policy

Documentation

Overview

Package policy holds access-control and naming rules.

Index

• Constants
• func CanAdmin(user store.User, repo store.Repo, grant string) bool
• func CanRead(user store.User, repo store.Repo, grant string) bool
• func CanWrite(user store.User, repo store.Repo, grant string) bool
• func CheckPush(repo store.Repo, updates []RefUpdate) string
• func DeployScopeAllows(scope string, repoID int64, write bool) bool
• func IsDeployScope(scope string) bool
• func OwnersFor(rules []CodeownersRule, filePath string) []string
• func Reserved(name string) bool
• func ScopeAllowsGit(scope, repoPath string, write bool) bool
• func ValidateName(name string) error
• func ValidateOwnerName(name string) error
• func ValidateTopic(topic string) error
• type CodeownersRule
  • func ParseCodeowners(content string) []CodeownersRule
• type RefUpdate

Constants

const MaxTopics = 20

MaxTopics caps topics per repository.

Functions

func CanAdmin

func CanAdmin(user store.User, repo store.Repo, grant string) bool

CanAdmin reports whether user may change repo settings and access.

func CanRead

func CanRead(user store.User, repo store.Repo, grant string) bool

CanRead reports whether user may read repo over an authenticated channel. Public repos are readable by any authenticated user; private repos require ownership or an explicit grant.

func CanWrite

func CanWrite(user store.User, repo store.Repo, grant string) bool

CanWrite reports whether user may push to repo.

func CheckPush

func CheckPush(repo store.Repo, updates []RefUpdate) string

CheckPush applies ref policy for a push by a user with write access already established. It returns a denial message, or "" to allow.

func DeployScopeAllows

func DeployScopeAllows(scope string, repoID int64, write bool) bool

DeployScopeAllows authorizes a deploy key purely by its scope: the key is bound to a repository ID (rename- and transfer-proof), grants nothing anywhere else, and never inherits the access of whoever registered it.

func IsDeployScope

func IsDeployScope(scope string) bool

IsDeployScope reports whether a key scope is a deploy binding.

func OwnersFor

func OwnersFor(rules []CodeownersRule, filePath string) []string

OwnersFor returns the owners of a path: the last matching rule wins, CODEOWNERS convention. nil means unowned.

func Reserved

func Reserved(name string) bool

Reserved reports whether name is a reserved route word. Exported so the httpd tests can assert route/reserved-list agreement.

func ScopeAllowsGit

func ScopeAllowsGit(scope, repoPath string, write bool) bool

ScopeAllowsGit reports whether an account-scoped SSH key permits git transport at all. Deploy scopes are decided by DeployScopeAllows instead.

func ValidateName

func ValidateName(name string) error

ValidateName checks a repo name (reserved words are allowed for repos; routes are namespaced under the owner).

func ValidateOwnerName

func ValidateOwnerName(name string) error

ValidateOwnerName checks a username or org name.

func ValidateTopic

func ValidateTopic(topic string) error

ValidateTopic checks a repository topic: lowercase alphanumerics and dashes, must start with an alphanumeric, max 35 chars.

Types

type CodeownersRule

type CodeownersRule struct {
	Pattern string
	Owners  []string // usernames, @ stripped
}

CodeownersRule is one line of a CODEOWNERS file: a pattern and the users who own paths matching it.

func ParseCodeowners

func ParseCodeowners(content string) []CodeownersRule

ParseCodeowners reads CODEOWNERS content: one rule per line, gitignore- style pattern followed by @user owners; #-comments and blanks ignored.

type RefUpdate

type RefUpdate struct {
	Ref      string `json:"ref"`
	Old      string `json:"old"`
	New      string `json:"new"`
	IsDelete bool   `json:"is_delete"`
	IsForce  bool   `json:"is_force"`
}

RefUpdate is one proposed ref change, with git facts computed by the hook process (which can see quarantined objects; the daemon cannot).