From 9c8a326c10d1c70c29c1cdc52d4bda2cb29e73c2 Mon Sep 17 00:00:00 2001
From: Farhaan Bukhsh <farhaan.bukhsh@gmail.com>
Date: Apr 12 2018 12:10:17 +0000
Subject: [PATCH 1/2] Fix private repo to be accessed by ACLs other than admin


This commit fixes the permission issues to display private project on the UI when the user is added as commiter or ticker access.

Signed-off-by: Farhaan Bukhsh <farhaan.bukhsh@gmail.com>

---

diff --git a/pagure/lib/__init__.py b/pagure/lib/__init__.py
index 3eb7203..3f4a35e 100644
--- a/pagure/lib/__init__.py
+++ b/pagure/lib/__init__.py
@@ -5015,7 +5015,7 @@ def get_authorized_project(
         case=pagure_config.get('CASE_SENSITIVE', False)
     )
 
-    if repo and repo.private and not pagure.utils.is_repo_admin(repo):
+    if repo and repo.private and not pagure.utils.is_repo_user(repo):
         return None
 
     return repo

From c03c25805bc64d664de15819265520f2d1f1b19b Mon Sep 17 00:00:00 2001
From: Farhaan Bukhsh <farhaan.bukhsh@gmail.com>
Date: Apr 12 2018 12:10:17 +0000
Subject: [PATCH 2/2] Add test for repo user access


This commit add test for adding user to a private repo and check if the user can access
the private repo.

Signed-off-by: Farhaan Bukhsh <farhaan.bukhsh@gmail.com>

---

diff --git a/tests/test_pagure_flask_api_ui_private_repo.py b/tests/test_pagure_flask_api_ui_private_repo.py
index 2d4f200..3a8fa70 100644
--- a/tests/test_pagure_flask_api_ui_private_repo.py
+++ b/tests/test_pagure_flask_api_ui_private_repo.py
@@ -876,6 +876,105 @@ class PagurePrivateRepotest(tests.Modeltests):
             output = self.app.get('/test4/issue/1')
             self.assertEqual(output.status_code, 200)
 
+    @patch('pagure.decorators.admin_session_timedout')
+    def test_private_repo_ui_for_different_repo_user(self, ast):
+        """ Test the private repo for different ACLS"""
+        ast.return_value = False
+
+        # Add private repo
+        item = pagure.lib.model.Project(
+            user_id=1,  # pingou
+            name='test4',
+            description='test project description',
+            hook_token='aaabbbeeeceee',
+            private=True,
+        )
+        self.session.add(item)
+        self.session.commit()
+
+        repo = pagure.lib._get_project(self.session, "test4")
+        # Add a git repo
+        repo_path = os.path.join(
+            pagure.config.config.get('GIT_FOLDER'), 'test4.git')
+        pygit2.init_repository(repo_path)
+
+        user = tests.FakeUser(username='pingou')
+        with tests.user_set(self.app.application, user):
+
+            # Check for private repo
+            output = self.app.get('/test4')
+            self.assertEqual(output.status_code, 200)
+
+        # Check if the user who doesn't have access to private repo can access it
+        user = tests.FakeUser(username="foo")
+        with tests.user_set(self.app.application, user):
+
+            output = self.app.get('/test4')
+            self.assertEqual(output.status_code, 404)
+
+        # Add commit access to a user
+        pagure.lib.add_user_to_project(
+            self.session,
+            project=repo,
+            new_user="foo",
+            user="pingou",
+            access='commit'
+        )
+        self.session.commit()
+
+
+        repo = pagure.lib._get_project(self.session, "test4")
+        self.assertEqual(len(repo.users), 1)
+
+        # Check if the user can access private repo
+        user = tests.FakeUser(username="foo")
+        with tests.user_set(self.app.application, user):
+
+            output = self.app.get('/test4')
+            self.assertEqual(output.status_code, 200)
+
+        # Making a new user bar
+        item = pagure.lib.model.User(
+            user='bar',
+            fullname='bar baz',
+            password='foo',
+            default_email='bar@bar.com',
+        )
+        self.session.add(item)
+        item = pagure.lib.model.UserEmail(
+            user_id=3,
+            email='bar@bar.com')
+        self.session.add(item)
+
+        self.session.commit()
+
+        # Check that bar shouldn't be able to access the project
+        user = tests.FakeUser(username="bar")
+        with tests.user_set(self.app.application, user):
+
+            output = self.app.get('/test4')
+            self.assertEqual(output.status_code, 404)
+
+        # Adding a ticket level access to bar
+        pagure.lib.add_user_to_project(
+            self.session,
+            project=repo,
+            new_user="bar",
+            user="pingou",
+            access='ticket'
+        )
+        self.session.commit()
+
+        repo = pagure.lib._get_project(self.session, "test4")
+        self.assertEqual(len(repo.users), 2)
+
+        # Check if the ticket level access user can access the project
+        user = tests.FakeUser(username="bar")
+        with tests.user_set(self.app.application, user):
+
+            output = self.app.get('/test4')
+            self.assertEqual(output.status_code, 200)
+
     # API checks
     def test_api_private_repo_projects(self):
         """ Test api points for private repo for projects"""