1433595 - restrict wptsync user to mozilla-inbound

Status: RESOLVED FIXED

(Developer Services :: General, task)

Description

[Maja Frydrychowicz :impossibus (was :maja_zf) (needinfo me)]

Follow-up to Bug 1426201.

Comment 1

[Maja Frydrychowicz :impossibus (was :maja_zf) (needinfo me)]

Attachment: hghooks: restrict [e-mail] to pushing to mozilla-inbound only (bug 1433595);

Review commit: https://reviewboard.mozilla.org/r/216036/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/216036/

Comment 2

[Maja Frydrychowicz :impossibus (was :maja_zf) (needinfo me)]

Comment on attachment 8945975 [details]
hghooks: restrict [e-mail] to pushing to mozilla-inbound only (bug 1433595);

https://reviewboard.mozilla.org/r/216036/#review221840

::: hghooks/mozhghooks/check/prevent_wptsync_changes.py:54
(Diff revision 1)
>          pass
>  
>      def check(self, ctx):
>          success = True
>          if os.environ['USER'] == '[e-mail]':
> +            if self.repo_metadata['path'] == "integration/mozilla-inbound":

This is my guess at how to detect mozilla-inbound. Is that right?

Comment 3

[Gregory Szorc [:gps]]

Comment on attachment 8945975 [details]
hghooks: restrict [e-mail] to pushing to mozilla-inbound only (bug 1433595);

https://reviewboard.mozilla.org/r/216036/#review222070

This is mostly good. But it needs a tweak and an additional test case to properly restrict permissions.

::: hghooks/mozhghooks/check/prevent_wptsync_changes.py:45
(Diff revision 1)
>      def relevant(self):
>          return self.repo_metadata['firefox_releasing']

We'll want to change this to `return True` so the hook runs on all repos. Or change it to `return os.environ['USER'] == '[e-mail]'` so the body of the hook only runs if the current user is the one whose permissions we care about.

By leaving this the way it is, the hook won't run on level 3 repos that aren't releasing Firefox repos. That will result in permissions not being restricted.

This also means we should have a test case showing that pushing to a non-Firefox repo is denied.

Comment 4

[Maja Frydrychowicz :impossibus (was :maja_zf) (needinfo me)]

Comment on attachment 8945975 [details]
hghooks: restrict [e-mail] to pushing to mozilla-inbound only (bug 1433595);

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/216036/diff/1-2/

Comment 5

[Gregory Szorc [:gps]]

Comment on attachment 8945975 [details]
hghooks: restrict [e-mail] to pushing to mozilla-inbound only (bug 1433595);

https://reviewboard.mozilla.org/r/216036/#review222548

Looks good!

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/hgcustom/version-control-tools/rev/ae84ef90223b
hghooks: restrict [e-mail] to pushing to mozilla-inbound only ; r=gps