chore(release): merged default into stable branch

docs/release-notes/release-notes-5.2.1.rst

@@ -0,0 +1,40 b''
+|RCE| 5.2.1 |RNS|
+-----------------
+
+Release Date
+^^^^^^^^^^^^
+
+- 2024-09-16
+
+
+New Features
+^^^^^^^^^^^^
+
+
+
+General
+^^^^^^^
+
+
+
+Security
+^^^^^^^^
+
+
+
+Performance
+^^^^^^^^^^^
+
+
+
+
+Fixes
+^^^^^
+
+- Fixed problems with incorrect user agent errors
+
+
+Upgrade notes
+^^^^^^^^^^^^^
+
+- RhodeCode 5.2.1 is unscheduled bugfix release to address some build issues with 5.2 images

docs/release-notes/release-notes-5.3.0.rst

@@ -0,0 +1,45 b''
+|RCE| 5.3.0 |RNS|
+-----------------
+
+Release Date
+^^^^^^^^^^^^
+
+- 2024-09-17
+
+
+New Features
+^^^^^^^^^^^^
+
+- System-info: expose rhodecode config for better visibility of set settings for RhodeCode system.
+
+
+General
+^^^^^^^
+
+
+
+Security
+^^^^^^^^
+
+- Permissions: fixed security problem with apply-to-children from a repo group functionality breaking
+  permissions for private repositories exposing them despite repo being private.
+- Git-lfs: fixed security problem with allowing off-chain attacks to replace OID data without validating hash for already present oids.
+  This allowed to replace an LFS OID content with malicious request tailored to open RhodeCode server.
+
+
+Performance
+^^^^^^^^^^^
+
+
+
+
+Fixes
+^^^^^
+
+- Fixed problems with incorrect user agent errors
+
+
+Upgrade notes
+^^^^^^^^^^^^^
+
+- RhodeCode 5.3.0 is unscheduled security release to address some build issues with 5.X images

.bumpversion.cfg

@@ -1,5 +1,5 b''
 [bumpversion]
-current_version = 5.2.1
+current_version = 5.3.0
 message = release: Bump version {current_version} to {new_version}
 
 [bumpversion:file:rhodecode/VERSION]

configs/development.ini

@@ -1,912 +1,915 b''
 
 ; #########################################
 ; RHODECODE COMMUNITY EDITION CONFIGURATION
 ; #########################################
 
 [DEFAULT]
 ; Debug flag sets all loggers to debug, and enables request tracking
 debug = true
 
 ; ########################################################################
 ; EMAIL CONFIGURATION
 ; These settings will be used by the RhodeCode mailing system
 ; ########################################################################
 
 ; prefix all emails subjects with given prefix, helps filtering out emails
 #email_prefix = [RhodeCode]
 
 ; email FROM address all mails will be sent
 #app_email_from = rhodecode-noreply@localhost
 
 #smtp_server = mail.server.com
 #smtp_username =
 #smtp_password =
 #smtp_port =
 #smtp_use_tls = false
 #smtp_use_ssl = true
 
 [server:main]
 ; COMMON HOST/IP CONFIG, This applies mostly to develop setup,
 ; Host port for gunicorn are controlled by gunicorn_conf.py
 host = 127.0.0.1
 port = 10020
 
 
 ; ###########################
 ; GUNICORN APPLICATION SERVER
 ; ###########################
 
 ; run with gunicorn  --config gunicorn_conf.py --paste rhodecode.ini
 
 ; Module to use, this setting shouldn't be changed
 use = egg:gunicorn#main
 
 ; Prefix middleware for RhodeCode.
 ; recommended when using proxy setup.
 ; allows to set RhodeCode under a prefix in server.
 ; eg https://server.com/custom_prefix. Enable `filter-with =` option below as well.
 ; And set your prefix like: `prefix = /custom_prefix`
 ; be sure to also set beaker.session.cookie_path = /custom_prefix if you need
 ; to make your cookies only work on prefix url
 [filter:proxy-prefix]
 use = egg:PasteDeploy#prefix
 prefix = /
 
 [app:main]
 ; The %(here)s variable will be replaced with the absolute path of parent directory
 ; of this file
 ; Each option in the app:main can be override by an environmental variable
 ;
 ;To override an option:
 ;
 ;RC_<KeyName>
 ;Everything should be uppercase, . and - should be replaced by _.
 ;For example, if you have these configuration settings:
 ;rc_cache.repo_object.backend = foo
 ;can be overridden by
 ;export RC_CACHE_REPO_OBJECT_BACKEND=foo
 
 use = egg:rhodecode-enterprise-ce
 
 ; enable proxy prefix middleware, defined above
 #filter-with = proxy-prefix
 
+; control if environmental variables to be expanded into the .ini settings
+#rhodecode.env_expand = true
+
 ; #############
 ; DEBUG OPTIONS
 ; #############
 
 pyramid.reload_templates = true
 
 # During development the we want to have the debug toolbar enabled
 pyramid.includes =
     pyramid_debugtoolbar
 
 debugtoolbar.hosts = 0.0.0.0/0
 debugtoolbar.exclude_prefixes =
     /css
     /fonts
     /images
     /js
 
 ## RHODECODE PLUGINS ##
 rhodecode.includes =
     rhodecode.api
 
 
 # api prefix url
 rhodecode.api.url = /_admin/api
 
 ; enable debug style page
 debug_style = true
 
 ; #################
 ; END DEBUG OPTIONS
 ; #################
 
 ; encryption key used to encrypt social plugin tokens,
 ; remote_urls with credentials etc, if not set it defaults to
 ; `beaker.session.secret`
 #rhodecode.encrypted_values.secret =
 
 ; decryption strict mode (enabled by default). It controls if decryption raises
 ; `SignatureVerificationError` in case of wrong key, or damaged encryption data.
 #rhodecode.encrypted_values.strict = false
 
 ; Pick algorithm for encryption. Either fernet (more secure) or aes (default)
 ; fernet is safer, and we strongly recommend switching to it.
 ; Due to backward compatibility aes is used as default.
 #rhodecode.encrypted_values.algorithm = fernet
 
 ; Return gzipped responses from RhodeCode (static files/application)
 gzip_responses = false
 
 ; Auto-generate javascript routes file on startup
 generate_js_files = false
 
 ; System global default language.
 ; All available languages: en (default), be, de, es, fr, it, ja, pl, pt, ru, zh
 lang = en
 
 ; Perform a full repository scan and import on each server start.
 ; Settings this to true could lead to very long startup time.
 startup.import_repos = false
 
 ; URL at which the application is running. This is used for Bootstrapping
 ; requests in context when no web request is available. Used in ishell, or
 ; SSH calls. Set this for events to receive proper url for SSH calls.
 app.base_url = http://rhodecode.local
 
 ; Host at which the Service API is running.
 app.service_api.host = http://rhodecode.local:10020
 
 ; Secret for Service API authentication.
 app.service_api.token =
 
 ; Unique application ID. Should be a random unique string for security.
 app_instance_uuid = rc-production
 
 ; Cut off limit for large diffs (size in bytes). If overall diff size on
 ; commit, or pull request exceeds this limit this diff will be displayed
 ; partially. E.g 512000 == 512Kb
 cut_off_limit_diff = 512000
 
 ; Cut off limit for large files inside diffs (size in bytes). Each individual
 ; file inside diff which exceeds this limit will be displayed partially.
 ;  E.g 128000 == 128Kb
 cut_off_limit_file = 128000
 
 ; Use cached version of vcs repositories everywhere. Recommended to be `true`
 vcs_full_cache = true
 
 ; Force https in RhodeCode, fixes https redirects, assumes it's always https.
 ; Normally this is controlled by proper flags sent from http server such as Nginx or Apache
 force_https = false
 
 ; use Strict-Transport-Security headers
 use_htsts = false
 
 ; Set to true if your repos are exposed using the dumb protocol
 git_update_server_info = false
 
 ; RSS/ATOM feed options
 rss_cut_off_limit = 256000
 rss_items_per_page = 10
 rss_include_diff = false
 
 ; gist URL alias, used to create nicer urls for gist. This should be an
 ; url that does rewrites to _admin/gists/{gistid}.
 ; example: http://gist.rhodecode.org/{gistid}. Empty means use the internal
 ; RhodeCode url, ie. http[s]://rhodecode.server/_admin/gists/{gistid}
 gist_alias_url =
 
 ; List of views (using glob pattern syntax) that AUTH TOKENS could be
 ; used for access.
 ; Adding ?auth_token=TOKEN_HASH to the url authenticates this request as if it
 ; came from the the logged in user who own this authentication token.
 ; Additionally @TOKEN syntax can be used to bound the view to specific
 ; authentication token. Such view would be only accessible when used together
 ; with this authentication token
 ; list of all views can be found under `/_admin/permissions/auth_token_access`
 ; The list should be "," separated and on a single line.
 ; Most common views to enable:
 
 #    RepoCommitsView:repo_commit_download
 #    RepoCommitsView:repo_commit_patch
 #    RepoCommitsView:repo_commit_raw
 #    RepoCommitsView:repo_commit_raw@TOKEN
 #    RepoFilesView:repo_files_diff
 #    RepoFilesView:repo_archivefile
 #    RepoFilesView:repo_file_raw
 #    GistView:*
 api_access_controllers_whitelist =
 
 ; Default encoding used to convert from and to unicode
 ; can be also a comma separated list of encoding in case of mixed encodings
 default_encoding = UTF-8
 
 ; instance-id prefix
 ; a prefix key for this instance used for cache invalidation when running
 ; multiple instances of RhodeCode, make sure it's globally unique for
 ; all running RhodeCode instances. Leave empty if you don't use it
 instance_id =
 
 ; Fallback authentication plugin. Set this to a plugin ID to force the usage
 ; of an authentication plugin also if it is disabled by it's settings.
 ; This could be useful if you are unable to log in to the system due to broken
 ; authentication settings. Then you can enable e.g. the internal RhodeCode auth
 ; module to log in again and fix the settings.
 ; Available builtin plugin IDs (hash is part of the ID):
 ; egg:rhodecode-enterprise-ce#rhodecode
 ; egg:rhodecode-enterprise-ce#pam
 ; egg:rhodecode-enterprise-ce#ldap
 ; egg:rhodecode-enterprise-ce#jasig_cas
 ; egg:rhodecode-enterprise-ce#headers
 ; egg:rhodecode-enterprise-ce#crowd
 
 #rhodecode.auth_plugin_fallback = egg:rhodecode-enterprise-ce#rhodecode
 
 ; Flag to control loading of legacy plugins in py:/path format
 auth_plugin.import_legacy_plugins = true
 
 ; alternative return HTTP header for failed authentication. Default HTTP
 ; response is 401 HTTPUnauthorized. Currently HG clients have troubles with
 ; handling that causing a series of failed authentication calls.
 ; Set this variable to 403 to return HTTPForbidden, or any other HTTP code
 ; This will be served instead of default 401 on bad authentication
 auth_ret_code =
 
 ; use special detection method when serving auth_ret_code, instead of serving
 ; ret_code directly, use 401 initially (Which triggers credentials prompt)
 ; and then serve auth_ret_code to clients
 auth_ret_code_detection = false
 
 ; locking return code. When repository is locked return this HTTP code. 2XX
 ; codes don't break the transactions while 4XX codes do
 lock_ret_code = 423
 
 ; Filesystem location were repositories should be stored
 repo_store.path = /var/opt/rhodecode_repo_store
 
 ; allows to setup custom hooks in settings page
 allow_custom_hooks_settings = true
 
 ; Generated license token required for EE edition license.
 ; New generated token value can be found in Admin > settings > license page.
 license_token =
 
 ; This flag hides sensitive information on the license page such as token, and license data
 license.hide_license_info = false
 
 ; Import EE license from this license path
 #license.import_path = %(here)s/rhodecode_enterprise.license
 
 ; import license 'if-missing' or 'force' (always override)
 ; if-missing means apply license if it doesn't exist. 'force' option always overrides it
 license.import_path_mode = if-missing
 
