From 697ebf3365bfc13f8c8d376b1e90be2258d043f6 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Mar 19 2020 21:15:21 +0000
Subject: [PATCH 1/2] Allow deploy keys to commit to the doc git repository of a project


While stored in a different git repo, docs are part of the sources of
a project and should not contain any privileged information unlike
the tickets or requests git repositories.
Thus we are fine with granting commit access to deploy keys to the
doc git repository.

Fixes https://pagure.io/pagure/issue/4763

Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/pagure/internal/__init__.py b/pagure/internal/__init__.py
index 9a31c0d..14b7f14 100644
--- a/pagure/internal/__init__.py
+++ b/pagure/internal/__init__.py
@@ -147,9 +147,11 @@ def check_ssh_access():
     if not project:
         return flask.jsonify({"access": False})
 
-    if repotype != "main" and not pagure.utils.is_repo_user(
+    if repotype not in ["main", "doc"] and not pagure.utils.is_repo_user(
         project, remoteuser
     ):
+        # Deploy keys are not allowed on ticket and PR repos but they are
+        # allowed for main and doc repos.
         return flask.jsonify({"access": False})
 
     return flask.jsonify(

From c524256a7f2aff9517915dbb2bb273e6a4eb6bad Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Mar 19 2020 21:15:21 +0000
Subject: [PATCH 2/2] Increase a lot the logging when someone asks for access to a git repo


The current information logged when someone asks/tries to access a
git repo via the aclchecker script is very low. With this commit
we will track in much finer details who asks for what and what the
answer was in the web server's log since aclchecker calls the
internal API endpoints and basically follows whatever decision that
endpoint makes.

Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/pagure/internal/__init__.py b/pagure/internal/__init__.py
index 14b7f14..4f106e8 100644
--- a/pagure/internal/__init__.py
+++ b/pagure/internal/__init__.py
@@ -126,14 +126,22 @@ def check_ssh_access():
 
     # Build a fake path so we can use get_repo_info_from_path
     path = os.path.join(pagure_config["GIT_FOLDER"], gitdir)
+    _log.info(
+        "%s asks to access %s (path: %s) via ssh" % (remoteuser, gitdir, path)
+    )
     (
         repotype,
         project_user,
         namespace,
         repo,
     ) = pagure.lib.git.get_repo_info_from_path(path, hide_notfound=True)
+    _log.info(
+        "%s asks to access the %s repo of %s/%s from user %s"
+        % (remoteuser, repotype, namespace, repo, project_user)
+    )
 
     if repo is None:
+        _log.info("Project name could not be extracted from path")
         return flask.jsonify({"access": False})
 
     project = pagure.lib.query.get_authorized_project(
@@ -145,15 +153,20 @@ def check_ssh_access():
     )
 
     if not project:
+        _log.info("Project not found with this path")
         return flask.jsonify({"access": False})
+    _log.info("Checking ACLs on project: %s" % project.fullname)
 
     if repotype not in ["main", "doc"] and not pagure.utils.is_repo_user(
         project, remoteuser
     ):
         # Deploy keys are not allowed on ticket and PR repos but they are
         # allowed for main and doc repos.
+        _log.info("%s is not a contributor to this project" % remoteuser)
         return flask.jsonify({"access": False})
 
+    _log.info("Access granted to %s on: %s" % (remoteuser, project.fullname))
+
     return flask.jsonify(
         {
             "access": True,