Line data    Source code

       1             : // Copyright (C) 2022 The Android Open Source Project
       2             : //
       3             : // Licensed under the Apache License, Version 2.0 (the "License");
       4             : // you may not use this file except in compliance with the License.
       5             : // You may obtain a copy of the License at
       6             : //
       7             : // http://www.apache.org/licenses/LICENSE-2.0
       8             : //
       9             : // Unless required by applicable law or agreed to in writing, software
      10             : // distributed under the License is distributed on an "AS IS" BASIS,
      11             : // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
      12             : // See the License for the specific language governing permissions and
      13             : // limitations under the License.
      14             : 
      15             : package com.google.gerrit.sshd.commands;
      16             : 
      17             : import static com.google.gerrit.sshd.CommandMetaData.Mode.MASTER_OR_SLAVE;
      18             : 
      19             : import com.google.gerrit.entities.Account;
      20             : import com.google.gerrit.entities.Project;
      21             : import com.google.gerrit.extensions.restapi.ResourceNotFoundException;
      22             : import com.google.gerrit.server.CurrentUser;
      23             : import com.google.gerrit.server.IdentifiedUser;
      24             : import com.google.gerrit.server.account.AccountResolver;
      25             : import com.google.gerrit.server.permissions.GlobalPermission;
      26             : import com.google.gerrit.server.permissions.PermissionBackend;
      27             : import com.google.gerrit.server.permissions.PermissionBackendException;
      28             : import com.google.gerrit.server.permissions.ProjectPermission;
      29             : import com.google.gerrit.sshd.CommandMetaData;
      30             : import com.google.gerrit.sshd.SshCommand;
      31             : import com.google.inject.Inject;
      32             : import com.google.inject.Provider;
      33             : import java.io.IOException;
      34             : import java.util.Set;
      35             : import java.util.stream.Collectors;
      36             : import org.eclipse.jgit.errors.ConfigInvalidException;
      37             : import org.kohsuke.args4j.Option;
      38             : 
      39             : @CommandMetaData(
      40             :     name = "check-project-access",
      41             :     description = "Check project readability for specified user(s)",
      42             :     runsAt = MASTER_OR_SLAVE)
      43           1 : public class CheckProjectAccessCommand extends SshCommand {
      44             :   @Inject private AccountResolver accountResolver;
      45             :   @Inject private IdentifiedUser.GenericFactory userFactory;
      46             :   @Inject private PermissionBackend permissionBackend;
      47             :   @Inject private Provider<CurrentUser> userProvider;
      48             : 
      49             :   @Option(
      50             :       name = "--project",
      51             :       aliases = {"-p"},
      52             :       metaVar = "PROJECT",
      53             :       required = true,
      54             :       usage = "project name to check")
      55             :   private String projectName;
      56             : 
      57             :   @Option(
      58             :       name = "--user",
      59             :       aliases = {"-u"},
      60             :       metaVar = "USER",
      61             :       required = true,
      62             :       usage = "Account identifier used to find the user(s) for which to check access.")
      63             :   private String userName;
      64             : 
      65             :   @Override
      66             :   protected void run() throws Failure, ConfigInvalidException, IOException {
      67           0 :     PermissionBackend.WithUser userPermission = permissionBackend.user(userProvider.get());
      68             : 
      69           0 :     boolean isAdmin = userPermission.testOrFalse(GlobalPermission.ADMINISTRATE_SERVER);
      70           0 :     boolean canViewAccount = isAdmin || userPermission.testOrFalse(GlobalPermission.VIEW_ACCESS);
      71             : 
      72           0 :     if (!user.hasSameAccountId(userProvider.get()) && !canViewAccount) {
      73           0 :       throw die("This command requires 'view access' or 'administrate server' capabilities.");
      74             :     }
      75             : 
      76             :     try {
      77           0 :       for (IdentifiedUser user : getUserList(userName)) {
      78           0 :         stdout.println(
      79           0 :             String.format(
      80             :                 "Username: '%s', Email: '%s', Full Name: '%s', Result: %b\n",
      81           0 :                 user.getLoggableName(),
      82           0 :                 user.getNameEmail()
      83           0 :                     .substring(
      84           0 :                         user.getNameEmail().indexOf("<") + 1, user.getNameEmail().indexOf(">")),
      85           0 :                 user.getName(),
      86           0 :                 permissionBackend
      87           0 :                     .user(user)
      88           0 :                     .project(Project.nameKey(projectName))
      89           0 :                     .test(ProjectPermission.READ)));
      90           0 :       }
      91           0 :     } catch (ConfigInvalidException
      92             :         | ResourceNotFoundException
      93             :         | IllegalArgumentException
      94             :         | PermissionBackendException e) {
      95           0 :       throw die(e);
      96           0 :     }
      97           0 :   }
      98             : 
      99             :   private Set<IdentifiedUser> getUserList(String userName)
     100             :       throws ConfigInvalidException, IOException, ResourceNotFoundException {
     101           0 :     return getIdList(userName).stream().map(userFactory::create).collect(Collectors.toSet());
     102             :   }
     103             : 
     104             :   private Set<Account.Id> getIdList(String userName)
     105             :       throws ConfigInvalidException, IOException, ResourceNotFoundException {
     106           0 :     Set<Account.Id> idList = accountResolver.resolve(userName).asIdSet();
     107           0 :     if (idList.isEmpty()) {
     108           0 :       throw new ResourceNotFoundException(
     109             :           "No accounts found for your query: \""
     110             :               + userName
     111             :               + "\""
     112             :               + " Tip: Try double-escaping spaces, for example: \"--user Last,\\\\ First\"");
     113             :     }
     114           0 :     return idList;
     115             :   }
     116             : }