 ; supervisor connection uri, for managing supervisor and logs.
 supervisor.uri =
 
 ; supervisord group name/id we only want this RC instance to handle
 supervisor.group_id = dev
 
 ; Display extended labs settings
 labs_settings_active = true
 
 ; Custom exception store path, defaults to TMPDIR
 ; This is used to store exception from RhodeCode in shared directory
 #exception_tracker.store_path =
 
 ; Send email with exception details when it happens
 #exception_tracker.send_email = false
 
 ; Comma separated list of recipients for exception emails,
 ; e.g [e-mail],[e-mail]
 ; Can be left empty, then emails will be sent to ALL super-admins
 #exception_tracker.send_email_recipients =
 
 ; optional prefix to Add to email Subject
 #exception_tracker.email_prefix = [RHODECODE ERROR]
 
 ; NOTE: this setting IS DEPRECATED:
 ; file_store backend is always enabled
 #file_store.enabled = true
 
 ; NOTE: this setting IS DEPRECATED:
 ; file_store.backend = X -> use `file_store.backend.type = filesystem_v2` instead
 ; Storage backend, available options are: local
 #file_store.backend = local
 
 ; NOTE: this setting IS DEPRECATED:
 ; file_store.storage_path = X -> use `file_store.filesystem_v2.storage_path = X` instead
 ; path to store the uploaded binaries and artifacts
 #file_store.storage_path = /var/opt/rhodecode_data/file_store
 
 ; Artifacts file-store, is used to store comment attachments and artifacts uploads.
 ; file_store backend type: filesystem_v1, filesystem_v2 or objectstore (s3-based) are available as options
 ; filesystem_v1 is backwards compat with pre 5.1 storage changes
 ; new installations should choose filesystem_v2 or objectstore (s3-based), pick filesystem when migrating from
 ; previous installations to keep the artifacts without a need of migration
 #file_store.backend.type = filesystem_v2
 
 ; filesystem options...
 #file_store.filesystem_v1.storage_path = /var/opt/rhodecode_data/artifacts_file_store
 
 ; filesystem_v2 options...
 #file_store.filesystem_v2.storage_path = /var/opt/rhodecode_data/artifacts_file_store
 #file_store.filesystem_v2.shards = 8
 
 ; objectstore options...
 ; url for s3 compatible storage that allows to upload artifacts
 ; e.g http://minio:9000
 #file_store.backend.type = objectstore
 #file_store.objectstore.url = http://s3-minio:9000
 
 ; a top-level bucket to put all other shards in
 ; objects will be stored in rhodecode-file-store/shard-N based on the bucket_shards number
 #file_store.objectstore.bucket = rhodecode-file-store
 
 ; number of sharded buckets to create to distribute archives across
 ; default is 8 shards
 #file_store.objectstore.bucket_shards = 8
 
 ; key for s3 auth
 #file_store.objectstore.key = s3admin
 
 ; secret for s3 auth
 #file_store.objectstore.secret = s3secret4
 
 ;region for s3 storage
 #file_store.objectstore.region = eu-central-1
 
 ; Redis url to acquire/check generation of archives locks
 archive_cache.locking.url = redis://redis:6379/1
 
 ; Storage backend, only 'filesystem' and 'objectstore' are available now
 archive_cache.backend.type = filesystem
 
 ; url for s3 compatible storage that allows to upload artifacts
 ; e.g http://minio:9000
 archive_cache.objectstore.url = http://s3-minio:9000
 
 ; key for s3 auth
 archive_cache.objectstore.key = key
 
 ; secret for s3 auth
 archive_cache.objectstore.secret = secret
 
 ;region for s3 storage
 archive_cache.objectstore.region = eu-central-1
 
 ; number of sharded buckets to create to distribute archives across
 ; default is 8 shards
 archive_cache.objectstore.bucket_shards = 8
 
 ; a top-level bucket to put all other shards in
 ; objects will be stored in rhodecode-archive-cache/shard-N based on the bucket_shards number
 archive_cache.objectstore.bucket = rhodecode-archive-cache
 
 ; if true, this cache will try to retry with retry_attempts=N times waiting retry_backoff time
 archive_cache.objectstore.retry = false
 
 ; number of seconds to wait for next try using retry
 archive_cache.objectstore.retry_backoff = 1
 
 ; how many tries do do a retry fetch from this backend
 archive_cache.objectstore.retry_attempts = 10
 
 ; Default is $cache_dir/archive_cache if not set
 ; Generated repo archives will be cached at this location
 ; and served from the cache during subsequent requests for the same archive of
 ; the repository. This path is important to be shared across filesystems and with
 ; RhodeCode and vcsserver
 archive_cache.filesystem.store_dir = /var/opt/rhodecode_data/archive_cache
 
 ; The limit in GB sets how much data we cache before recycling last used, defaults to 10 gb
 archive_cache.filesystem.cache_size_gb = 1
 
 ; Eviction policy used to clear out after cache_size_gb limit is reached
 archive_cache.filesystem.eviction_policy = least-recently-stored
 
 ; By default cache uses sharding technique, this specifies how many shards are there
 ; default is 8 shards
 archive_cache.filesystem.cache_shards = 8
 
 ; if true, this cache will try to retry with retry_attempts=N times waiting retry_backoff time
 archive_cache.filesystem.retry = false
 
 ; number of seconds to wait for next try using retry
 archive_cache.filesystem.retry_backoff = 1
 
 ; how many tries do do a retry fetch from this backend
 archive_cache.filesystem.retry_attempts = 10
 
 
 ; #############
 ; CELERY CONFIG
 ; #############
 
 ; manually run celery: /path/to/celery worker --task-events --beat --app rhodecode.lib.celerylib.loader --scheduler rhodecode.lib.celerylib.scheduler.RcScheduler --loglevel DEBUG --ini /path/to/rhodecode.ini
 
 use_celery = true
 
 ; path to store schedule database
 #celerybeat-schedule.path =
 
 ; connection url to the message broker (default redis)
 celery.broker_url = redis://redis:6379/8
 
 ; results backend to get results for (default redis)
 celery.result_backend = redis://redis:6379/8
 
 ; rabbitmq example
 #celery.broker_url = amqp://rabbitmq:qweqwe@localhost:5672/rabbitmqhost
 
 ; maximum tasks to execute before worker restart
 celery.max_tasks_per_child = 20
 
 ; tasks will never be sent to the queue, but executed locally instead.
 celery.task_always_eager = false
 
 ; #############
 ; DOGPILE CACHE
 ; #############
 
 ; Default cache dir for caches. Putting this into a ramdisk can boost performance.
 ; eg. /tmpfs/data_ramdisk, however this directory might require large amount of space
 cache_dir = /var/opt/rhodecode_data
 
 ; *********************************************
 ; `sql_cache_short` cache for heavy SQL queries
 ; Only supported backend is `memory_lru`
 ; *********************************************
 rc_cache.sql_cache_short.backend = dogpile.cache.rc.memory_lru
 rc_cache.sql_cache_short.expiration_time = 30
 
 
 ; *****************************************************
 ; `cache_repo_longterm` cache for repo object instances
 ; Only supported backend is `memory_lru`
 ; *****************************************************
 rc_cache.cache_repo_longterm.backend = dogpile.cache.rc.memory_lru
 ; by default we use 30 Days, cache is still invalidated on push
 rc_cache.cache_repo_longterm.expiration_time = 2592000
 ; max items in LRU cache, set to smaller number to save memory, and expire last used caches
 rc_cache.cache_repo_longterm.max_size = 10000
 
 
 ; *********************************************
 ; `cache_general` cache for general purpose use
 ; for simplicity use rc.file_namespace backend,
 ; for performance and scale use rc.redis
 ; *********************************************
 rc_cache.cache_general.backend = dogpile.cache.rc.file_namespace
 rc_cache.cache_general.expiration_time = 43200
 ; file cache store path. Defaults to `cache_dir =` value or tempdir if both values are not set
 #rc_cache.cache_general.arguments.filename = /tmp/cache_general_db
 
 ; alternative `cache_general` redis backend with distributed lock
 #rc_cache.cache_general.backend = dogpile.cache.rc.redis
 #rc_cache.cache_general.expiration_time = 300
 
 ; redis_expiration_time needs to be greater then expiration_time
 #rc_cache.cache_general.arguments.redis_expiration_time = 7200
 
 #rc_cache.cache_general.arguments.host = localhost
 #rc_cache.cache_general.arguments.port = 6379
 #rc_cache.cache_general.arguments.db = 0
 #rc_cache.cache_general.arguments.socket_timeout = 30
 ; more Redis options: https://dogpilecache.sqlalchemy.org/en/latest/api.html#redis-backends
 #rc_cache.cache_general.arguments.distributed_lock = true
 
 ; auto-renew lock to prevent stale locks, slower but safer. Use only if problems happen
 #rc_cache.cache_general.arguments.lock_auto_renewal = true
 
 ; *************************************************
 ; `cache_perms` cache for permission tree, auth TTL
 ; for simplicity use rc.file_namespace backend,
 ; for performance and scale use rc.redis
 ; *************************************************
 rc_cache.cache_perms.backend = dogpile.cache.rc.file_namespace
 rc_cache.cache_perms.expiration_time = 3600
 ; file cache store path. Defaults to `cache_dir =` value or tempdir if both values are not set
 #rc_cache.cache_perms.arguments.filename = /tmp/cache_perms_db
 
 ; alternative `cache_perms` redis backend with distributed lock
 #rc_cache.cache_perms.backend = dogpile.cache.rc.redis
 #rc_cache.cache_perms.expiration_time = 300
 
 ; redis_expiration_time needs to be greater then expiration_time
 #rc_cache.cache_perms.arguments.redis_expiration_time = 7200
 
 #rc_cache.cache_perms.arguments.host = localhost
 #rc_cache.cache_perms.arguments.port = 6379
 #rc_cache.cache_perms.arguments.db = 0
 #rc_cache.cache_perms.arguments.socket_timeout = 30
 ; more Redis options: https://dogpilecache.sqlalchemy.org/en/latest/api.html#redis-backends
 #rc_cache.cache_perms.arguments.distributed_lock = true
 
 ; auto-renew lock to prevent stale locks, slower but safer. Use only if problems happen
 #rc_cache.cache_perms.arguments.lock_auto_renewal = true
 
 ; ***************************************************
 ; `cache_repo` cache for file tree, Readme, RSS FEEDS
 ; for simplicity use rc.file_namespace backend,
 ; for performance and scale use rc.redis
 ; ***************************************************
 rc_cache.cache_repo.backend = dogpile.cache.rc.file_namespace
 rc_cache.cache_repo.expiration_time = 2592000
 ; file cache store path. Defaults to `cache_dir =` value or tempdir if both values are not set
 #rc_cache.cache_repo.arguments.filename = /tmp/cache_repo_db
 
 ; alternative `cache_repo` redis backend with distributed lock
 #rc_cache.cache_repo.backend = dogpile.cache.rc.redis
 #rc_cache.cache_repo.expiration_time = 2592000
 
 ; redis_expiration_time needs to be greater then expiration_time
 #rc_cache.cache_repo.arguments.redis_expiration_time = 2678400
 
 #rc_cache.cache_repo.arguments.host = localhost
 #rc_cache.cache_repo.arguments.port = 6379
 #rc_cache.cache_repo.arguments.db = 1
 #rc_cache.cache_repo.arguments.socket_timeout = 30
 ; more Redis options: https://dogpilecache.sqlalchemy.org/en/latest/api.html#redis-backends
 #rc_cache.cache_repo.arguments.distributed_lock = true
 
 ; auto-renew lock to prevent stale locks, slower but safer. Use only if problems happen
 #rc_cache.cache_repo.arguments.lock_auto_renewal = true
 
 ; ##############
 ; BEAKER SESSION
 ; ##############
 
 ; beaker.session.type is type of storage options for the logged users sessions. Current allowed
 ; types are file, ext:redis, ext:database, ext:memcached
 ; Fastest ones are ext:redis and ext:database, DO NOT use memory type for session
 #beaker.session.type = file
 #beaker.session.data_dir = %(here)s/data/sessions
 
