Skip to content
This repository was archived by the owner on Sep 30, 2024. It is now read-only.

Add config to allow for ignoring Perforce protects rules that specify a Host#56450

Merged
peterguy merged 7 commits into
mainfrom
peterguy/perforce-protects-ignore-host
Sep 13, 2023
Merged

Add config to allow for ignoring Perforce protects rules that specify a Host#56450
peterguy merged 7 commits into
mainfrom
peterguy/perforce-protects-ignore-host

Conversation

@peterguy

@peterguy peterguy commented Sep 8, 2023

Copy link
Copy Markdown
Contributor

User access to Perforce depots is sometimes denied unintentionally when using "authorization"/"subRepoPermissions": true in the code host config and the protects file contains exclusionary entries with the Host field filled out. Ignoring those rules (that use anything other than the wildcard (*) in the Host field) is now toggle-able by adding "authorization"/"ignoreRulesWithHost" to the code host config and setting the value to true.

This will cause the protects parser to simply ignore all rules that specify a Host.

closes #53374

Test plan

Added unit tests to verify correct behavior of the protects file parser.

@peterguy peterguy requested a review from eseliger September 8, 2023 01:50
@peterguy peterguy self-assigned this Sep 8, 2023
@cla-bot cla-bot Bot added the cla-signed label Sep 8, 2023
@sourcegraph-bot

sourcegraph-bot commented Sep 8, 2023

Copy link
Copy Markdown
Contributor

Codenotify: Notifying subscribers in CODENOTIFY files for diff 12c3ce6...a001c09.

Notify File(s)
@sourcegraph/delivery doc/admin/repo/perforce.md
@unknwon internal/authz/providers/perforce/authz.go
internal/authz/providers/perforce/authz.go
internal/authz/providers/perforce/cmd/scanprotects/main.go
internal/authz/providers/perforce/cmd/scanprotects/main.go
internal/authz/providers/perforce/cmd/scanprotects/main_test.go
internal/authz/providers/perforce/cmd/scanprotects/main_test.go
internal/authz/providers/perforce/perforce.go
internal/authz/providers/perforce/perforce.go
internal/authz/providers/perforce/perforce_test.go
internal/authz/providers/perforce/perforce_test.go
internal/authz/providers/perforce/protects.go
internal/authz/providers/perforce/protects.go
internal/authz/providers/perforce/protects_test.go
internal/authz/providers/perforce/protects_test.go

@peterguy peterguy force-pushed the peterguy/perforce-protects-ignore-host branch 2 times, most recently from 88c1d62 to e2b47be Compare September 8, 2023 23:13

@unknwon unknwon left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: a better variable/argument name would be IMO ignoreRulesWithHost.

Comment on lines +227 to +230
// Skip blank lines
if line == "" {
continue
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, shouldn't it better to have this checked right after line 215?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I moved it around a couple of times. Left it after the comment handling because removing the comments could result in blank lines. It could go above the // Trim trailing comments block, since after trimming whitespace and discarding lines that start with a comment (##), trimming the comment off the end of the line won't result in a blank line anymore.

I'll add it to the check for lines that start with a comment:


		// Skip comments and blank lines
		if strings.HasPrefix(line, "##") || line == "" {
			continue
		}

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like ignoreRulesWithHost! It matches the config field name; not sure why I settled on ignoreHostRules for the variables and parameters.

@eseliger eseliger left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we add this property to some docs page as well?

@peterguy peterguy force-pushed the peterguy/perforce-protects-ignore-host branch from e2b47be to 0bad2c4 Compare September 11, 2023 18:30
Needs to be gated by code host or site config.
The setting is "authorization"/"ignoreRulesWithHost" - a boolean value
that defaults to `false`, which preserves current behavior.
When set to `true`, it turns off all processing of protects rules
that have anything other than the wildcard value in the Host field.
Added a test for that behavior in the protects parsing.
@peterguy peterguy force-pushed the peterguy/perforce-protects-ignore-host branch from 0bad2c4 to af11dfb Compare September 12, 2023 19:08
`ignoreHostRules` to `ignoreRulesWithHost`
which matches the name of the config field and is a better variable name.
@peterguy

Copy link
Copy Markdown
Contributor Author

Should we add this property to some docs page as well?
You are so gracious @eseliger. Docs added. 😄

@peterguy peterguy merged commit 7a80914 into main Sep 13, 2023
@peterguy peterguy deleted the peterguy/perforce-protects-ignore-host branch September 13, 2023 02:09
@sourcegraph-release-bot

sourcegraph-release-bot commented Sep 13, 2023

Copy link
Copy Markdown
Collaborator

The backport to 5.1 failed at https://github.com/sourcegraph/sourcegraph/actions/runs/6167131444:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-5.1 5.1
# Navigate to the new working tree
cd .worktrees/backport-5.1
# Create a new branch
git switch --create backport-56450-to-5.1
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 7a809147779c502d705cd56a7b84d489e21b4a0c
# Push it to GitHub
git push --set-upstream origin backport-56450-to-5.1
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-5.1

If you encouter conflict, first resolve the conflict and stage all files, then run the commands below:

git cherry-pick --continue
# Push it to GitHub
git push --set-upstream origin backport-56450-to-5.1
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-5.1
  • Follow above instructions to backport the commit.
  • Create a pull request where the base branch is 5.1 and the compare/head branch is backport-56450-to-5.1., click here to create the pull request.
  • Make sure to tag @sourcegraph/release-guild in the pull request description.
  • Once the backport pull request is created, kindly remove the release-blocker from this pull request.

@sourcegraph-release-bot sourcegraph-release-bot added backports failed-backport-to-5.1 release-blocker Prevents us from releasing: https://about.sourcegraph.com/handbook/engineering/releases labels Sep 13, 2023
peterguy added a commit that referenced this pull request Sep 13, 2023
… a Host (#56450)

* Change the protects parsing to ignore hosts
Needs to be gated by code host or site config.

* Add a host config setting to control behavior
The setting is "authorization"/"ignoreRulesWithHost" - a boolean value
that defaults to `false`, which preserves current behavior.
When set to `true`, it turns off all processing of protects rules
that have anything other than the wildcard value in the Host field.
Added a test for that behavior in the protects parsing.

* Add CHANGELOG entry

* Adjust tests to accomodate skipping empty lines

* refactor: combine comment and blank line detection

* refactor: change variable/parameter name
`ignoreHostRules` to `ignoreRulesWithHost`
which matches the name of the config field and is a better variable name.

* add docs for "ignoreRulesWithHost"

(cherry picked from commit 7a80914)
@peterguy peterguy mentioned this pull request Sep 13, 2023
@peterguy peterguy removed the release-blocker Prevents us from releasing: https://about.sourcegraph.com/handbook/engineering/releases label Sep 13, 2023
@eseliger

eseliger commented Oct 3, 2023

Copy link
Copy Markdown
Member

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

perforce: Support IP based rules in p4 protects

5 participants