woodpecker/server/forge/userSyncer.go

118 lines
3.1 KiB
Go
Raw Normal View History

// Copyright 2022 Woodpecker Authors
2018-02-19 22:24:10 +00:00
// Copyright 2018 Drone.IO Inc.
2018-03-21 13:02:17 +00:00
//
2018-02-19 22:24:10 +00:00
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
2018-03-21 13:02:17 +00:00
//
2018-02-19 22:24:10 +00:00
// http://www.apache.org/licenses/LICENSE-2.0
2018-03-21 13:02:17 +00:00
//
2018-02-19 22:24:10 +00:00
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
2022-11-06 11:44:04 +00:00
package forge
2017-07-14 19:58:38 +00:00
import (
"context"
"fmt"
2017-07-14 19:58:38 +00:00
"time"
"github.com/woodpecker-ci/woodpecker/server/model"
"github.com/woodpecker-ci/woodpecker/server/store"
2017-07-14 19:58:38 +00:00
)
// UserSyncer syncs the user repository and permissions.
type UserSyncer interface {
Sync(ctx context.Context, user *model.User) error
2017-07-14 19:58:38 +00:00
}
type Syncer struct {
2022-11-06 11:44:04 +00:00
Forge Forge
Store store.Store
Perms model.PermStore
Match FilterFunc
2020-05-18 15:58:04 +00:00
}
// FilterFunc can be used to filter which repositories are
// synchronized with the local datastore.
type FilterFunc func(*model.Repo) bool
func NamespaceFilter(namespaces map[string]bool) FilterFunc {
if len(namespaces) == 0 {
2020-05-18 15:58:04 +00:00
return noopFilter
}
return func(repo *model.Repo) bool {
return namespaces[repo.Owner]
2020-05-18 15:58:04 +00:00
}
}
// noopFilter is a filter function that always returns true.
func noopFilter(*model.Repo) bool {
return true
}
// SetFilter sets the filter function.
func (s *Syncer) SetFilter(fn FilterFunc) {
s.Match = fn
2017-07-14 19:58:38 +00:00
}
func (s *Syncer) Sync(ctx context.Context, user *model.User, flatPermissions bool) error {
2017-07-27 17:06:24 +00:00
unix := time.Now().Unix() - (3601) // force immediate expiration. note 1 hour expiration is hard coded at the moment
repos, err := s.Forge.Repos(ctx, user)
2017-07-14 19:58:38 +00:00
if err != nil {
return err
}
forgeRepos := make([]*model.Repo, 0, len(repos))
2017-07-14 19:58:38 +00:00
for _, repo := range repos {
if s.Match(repo) {
repo.Perm = &model.Perm{
2020-05-18 15:58:04 +00:00
UserID: user.ID,
RepoID: repo.ID,
Repo: repo,
2020-05-18 15:58:04 +00:00
Synced: unix,
}
// TODO(485) temporary workaround to not hit api rate limits
if flatPermissions {
if repo.Perm == nil {
repo.Perm.Pull = true
repo.Perm.Push = true
repo.Perm.Admin = true
}
} else {
forgePerm, err := s.Forge.Perm(ctx, user, repo)
if err != nil {
return fmt.Errorf("could not fetch permission of repo '%s': %v", repo.FullName, err)
}
repo.Perm.Pull = forgePerm.Pull
repo.Perm.Push = forgePerm.Push
repo.Perm.Admin = forgePerm.Admin
2020-05-18 15:58:04 +00:00
}
forgeRepos = append(forgeRepos, repo)
2017-07-14 19:58:38 +00:00
}
}
err = s.Store.RepoBatch(forgeRepos)
2017-07-14 19:58:38 +00:00
if err != nil {
return err
}
2017-07-16 17:37:16 +00:00
// this is here as a precaution. I want to make sure that if an api
// call to the version control system fails and (for some reason) returns
// an empty list, we don't wipe out the user repository permissions.
//
// the side-effect of this code is that a user with 1 repository whose
// access is removed will still display in the feed, but they will not
// be able to access the actual repository data.
if len(repos) == 0 {
return nil
}
return s.Perms.PermFlush(user, unix)
2017-07-14 19:58:38 +00:00
}