Skip to content

Commit cd01d64

Browse files
ayufanayufan
committed
Developer allow
1 parent 83d30b8 commit cd01d64

6 files changed

Lines changed: 219 additions & 134 deletions

File tree

‎plugins/acl/commands‎

Lines changed: 52 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,13 +42,52 @@ case "$1" in
4242
fi
4343

4444
for APP in $(ls -d $DOKKU_ROOT/*/ 2>/dev/null); do
45-
if is_fingerprint_allowed "$1"
45+
if is_developer_fingerprint_allowed "$1"
46+
then
47+
echo "Developer access to $APP."
48+
fi
49+
if is_fingerprint_allowed "$1"
4650
then
4751
echo "Push-access to $APP."
4852
fi
4953
done
5054
;;
5155

56+
developer:allow)
57+
verify_app_name "$2"
58+
verify_max_args 2 "$@"
59+
60+
add_ssh_key "deploy" "deploy"
61+
if ! is_developer_fingerprint_allowed "$FINGERPRINT"
62+
then
63+
echo "$FINGERPRINT" >> "$APP_DIR/$DEVELOPER_ALLOWED"
64+
info "$FINGERPRINT added to $APP as an developer key"
65+
else
66+
info "$FINGERPRINT is already added to $APP as an developer key"
67+
fi
68+
;;
69+
70+
developer:list)
71+
verify_app_name "$2"
72+
verify_max_args 2 "$@"
73+
74+
cat "$APP_DIR/$DEVELOPER_ALLOWED" 2>/dev/null || true
75+
;;
76+
77+
developer:revoke)
78+
verify_app_name "$2"
79+
verify_fingerprint "$3"
80+
verify_max_args 3 "$@"
81+
82+
if is_fingerprint_allowed "$FINGERPRINT"
83+
then
84+
sed --in-place "/^$FINGERPRINT\$/d" "$APP_DIR/$DEVELOPER_ALLOWED"
85+
info "$FINGERPRINT removed from an $APP as an developer key"
86+
else
87+
info "$FINGERPRINT is not added to $APP as an developer key"
88+
fi
89+
;;
90+
5291
deploy:allow)
5392
verify_app_name "$2"
5493
verify_max_args 2 "$@"
@@ -70,12 +109,19 @@ case "$1" in
70109
cat "$APP_DIR/$DEPLOY_ALLOWED" 2>/dev/null || true
71110
;;
72111

73-
deploy:revoke)
112+
deploy:revoke|developer:revoke)
74113
verify_app_name "$2"
75114
verify_fingerprint "$3"
76115
verify_max_args 3 "$@"
77116

78-
if is_fingerprint_allowed "$FINGERPRINT"
117+
if is_developer_fingerprint_allowed "$FINGERPRINT"
118+
then
119+
sed --in-place "/^$FINGERPRINT\$/d" "$APP_DIR/$DEVELOPER_ALLOWED"
120+
info "$FINGERPRINT removed from an $APP as an developer key"
121+
else
122+
info "$FINGERPRINT is not added to $APP as an developer key"
123+
fi
124+
if is_fingerprint_allowed "$FINGERPRINT"
79125
then
80126
sed --in-place "/^$FINGERPRINT\$/d" "$APP_DIR/$DEPLOY_ALLOWED"
81127
info "$FINGERPRINT removed from an $APP as an deployment key"
@@ -90,6 +136,9 @@ case "$1" in
90136
access:list List all SSH keys: admins and deployments
91137
access:info <fingeprint> Show information about the key
92138
access:remove <fingerprint> Revoke all permissions for specific SSH key
139+
developer:allow <app> Allow access commands specific for an app
140+
developer:list <app> List all keys with developer access to an application
141+
developer:revoke <app> <fingerprint> Revoke developer access to an application
93142
deploy:allow <app> Allow push-access (aka. deployment) to an app
94143
deploy:list <app> List all push-acccesses for an application
95144
deploy:revoke <app> <fingerprint> Revoke push-access for an application

‎plugins/acl/vars‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
source "$(dirname $0)/../dokku_common"
44

55
AUTHORIZED_KEYS="$DOKKU_ROOT/.ssh/authorized_keys"
6+
DEVELOPER_ALLOWED="DEVELOPER_ALLOWED"
67
DEPLOY_ALLOWED="DEPLOY_ALLOWED"
78