 ; Redis based sessions
 beaker.session.type = ext:redis
 beaker.session.url = redis://redis:6379/2
 
 ; DB based session, fast, and allows easy management over logged in users
 #beaker.session.type = ext:database
 #beaker.session.table_name = db_session
 #beaker.session.sa.url = postgresql://postgres:secret@localhost/rhodecode
 #beaker.session.sa.url = mysql://root:secret@127.0.0.1/rhodecode
 #beaker.session.sa.pool_recycle = 3600
 #beaker.session.sa.echo = false
 
 beaker.session.key = rhodecode
 beaker.session.secret = develop-rc-uytcxaz
 beaker.session.lock_dir = /data_ramdisk/lock
 
 ; Secure encrypted cookie. Requires AES and AES python libraries
 ; you must disable beaker.session.secret to use this
 #beaker.session.encrypt_key = key_for_encryption
 #beaker.session.validate_key = validation_key
 
 ; Sets session as invalid (also logging out user) if it haven not been
 ; accessed for given amount of time in seconds
 beaker.session.timeout = 2592000
 beaker.session.httponly = true
 
 ; Path to use for the cookie. Set to prefix if you use prefix middleware
 #beaker.session.cookie_path = /custom_prefix
 
 ; Set https secure cookie
 beaker.session.secure = false
 
 ; default cookie expiration time in seconds, set to `true` to set expire
 ; at browser close
 #beaker.session.cookie_expires = 3600
 
 ; #############################
 ; SEARCH INDEXING CONFIGURATION
 ; #############################
 
 ; Full text search indexer is available in rhodecode-tools under
 ; `rhodecode-tools index` command
 
 ; WHOOSH Backend, doesn't require additional services to run
 ; it works good with few dozen repos
 search.module = rhodecode.lib.index.whoosh
 search.location = %(here)s/data/index
 
 ; ####################
 ; CHANNELSTREAM CONFIG
 ; ####################
 
 ; channelstream enables persistent connections and live notification
 ; in the system. It's also used by the chat system
 
 channelstream.enabled = true
 
 ; server address for channelstream server on the backend
 channelstream.server = channelstream:9800
 
 ; location of the channelstream server from outside world
 ; use ws:// for http or wss:// for https. This address needs to be handled
 ; by external HTTP server such as Nginx or Apache
 ; see Nginx/Apache configuration examples in our docs
 channelstream.ws_url = ws://rhodecode.yourserver.com/_channelstream
 channelstream.secret = ENV_GENERATED
 channelstream.history.location = /var/opt/rhodecode_data/channelstream_history
 
 ; Internal application path that Javascript uses to connect into.
 ; If you use proxy-prefix the prefix should be added before /_channelstream
 channelstream.proxy_path = /_channelstream
 
 
 ; ##############################
 ; MAIN RHODECODE DATABASE CONFIG
 ; ##############################
 
 #sqlalchemy.db1.url = sqlite:///%(here)s/rhodecode.db?timeout=30
 #sqlalchemy.db1.url = postgresql://postgres:qweqwe@localhost/rhodecode
 #sqlalchemy.db1.url = mysql://root:qweqwe@localhost/rhodecode?charset=utf8
 ; pymysql is an alternative driver for MySQL, use in case of problems with default one
 #sqlalchemy.db1.url = mysql+pymysql://root:qweqwe@localhost/rhodecode
 
 sqlalchemy.db1.url = sqlite:///%(here)s/rhodecode.db?timeout=30
 
 ; see sqlalchemy docs for other advanced settings
 ; print the sql statements to output
 sqlalchemy.db1.echo = false
 
 ; recycle the connections after this amount of seconds
 sqlalchemy.db1.pool_recycle = 3600
 
 ; the number of connections to keep open inside the connection pool.
 ; 0 indicates no limit
 ; the general calculus with gevent is:
 ; if your system allows 500 concurrent greenlets (max_connections) that all do database access,
 ; then increase pool size + max overflow so that they add up to 500.
 #sqlalchemy.db1.pool_size = 5
 
 ; The number of connections to allow in connection pool "overflow", that is
 ; connections that can be opened above and beyond the pool_size setting,
 ; which defaults to five.
 #sqlalchemy.db1.max_overflow = 10
 
 ; Connection check ping, used to detect broken database connections
 ; could be enabled to better handle cases if MySQL has gone away errors
 #sqlalchemy.db1.ping_connection = true
 
 ; ##########
 ; VCS CONFIG
 ; ##########
 vcs.server.enable = true
 vcs.server = vcsserver:10010
 
 ; Web server connectivity protocol, responsible for web based VCS operations
 ; Available protocols are:
 ; `http` - use http-rpc backend (default)
 vcs.server.protocol = http
 
 ; Push/Pull operations protocol, available options are:
 ; `http` - use http-rpc backend (default)
 vcs.scm_app_implementation = http
 
 ; Push/Pull operations hooks protocol, available options are:
 ; `http` - use http-rpc backend (default)
 ; `celery` - use celery based hooks
 #DEPRECATED:vcs.hooks.protocol = http
 vcs.hooks.protocol.v2 = celery
 
 ; Host on which this instance is listening for hooks. vcsserver will call this host to pull/push hooks so it should be
 ; accessible via network.
 ; Use vcs.hooks.host = "*" to bind to current hostname (for Docker)
 vcs.hooks.host = *
 
 ; Start VCSServer with this instance as a subprocess, useful for development
 vcs.start_server = false
 
 ; List of enabled VCS backends, available options are:
 ; `hg`  - mercurial
 ; `git` - git
 ; `svn` - subversion
 vcs.backends = hg, git, svn
 
 ; Wait this number of seconds before killing connection to the vcsserver
 vcs.connection_timeout = 3600
 
 ; Cache flag to cache vcsserver remote calls locally
 ; It uses cache_region `cache_repo`
 vcs.methods.cache = true
 
 ; Filesystem location where Git lfs objects should be stored
 vcs.git.lfs.storage_location = /var/opt/rhodecode_repo_store/.cache/git_lfs_store
 
 ; Filesystem location where Mercurial largefile objects should be stored
 vcs.hg.largefiles.storage_location = /var/opt/rhodecode_repo_store/.cache/hg_largefiles_store
 
 ; ####################################################
 ; Subversion proxy support (mod_dav_svn)
 ; Maps RhodeCode repo groups into SVN paths for Apache
 ; ####################################################
 
 ; Compatibility version when creating SVN repositories. Defaults to newest version when commented out.
 ; Set a numeric version for your current SVN e.g 1.8, or 1.12
 ; Legacy available options are: pre-1.4-compatible, pre-1.5-compatible, pre-1.6-compatible, pre-1.8-compatible, pre-1.9-compatible
 #vcs.svn.compatible_version = 1.8
 
 ; Redis connection settings for svn integrations logic
 ; This connection string needs to be the same on ce and vcsserver
 vcs.svn.redis_conn = redis://redis:6379/0
 
 ; Enable SVN proxy of requests over HTTP
 vcs.svn.proxy.enabled = true
 
 ; host to connect to running SVN subsystem
 vcs.svn.proxy.host = http://svn:8090
 
 ; Enable or disable the config file generation.
 svn.proxy.generate_config = true
 
 ; Generate config file with `SVNListParentPath` set to `On`.
 svn.proxy.list_parent_path = true
 
 ; Set location and file name of generated config file.
 svn.proxy.config_file_path = /etc/rhodecode/conf/svn/mod_dav_svn.conf
 
 ; alternative mod_dav config template. This needs to be a valid mako template
 ; Example template can be found in the source code:
 ; rhodecode/apps/svn_support/templates/mod-dav-svn.conf.mako
 #svn.proxy.config_template = ~/.rccontrol/enterprise-1/custom_svn_conf.mako
 
 ; Used as a prefix to the `Location` block in the generated config file.
 ; In most cases it should be set to `/`.
 svn.proxy.location_root = /
 
 ; Command to reload the mod dav svn configuration on change.
 ; Example: `/etc/init.d/apache2 reload` or /home/USER/apache_reload.sh
 ; Make sure user who runs RhodeCode process is allowed to reload Apache
 #svn.proxy.reload_cmd = /etc/init.d/apache2 reload
 
 ; If the timeout expires before the reload command finishes, the command will
 ; be killed. Setting it to zero means no timeout. Defaults to 10 seconds.
 #svn.proxy.reload_timeout = 10
 
 ; ####################
 ; SSH Support Settings
 ; ####################
 
 ; Defines if a custom authorized_keys file should be created and written on
 ; any change user ssh keys. Setting this to false also disables possibility
 ; of adding SSH keys by users from web interface. Super admins can still
 ; manage SSH Keys.
 ssh.generate_authorized_keyfile = true
 
 ; Options for ssh, default is `no-pty,no-port-forwarding,no-X11-forwarding,no-agent-forwarding`
 # ssh.authorized_keys_ssh_opts =
 
 ; Path to the authorized_keys file where the generate entries are placed.
 ; It is possible to have multiple key files specified in `sshd_config` e.g.
 ; AuthorizedKeysFile %h/.ssh/authorized_keys %h/.ssh/authorized_keys_rhodecode
 ssh.authorized_keys_file_path = /etc/rhodecode/conf/ssh/authorized_keys_rhodecode
 
 ; Command to execute the SSH wrapper. The binary is available in the
 ; RhodeCode installation directory.
 ; legacy: /usr/local/bin/rhodecode_bin/bin/rc-ssh-wrapper
 ; new rewrite: /usr/local/bin/rhodecode_bin/bin/rc-ssh-wrapper-v2
 #DEPRECATED: ssh.wrapper_cmd = /usr/local/bin/rhodecode_bin/bin/rc-ssh-wrapper
 ssh.wrapper_cmd.v2 = /usr/local/bin/rhodecode_bin/bin/rc-ssh-wrapper-v2
 
 ; Allow shell when executing the ssh-wrapper command
 ssh.wrapper_cmd_allow_shell = false
 
 ; Enables logging, and detailed output send back to the client during SSH
 ; operations. Useful for debugging, shouldn't be used in production.
 ssh.enable_debug_logging = true
 
 ; Paths to binary executable, by default they are the names, but we can
 ; override them if we want to use a custom one
 ssh.executable.hg = /usr/local/bin/rhodecode_bin/vcs_bin/hg
 ssh.executable.git = /usr/local/bin/rhodecode_bin/vcs_bin/git
 ssh.executable.svn = /usr/local/bin/rhodecode_bin/vcs_bin/svnserve
 
 ; Enables SSH key generator web interface. Disabling this still allows users
 ; to add their own keys.
 ssh.enable_ui_key_generator = true
 
 ; Statsd client config, this is used to send metrics to statsd
 ; We recommend setting statsd_exported and scrape them using Prometheus
 #statsd.enabled = false
 #statsd.statsd_host = 0.0.0.0
 #statsd.statsd_port = 8125
 #statsd.statsd_prefix =
 #statsd.statsd_ipv6 = false
 
 ; configure logging automatically at server startup set to false
 ; to use the below custom logging config.
 ; RC_LOGGING_FORMATTER
 ; RC_LOGGING_LEVEL
 ; env variables can control the settings for logging in case of autoconfigure
 
 #logging.autoconfigure = true
 
 ; specify your own custom logging config file to configure logging
 #logging.logging_conf_file = /path/to/custom_logging.ini
 
 ; Dummy marker to add new entries after.
 ; Add any custom entries below. Please don't remove this marker.
 custom.conf = 1
 
 
 ; #####################
 ; LOGGING CONFIGURATION
 ; #####################
 
 [loggers]
 keys = root, sqlalchemy, beaker, celery, rhodecode, ssh_wrapper
 
 [handlers]
 keys = console, console_sql
 
 [formatters]
 keys = generic, json, color_formatter, color_formatter_sql
 
 ; #######
 ; LOGGERS
 ; #######
 [logger_root]
 level = NOTSET
 handlers = console
 
