Support custom policy for GIT access rules

Implements following rules:
- Users
- Users of any project
- Users of all projects
- Administrators
- Signers

The 'If No Rules Match' the access is implicitly considered to
be 'DENY'.

It is not possible to control access based on the Moon phase.

scripts/gitadmin/rebuild_gitadmin.php

@@ -34,6 +34,16 @@ function write_ini_file($array, $file) {
   file_put_contents($file, implode("\n", $res));
 }
 
+function getProjectMembersPHIDs($viewer, $project_phid) {
+  $project = id(new PhabricatorProjectQuery())
+    ->setViewer($viewer)
+    ->needMembers(true)
+    ->withPHIDs(array($project_phid))
+    ->executeOne();
+
+  return $project->getMemberPHIDs();
+}
+
 // Get user's heys and put them to the configuration
 function handleSingleUserPHID(
   $keydir, $viewer, $userPHID, $system_keys, &$used_keys) {
@@ -77,24 +87,141 @@ function handleSingleUserPHID(
   return $members;
 }
 
+function handleUsersPolicyRule(
+  $keydir, $viewer, $rule, $system_keys, &$used_keys) {
+  $members = array();
+  foreach ($rule['value'] as $userPHID) {
+    $members = array_merge($members,
+      handleSingleUserPHID($keydir, $viewer, $userPHID,
+                           $system_keys, $used_keys));
+  }
+  return $members;
+}
+
+function handleProjectsPolicyRule(
+  $keydir, $viewer, $rule, $system_keys, &$used_keys) {
+  $members = array();
+  foreach ($rule['value'] as $projectPHID) {
+    $memberPHIDs = getProjectMembersPHIDs($viewer, $projectPHID);
+    foreach ($memberPHIDs as $userPHID) {
+      $members = array_merge($members,
+        handleSingleUserPHID($keydir, $viewer, $userPHID,
+                             $system_keys, $used_keys));
+    }
+  }
+  return $members;
+}
+
+function handleProjectsAllPolicyRule(
+  $keydir, $viewer, $rule, $system_keys, &$used_keys) {
+  $is_first_project = true;
+  $allowed_members_phids = array();
+  foreach ($rule['value'] as $project_phid) {
+    $memberPHIDs = getProjectMembersPHIDs($viewer, $project_phid);
+    if ($is_first_project) {
+      $allowed_members_phids = $memberPHIDs;
+      $is_first_project = false;
+    } else {
+      $allowed_members_phids = array_intersect(
+        $allowed_members_phids, $memberPHIDs);
+    }
+  }
+
+  $members = array();
+  foreach ($allowed_members_phids as $userPHID) {
+    $members = array_merge($members,
+      handleSingleUserPHID($keydir, $viewer, $userPHID,
+                           $system_keys, $used_keys));
+  }
+  return $members;
+}
+
+function handleAdministratorsPolicyRule(
+  $keydir, $viewer, $rule, $system_keys, &$used_keys) {
+  $administrators = id(new PhabricatorPeopleQuery())
+    ->setViewer($viewer)
+    ->withIsAdmin(true)
+    ->execute();
+
+  $members = array();
+  foreach ($administrators as $administrator) {
+    $members = array_merge($members,
+      handleSingleUserPHID($keydir, $viewer, $administrator->getPHID(),
+                           $system_keys, $used_keys));
+  }
+  return $members;
+}
+
+function handleLegalpadSingleDocument(
+  $keydir, $viewer, $document, $system_keys, &$used_keys) {
+  if ($document->getSignatureType() !=
+      LegalpadDocument::SIGNATURE_TYPE_INDIVIDUAL) {
+    return array();
+  }
+
+  $members = array();
+  foreach ($document->getSignatures() as $signature) {
+    if ($signature->getSignatureType() !=
+        LegalpadDocument::SIGNATURE_TYPE_INDIVIDUAL) {
+      continue;
+    }
+    $members = array_merge($members,
+      handleSingleUserPHID($keydir, $viewer, $signature->getSignerPHID(),
+                           $system_keys, $used_keys));
+  }
+  return $members;
+}
+
+function handleLegalpadSignaturePolicyRule(
+  $keydir, $viewer, $rule, $system_keys, &$used_keys) {
+  $documents = id(new LegalpadDocumentQuery())
+    ->setViewer($viewer)
+    ->withPHIDs($rule['value'])
+    ->needSignatures(true)
+    ->execute();
+
+  $members = array();
+  foreach ($documents as $document) {
+    $members = array_merge(
+      $members,
+      handleLegalpadSingleDocument(
+        $keydir, $viewer, $document, $system_keys, $used_keys));
+  }
+  return $members;
+}
+
 function handleCustomPolicy(
   $keydir, $viewer, $policy, $system_keys, &$used_keys) {
   $members = array();
   $rules = $policy->getRules();
   foreach ($rules as $rule) {
     // Everyone is denied by default anyway
-    if ($rule['action'] == 'allow') {
-      if ($rule['rule'] == 'PhabricatorPolicyRuleUsers') {
-        foreach ($rule['value'] as $userPHID) {
-          $members = array_merge($members,
-              handleSingleUserPHID($keydir, $viewer, $userPHID,
-                                   $system_keys, $used_keys));
-        }
-      } else {
-        /* pass */
-      }
+    if ($rule['action'] != 'allow') {
+      continue;
     }
+
+    $policy_members = array();
+    $rule_type = $rule['rule'];
+    if ($rule_type == 'PhabricatorPolicyRuleUsers') {
+      $policy_members = handleUsersPolicyRule(
+        $keydir, $viewer, $rule, $system_keys, $used_keys);
+    } else if ($rule_type == 'PhabricatorProjectsPolicyRule') {
+      $policy_members = handleProjectsPolicyRule(
+        $keydir, $viewer, $rule, $system_keys, $used_keys);
+    } else if ($rule_type == 'PhabricatorProjectsAllPolicyRule') {
+      $policy_members = handleProjectsAllPolicyRule(
+        $keydir, $viewer, $rule, $system_keys, $used_keys);
+    } else if ($rule_type == 'PhabricatorAdministratorsPolicyRule') {
+      $policy_members = handleAdministratorsPolicyRule(
+        $keydir, $viewer, $rule, $system_keys, $used_keys);
+    } else if ($rule_type == 'PhabricatorLegalpadSignaturePolicyRule') {
+      $policy_members = handleLegalpadSignaturePolicyRule(
+        $keydir, $viewer, $rule, $system_keys, $used_keys);
+    }
+
+    $members = array_merge($members, $policy_members);
   }
+
   return $members;
 }