89
add_ssh_key() {
@@ -36,6 +37,15 @@ verify_fingerprint() {
3637
[[ "$FINGERPRINT" =~ ^[0-9a-fA-F:]+$ ]] || fail "$FINGERPRINT: this is not fingerprint!"
3738
}
3839

40+
is_developer_fingerprint_allowed() {
41+
if [[ -f "$DOKKU_ROOT/$APP/$DEVELOPER_ALLOWED" ]] && grep -q "^$1\$" "$DOKKU_ROOT/$APP/$DEVELOPER_ALLOWED"
42+
then
43+
return 0
44+
else
45+
return 1
46+
fi
47+
}
48+
3949
is_fingerprint_allowed() {
4050
if [[ -f "$DOKKU_ROOT/$APP/$DEPLOY_ALLOWED" ]] && grep -q "^$1\$" "$DOKKU_ROOT/$APP/$DEPLOY_ALLOWED"
4151
then

‎plugins/acl/verify-command‎

Lines changed: 20 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -13,23 +13,29 @@ fi
1313

1414
[[ -z "$FINGERPRINT" ]] && fail "Access denied. No fingerprint supplied."
1515

16-
case "$1" in
17-
git-hook)
18-
APP="$2"
19-
;;
16+
read ACL_LEVEL ACL_APPNAME < <(: | pluginhook get-acl "$@")
17+
18+
if [[ -z "$ACL_LEVEL" ]] || [[ -z "$ACL_APPNAME" ]]; then
19+
fail "Access denied. You don't have permission to access this app."
20+
fi
2021

21-
git-*)
22-
APP="$(echo "$2" | perl -pe 's/(?<!\\)'\''//g' | sed 's/\\'\''/'\''/g')"
22+
check_app_name "$ACL_APPNAME"
23+
24+
case "$ACL_APPNAME" in
25+
developer)
26+
if is_developer_fingerprint_allowed "$FINGERPRINT"; then
27+
exit 0
28+
fi
2329
;;
2430

25-
*)
26-
fail "Access denied. Please login as an admin."
31+
deploy)
32+
if is_fingerprint_allowed "$FINGERPRINT"; then
33+
exit 0
34+
fi
35+
if is_developer_fingerprint_allowed "$FINGERPRINT"; then
36+
exit 0
37+
fi
2738
;;
2839
esac
2940

30-
check_app_name "$APP"
31-
32-
if ! is_fingerprint_allowed "$FINGERPRINT"
33-
then
34-
fail "Access denied. You don't have permission to access this app."
35-
fi
41+
fail "Access denied. You don't have permission to access this app."

‎plugins/apps/commands‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ case "$1" in
6767
apps:restart|restart)
6868
verify_app_name "$2"
6969
verify_max_args 2 "$@"
70-
docker restart "$APP_NAME"
70+
deploy_app "$APP"
7171
;;
7272

7373
apps:top|top)

‎plugins/git/commands‎

Lines changed: 6 additions & 116 deletions
Original file line numberDiff line numberDiff line change
@@ -2,129 +2,19 @@
22

33
source "$(dirname $0)/../dokku_common"
44

5-
create_pre_receive_hook() {
6-
PRERECEIVE_HOOK="$2/hooks/pre-receive"
7-
cat > "$PRERECEIVE_HOOK" <<EOF
8-
#!/usr/bin/env bash
9-
set -e; set -o pipefail;
10-
cat | DOKKU_ROOT="$DOKKU_ROOT" dokku git-hook "$1"
11-
EOF
12-
chmod +x "$PRERECEIVE_HOOK"
13-
}
14-
15-
create_bare_repository() {
16-
git init --bare "$2" > /dev/null
17-
create_pre_receive_hook "$@"
18-
}
5+
cat
196