 [logger_sqlalchemy]
 level = INFO
 handlers = console_sql
 qualname = sqlalchemy.engine
 propagate = 0
 
 [logger_beaker]
 level = DEBUG
 handlers =
 qualname = beaker.container
 propagate = 1
 
 [logger_rhodecode]
 level = DEBUG
 handlers =
 qualname = rhodecode
 propagate = 1
 
 [logger_ssh_wrapper]
 level = DEBUG
 handlers =
 qualname = ssh_wrapper
 propagate = 1
 
 [logger_celery]
 level = DEBUG
 handlers =
 qualname = celery
 
 
 ; ########
 ; HANDLERS
 ; ########
 
 [handler_console]
 class = StreamHandler
 args = (sys.stderr, )
 level = DEBUG
 ; To enable JSON formatted logs replace 'generic/color_formatter' with 'json'
 ; This allows sending properly formatted logs to grafana loki or elasticsearch
 formatter = color_formatter
 
 [handler_console_sql]
 ; "level = DEBUG" logs SQL queries and results.
 ; "level = INFO" logs SQL queries.
 ; "level = WARN" logs neither.  (Recommended for production systems.)
 class = StreamHandler
 args = (sys.stderr, )
 level = WARN
 ; To enable JSON formatted logs replace 'generic/color_formatter_sql' with 'json'
 ; This allows sending properly formatted logs to grafana loki or elasticsearch
 formatter = color_formatter_sql
 
 ; ##########
 ; FORMATTERS
 ; ##########
 
 [formatter_generic]
 class = rhodecode.lib.logging_formatter.ExceptionAwareFormatter
 format = %(asctime)s.%(msecs)03d [%(process)d] %(levelname)-5.5s [%(name)s] %(message)s
 datefmt = %Y-%m-%d %H:%M:%S
 
 [formatter_color_formatter]
 class = rhodecode.lib.logging_formatter.ColorFormatter
 format = %(asctime)s.%(msecs)03d [%(process)d] %(levelname)-5.5s [%(name)s] %(message)s
 datefmt = %Y-%m-%d %H:%M:%S
 
 [formatter_color_formatter_sql]
 class = rhodecode.lib.logging_formatter.ColorFormatterSql
 format = %(asctime)s.%(msecs)03d [%(process)d] %(levelname)-5.5s [%(name)s] %(message)s
 datefmt = %Y-%m-%d %H:%M:%S
 
 [formatter_json]
 format = %(timestamp)s %(levelname)s %(name)s %(message)s %(req_id)s
 class = rhodecode.lib._vendor.jsonlogger.JsonFormatter

configs/production.ini

@@ -1,880 +1,883 b''
 
 ; #########################################
 ; RHODECODE COMMUNITY EDITION CONFIGURATION
 ; #########################################
 
 [DEFAULT]
 ; Debug flag sets all loggers to debug, and enables request tracking
 debug = false
 
 ; ########################################################################
 ; EMAIL CONFIGURATION
 ; These settings will be used by the RhodeCode mailing system
 ; ########################################################################
 
 ; prefix all emails subjects with given prefix, helps filtering out emails
 #email_prefix = [RhodeCode]
 
 ; email FROM address all mails will be sent
 #app_email_from = rhodecode-noreply@localhost
 
 #smtp_server = mail.server.com
 #smtp_username =
 #smtp_password =
 #smtp_port =
 #smtp_use_tls = false
 #smtp_use_ssl = true
 
 [server:main]
 ; COMMON HOST/IP CONFIG, This applies mostly to develop setup,
 ; Host port for gunicorn are controlled by gunicorn_conf.py
 host = 127.0.0.1
 port = 10020
 
 
 ; ###########################
 ; GUNICORN APPLICATION SERVER
 ; ###########################
 
 ; run with gunicorn  --config gunicorn_conf.py --paste rhodecode.ini
 
 ; Module to use, this setting shouldn't be changed
 use = egg:gunicorn#main
 
 ; Prefix middleware for RhodeCode.
 ; recommended when using proxy setup.
 ; allows to set RhodeCode under a prefix in server.
 ; eg https://server.com/custom_prefix. Enable `filter-with =` option below as well.
 ; And set your prefix like: `prefix = /custom_prefix`
 ; be sure to also set beaker.session.cookie_path = /custom_prefix if you need
 ; to make your cookies only work on prefix url
 [filter:proxy-prefix]
 use = egg:PasteDeploy#prefix
 prefix = /
 
 [app:main]
 ; The %(here)s variable will be replaced with the absolute path of parent directory
 ; of this file
 ; Each option in the app:main can be override by an environmental variable
 ;
 ;To override an option:
 ;
 ;RC_<KeyName>
 ;Everything should be uppercase, . and - should be replaced by _.
 ;For example, if you have these configuration settings:
 ;rc_cache.repo_object.backend = foo
 ;can be overridden by
 ;export RC_CACHE_REPO_OBJECT_BACKEND=foo
 
 use = egg:rhodecode-enterprise-ce
 
 ; enable proxy prefix middleware, defined above
 #filter-with = proxy-prefix
 
+; control if environmental variables to be expanded into the .ini settings
+#rhodecode.env_expand = true
+
 ; encryption key used to encrypt social plugin tokens,
 ; remote_urls with credentials etc, if not set it defaults to
 ; `beaker.session.secret`
 #rhodecode.encrypted_values.secret =
 
 ; decryption strict mode (enabled by default). It controls if decryption raises
 ; `SignatureVerificationError` in case of wrong key, or damaged encryption data.
 #rhodecode.encrypted_values.strict = false
 
 ; Pick algorithm for encryption. Either fernet (more secure) or aes (default)
 ; fernet is safer, and we strongly recommend switching to it.
 ; Due to backward compatibility aes is used as default.
 #rhodecode.encrypted_values.algorithm = fernet
 
 ; Return gzipped responses from RhodeCode (static files/application)
 gzip_responses = false
 
 ; Auto-generate javascript routes file on startup
 generate_js_files = false
 
 ; System global default language.
 ; All available languages: en (default), be, de, es, fr, it, ja, pl, pt, ru, zh
 lang = en
 
 ; Perform a full repository scan and import on each server start.
 ; Settings this to true could lead to very long startup time.
 startup.import_repos = false
 
 ; URL at which the application is running. This is used for Bootstrapping
 ; requests in context when no web request is available. Used in ishell, or
 ; SSH calls. Set this for events to receive proper url for SSH calls.
 app.base_url = http://rhodecode.local
 
 ; Host at which the Service API is running.
 app.service_api.host = http://rhodecode.local:10020
 
 ; Secret for Service API authentication.
 app.service_api.token =
 
 ; Unique application ID. Should be a random unique string for security.
 app_instance_uuid = rc-production
 
 ; Cut off limit for large diffs (size in bytes). If overall diff size on
 ; commit, or pull request exceeds this limit this diff will be displayed
 ; partially. E.g 512000 == 512Kb
 cut_off_limit_diff = 512000
 
 ; Cut off limit for large files inside diffs (size in bytes). Each individual
 ; file inside diff which exceeds this limit will be displayed partially.
 ;  E.g 128000 == 128Kb
 cut_off_limit_file = 128000
 
 ; Use cached version of vcs repositories everywhere. Recommended to be `true`
 vcs_full_cache = true
 
 ; Force https in RhodeCode, fixes https redirects, assumes it's always https.
 ; Normally this is controlled by proper flags sent from http server such as Nginx or Apache
 force_https = false
 
 ; use Strict-Transport-Security headers
 use_htsts = false
 
 ; Set to true if your repos are exposed using the dumb protocol
 git_update_server_info = false
 
 ; RSS/ATOM feed options
 rss_cut_off_limit = 256000
 rss_items_per_page = 10
 rss_include_diff = false
 
 ; gist URL alias, used to create nicer urls for gist. This should be an
 ; url that does rewrites to _admin/gists/{gistid}.
 ; example: http://gist.rhodecode.org/{gistid}. Empty means use the internal
 ; RhodeCode url, ie. http[s]://rhodecode.server/_admin/gists/{gistid}
 gist_alias_url =
 
 ; List of views (using glob pattern syntax) that AUTH TOKENS could be
 ; used for access.
 ; Adding ?auth_token=TOKEN_HASH to the url authenticates this request as if it
 ; came from the the logged in user who own this authentication token.
 ; Additionally @TOKEN syntax can be used to bound the view to specific
 ; authentication token. Such view would be only accessible when used together
 ; with this authentication token
 ; list of all views can be found under `/_admin/permissions/auth_token_access`
 ; The list should be "," separated and on a single line.
 ; Most common views to enable:
 
 #    RepoCommitsView:repo_commit_download
 #    RepoCommitsView:repo_commit_patch
 #    RepoCommitsView:repo_commit_raw
 #    RepoCommitsView:repo_commit_raw@TOKEN
 #    RepoFilesView:repo_files_diff
 #    RepoFilesView:repo_archivefile
 #    RepoFilesView:repo_file_raw
 #    GistView:*
 api_access_controllers_whitelist =
 
 ; Default encoding used to convert from and to unicode
 ; can be also a comma separated list of encoding in case of mixed encodings
 default_encoding = UTF-8
 
 ; instance-id prefix
 ; a prefix key for this instance used for cache invalidation when running
 ; multiple instances of RhodeCode, make sure it's globally unique for
 ; all running RhodeCode instances. Leave empty if you don't use it
 instance_id =
 
 ; Fallback authentication plugin. Set this to a plugin ID to force the usage
 ; of an authentication plugin also if it is disabled by it's settings.
 ; This could be useful if you are unable to log in to the system due to broken
 ; authentication settings. Then you can enable e.g. the internal RhodeCode auth
 ; module to log in again and fix the settings.
 ; Available builtin plugin IDs (hash is part of the ID):
 ; egg:rhodecode-enterprise-ce#rhodecode
 ; egg:rhodecode-enterprise-ce#pam
 ; egg:rhodecode-enterprise-ce#ldap
 ; egg:rhodecode-enterprise-ce#jasig_cas
 ; egg:rhodecode-enterprise-ce#headers
 ; egg:rhodecode-enterprise-ce#crowd
 
 #rhodecode.auth_plugin_fallback = egg:rhodecode-enterprise-ce#rhodecode
 
 ; Flag to control loading of legacy plugins in py:/path format
 auth_plugin.import_legacy_plugins = true
 
 ; alternative return HTTP header for failed authentication. Default HTTP
 ; response is 401 HTTPUnauthorized. Currently HG clients have troubles with
 ; handling that causing a series of failed authentication calls.
 ; Set this variable to 403 to return HTTPForbidden, or any other HTTP code
 ; This will be served instead of default 401 on bad authentication
 auth_ret_code =
 
 ; use special detection method when serving auth_ret_code, instead of serving
 ; ret_code directly, use 401 initially (Which triggers credentials prompt)
 ; and then serve auth_ret_code to clients
 auth_ret_code_detection = false
 
 ; locking return code. When repository is locked return this HTTP code. 2XX
 ; codes don't break the transactions while 4XX codes do
 lock_ret_code = 423
 
 ; Filesystem location were repositories should be stored
 repo_store.path = /var/opt/rhodecode_repo_store
 
 ; allows to setup custom hooks in settings page
 allow_custom_hooks_settings = true
 
 ; Generated license token required for EE edition license.
 ; New generated token value can be found in Admin > settings > license page.
 license_token =
 
 ; This flag hides sensitive information on the license page such as token, and license data
 license.hide_license_info = false
 
 ; Import EE license from this license path
 #license.import_path = %(here)s/rhodecode_enterprise.license
 
 ; import license 'if-missing' or 'force' (always override)
 ; if-missing means apply license if it doesn't exist. 'force' option always overrides it
 license.import_path_mode = if-missing
 
 ; supervisor connection uri, for managing supervisor and logs.
 supervisor.uri =
 
 ; supervisord group name/id we only want this RC instance to handle
 supervisor.group_id = prod
 
