Add permissions check in josh-filter

Author: LMG

josh-proxy/src/bin/josh-proxy.rs

@@ -295,7 +295,7 @@ async fn do_filter(
 
         let mut headref = headref;
 
-        josh::filter_refs(&transaction, filter, &from_to)?;
+        josh::filter_refs(&transaction, filter, &from_to, josh::filter::empty())?;
         if headref == "HEAD" {
             headref = heads_map
                 .read()?

src/bin/josh-filter.rs

@@ -101,7 +101,18 @@ fn run_filter(args: Vec<String>) -> josh::JoshResult<i32> {
         .arg(
             clap::Arg::with_name("check-permission")
                 .long("check-permission")
-                .short("c")
+                .short("c"),
+        )
+        .arg(
+            clap::Arg::with_name("whitelist")
+                .long("whitelist")
+                .short("w")
+                .takes_value(true),
+        )
+        .arg(
+            clap::Arg::with_name("blacklist")
+                .long("blacklist")
+                .short("b")
                 .takes_value(true),
         )
         .arg(clap::Arg::with_name("version").long("version").short("v"))
@@ -183,6 +194,7 @@ fn run_filter(args: Vec<String>) -> josh::JoshResult<i32> {
                 josh::filter::parse(&i)?,
                 input_ref,
                 "refs/JOSH_TMP",
+                josh::filter::empty(),
             )?;
         }
     }
@@ -193,12 +205,6 @@ fn run_filter(args: Vec<String>) -> josh::JoshResult<i32> {
     let target = update_target;
 
     let reverse = args.is_present("reverse");
-    let check_permissions = args.is_present("check-permission");
-
-    if check_permissions {
-        filterobj = josh::filter::chain(josh::filter::parse(":PATHS")?, filterobj);
-        filterobj = josh::filter::chain(filterobj, josh::filter::parse(":FOLD")?);
-    }
 
     let t = if reverse {
         "refs/JOSH_TMP".to_owned()
@@ -213,21 +219,32 @@ fn run_filter(args: Vec<String>) -> josh::JoshResult<i32> {
         .unwrap()
         .to_string();
 
-    josh::filter_ref(&transaction, filterobj, &src, &t)?;
-
-    let mut all_paths = vec![];
-
+    let check_permissions = args.is_present("check-permission");
+    let mut permissions_filter = josh::filter::empty();
     if check_permissions {
-        let result_tree = repo.find_reference(&t)?.peel_to_tree()?;
+        let whitelist = match args.value_of("whitelist") {
+            Some(s) => josh::filter::parse(s)?,
+            _ => josh::filter::nop(),
+        };
+        let blacklist = match args.value_of("blacklist") {
+            Some(s) => josh::filter::parse(s)?,
+            _ => josh::filter::empty(),
+        };
+        permissions_filter = josh::filter::make_permissions_filter(filterobj, whitelist, blacklist)
+    }
 
-        result_tree.walk(git2::TreeWalkMode::PreOrder, |_, entry| {
-            let name = entry.name().unwrap();
-            if name.starts_with("JOSH_ORIG_PATH_") {
-                let pathname = josh::from_ns(&name.replacen("JOSH_ORIG_PATH_", "", 1));
-                all_paths.push(pathname);
-            }
-            git2::TreeWalkResult::Ok
-        })?;
+    let updated_refs = josh::filter_ref(
+        &transaction,
+        filterobj,
+        &src,
+        &t,
+        permissions_filter,
+    )?;
+    if args.value_of("update") != Some("FILTERED_HEAD") && updated_refs == 0 {
+        println!(
+            "Warning: reference {} wasn't updated",
+            args.value_of("update").unwrap()
+        );
     }
 
     #[cfg(feature = "search")]
@@ -264,39 +281,6 @@ fn run_filter(args: Vec<String>) -> josh::JoshResult<i32> {
         /* println!("\n Search took {:?}", duration); */
     }
 
-    let mut dedup = vec![];
-
-    for w in all_paths.as_slice().windows(2) {
-        if let [a, b, ..] = w {
-            if !b.starts_with(a) {
-                dedup.push(a.to_owned());
-            }
-        }
-    }
-
-    let dedup = all_paths;
-
-    let options = glob::MatchOptions {
-        case_sensitive: true,
-        require_literal_separator: true,
-        require_literal_leading_dot: true,
-    };
-
-    if let Some(cp) = args.value_of("check-permission") {
-        let pattern = glob::Pattern::new(cp)?;
-
-        let mut allowed = !dedup.is_empty();
-        for d in dedup.iter() {
-            let d = std::path::PathBuf::from(d);
-            let m = pattern.matches_path_with(&d, options);
-            if !m {
-                allowed = false;
-                println!("missing permission for: {:?}", &d);
-            }
-        }
-        println!("Allowed = {:?}", allowed);
-    }
-
     if reverse {
         let new = repo.revparse_single(target).unwrap().id();
         let old = repo.revparse_single("JOSH_TMP").unwrap().id();

src/filter/mod.rs

@@ -33,6 +33,10 @@ pub fn nop() -> Filter {
     to_filter(Op::Nop)
 }
 
+pub fn empty() -> Filter {
+    to_filter(Op::Empty)
+}
+
 fn to_filter(op: Op) -> Filter {
     let s = format!("{:?}", op);
     let f = Filter(
@@ -767,6 +771,20 @@ fn compute_warnings2<'a>(
     warnings
 }
 
