[git_auth] Move Git auth stuff to new file
Needs to be imported by gclient Bug: b/351071334 Change-Id: Ibcb7c5541ffab6f9302efad863d0c59b8041122d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/5739296 Reviewed-by: Yiwei Zhang <yiwzhang@google.com> Commit-Queue: Allen Li <ayatane@chromium.org>changes/96/5739296/4
Allen Li
9 months ago
committed by
LUCI CQ
parent
dbaad43b23
commit
a61e517b45
@ -0,0 +1,209 @@
|
||||
# Copyright (c) 2024 The Chromium Authors. All rights reserved.
|
||||
# Use of this source code is governed by a BSD-style license that can be
|
||||
# found in the LICENSE file.
|
||||
"""Defines utilities for setting up Git authentication."""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import enum
|
||||
import functools
|
||||
from typing import Callable
|
||||
import urllib.parse
|
||||
|
||||
import scm
|
||||
|
||||
|
||||
class GitAuthMode(enum.Enum):
|
||||
"""Modes to pass to GitAuthConfigChanger"""
|
||||
NO_AUTH = 1
|
||||
NEW_AUTH = 2
|
||||
NEW_AUTH_SSO = 3
|
||||
|
||||
|
||||
class GitAuthConfigChanger(object):
|
||||
"""Changes Git auth config as needed for Gerrit."""
|
||||
|
||||
# Can be used to determine whether this version of the config has
|
||||
# been applied to a Git repo.
|
||||
#
|
||||
# Increment this when making changes to the config, so that reliant
|
||||
# code can determine whether the config needs to be re-applied.
|
||||
VERSION: int = 2
|
||||
|
||||
def __init__(
|
||||
self,
|
||||
*,
|
||||
mode: GitAuthMode,
|
||||
remote_url: str,
|
||||
set_config_func: Callable[..., None] = scm.GIT.SetConfig,
|
||||
):
|
||||
"""Create a new GitAuthConfigChanger.
|
||||
|
||||
Args:
|
||||
mode: How to configure auth
|
||||
remote_url: Git repository's remote URL, e.g.,
|
||||
https://chromium.googlesource.com/chromium/tools/depot_tools.git
|
||||
set_config_func: Function used to set configuration. Used
|
||||
for testing.
|
||||
"""
|
||||
self.mode: GitAuthMode = mode
|
||||
|
||||
self._remote_url: str = remote_url
|
||||
self._set_config_func: Callable[..., str] = set_config_func
|
||||
|
||||
@functools.cached_property
|
||||
def _shortname(self) -> str:
|
||||
parts: urllib.parse.SplitResult = urllib.parse.urlsplit(
|
||||
self._remote_url)
|
||||
name: str = parts.netloc.split('.')[0]
|
||||
if name.endswith('-review'):
|
||||
name = name[:-len('-review')]
|
||||
return name
|
||||
|
||||
@functools.cached_property
|
||||
def _base_url(self) -> str:
|
||||
# Base URL looks like https://chromium.googlesource.com/
|
||||
parts: urllib.parse.SplitResult = urllib.parse.urlsplit(
|
||||
self._remote_url)
|
||||
return parts._replace(path='/', query='', fragment='').geturl()
|
||||
|
||||
@classmethod
|
||||
def new_from_env(cls, cwd: str) -> 'GitAuthConfigChanger':
|
||||
"""Create a GitAuthConfigChanger by inferring from env.
|
||||
|
||||
The Gerrit host is inferred from the current repo/branch.
|
||||
The user, which is used to determine the mode, is inferred using
|
||||
git-config(1) in the given `cwd`.
|
||||
"""
|
||||
cl = Changelist()
|
||||
# This is determined either from the branch or repo config.
|
||||
#
|
||||
# Example: chromium-review.googlesource.com
|
||||
gerrit_host: str = cl.GetGerritHost()
|
||||
# This depends on what the user set for their remote.
|
||||
# There are a couple potential variations for the same host+repo.
|
||||
#
|
||||
# Example:
|
||||
# https://chromium.googlesource.com/chromium/tools/depot_tools.git
|
||||
remote_url: str = cl.GetRemoteUrl()
|
||||
|
||||
return cls(
|
||||
mode=cls._infer_mode(cwd, gerrit_host),
|
||||
remote_url=remote_url,
|
||||
)
|
||||
|
||||
@staticmethod
|
||||
def _infer_mode(cwd: str, gerrit_host: str) -> GitAuthMode:
|
||||
"""Infer default mode to use."""
|
||||
if not newauth.Enabled():
|
||||
return GitAuthMode.NO_AUTH
|
||||
email: str = scm.GIT.GetConfig(cwd, 'user.email', default='')
|
||||
if gerrit_util.ShouldUseSSO(gerrit_host, email):
|
||||
return GitAuthMode.NEW_AUTH_SSO
|
||||
return GitAuthMode.NEW_AUTH
|
||||
|
||||
def apply(self, cwd: str) -> None:
|
||||
"""Apply config changes to the Git repo directory."""
|
||||
self._apply_cred_helper(cwd)
|
||||
self._apply_sso(cwd)
|
||||
self._apply_gitcookies(cwd)
|
||||
|
||||
def apply_global(self, cwd: str) -> None:
|
||||
"""Apply config changes to the global (user) Git config.