 ; Display extended labs settings
 labs_settings_active = true
 
 ; Custom exception store path, defaults to TMPDIR
 ; This is used to store exception from RhodeCode in shared directory
 #exception_tracker.store_path =
 
 ; Send email with exception details when it happens
 #exception_tracker.send_email = false
 
 ; Comma separated list of recipients for exception emails,
 ; e.g [e-mail],[e-mail]
 ; Can be left empty, then emails will be sent to ALL super-admins
 #exception_tracker.send_email_recipients =
 
 ; optional prefix to Add to email Subject
 #exception_tracker.email_prefix = [RHODECODE ERROR]
 
 ; NOTE: this setting IS DEPRECATED:
 ; file_store backend is always enabled
 #file_store.enabled = true
 
 ; NOTE: this setting IS DEPRECATED:
 ; file_store.backend = X -> use `file_store.backend.type = filesystem_v2` instead
 ; Storage backend, available options are: local
 #file_store.backend = local
 
 ; NOTE: this setting IS DEPRECATED:
 ; file_store.storage_path = X -> use `file_store.filesystem_v2.storage_path = X` instead
 ; path to store the uploaded binaries and artifacts
 #file_store.storage_path = /var/opt/rhodecode_data/file_store
 
 ; Artifacts file-store, is used to store comment attachments and artifacts uploads.
 ; file_store backend type: filesystem_v1, filesystem_v2 or objectstore (s3-based) are available as options
 ; filesystem_v1 is backwards compat with pre 5.1 storage changes
 ; new installations should choose filesystem_v2 or objectstore (s3-based), pick filesystem when migrating from
 ; previous installations to keep the artifacts without a need of migration
 #file_store.backend.type = filesystem_v2
 
 ; filesystem options...
 #file_store.filesystem_v1.storage_path = /var/opt/rhodecode_data/artifacts_file_store
 
 ; filesystem_v2 options...
 #file_store.filesystem_v2.storage_path = /var/opt/rhodecode_data/artifacts_file_store
 #file_store.filesystem_v2.shards = 8
 
 ; objectstore options...
 ; url for s3 compatible storage that allows to upload artifacts
 ; e.g http://minio:9000
 #file_store.backend.type = objectstore
 #file_store.objectstore.url = http://s3-minio:9000
 
 ; a top-level bucket to put all other shards in
 ; objects will be stored in rhodecode-file-store/shard-N based on the bucket_shards number
 #file_store.objectstore.bucket = rhodecode-file-store
 
 ; number of sharded buckets to create to distribute archives across
 ; default is 8 shards
 #file_store.objectstore.bucket_shards = 8
 
 ; key for s3 auth
 #file_store.objectstore.key = s3admin
 
 ; secret for s3 auth
 #file_store.objectstore.secret = s3secret4
 
 ;region for s3 storage
 #file_store.objectstore.region = eu-central-1
 
 ; Redis url to acquire/check generation of archives locks
 archive_cache.locking.url = redis://redis:6379/1
 
 ; Storage backend, only 'filesystem' and 'objectstore' are available now
 archive_cache.backend.type = filesystem
 
 ; url for s3 compatible storage that allows to upload artifacts
 ; e.g http://minio:9000
 archive_cache.objectstore.url = http://s3-minio:9000
 
 ; key for s3 auth
 archive_cache.objectstore.key = key
 
 ; secret for s3 auth
 archive_cache.objectstore.secret = secret
 
 ;region for s3 storage
 archive_cache.objectstore.region = eu-central-1
 
 ; number of sharded buckets to create to distribute archives across
 ; default is 8 shards
 archive_cache.objectstore.bucket_shards = 8
 
 ; a top-level bucket to put all other shards in
 ; objects will be stored in rhodecode-archive-cache/shard-N based on the bucket_shards number
 archive_cache.objectstore.bucket = rhodecode-archive-cache
 
 ; if true, this cache will try to retry with retry_attempts=N times waiting retry_backoff time
 archive_cache.objectstore.retry = false
 
 ; number of seconds to wait for next try using retry
 archive_cache.objectstore.retry_backoff = 1
 
 ; how many tries do do a retry fetch from this backend
 archive_cache.objectstore.retry_attempts = 10
 
 ; Default is $cache_dir/archive_cache if not set
 ; Generated repo archives will be cached at this location
 ; and served from the cache during subsequent requests for the same archive of
 ; the repository. This path is important to be shared across filesystems and with
 ; RhodeCode and vcsserver
 archive_cache.filesystem.store_dir = /var/opt/rhodecode_data/archive_cache
 
 ; The limit in GB sets how much data we cache before recycling last used, defaults to 10 gb
 archive_cache.filesystem.cache_size_gb = 40
 
 ; Eviction policy used to clear out after cache_size_gb limit is reached
 archive_cache.filesystem.eviction_policy = least-recently-stored
 
 ; By default cache uses sharding technique, this specifies how many shards are there
 ; default is 8 shards
 archive_cache.filesystem.cache_shards = 8
 
 ; if true, this cache will try to retry with retry_attempts=N times waiting retry_backoff time
 archive_cache.filesystem.retry = false
 
 ; number of seconds to wait for next try using retry
 archive_cache.filesystem.retry_backoff = 1
 
 ; how many tries do do a retry fetch from this backend
 archive_cache.filesystem.retry_attempts = 10
 
 
 ; #############
 ; CELERY CONFIG
 ; #############
 
 ; manually run celery: /path/to/celery worker --task-events --beat --app rhodecode.lib.celerylib.loader --scheduler rhodecode.lib.celerylib.scheduler.RcScheduler --loglevel DEBUG --ini /path/to/rhodecode.ini
 
 use_celery = true
 
 ; path to store schedule database
 #celerybeat-schedule.path =
 
 ; connection url to the message broker (default redis)
 celery.broker_url = redis://redis:6379/8
 
 ; results backend to get results for (default redis)
 celery.result_backend = redis://redis:6379/8
 
 ; rabbitmq example
 #celery.broker_url = amqp://rabbitmq:qweqwe@localhost:5672/rabbitmqhost
 
 ; maximum tasks to execute before worker restart
 celery.max_tasks_per_child = 20
 
 ; tasks will never be sent to the queue, but executed locally instead.
 celery.task_always_eager = false
 
 ; #############
 ; DOGPILE CACHE
 ; #############
 
 ; Default cache dir for caches. Putting this into a ramdisk can boost performance.
 ; eg. /tmpfs/data_ramdisk, however this directory might require large amount of space
 cache_dir = /var/opt/rhodecode_data
 
 ; *********************************************
 ; `sql_cache_short` cache for heavy SQL queries
 ; Only supported backend is `memory_lru`
 ; *********************************************
 rc_cache.sql_cache_short.backend = dogpile.cache.rc.memory_lru
 rc_cache.sql_cache_short.expiration_time = 30
 
 
 ; *****************************************************
 ; `cache_repo_longterm` cache for repo object instances
 ; Only supported backend is `memory_lru`
 ; *****************************************************
 rc_cache.cache_repo_longterm.backend = dogpile.cache.rc.memory_lru
 ; by default we use 30 Days, cache is still invalidated on push
 rc_cache.cache_repo_longterm.expiration_time = 2592000
 ; max items in LRU cache, set to smaller number to save memory, and expire last used caches
 rc_cache.cache_repo_longterm.max_size = 10000
 
 
 ; *********************************************
 ; `cache_general` cache for general purpose use
 ; for simplicity use rc.file_namespace backend,
 ; for performance and scale use rc.redis
 ; *********************************************
 rc_cache.cache_general.backend = dogpile.cache.rc.file_namespace
 rc_cache.cache_general.expiration_time = 43200
 ; file cache store path. Defaults to `cache_dir =` value or tempdir if both values are not set
 #rc_cache.cache_general.arguments.filename = /tmp/cache_general_db
 
 ; alternative `cache_general` redis backend with distributed lock
 #rc_cache.cache_general.backend = dogpile.cache.rc.redis
 #rc_cache.cache_general.expiration_time = 300
 
 ; redis_expiration_time needs to be greater then expiration_time
 #rc_cache.cache_general.arguments.redis_expiration_time = 7200
 
 #rc_cache.cache_general.arguments.host = localhost
 #rc_cache.cache_general.arguments.port = 6379
 #rc_cache.cache_general.arguments.db = 0
 #rc_cache.cache_general.arguments.socket_timeout = 30
 ; more Redis options: https://dogpilecache.sqlalchemy.org/en/latest/api.html#redis-backends
 #rc_cache.cache_general.arguments.distributed_lock = true
 
 ; auto-renew lock to prevent stale locks, slower but safer. Use only if problems happen
 #rc_cache.cache_general.arguments.lock_auto_renewal = true
 
 ; *************************************************
 ; `cache_perms` cache for permission tree, auth TTL
 ; for simplicity use rc.file_namespace backend,
 ; for performance and scale use rc.redis
 ; *************************************************
 rc_cache.cache_perms.backend = dogpile.cache.rc.file_namespace
 rc_cache.cache_perms.expiration_time = 3600
 ; file cache store path. Defaults to `cache_dir =` value or tempdir if both values are not set
 #rc_cache.cache_perms.arguments.filename = /tmp/cache_perms_db
 
 ; alternative `cache_perms` redis backend with distributed lock
 #rc_cache.cache_perms.backend = dogpile.cache.rc.redis
 #rc_cache.cache_perms.expiration_time = 300
 
 ; redis_expiration_time needs to be greater then expiration_time
 #rc_cache.cache_perms.arguments.redis_expiration_time = 7200
 
 #rc_cache.cache_perms.arguments.host = localhost
 #rc_cache.cache_perms.arguments.port = 6379
 #rc_cache.cache_perms.arguments.db = 0
 #rc_cache.cache_perms.arguments.socket_timeout = 30
 ; more Redis options: https://dogpilecache.sqlalchemy.org/en/latest/api.html#redis-backends
 #rc_cache.cache_perms.arguments.distributed_lock = true
 
 ; auto-renew lock to prevent stale locks, slower but safer. Use only if problems happen
 #rc_cache.cache_perms.arguments.lock_auto_renewal = true
 
 ; ***************************************************
 ; `cache_repo` cache for file tree, Readme, RSS FEEDS
 ; for simplicity use rc.file_namespace backend,
 ; for performance and scale use rc.redis
 ; ***************************************************
 rc_cache.cache_repo.backend = dogpile.cache.rc.file_namespace
 rc_cache.cache_repo.expiration_time = 2592000
 ; file cache store path. Defaults to `cache_dir =` value or tempdir if both values are not set
 #rc_cache.cache_repo.arguments.filename = /tmp/cache_repo_db
 
 ; alternative `cache_repo` redis backend with distributed lock
 #rc_cache.cache_repo.backend = dogpile.cache.rc.redis
 #rc_cache.cache_repo.expiration_time = 2592000
 
 ; redis_expiration_time needs to be greater then expiration_time
 #rc_cache.cache_repo.arguments.redis_expiration_time = 2678400
 
 #rc_cache.cache_repo.arguments.host = localhost
 #rc_cache.cache_repo.arguments.port = 6379
 #rc_cache.cache_repo.arguments.db = 1
 #rc_cache.cache_repo.arguments.socket_timeout = 30
 ; more Redis options: https://dogpilecache.sqlalchemy.org/en/latest/api.html#redis-backends
 #rc_cache.cache_repo.arguments.distributed_lock = true
 
 ; auto-renew lock to prevent stale locks, slower but safer. Use only if problems happen
 #rc_cache.cache_repo.arguments.lock_auto_renewal = true
 
 ; ##############
 ; BEAKER SESSION
 ; ##############
 
 ; beaker.session.type is type of storage options for the logged users sessions. Current allowed
 ; types are file, ext:redis, ext:database, ext:memcached
 ; Fastest ones are ext:redis and ext:database, DO NOT use memory type for session
 #beaker.session.type = file
 #beaker.session.data_dir = %(here)s/data/sessions
 
 ; Redis based sessions
 beaker.session.type = ext:redis
 beaker.session.url = redis://redis:6379/2
 
