permissions_for :read, user_or_group
+    end
+    
+    def remove_permissions_for(user_or_group)
+      @permissions.each_value do |val|
+        val.reject! { |m| m == user_or_group.to_s }
+      end
+    end
+    
+    def real_path
+      File.join(GitAuth::Settings.base_path, @path)
+    end
+    
+    def create_repo!
+      return false if !GitAuth.has_git?
+      unless File.directory?(real_path)
+        FileUtils.mkdir_p(real_path)
+        output = ""
+        Dir.chdir(real_path) { IO.popen("git --bare init") { |f| output << f.read } }
+        !!(output =~ /Initialized empty Git repository/)
+      end
+    end
+    
+    def destroy!
+      FileUtils.rm_rf(real_path) if File.exist?(real_path)
+      self.class.all.reject! { |r| r == self }
+      self.class.save!
+    end
+    
+    def make_empty!
+      tmp_path = "/tmp/gitauth-#{rand(100000)}-#{Time.now.to_i}"
+      logger.info "Creating temporary dir at #{tmp_path}"
+      FileUtils.mkdir_p("#{tmp_path}/current-repo")
+      logger.info "Changing to new directory"
+      Dir.chdir("#{tmp_path}/current-repo") do
+        logger.info "Marking as git repo"
+        GitAuth.run "git init"
+        logger.info "Touching .gitignore"
+        GitAuth.run "touch .gitignore"
+        # Configure it
+        GitAuth.run "git config push.default current"
+        logger.info "Commiting"
+        GitAuth.run "git add ."
+        GitAuth.run "git commit -am 'Initialize Empty Repository'"
+        # Push the changes to the actual repository
+        logger.info "Adding origin #{self.real_path}"
+        GitAuth.run "git remote add origin '#{self.real_path}'"
+        logger.info "Pushing..."
+        GitAuth.run "git push origin master"
+      end
+    ensure
+      logger.info "Cleaning up old tmp file"
+      FileUtils.rm_rf(tmp_path) if File.directory?(tmp_path)
+    end
+    
+    def execute_post_create_hook!
+      script = File.expand_path("~/.gitauth/post-create")
+      if File.executable?(script)
+        system(script, @name, @path)
+        return $?.success?
+      else
+        # If there isn't a file, run it ourselves.
+        return true
+      end
+    end
+    
+    protected
+    
+    def add_permissions(type, whom)
+      @permissions[type] ||= []
+      @permissions[type] << whom.to_s
+      @permissions[type].uniq!
+    end
+    
+    def has_permissions_for(type, whom)
+      whom = GitAuth.get_user_or_group(whom) if whom.is_a?(String)
+      logger.info "Checking if #{whom.to_s} can #{type} #{self.name}"
+      !(@permissions[type] || []).detect do |reader|
+        reader = GitAuth.get_user_or_group(reader)
+        reader == whom || (reader.is_a?(Group) && reader.member?(whom, true))
+      end.nil?
+    end
+    
+  end
+end

data/lib/gitauth/saveable_class.rb

@@ -0,0 +1,54 @@
+#--
+#   Copyright (C) 2009 Brown Beagle Software
+#   Copyright (C) 2009 Darcy Laycock <sutto@sutto.net>
+#
+#   This program is free software: you can redistribute it and/or modify
+#   it under the terms of the GNU Affero General Public License as published by
+#   the Free Software Foundation, either version 3 of the License, or
+#   (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be useful,
+#   but WITHOUT ANY WARRANTY; without even the implied warranty of
+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#   GNU Affero General Public License for more details.
+#
+#   You should have received a copy of the GNU Affero General Public License
+#   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#++
+
+module GitAuth
+  
+  class BasicSaveable
+    
+    class_inheritable_accessor :all, :store_path
+    self.all = nil
+    
+    class << self
+      
+      def load!
+        self.all = YAML.load(File.read(store_path)) rescue nil if File.file?(store_path)
+        self.all = [] unless all.is_a?(Array)
+      end
+      
+      def save!
+        load! if all.nil?
+        File.open(store_path, "w+") { |f| f.write all.to_yaml }
+      end
+      
+      def add_item(item)
+        load! if all.nil?
+        all << item
+        save!
+      end
+      
+    end
+  end
+  
+  def self.SaveableClass(kind)
+    klass            = Class.new(BasicSaveable)
+    klass.store_path = GitAuth::GITAUTH_DIR.join("#{kind}.yml").to_s
+    klass.all        = nil
+    return klass
+  end
+  
+end

