From 3728f21f95ba8b3fc9f64123c5b9bec50642fd99 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <patrick@puiterwijk.org>
Date: Oct 08 2018 19:55:03 +0000
Subject: Implement dynamic git auth module that performs standard behaviour


Signed-off-by: Patrick Uiterwijk <patrick@puiterwijk.org>

---

diff --git a/pagure/lib/git_auth.py b/pagure/lib/git_auth.py
index b2532e9..e75ca04 100644
--- a/pagure/lib/git_auth.py
+++ b/pagure/lib/git_auth.py
@@ -25,6 +25,7 @@ from six.moves import dbm_gnu
 import pagure.exceptions
 from pagure.config import config as pagure_config
 from pagure.lib import model
+from pagure.utils import is_repo_committer, lookup_deploykey
 
 
 # logging.config.dictConfig(pagure_config.get('LOGGING') or {'version': 1})
@@ -68,6 +69,7 @@ def get_git_auth_helper(backend=None):
         _log.debug("Was unable to find any helpers, registering built-in")
         cls = {
             "test_auth": GitAuthTestHelper,
+            "pagure": PagureGitAuthBackend,
             "gitolite2": Gitolite2Auth,
             "gitolite3": Gitolite3Auth,
         }[backend]
@@ -912,3 +914,50 @@ class GitAuthTestHelper(GitAuthHelper):
             return True
         elif status[refname] == "pronly":
             return pull_request is not None
+
+
+class PagureGitAuthBackend(GitAuthHelper):
+    """ Git Auth backend implementing default Pagure behaviour. """
+
+    is_dynamic = True
+
+    @classmethod
+    def generate_acls(cls, project, group=None):
+        """ Unused function for dynamic plugins. """
+
+    @classmethod
+    def remove_acls(cls, session, project):
+        """ Unused function for dynamic plugins. """
+
+    @classmethod
+    # This method can't be marked as abstract, since it's new and that would
+    # break backwards compatibility
+    def check_acl(
+        cls,
+        session,
+        project,
+        username,
+        refname,
+        repotype,
+        pull_request,
+        **info
+    ):
+        """ Actual ACL implementation.
+
+        See GitAuthHelper.check_acl for information on arguments. """
+        global_pr_only = pagure_config.get("PR_ONLY", False)
+        pr_only = project.settings.get("pull_request_access_only", False)
+
+        if (
+            repotype == "main"
+            and (pr_only or (global_pr_only and not project.is_fork))
+            and pull_request is None
+        ):
+            print("This project requires pull requests")
+            return False
+
+        deploykey = lookup_deploykey(project, username)
+        if deploykey and deploykey.pushaccess:
+            return True
+
+        return is_repo_committer(project, username, session)
diff --git a/setup.py b/setup.py
index d5d7ae5..482a442 100644
--- a/setup.py
+++ b/setup.py
@@ -58,6 +58,7 @@ setup(
 
     [pagure.git_auth.helpers]
     test_auth = pagure.lib.git_auth:GitAuthTestHelper
+    pagure = pagure.lib.git_auth:PagureGitAuthBackend
     gitolite2 = pagure.lib.git_auth:Gitolite2Auth
     gitolite3 = pagure.lib.git_auth:Gitolite3Auth
     """,