 ; DB based session, fast, and allows easy management over logged in users
 #beaker.session.type = ext:database
 #beaker.session.table_name = db_session
 #beaker.session.sa.url = postgresql://postgres:secret@localhost/rhodecode
 #beaker.session.sa.url = mysql://root:secret@127.0.0.1/rhodecode
 #beaker.session.sa.pool_recycle = 3600
 #beaker.session.sa.echo = false
 
 beaker.session.key = rhodecode
 beaker.session.secret = production-rc-uytcxaz
 beaker.session.lock_dir = /data_ramdisk/lock
 
 ; Secure encrypted cookie. Requires AES and AES python libraries
 ; you must disable beaker.session.secret to use this
 #beaker.session.encrypt_key = key_for_encryption
 #beaker.session.validate_key = validation_key
 
 ; Sets session as invalid (also logging out user) if it haven not been
 ; accessed for given amount of time in seconds
 beaker.session.timeout = 2592000
 beaker.session.httponly = true
 
 ; Path to use for the cookie. Set to prefix if you use prefix middleware
 #beaker.session.cookie_path = /custom_prefix
 
 ; Set https secure cookie
 beaker.session.secure = false
 
 ; default cookie expiration time in seconds, set to `true` to set expire
 ; at browser close
 #beaker.session.cookie_expires = 3600
 
 ; #############################
 ; SEARCH INDEXING CONFIGURATION
 ; #############################
 
 ; Full text search indexer is available in rhodecode-tools under
 ; `rhodecode-tools index` command
 
 ; WHOOSH Backend, doesn't require additional services to run
 ; it works good with few dozen repos
 search.module = rhodecode.lib.index.whoosh
 search.location = %(here)s/data/index
 
 ; ####################
 ; CHANNELSTREAM CONFIG
 ; ####################
 
 ; channelstream enables persistent connections and live notification
 ; in the system. It's also used by the chat system
 
 channelstream.enabled = true
 
 ; server address for channelstream server on the backend
 channelstream.server = channelstream:9800
 
 ; location of the channelstream server from outside world
 ; use ws:// for http or wss:// for https. This address needs to be handled
 ; by external HTTP server such as Nginx or Apache
 ; see Nginx/Apache configuration examples in our docs
 channelstream.ws_url = ws://rhodecode.yourserver.com/_channelstream
 channelstream.secret = ENV_GENERATED
 channelstream.history.location = /var/opt/rhodecode_data/channelstream_history
 
 ; Internal application path that Javascript uses to connect into.
 ; If you use proxy-prefix the prefix should be added before /_channelstream
 channelstream.proxy_path = /_channelstream
 
 
 ; ##############################
 ; MAIN RHODECODE DATABASE CONFIG
 ; ##############################
 
 #sqlalchemy.db1.url = sqlite:///%(here)s/rhodecode.db?timeout=30
 #sqlalchemy.db1.url = postgresql://postgres:qweqwe@localhost/rhodecode
 #sqlalchemy.db1.url = mysql://root:qweqwe@localhost/rhodecode?charset=utf8
 ; pymysql is an alternative driver for MySQL, use in case of problems with default one
 #sqlalchemy.db1.url = mysql+pymysql://root:qweqwe@localhost/rhodecode
 
 sqlalchemy.db1.url = postgresql://postgres:qweqwe@localhost/rhodecode
 
 ; see sqlalchemy docs for other advanced settings
 ; print the sql statements to output
 sqlalchemy.db1.echo = false
 
 ; recycle the connections after this amount of seconds
 sqlalchemy.db1.pool_recycle = 3600
 
 ; the number of connections to keep open inside the connection pool.
 ; 0 indicates no limit
 ; the general calculus with gevent is:
 ; if your system allows 500 concurrent greenlets (max_connections) that all do database access,
 ; then increase pool size + max overflow so that they add up to 500.
 #sqlalchemy.db1.pool_size = 5
 
 ; The number of connections to allow in connection pool "overflow", that is
 ; connections that can be opened above and beyond the pool_size setting,
 ; which defaults to five.
 #sqlalchemy.db1.max_overflow = 10
 
 ; Connection check ping, used to detect broken database connections
 ; could be enabled to better handle cases if MySQL has gone away errors
 #sqlalchemy.db1.ping_connection = true
 
 ; ##########
 ; VCS CONFIG
 ; ##########
 vcs.server.enable = true
 vcs.server = vcsserver:10010
 
 ; Web server connectivity protocol, responsible for web based VCS operations
 ; Available protocols are:
 ; `http` - use http-rpc backend (default)
 vcs.server.protocol = http
 
 ; Push/Pull operations protocol, available options are:
 ; `http` - use http-rpc backend (default)
 vcs.scm_app_implementation = http
 
 ; Push/Pull operations hooks protocol, available options are:
 ; `http` - use http-rpc backend (default)
 ; `celery` - use celery based hooks
 #DEPRECATED:vcs.hooks.protocol = http
 vcs.hooks.protocol.v2 = celery
 
 ; Host on which this instance is listening for hooks. vcsserver will call this host to pull/push hooks so it should be
 ; accessible via network.
 ; Use vcs.hooks.host = "*" to bind to current hostname (for Docker)
 vcs.hooks.host = *
 
 ; Start VCSServer with this instance as a subprocess, useful for development
 vcs.start_server = false
 
 ; List of enabled VCS backends, available options are:
 ; `hg`  - mercurial
 ; `git` - git
 ; `svn` - subversion
 vcs.backends = hg, git, svn
 
 ; Wait this number of seconds before killing connection to the vcsserver
 vcs.connection_timeout = 3600
 
 ; Cache flag to cache vcsserver remote calls locally
 ; It uses cache_region `cache_repo`
 vcs.methods.cache = true
 
 ; Filesystem location where Git lfs objects should be stored
 vcs.git.lfs.storage_location = /var/opt/rhodecode_repo_store/.cache/git_lfs_store
 
 ; Filesystem location where Mercurial largefile objects should be stored
 vcs.hg.largefiles.storage_location = /var/opt/rhodecode_repo_store/.cache/hg_largefiles_store
 
 ; ####################################################
 ; Subversion proxy support (mod_dav_svn)
 ; Maps RhodeCode repo groups into SVN paths for Apache
 ; ####################################################
 
 ; Compatibility version when creating SVN repositories. Defaults to newest version when commented out.
 ; Set a numeric version for your current SVN e.g 1.8, or 1.12
 ; Legacy available options are: pre-1.4-compatible, pre-1.5-compatible, pre-1.6-compatible, pre-1.8-compatible, pre-1.9-compatible
 #vcs.svn.compatible_version = 1.8
 
 ; Redis connection settings for svn integrations logic
 ; This connection string needs to be the same on ce and vcsserver
 vcs.svn.redis_conn = redis://redis:6379/0
 
 ; Enable SVN proxy of requests over HTTP
 vcs.svn.proxy.enabled = true
 
 ; host to connect to running SVN subsystem
 vcs.svn.proxy.host = http://svn:8090
 
 ; Enable or disable the config file generation.
 svn.proxy.generate_config = true
 
 ; Generate config file with `SVNListParentPath` set to `On`.
 svn.proxy.list_parent_path = true
 
 ; Set location and file name of generated config file.
 svn.proxy.config_file_path = /etc/rhodecode/conf/svn/mod_dav_svn.conf
 
 ; alternative mod_dav config template. This needs to be a valid mako template
 ; Example template can be found in the source code:
 ; rhodecode/apps/svn_support/templates/mod-dav-svn.conf.mako
 #svn.proxy.config_template = ~/.rccontrol/enterprise-1/custom_svn_conf.mako
 
 ; Used as a prefix to the `Location` block in the generated config file.
 ; In most cases it should be set to `/`.
 svn.proxy.location_root = /
 
 ; Command to reload the mod dav svn configuration on change.
 ; Example: `/etc/init.d/apache2 reload` or /home/USER/apache_reload.sh
 ; Make sure user who runs RhodeCode process is allowed to reload Apache
 #svn.proxy.reload_cmd = /etc/init.d/apache2 reload
 
 ; If the timeout expires before the reload command finishes, the command will
 ; be killed. Setting it to zero means no timeout. Defaults to 10 seconds.
 #svn.proxy.reload_timeout = 10
 
 ; ####################
 ; SSH Support Settings
 ; ####################
 
 ; Defines if a custom authorized_keys file should be created and written on
 ; any change user ssh keys. Setting this to false also disables possibility
 ; of adding SSH keys by users from web interface. Super admins can still
 ; manage SSH Keys.
 ssh.generate_authorized_keyfile = true
 
 ; Options for ssh, default is `no-pty,no-port-forwarding,no-X11-forwarding,no-agent-forwarding`
 # ssh.authorized_keys_ssh_opts =
 
 ; Path to the authorized_keys file where the generate entries are placed.
 ; It is possible to have multiple key files specified in `sshd_config` e.g.
 ; AuthorizedKeysFile %h/.ssh/authorized_keys %h/.ssh/authorized_keys_rhodecode
 ssh.authorized_keys_file_path = /etc/rhodecode/conf/ssh/authorized_keys_rhodecode
 
 ; Command to execute the SSH wrapper. The binary is available in the
 ; RhodeCode installation directory.
 ; legacy: /usr/local/bin/rhodecode_bin/bin/rc-ssh-wrapper
 ; new rewrite: /usr/local/bin/rhodecode_bin/bin/rc-ssh-wrapper-v2
 #DEPRECATED: ssh.wrapper_cmd = /usr/local/bin/rhodecode_bin/bin/rc-ssh-wrapper
 ssh.wrapper_cmd.v2 = /usr/local/bin/rhodecode_bin/bin/rc-ssh-wrapper-v2
 
 ; Allow shell when executing the ssh-wrapper command
 ssh.wrapper_cmd_allow_shell = false
 
 ; Enables logging, and detailed output send back to the client during SSH
 ; operations. Useful for debugging, shouldn't be used in production.
 ssh.enable_debug_logging = false
 
 ; Paths to binary executable, by default they are the names, but we can
 ; override them if we want to use a custom one
 ssh.executable.hg = /usr/local/bin/rhodecode_bin/vcs_bin/hg
 ssh.executable.git = /usr/local/bin/rhodecode_bin/vcs_bin/git
 ssh.executable.svn = /usr/local/bin/rhodecode_bin/vcs_bin/svnserve
 
 ; Enables SSH key generator web interface. Disabling this still allows users
 ; to add their own keys.
 ssh.enable_ui_key_generator = true
 
 ; Statsd client config, this is used to send metrics to statsd
 ; We recommend setting statsd_exported and scrape them using Prometheus
 #statsd.enabled = false
 #statsd.statsd_host = 0.0.0.0
 #statsd.statsd_port = 8125
 #statsd.statsd_prefix =
 #statsd.statsd_ipv6 = false
 
 ; configure logging automatically at server startup set to false
 ; to use the below custom logging config.
 ; RC_LOGGING_FORMATTER
 ; RC_LOGGING_LEVEL
 ; env variables can control the settings for logging in case of autoconfigure
 
 #logging.autoconfigure = true
 
 ; specify your own custom logging config file to configure logging
 #logging.logging_conf_file = /path/to/custom_logging.ini
 
 ; Dummy marker to add new entries after.
 ; Add any custom entries below. Please don't remove this marker.
 custom.conf = 1
 
 
 ; #####################
 ; LOGGING CONFIGURATION
 ; #####################
 
 [loggers]
 keys = root, sqlalchemy, beaker, celery, rhodecode, ssh_wrapper
 
 [handlers]
 keys = console, console_sql
 
 [formatters]
 keys = generic, json, color_formatter, color_formatter_sql
 
 ; #######
 ; LOGGERS
 ; #######
 [logger_root]
 level = NOTSET
 handlers = console
 
 [logger_sqlalchemy]
 level = INFO
 handlers = console_sql
 qualname = sqlalchemy.engine
 propagate = 0
 
 [logger_beaker]
 level = DEBUG
 handlers =
 qualname = beaker.container
 propagate = 1
 