data/lib/gitauth/user.rb

@@ -0,0 +1,135 @@
+#--
+#   Copyright (C) 2009 Brown Beagle Software
+#   Copyright (C) 2009 Darcy Laycock <sutto@sutto.net>
+#
+#   This program is free software: you can redistribute it and/or modify
+#   it under the terms of the GNU Affero General Public License as published by
+#   the Free Software Foundation, either version 3 of the License, or
+#   (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be useful,
+#   but WITHOUT ANY WARRANTY; without even the implied warranty of
+#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#   GNU Affero General Public License for more details.
+#
+#   You should have received a copy of the GNU Affero General Public License
+#   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#++
+
+
+module GitAuth
+  class User < SaveableClass(:users)
+    include GitAuth::Loggable  
+    
+    def self.get(name)
+      logger.debug "Getting user for the name '#{name}'"
+      (all || []).detect { |r| r.name == name }
+    end
+    
+    def self.create(name, admin, key)
+      # Basic sanity checking
+      return false if name.nil? || admin.nil? || key.nil?
+      # Require that the name is valid and admin is a boolean.
+      return false unless name =~ /^([\w\_\-\.]+)$/ && !!admin == admin
+      # Check there isn't an existing user
+      return false unless get(name).blank?
+      if (user = new(name, admin)).write_ssh_key!(key)
+        add_item(user)
+        return true
+      else
+        return false
+      end
+    end
+    
+    attr_reader :name, :admin
+    
+    def initialize(name, admin = false)
+      @name = name
+      @admin = admin
+    end
+    
+    def to_s
+      @name.to_s
+    end
+    
+    def write_ssh_key!(key)
+      cleaned_key = self.class.clean_ssh_key(key)
+      if cleaned_key.nil?
+        return false
+      else
+        output = "#{command_prefix} #{cleaned_key}"
+        File.open(GitAuth::Settings.authorized_keys_file, "a+") do |file|
+          file.puts output
+        end
+        return true
+      end
+    end
+    
+    def command_prefix
+      options  = ["command=\"#{GitAuth::Settings.shell_executable} #{@name}\"",
+                  "no-port-forwarding", "no-X11-forwarding", "no-agent-forwarding"]
+      options << "no-pty" if !shell_accessible?
+      options.join(",")
+    end
+    
+    def destroy!
+      GitAuth::Repo.all.each  { |r| r.remove_permissions_for(self) }
+      GitAuth::Group.all.each { |g| g.remove_member(self) }
+      # Remove the public key from the authorized_keys file.
+      auth_keys_path = GitAuth::Settings.authorized_keys_file
+      if File.exist?(auth_keys_path)
+        contents = File.read(auth_keys_path)
+        contents.gsub!(/#{command_prefix} ssh-\w+ [a-zA-Z0-9\/\+]+==\r?\n?/m, "")
+        File.open(auth_keys_path, "w+") { |f| f.write contents }
+      end
+      self.class.all.reject! { |u| u == self }
+      # Finally, save everything
+      self.class.save!
+      GitAuth::Repo.save!
+      GitAuth::Group.save!
+    end
+    
+    def groups
+      (Group.all || []).select { |g| g.member?(self) }
+    end
+    
+    def admin?
+      !!@admin
+    end
+    
+    alias shell_accessible? admin?
+    
+    def pushable?(repo)
+      admin? || repo.writeable_by?(self)
+    end
+    
+    def pullable?(repo)
+      admin? || repo.readable_by?(self)
+    end
+    
+    def can_execute?(command, repo)
+      return if command.bad?
+      if command.write?
+        logger.debug "Checking if #{self.name} can push to #{repo.name}"
+        pushable?(repo)
+      else
+        logger.debug "Checking if #{self.name} can pull from #{repo.name}"
+        pullable?(repo)
+      end
+    end
+    
+    def self.clean_ssh_key(key)
+      if key =~ /^(ssh-\w+ [a-zA-Z0-9\/\+]+==?).*$/
+        return $1
+      else
+        return nil
+      end
+    end
+    
+    def self.valid_key?(key)
+      clean_ssh_key(key).present?
+    end
+    
+  end
+  Users = User # For Backwards Compat.
+end