From 85ca6c6c7407b3d48bca5591671c66942275bec9 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jun 27 2016 08:52:35 +0000
Subject: [PATCH 1/2] Add global site admins having access to everything


---

diff --git a/pagure/__init__.py b/pagure/__init__.py
index 153a89d..f6b52eb 100644
--- a/pagure/__init__.py
+++ b/pagure/__init__.py
@@ -107,7 +107,6 @@ if APP.config.get('PAGURE_AUTH', None) in ['fas', 'openid']:
     def set_user(return_url):
         ''' After login method. '''
         try:
-
             pagure.lib.set_up_user(
                 session=SESSION,
                 username=flask.g.fas_user.username,
@@ -223,6 +222,12 @@ def is_admin():
         if not user.cla_done or len(user.groups) < 1:
             return False
 
+    admin_users = APP.config.get('PAGURE_ADMIN_USERS', [])
+    if not isinstance(admin_users, list):
+        admin_users = [admin_users]
+    if user.username in admin_users:
+        return True
+
     admins = APP.config['ADMIN_GROUP']
     if isinstance(admins, basestring):
         admins = [admins]
@@ -239,6 +244,12 @@ def is_repo_admin(repo_obj):
 
     user = flask.g.fas_user.username
 
+    admin_users = APP.config.get('PAGURE_ADMIN_USERS', [])
+    if not isinstance(admin_users, list):
+        admin_users = [admin_users]
+    if user in admin_users:
+        return True
+
     usergrps = [
         usr.user
         for grp in repo_obj.groups
diff --git a/pagure/default_config.py b/pagure/default_config.py
index 9a5b816..4ea4a16 100644
--- a/pagure/default_config.py
+++ b/pagure/default_config.py
@@ -28,6 +28,9 @@ DB_URL = 'sqlite:////var/tmp/pagure_dev.sqlite'
 # The FAS group in which the admin of pagure are
 ADMIN_GROUP = 'sysadmin-main'
 
+# Hard-code a list of users that are global admins
+PAGURE_ADMIN_USERS = []
+
 # Whether or not to send emails
 EMAIL_SEND = False
 

From 1abf96fb426520a2aa10807c521ef85e3d98a416 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jun 27 2016 08:59:02 +0000
Subject: [PATCH 2/2] Document the PAGURE_ADMIN_USERS option in the doc and the sample configuration file


---

diff --git a/doc/configuration.rst b/doc/configuration.rst
index 30a1310..effe7af 100644
--- a/doc/configuration.rst
+++ b/doc/configuration.rst
@@ -286,6 +286,26 @@ communicate with the EventSource server.
 Defaults to: ``0``.
 
 
+Authentication options
+----------------------
+
+ADMIN_GROUP
+~~~~~~~~~~~
+
+List of groups, local or remotes (if the openid server used supports the
+group extension), that are site admin. These admins can regenerate the
+gitolite configuration, the ssh key files, the hook-token for every project
+as well as manage users and groups.
+
+
+PAGURE_ADMIN_USERS
+~~~~~~~~~~~~~~~~~~
+
+List of usernames that are site admin. These admins have the same rights as
+the user in the admin groups (listed above) as well as admin rights to
+every projects hosted on this pagure instance.
+
+
 Optional options
 ----------------
 
diff --git a/files/pagure.cfg.sample b/files/pagure.cfg.sample
index d5c0458..653edb3 100644
--- a/files/pagure.cfg.sample
+++ b/files/pagure.cfg.sample
@@ -19,6 +19,9 @@ DB_URL = 'sqlite:////var/tmp/pagure_dev.sqlite'
 ### The FAS group in which the admin of pagure are
 ADMIN_GROUP = ['sysadmin-main']
 
+### Hard-coded list of global admins
+PAGURE_ADMIN_USERS = []
+
 ### The email address to which the flask.log will send the errors (tracebacks)
 EMAIL_ERROR = 'pingou@pingoured.fr'