 [logger_rhodecode]
 level = DEBUG
 handlers =
 qualname = rhodecode
 propagate = 1
 
 [logger_ssh_wrapper]
 level = DEBUG
 handlers =
 qualname = ssh_wrapper
 propagate = 1
 
 [logger_celery]
 level = DEBUG
 handlers =
 qualname = celery
 
 
 ; ########
 ; HANDLERS
 ; ########
 
 [handler_console]
 class = StreamHandler
 args = (sys.stderr, )
 level = INFO
 ; To enable JSON formatted logs replace 'generic/color_formatter' with 'json'
 ; This allows sending properly formatted logs to grafana loki or elasticsearch
 formatter = generic
 
 [handler_console_sql]
 ; "level = DEBUG" logs SQL queries and results.
 ; "level = INFO" logs SQL queries.
 ; "level = WARN" logs neither.  (Recommended for production systems.)
 class = StreamHandler
 args = (sys.stderr, )
 level = WARN
 ; To enable JSON formatted logs replace 'generic/color_formatter_sql' with 'json'
 ; This allows sending properly formatted logs to grafana loki or elasticsearch
 formatter = generic
 
 ; ##########
 ; FORMATTERS
 ; ##########
 
 [formatter_generic]
 class = rhodecode.lib.logging_formatter.ExceptionAwareFormatter
 format = %(asctime)s.%(msecs)03d [%(process)d] %(levelname)-5.5s [%(name)s] %(message)s
 datefmt = %Y-%m-%d %H:%M:%S
 
 [formatter_color_formatter]
 class = rhodecode.lib.logging_formatter.ColorFormatter
 format = %(asctime)s.%(msecs)03d [%(process)d] %(levelname)-5.5s [%(name)s] %(message)s
 datefmt = %Y-%m-%d %H:%M:%S
 
 [formatter_color_formatter_sql]
 class = rhodecode.lib.logging_formatter.ColorFormatterSql
 format = %(asctime)s.%(msecs)03d [%(process)d] %(levelname)-5.5s [%(name)s] %(message)s
 datefmt = %Y-%m-%d %H:%M:%S
 
 [formatter_json]
 format = %(timestamp)s %(levelname)s %(name)s %(message)s %(req_id)s
 class = rhodecode.lib._vendor.jsonlogger.JsonFormatter

docs/release-notes/release-notes.rst

@@ -1,175 +1,177 b''
 .. _rhodecode-release-notes-ref:
 
 Release Notes
 =============
 
 |RCE| 5.x Versions
 ------------------
 
 .. toctree::
    :maxdepth: 1
 
+   release-notes-5.3.0.rst
+   release-notes-5.2.1.rst
    release-notes-5.2.0.rst
    release-notes-5.1.2.rst
    release-notes-5.1.1.rst
    release-notes-5.1.0.rst
    release-notes-5.0.3.rst
    release-notes-5.0.2.rst
    release-notes-5.0.1.rst
    release-notes-5.0.0.rst
 
 
 |RCE| 4.x Versions
 ------------------
 
 .. toctree::
    :maxdepth: 1
 
    release-notes-4.27.1.rst
    release-notes-4.27.0.rst
    release-notes-4.26.0.rst
    release-notes-4.25.2.rst
    release-notes-4.25.1.rst
    release-notes-4.25.0.rst
    release-notes-4.24.1.rst
    release-notes-4.24.0.rst
    release-notes-4.23.2.rst
    release-notes-4.23.1.rst
    release-notes-4.23.0.rst
    release-notes-4.22.0.rst
    release-notes-4.21.0.rst
    release-notes-4.20.1.rst
    release-notes-4.20.0.rst
    release-notes-4.19.3.rst
    release-notes-4.19.2.rst
    release-notes-4.19.1.rst
    release-notes-4.19.0.rst
    release-notes-4.18.3.rst
    release-notes-4.18.2.rst
    release-notes-4.18.1.rst
    release-notes-4.18.0.rst
    release-notes-4.17.4.rst
    release-notes-4.17.3.rst
    release-notes-4.17.2.rst
    release-notes-4.17.1.rst
    release-notes-4.17.0.rst
    release-notes-4.16.2.rst
    release-notes-4.16.1.rst
    release-notes-4.16.0.rst
    release-notes-4.15.2.rst
    release-notes-4.15.1.rst
    release-notes-4.15.0.rst
    release-notes-4.14.1.rst
    release-notes-4.14.0.rst
    release-notes-4.13.3.rst
    release-notes-4.13.2.rst
    release-notes-4.13.1.rst
    release-notes-4.13.0.rst
    release-notes-4.12.4.rst
    release-notes-4.12.3.rst
    release-notes-4.12.2.rst
    release-notes-4.12.1.rst
    release-notes-4.12.0.rst
    release-notes-4.11.6.rst
    release-notes-4.11.5.rst
    release-notes-4.11.4.rst
    release-notes-4.11.3.rst
    release-notes-4.11.2.rst
    release-notes-4.11.1.rst
    release-notes-4.11.0.rst
    release-notes-4.10.6.rst
    release-notes-4.10.5.rst
    release-notes-4.10.4.rst
    release-notes-4.10.3.rst
    release-notes-4.10.2.rst
    release-notes-4.10.1.rst
    release-notes-4.10.0.rst
    release-notes-4.9.1.rst
    release-notes-4.9.0.rst
    release-notes-4.8.0.rst
    release-notes-4.7.2.rst
    release-notes-4.7.1.rst
    release-notes-4.7.0.rst
    release-notes-4.6.1.rst
    release-notes-4.6.0.rst
    release-notes-4.5.2.rst
    release-notes-4.5.1.rst
    release-notes-4.5.0.rst
    release-notes-4.4.2.rst
    release-notes-4.4.1.rst
    release-notes-4.4.0.rst
    release-notes-4.3.1.rst
    release-notes-4.3.0.rst
    release-notes-4.2.1.rst
    release-notes-4.2.0.rst
    release-notes-4.1.2.rst
    release-notes-4.1.1.rst
    release-notes-4.1.0.rst
    release-notes-4.0.1.rst
    release-notes-4.0.0.rst
 
 |RCE| 3.x Versions
 ------------------
 
 .. toctree::
    :maxdepth: 1
 
    release-notes-3.8.4.rst
    release-notes-3.8.3.rst
    release-notes-3.8.2.rst
    release-notes-3.8.1.rst
    release-notes-3.8.0.rst
    release-notes-3.7.1.rst
    release-notes-3.7.0.rst
    release-notes-3.6.1.rst
    release-notes-3.6.0.rst
    release-notes-3.5.2.rst
    release-notes-3.5.1.rst
    release-notes-3.5.0.rst
    release-notes-3.4.1.rst
    release-notes-3.4.0.rst
    release-notes-3.3.4.rst
    release-notes-3.3.3.rst
    release-notes-3.3.2.rst
    release-notes-3.3.1.rst
    release-notes-3.3.0.rst
    release-notes-3.2.3.rst
    release-notes-3.2.2.rst
    release-notes-3.2.1.rst
    release-notes-3.2.0.rst
    release-notes-3.1.1.rst
    release-notes-3.1.0.rst
    release-notes-3.0.2.rst
    release-notes-3.0.1.rst
    release-notes-3.0.0.rst
 
 |RCE| 2.x Versions
 ------------------
 
 .. toctree::
    :maxdepth: 1
 
    release-notes-2.2.8.rst
    release-notes-2.2.7.rst
    release-notes-2.2.6.rst
    release-notes-2.2.5.rst
    release-notes-2.2.4.rst
    release-notes-2.2.3.rst
    release-notes-2.2.2.rst
    release-notes-2.2.1.rst
    release-notes-2.2.0.rst
    release-notes-2.1.0.rst
    release-notes-2.0.2.rst
    release-notes-2.0.1.rst
    release-notes-2.0.0.rst
 
 |RCE| 1.x Versions
 ------------------
 
 .. toctree::
    :maxdepth: 1
 
    release-notes-1.7.2.rst
    release-notes-1.7.1.rst
    release-notes-1.7.0.rst
    release-notes-1.6.0.rst

rhodecode/VERSION

@@ -1,1 +1,1 b''
-5.2.1
  No newline at end of file
+5.3.0

rhodecode/apps/admin/views/system_info.py

@@ -1,249 +1,253 b''
 
 
 # Copyright (C) 2016-2023 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import logging
 import urllib.request
 import urllib.error
 import urllib.parse
 import os
 
 import rhodecode
 from rhodecode.apps._base import BaseAppView
 from rhodecode.apps._base.navigation import navigation_list
 from rhodecode.lib import helpers as h
 from rhodecode.lib.auth import (LoginRequired, HasPermissionAllDecorator)
 from rhodecode.lib.utils2 import str2bool
 from rhodecode.lib import system_info
 from rhodecode.model.update import UpdateModel
 
 log = logging.getLogger(__name__)
 
 
 class AdminSystemInfoSettingsView(BaseAppView):
     def load_default_context(self):
         c = self._get_local_tmpl_context()
         return c
 
     def get_env_data(self):
         black_list = [
             'NIX_LDFLAGS',
             'NIX_CFLAGS_COMPILE',
             'propagatedBuildInputs',
             'propagatedNativeBuildInputs',
             'postInstall',
             'buildInputs',
             'buildPhase',
             'preShellHook',
             'preShellHook',
             'preCheck',
             'preBuild',
             'postShellHook',
             'postFixup',
             'postCheck',
             'nativeBuildInputs',
             'installPhase',
             'installCheckPhase',
             'checkPhase',
             'configurePhase',
             'shellHook'
         ]
         secret_list = [
             'RHODECODE_USER_PASS'
         ]
 
         for k, v in sorted(os.environ.items()):
             if k in black_list:
                 continue
             if k in secret_list:
                 v = '*****'
             yield k, v
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     def settings_system_info(self):
         _ = self.request.translate
         c = self.load_default_context()
 
         c.active = 'system'
         c.navlist = navigation_list(self.request)
 
         # TODO(marcink), figure out how to allow only selected users to do this
         c.allowed_to_snapshot = self._rhodecode_user.admin
 
         snapshot = str2bool(self.request.params.get('snapshot'))
 
         c.rhodecode_update_url = UpdateModel().get_update_url()
         c.env_data = self.get_env_data()
         server_info = system_info.get_system_info(self.request.environ)
 
         for key, val in server_info.items():
             setattr(c, key, val)
 
         def val(name, subkey='human_value'):
             return server_info[name][subkey]
 
         def state(name):
             return server_info[name]['state']
 
         def val2(name):
             val = server_info[name]['human_value']
             state = server_info[name]['state']
             return val, state
 
         update_info_msg = _('Note: please make sure this server can '
                             'access `${url}` for the update link to work',
                             mapping=dict(url=c.rhodecode_update_url))
         version = UpdateModel().get_stored_version()
         is_outdated = UpdateModel().is_outdated(
             rhodecode.__version__, version)
         update_state = {
             'type': 'warning',
             'message': 'New version available: {}'.format(version)
             } \
             if is_outdated else {}
         c.data_items = [
             # update info
             (_('Update info'), h.literal(
                 '<span class="link" id="check_for_update" >%s.</span>' % (
                 _('Check for updates')) +
                 '<br/> <span >%s.</span>' % (update_info_msg)
             ), ''),
 
             # RhodeCode specific
             (_('RhodeCode Version'), val('rhodecode_app')['text'], state('rhodecode_app')),
             (_('Latest version'), version, update_state),
             (_('RhodeCode Base URL'), val('rhodecode_config')['config'].get('app.base_url'), state('rhodecode_config')),
             (_('RhodeCode Server IP'), val('server')['server_ip'], state('server')),
             (_('RhodeCode Server ID'), val('server')['server_id'], state('server')),
             (_('RhodeCode Configuration'), val('rhodecode_config')['path'], state('rhodecode_config')),
             (_('RhodeCode Certificate'), val('rhodecode_config')['cert_path'], state('rhodecode_config')),
             (_('Workers'), val('rhodecode_config')['config']['server:main'].get('workers', '?'), state('rhodecode_config')),
             (_('Worker Type'), val('rhodecode_config')['config']['server:main'].get('worker_class', 'sync'), state('rhodecode_config')),
             ('', '', ''),  # spacer
 