+pub fn make_permissions_filter(filter: Filter, whitelist: Filter, blacklist: Filter) -> Filter {
+    rs_tracing::trace_scoped!("make_permissions_filter");
+
+    let filter = chain(to_filter(Op::Paths), filter);
+    let filter = chain(filter, to_filter(Op::Invert));
+    let filter = chain(
+        filter,
+        compose(blacklist, to_filter(Op::Subtract(nop(), whitelist))),
+    );
+    let filter = opt::optimize(filter);
+
+    return filter;
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

src/housekeeping.rs

@@ -227,7 +227,7 @@ pub fn refresh_known_filters(
                 upstream_repo,
             );
 
-            updated_count += filter_refs(&t, filter::parse(filter_spec)?, &refs)?;
+            updated_count += filter_refs(&t, filter::parse(filter_spec)?, &refs, filter::empty())?;
         }
         info!("updated {} refs for {:?}", updated_count, upstream_repo);
     }

src/lib.rs

@@ -166,12 +166,34 @@ pub fn filter_ref(
     filterobj: filter::Filter,
     from_refsname: &str,
     to_refname: &str,
+    permissions: filter::Filter,
 ) -> JoshResult<usize> {
     let mut updated_count = 0;
     if let Ok(reference) = transaction.repo().revparse_single(from_refsname) {
         let original_commit = reference.peel_to_commit()?;
         let oid = original_commit.id();
 
+        let perms_commit = if let Some(s) = transaction.get_ref(permissions, oid) {
+            s
+        } else {
+            tracing::trace!("apply_to_commit (permissions)");
+
+            filter::apply_to_commit(permissions, &original_commit, &transaction)?
+        };
+
+        if perms_commit != git2::Oid::zero() {
+            let perms_commit = transaction.repo().find_commit(perms_commit)?;
+            if !perms_commit.tree()?.is_empty() || perms_commit.parents().len() > 0 {
+                tracing::event!(
+                    tracing::Level::WARN,
+                    msg = "filter_refs: missing permissions for ref",
+                    warn = true,
+                    reference = from_refsname,
+                );
+                return Err(josh_error("missing permissions for ref"));
+            }
+        }
+
         let filter_commit = if let Some(s) = transaction.get_ref(filterobj, oid) {
             s
         } else {
@@ -226,6 +248,7 @@ pub fn filter_refs(
     transaction: &cache::Transaction,
     filterobj: filter::Filter,
     refs: &[(String, String)],
+    permissions: filter::Filter,
 ) -> JoshResult<usize> {
     rs_tracing::trace_scoped!("filter_refs", "spec": filter::spec(filterobj));
     let s = tracing::Span::current();
@@ -235,7 +258,7 @@ pub fn filter_refs(
 
     let mut updated_count = 0;
     for (k, v) in refs {
-        updated_count += ok_or!(filter_ref(transaction, filterobj, k, v), {
+        updated_count += ok_or!(filter_ref(&transaction, filterobj, &k, &v, permissions), {
             tracing::event!(
                 tracing::Level::WARN,
                 msg = "filter_refs: Can't filter reference",

tests/filter/empty_head.t

@@ -35,6 +35,7 @@
   $ git commit -m "add file5" 1> /dev/null
 
   $ josh-filter -s :/sub2 master --update refs/josh/filter/master
+  Warning: reference refs/josh/filter/master wasn't updated
   [2] :/sub1
   [2] :/sub2
   $ git log --graph --pretty=%s josh/filter/master

tests/filter/infofile.t

@@ -30,6 +30,7 @@
   * add file1
 
   $ josh-filter -s c=:/sub1 master --update refs/josh/filter/master
+  Warning: reference refs/josh/filter/master wasn't updated
   [2] :/sub1
   [2] :prefix=c
   $ git log --graph --pretty=%s josh/filter/master
@@ -48,6 +49,7 @@
   $ git commit -m "add file5" 1> /dev/null
 
   $ josh-filter -s c=:/sub2 master --update refs/josh/filter/master
+  Warning: reference refs/josh/filter/master wasn't updated
   [2] :/sub1
   [2] :/sub2
   [3] :prefix=c