207
case "$1" in
218
git-hook)
22-
verify_app_name "$2"
23-
24-
# if we got here we have full access
25-
export NAME="dokku"
26-
export FINGERPRINT=""
27-
28-
while read oldrev newrev refname
29-
do
30-
# Only run this script for the master branch. You can remove this
31-
# if block if you wish to run it for others as well.
32-
if [[ $refname = "refs/heads/master" ]] ; then
33-
dokku rebuild "$APP" "$newrev"
34-
else
35-
echo $'\e[1G\e[K'"-----> WARNING: deploy did not complete, you must push to master."
36-
echo $'\e[1G\e[K'"-----> for example, try 'git push <dokku> ${refname/refs\/heads\/}:master'"
37-
fi
38-
done
39-
;;
40-
41-
git-upload-pack)
42-
APP="$(echo $2 | perl -pe 's/(?<!\\)'\''//g' | sed 's/\\'\''/'\''/g')"
43-
pluginhook git-pre-pull $APP
44-
cat | git-upload-pack "$DOKKU_ROOT/$APP"
45-
pluginhook git-post-pull $APP
9+
check_app_name "$2"
10+
echo "deploy"
11+
echo "$APP"
4612
;;
4713

4814
git-*)
4915
APP="$(echo "$2" | perl -pe 's/(?<!\\)'\''//g' | sed 's/\\'\''/'\''/g')"
5016
check_app_name "$APP"
51-
52-
if [[ $1 == "git-receive-pack" && ! -d "$APP_DIR/refs" ]]; then
53-
[[ "$DOKKU_DISABLE_AUTO_APP_CREATE" == "1" ]] && fail "$APP: application doesn't exit, please create it with: dokku create $APP"
54-
create_bare_repository "$APP" "$APP_DIR"
55-
fi
56-
57-
verify_app_name "$APP"
58-
59-
args=$@
60-
git-shell -c "$args"
61-
;;
62-
63-
create|apps:create)
64-
check_app_name "$2"
65-
verify_max_args 2 "$@"
66-
[[ -d "$APP_DIR/refs" ]] && fail "$APP: already exist"
67-
create_bare_repository "$APP" "$APP_DIR"
68-
info "Application $APP created!"
17+
echo "deploy"
18+
echo "$APP"
6919
;;
70-
71-
clone)
72-
cleanup_clone() {
73-
dokku delete "$APP"
74-
}
75-
check_app_name "$2"
76-
verify_max_args 4 "$@"
77-
[[ -d "$APP_DIR/refs" ]] && fail "$APP: already exist"
78-
info "Cloning $APP repository from $3..."
79-
git clone --bare -b "${4:-master}" "$3" "$APP_DIR"
80-
cd "$APP_DIR"
81-
HEAD="$(git rev-parse "${4:-master}")"
82-
trap cleanup_clone EXIT
83-
create_pre_receive_hook "$APP" "$APP_DIR"
84-
dokku rebuild "$APP" "$HEAD"
85-
echo "$HEAD" > "refs/heads/master"
86-
trap - EXIT
87-
;;
88-
89-
import:docker)
90-
cleanup() {
91-
dokku delete "$APP"
92-
[[ -n "$TMP_WORK_DIR" ]] && rm -rf "$TMP_WORK_DIR"
93-
}
94-
check_app_name "$2"
95-
verify_max_args 3 "$@"
96-
dokku create "$2"
97-
trap cleanup EXIT
98-
99-
TMP_WORK_DIR="$(mktemp -d)"
100-
echo "$3"
101-
# clone git repository
102-
chmod 755 "$TMP_WORK_DIR"
103-
unset GIT_DIR GIT_WORK_TREE
104-
pushd "$TMP_WORK_DIR" > /dev/null
105-
git clone "$APP_DIR" "$TMP_WORK_DIR" > /dev/null
106-
git config advice.detachedHead false
107-
git config user.email "$(id -u -n)@$(hostname)"
108-
git config user.name "$(id -u -n)"
109-
cat <<EOF > Dockerfile
110-
FROM $3
111-
EOF
112-
git add Dockerfile
113-
git commit -am "Created application with Docker FROM $3"
114-
git push origin master
115-
trap - EXIT
116-
;;
117-
118-
help | git:help)
119-
cat && cat <<EOF
120-
create <app> Create shallow app
121-
clone <app> <repository> [branch] Create application by cloning git repository
122-
import:docker <app> <docker-image-from> Create application from Docker image
123-
EOF
124-
;;
125-
126-
*)
127-
exit $DOKKU_NOT_IMPLEMENTED_EXIT
128-
;;
129-
13020
esac

0 commit comments

Comments
 (0)