|
||||
|
||||
This will make the instance's mode (e.g., SSO or not) the global
|
||||
default for the Gerrit host, if not overridden by a specific Git repo.
|
||||
"""
|
||||
self._apply_global_cred_helper(cwd)
|
||||
self._apply_global_sso(cwd)
|
||||
|
||||
def _apply_cred_helper(self, cwd: str) -> None:
|
||||
"""Apply config changes relating to credential helper."""
|
||||
cred_key: str = f'credential.{self._base_url}.helper'
|
||||
if self.mode == GitAuthMode.NEW_AUTH:
|
||||
self._set_config(cwd, cred_key, '', modify_all=True)
|
||||
self._set_config(cwd, cred_key, 'luci', append=True)
|
||||
elif self.mode == GitAuthMode.NEW_AUTH_SSO:
|
||||
self._set_config(cwd, cred_key, None, modify_all=True)
|
||||
elif self.mode == GitAuthMode.NO_AUTH:
|
||||
self._set_config(cwd, cred_key, None, modify_all=True)
|
||||
else:
|
||||
raise TypeError(f'Invalid mode {self.mode!r}')
|
||||
|
||||
def _apply_sso(self, cwd: str) -> None:
|
||||
"""Apply config changes relating to SSO."""
|
||||
sso_key: str = f'url.sso://{self._shortname}/.insteadOf'
|
||||
if self.mode == GitAuthMode.NEW_AUTH:
|
||||
self._set_config(cwd, 'protocol.sso.allow', None)
|
||||
self._set_config(cwd, sso_key, None, modify_all=True)
|
||||
elif self.mode == GitAuthMode.NEW_AUTH_SSO:
|
||||
self._set_config(cwd, 'protocol.sso.allow', 'always')
|
||||
self._set_config(cwd, sso_key, self._base_url, modify_all=True)
|
||||
elif self.mode == GitAuthMode.NO_AUTH:
|
||||
self._set_config(cwd, 'protocol.sso.allow', None)
|
||||
self._set_config(cwd, sso_key, None, modify_all=True)
|
||||
else:
|
||||
raise TypeError(f'Invalid mode {self.mode!r}')
|
||||
|
||||
def _apply_gitcookies(self, cwd: str) -> None:
|
||||
"""Apply config changes relating to gitcookies."""
|
||||
# TODO(ayatane): Clear invalid setting. Remove line after a few weeks
|
||||
self._set_config(cwd, 'http.gitcookies', None, modify_all=True)
|
||||
if self.mode == GitAuthMode.NEW_AUTH:
|
||||
# Override potential global setting
|
||||
self._set_config(cwd, 'http.cookieFile', '', modify_all=True)
|
||||
elif self.mode == GitAuthMode.NEW_AUTH_SSO:
|
||||
# Override potential global setting
|
||||
self._set_config(cwd, 'http.cookieFile', '', modify_all=True)
|
||||
elif self.mode == GitAuthMode.NO_AUTH:
|
||||
self._set_config(cwd, 'http.cookieFile', None, modify_all=True)
|
||||
else:
|
||||
raise TypeError(f'Invalid mode {self.mode!r}')
|
||||
|
||||
def _apply_global_cred_helper(self, cwd: str) -> None:
|
||||
"""Apply config changes relating to credential helper."""
|
||||
cred_key: str = f'credential.{self._base_url}.helper'
|
||||
if self.mode == GitAuthMode.NEW_AUTH:
|
||||
self._set_config(cwd, cred_key, '', scope='global', modify_all=True)
|
||||
self._set_config(cwd, cred_key, 'luci', scope='global', append=True)
|
||||
elif self.mode == GitAuthMode.NEW_AUTH_SSO:
|
||||
# Avoid editing the user's config in case they manually
|
||||
# configured something.
|
||||
pass
|
||||
elif self.mode == GitAuthMode.NO_AUTH:
|
||||
# Avoid editing the user's config in case they manually
|
||||
# configured something.
|
||||
pass
|
||||
else:
|
||||
raise TypeError(f'Invalid mode {self.mode!r}')
|
||||
|
||||
def _apply_global_sso(self, cwd: str) -> None:
|
||||
"""Apply config changes relating to SSO."""
|
||||
sso_key: str = f'url.sso://{self._shortname}/.insteadOf'
|
||||
if self.mode == GitAuthMode.NEW_AUTH:
|
||||
# Do not unset protocol.sso.allow because it may be used by
|
||||
# other hosts.
|
||||
self._set_config(cwd,
|
||||
sso_key,
|
||||
None,
|
||||
scope='global',
|
||||
modify_all=True)
|
||||
elif self.mode == GitAuthMode.NEW_AUTH_SSO:
|
||||
self._set_config(cwd,
|
||||
'protocol.sso.allow',
|
||||
'always',
|
||||
scope='global')
|
||||
self._set_config(cwd,
|
||||
sso_key,
|
||||
self._base_url,
|
||||
scope='global',
|
||||
modify_all=True)
|
||||
elif self.mode == GitAuthMode.NO_AUTH:
|
||||
# Avoid editing the user's config in case they manually
|
||||
# configured something.
|
||||
pass
|
||||
else:
|
||||
raise TypeError(f'Invalid mode {self.mode!r}')
|
||||
|
||||
def _set_config(self, *args, **kwargs) -> None:
|
||||
self._set_config_func(*args, **kwargs)
|
||||
Loading…
Reference in New Issue