From d4d00d4786c1fc395a8f7f637f257676ea18bc0b Mon Sep 17 00:00:00 2001
From: Joe Talbott <joetalbott@gmail.com>
Date: May 24 2021 20:23:25 +0000
Subject: [PATCH 1/2] koji-gc: Allow admins to force untagging builds.


* Add check for needed permsission and skip the tag if the user doesn't
  have the needed permission.

Fixes: https://pagure.io/koji/issue/2189

---

diff --git a/util/koji-gc b/util/koji-gc
index c84ca2e..c5bbd12 100755
--- a/util/koji-gc
+++ b/util/koji-gc
@@ -233,6 +233,26 @@ def get_options():
     return options, args
 
 
+def check_perms(required, granted):
+    """Check that the 'granted' permissions are sufficient with regard to the
+    'required' permissions.
+
+    :param required: a permission name.
+    :param granted: a list of granted permissions.
+    :returns: True if required permissions are met and False if not.
+    """
+    # Nothing required
+    if required is None or not required:
+        return True
+    # Nothing granted
+    elif granted is None or not granted:
+        return False
+    elif required in granted:
+        return True
+
+    return False
+
+
 def check_tag(name):
     """Check tag name against options and determine if we should process it
 
@@ -860,8 +880,15 @@ def handle_prune():
             raise Exception("Invalid action: %s" % action)
     if options.debug:
         pprint.pprint(policies.ruleset)
+
+    # get user info
+    user_perms = session.getPerms() #JOE
+    user = session.getLoggedInUser() #JOE
+    username = user['name']
+
     # get tags
-    tags = session.listTags(perms=False, queryOpts={'order': 'name'})
+    tags = session.listTags(perms=True, queryOpts={'order': 'name'})
+    is_admin = session.hasPerm('admin')
     untagged = {}
     build_ids = {}
     for taginfo in tags:
@@ -887,6 +914,27 @@ def handle_prune():
                 if options.debug:
                     print("skipping locked tag: %s" % tagname)
                 continue
+
+        perm = taginfo['perm']
+        # Fail early if required permissions are missing.
+        has_tag_specific_perm = check_perms(perm, user_perms)
+        has_global_tag_perm = check_perms('tag', user_perms)
+        if (
+            not has_tag_specific_perm and
+            not has_global_tag_perm and
+            not is_admin
+        ):
+
+            required_perms = '"{}"{}'.format(
+                perm if perm is not None else 'tag',
+                ' or "admin"' if not is_admin and perm != "admin"  else '')
+            print("Skipping tag "
+                  "'{}' which requires {} but not found for user '{}'".format(
+                      taginfo['name'],
+                      required_perms,
+                      username))
+            continue
+
         if options.debug:
             print("Pruning tag: %s" % tagname)
         # get builds
@@ -946,7 +994,7 @@ def handle_prune():
                         print("Untagging build %s from %s" % (nvr, tagname))
                         try:
                             session.untagBuildBypass(taginfo['id'], entry['build_id'],
-                                                     force=bypass)
+                                                     force=bypass or is_admin)
                             untagged.setdefault(nvr, {})[tagname] = 1
                         except (xmlrpc.client.Fault, koji.GenericError) as e:
                             print("Warning: untag operation failed: %s" % e)

From 35cb512f6e314c431bcb454dce164fc0c07efdbf Mon Sep 17 00:00:00 2001
From: Joe Talbott <joetalbott@gmail.com>
Date: May 24 2021 20:55:50 +0000
Subject: [PATCH 2/2] Fix flake8 warnings.


---

diff --git a/util/koji-gc b/util/koji-gc
index c5bbd12..4807ca3 100755
--- a/util/koji-gc
+++ b/util/koji-gc
@@ -882,8 +882,8 @@ def handle_prune():
         pprint.pprint(policies.ruleset)
 
     # get user info
-    user_perms = session.getPerms() #JOE
-    user = session.getLoggedInUser() #JOE
+    user_perms = session.getPerms()
+    user = session.getLoggedInUser()
     username = user['name']
 
     # get tags
@@ -927,7 +927,7 @@ def handle_prune():
 
             required_perms = '"{}"{}'.format(
                 perm if perm is not None else 'tag',
-                ' or "admin"' if not is_admin and perm != "admin"  else '')
+                ' or "admin"' if not is_admin and perm != "admin" else '')
             print("Skipping tag "
                   "'{}' which requires {} but not found for user '{}'".format(
                       taginfo['name'],