domi/forgejo-domi
1
0
Fork 0
forked from forgejo/forgejo
Code Pull requests Activity

Add require signed commit for protected branch (#9708)

Browse source 
* Add require signed commit for protected branch

* Fix fmt

* Make editor show if they will be signed

* bugfix

* Add basic merge check and better information for CRUD

* linting comment

* Add descriptors to merge signing

* Slight refactor

* Slight improvement to appearances

* Handle Merge API

* manage CRUD API

* Move error to error.go

* Remove fix to delete.go

* prep for merge

* need to tolerate \r\n in message

* check protected branch before trying to load it

* Apply suggestions from code review

Co-Authored-By: guillep2k <18600385+guillep2k@users.noreply.github.com>

* fix commit-reader

Co-authored-by: guillep2k <18600385+guillep2k@users.noreply.github.com>
This commit is contained in:
zeripath 2020-01-15 08:32:57 +00:00 • committed by Antoine GIRARD
parent 6b1fa12359
commit 66ee9b87f9
29 changed files with 618 additions and 122 deletions
Download patch file Download diff file Expand all files Collapse all files

51
modules/context/repo.go
View file

@ -74,14 +74,57 @@ func RepoMustNotBeArchived() macaron.Handler {
}
}
// CanCommitToBranchResults represents the results of CanCommitToBranch
type CanCommitToBranchResults struct {
CanCommitToBranch bool
EditorEnabled bool
UserCanPush bool
RequireSigned bool
WillSign bool
SigningKey string
WontSignReason string
}
// CanCommitToBranch returns true if repository is editable and user has proper access level
// and branch is not protected for push
func (r *Repository) CanCommitToBranch(doer *models.User) (bool, error) {
protectedBranch, err := r.Repository.IsProtectedBranchForPush(r.BranchName, doer)
func (r *Repository) CanCommitToBranch(doer *models.User) (CanCommitToBranchResults, error) {
protectedBranch, err := models.GetProtectedBranchBy(r.Repository.ID, r.BranchName)
if err != nil {
return false, err
return CanCommitToBranchResults{}, err
}
return r.CanEnableEditor() && !protectedBranch, nil
userCanPush := true
requireSigned := false
if protectedBranch != nil {
userCanPush = protectedBranch.CanUserPush(doer.ID)
requireSigned = protectedBranch.RequireSignedCommits
}
sign, keyID, err := r.Repository.SignCRUDAction(doer, r.Repository.RepoPath(), git.BranchPrefix+r.BranchName)
canCommit := r.CanEnableEditor() && userCanPush
if requireSigned {
canCommit = canCommit && sign
}
wontSignReason := ""
if err != nil {
if models.IsErrWontSign(err) {
wontSignReason = string(err.(*models.ErrWontSign).Reason)
err = nil
} else {
wontSignReason = "error"
}
}
return CanCommitToBranchResults{
CanCommitToBranch: canCommit,
EditorEnabled: r.CanEnableEditor(),
UserCanPush: userCanPush,
RequireSigned: requireSigned,
WillSign: sign,
SigningKey: keyID,
WontSignReason: wontSignReason,
}, err
}
// CanUseTimetracker returns whether or not a user can use the timetracker.