             # Database
             (_('Database'), val('database')['url'], state('database')),
             (_('Database version'), val('database')['version'], state('database')),
             ('', '', ''),  # spacer
 
             # Platform/Python
             (_('Platform'), val('platform')['name'], state('platform')),
             (_('Platform UUID'), val('platform')['uuid'], state('platform')),
             (_('Lang'), val('locale'), state('locale')),
             (_('Python version'), val('python')['version'], state('python')),
             (_('Python path'), val('python')['executable'], state('python')),
             ('', '', ''),  # spacer
 
             # Systems stats
             (_('CPU'), val('cpu')['text'], state('cpu')),
             (_('Load'), val('load')['text'], state('load')),
             (_('Memory'), val('memory')['text'], state('memory')),
             (_('Uptime'), val('uptime')['text'], state('uptime')),
             ('', '', ''),  # spacer
 
             # ulimit
             (_('Ulimit'), val('ulimit')['text'], state('ulimit')),
 
             # Repo storage
             (_('Storage location'), val('storage')['path'], state('storage')),
             (_('Storage info'), val('storage')['text'], state('storage')),
             (_('Storage inodes'), val('storage_inodes')['text'], state('storage_inodes')),
             ('', '', ''),  # spacer
 
             (_('Gist storage location'), val('storage_gist')['path'], state('storage_gist')),
             (_('Gist storage info'), val('storage_gist')['text'], state('storage_gist')),
             ('', '', ''),  # spacer
 
             (_('Artifacts storage backend'), val('storage_artifacts')['type'], state('storage_artifacts')),
             (_('Artifacts storage location'), val('storage_artifacts')['path'], state('storage_artifacts')),
             (_('Artifacts info'), val('storage_artifacts')['text'], state('storage_artifacts')),
             ('', '', ''),  # spacer
 
             (_('Archive cache storage backend'), val('storage_archive')['type'], state('storage_archive')),
             (_('Archive cache storage location'), val('storage_archive')['path'], state('storage_archive')),
             (_('Archive cache info'), val('storage_archive')['text'], state('storage_archive')),
             ('', '', ''),  # spacer
 
 
             (_('Temp storage location'), val('storage_temp')['path'], state('storage_temp')),
             (_('Temp storage info'), val('storage_temp')['text'], state('storage_temp')),
             ('', '', ''),  # spacer
 
             (_('Search info'), val('search')['text'], state('search')),
             (_('Search location'), val('search')['location'], state('search')),
             ('', '', ''),  # spacer
 
             # VCS specific
             (_('VCS Backends'), val('vcs_backends'), state('vcs_backends')),
             (_('VCS Server'), val('vcs_server')['text'], state('vcs_server')),
             (_('GIT'), val('git'), state('git')),
             (_('HG'), val('hg'), state('hg')),
             (_('SVN'), val('svn'), state('svn')),
 
         ]
 
+        c.rhodecode_data_items = [
+            (k, v) for k, v in sorted((val('rhodecode_server_config') or {}).items(), key=lambda x: x[0].lower())
+        ]
+
         c.vcsserver_data_items = [
-            (k, v) for k, v in (val('vcs_server_config') or {}).items()
+            (k, v) for k, v in sorted((val('vcs_server_config') or {}).items(), key=lambda x: x[0].lower())
         ]
 
         if snapshot:
             if c.allowed_to_snapshot:
                 c.data_items.pop(0)  # remove server info
                 self.request.override_renderer = 'admin/settings/settings_system_snapshot.mako'
             else:
                 h.flash('You are not allowed to do this', category='warning')
         return self._get_template_context(c)
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     def settings_system_info_check_update(self):
         _ = self.request.translate
         c = self.load_default_context()
 
         update_url = UpdateModel().get_update_url()
 
         def _err(s):
             return f'<div style="color:#ff8888; padding:4px 0px">{s}</div>'
 
         try:
             data = UpdateModel().get_update_data(update_url)
         except urllib.error.URLError as e:
             log.exception("Exception contacting upgrade server")
             self.request.override_renderer = 'string'
             return _err('Failed to contact upgrade server: %r' % e)
         except ValueError as e:
             log.exception("Bad data sent from update server")
             self.request.override_renderer = 'string'
             return _err('Bad data sent from update server')
 
         latest = data['versions'][0]
 
         c.update_url = update_url
         c.latest_data = latest
         c.latest_ver = (latest['version'] or '').strip()
         c.cur_ver = self.request.GET.get('ver') or rhodecode.__version__
         c.should_upgrade = False
 
         is_outdated = UpdateModel().is_outdated(c.cur_ver, c.latest_ver)
         if is_outdated:
             c.should_upgrade = True
         c.important_notices = latest['general']
         UpdateModel().store_version(latest['version'])
         return self._get_template_context(c)

rhodecode/apps/repository/views/repo_permissions.py

@@ -1,128 +1,122 b''
 # Copyright (C) 2011-2023 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import logging
 
 from pyramid.httpexceptions import HTTPFound
 
 from rhodecode.apps._base import RepoAppView
 from rhodecode.lib import helpers as h
 from rhodecode.lib import audit_logger
 from rhodecode.lib.auth import (
     LoginRequired, HasRepoPermissionAnyDecorator, CSRFRequired)
 from rhodecode.lib.utils2 import str2bool
 from rhodecode.model.db import User
 from rhodecode.model.forms import RepoPermsForm
 from rhodecode.model.meta import Session
 from rhodecode.model.permission import PermissionModel
 from rhodecode.model.repo import RepoModel
 
 log = logging.getLogger(__name__)
 
 
 class RepoSettingsPermissionsView(RepoAppView):
 
     def load_default_context(self):
         c = self._get_local_tmpl_context()
         return c
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.admin')
     def edit_permissions(self):
         _ = self.request.translate
         c = self.load_default_context()
         c.active = 'permissions'
         if self.request.GET.get('branch_permissions'):
             h.flash(_('Explicitly add user or user group with write or higher '
                       'permission to modify their branch permissions.'),
                     category='notice')
         return self._get_template_context(c)
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.admin')
     @CSRFRequired()
     def edit_permissions_update(self):
         _ = self.request.translate
         c = self.load_default_context()
         c.active = 'permissions'
         data = self.request.POST
         # store private flag outside of HTML to verify if we can modify
         # default user permissions, prevents submission of FAKE post data
         # into the form for private repos
         data['repo_private'] = self.db_repo.private
         form = RepoPermsForm(self.request.translate)().to_python(data)
         changes = RepoModel().update_permissions(
             self.db_repo_name, form['perm_additions'], form['perm_updates'],
             form['perm_deletions'])
 
         action_data = {
             'added': changes['added'],
             'updated': changes['updated'],
             'deleted': changes['deleted'],
         }
         audit_logger.store_web(
             'repo.edit.permissions', action_data=action_data,
             user=self._rhodecode_user, repo=self.db_repo)
 
         Session().commit()
         h.flash(_('Repository access permissions updated'), category='success')
 
         affected_user_ids = None
         if changes.get('default_user_changed', False):
             # if we change the default user, we need to flush everyone permissions
             affected_user_ids = User.get_all_user_ids()
         PermissionModel().flush_user_permission_caches(
             changes, affected_user_ids=affected_user_ids)
 
         raise HTTPFound(
             h.route_path('edit_repo_perms', repo_name=self.db_repo_name))
 
     @LoginRequired()
     @HasRepoPermissionAnyDecorator('repository.admin')
     @CSRFRequired()
     def edit_permissions_set_private_repo(self):
         _ = self.request.translate
         self.load_default_context()
 
         private_flag = str2bool(self.request.POST.get('private'))
-
+        changes = {
+            'repo_private': private_flag
+        }
         try:
             repo = RepoModel().get(self.db_repo.repo_id)
-            repo.private = private_flag
-            Session().add(repo)
-            RepoModel().grant_user_permission(
-                repo=self.db_repo, user=User.DEFAULT_USER, perm='repository.none'
-            )
-
+            RepoModel().update(repo, **changes)
             Session().commit()
 
             h.flash(_('Repository `{}` private mode set successfully').format(self.db_repo_name),
                     category='success')
-            # NOTE(dan): we change repo private mode we need to notify all USERS
-            affected_user_ids = User.get_all_user_ids()
-            PermissionModel().trigger_permission_flush(affected_user_ids)
 
         except Exception:
             log.exception("Exception during update of repository")
             h.flash(_('Error occurred during update of repository {}').format(
                 self.db_repo_name), category='error')
 
         return {
             'redirect_url': h.route_path('edit_repo_perms', repo_name=self.db_repo_name),
             'private': private_flag
         }

rhodecode/config/settings_maker.py

@@ -1,184 +1,187 b''
 # Copyright (C) 2010-2023 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import os
 import textwrap
 import string
 import functools
 import logging
 import tempfile
 import logging.config
 
 from rhodecode.lib.type_utils import str2bool, aslist
 
 log = logging.getLogger(__name__)
 
 
 # skip keys, that are set here, so we don't double process those
 set_keys = {
     '__file__': ''
 }
 
 
 class SettingsMaker:
 
     def __init__(self, app_settings):
         self.settings = app_settings
 
     @classmethod
     def _bool_func(cls, input_val):
         if isinstance(input_val, bytes):
             # decode to str
             input_val = input_val.decode('utf8')
         return str2bool(input_val)
 
     @classmethod
     def _int_func(cls, input_val):
         return int(input_val)
 
     @classmethod
     def _float_func(cls, input_val):
         return float(input_val)
 
     @classmethod
     def _list_func(cls, input_val, sep=','):
         return aslist(input_val, sep=sep)
 
     @classmethod
     def _string_func(cls, input_val, lower=True):
         if lower:
             input_val = input_val.lower()
         return input_val
 
     @classmethod
     def _string_no_quote_func(cls, input_val, lower=True):
         """
         Special case string function that detects if value is set to empty quote string
         e.g.
 
         core.binar_dir = ""
         """
 
         input_val = cls._string_func(input_val, lower=lower)
         if input_val in ['""', "''"]:
             return ''
 
     @classmethod
     def _dir_func(cls, input_val, ensure_dir=False, mode=0o755):
 
         # ensure we have our dir created
         if not os.path.isdir(input_val) and ensure_dir:
             os.makedirs(input_val, mode=mode, exist_ok=True)
 
         if not os.path.isdir(input_val):
             raise Exception(f'Dir at {input_val} does not exist')
         return input_val
 
     @classmethod
     def _file_path_func(cls, input_val, ensure_dir=False, mode=0o755):
         dirname = os.path.dirname(input_val)
         cls._dir_func(dirname, ensure_dir=ensure_dir)
         return input_val
 
     @classmethod
     def _key_transformator(cls, key):
         return "{}_{}".format('RC'.upper(), key.upper().replace('.', '_').replace('-', '_'))
 
     def maybe_env_key(self, key):
         # now maybe we have this KEY in env, search and use the value with higher priority.
         transformed_key = self._key_transformator(key)
         envvar_value = os.environ.get(transformed_key)
         if envvar_value:
             log.debug('using `%s` key instead of `%s` key for config', transformed_key, key)
 
         return envvar_value
 
     def env_expand(self):
+        if self.settings.get('rhodecode.env_expand') == 'false':
+            return
+
         replaced = {}
         for k, v in self.settings.items():
             if k not in set_keys:
                 envvar_value = self.maybe_env_key(k)
                 if envvar_value:
                     replaced[k] = envvar_value
                     set_keys[k] = envvar_value
 
         # replace ALL keys updated
         self.settings.update(replaced)
 
     def enable_logging(self, logging_conf=None, level='INFO', formatter='generic'):
         """
         Helper to enable debug on running instance
         :return:
         """
 
         if not str2bool(self.settings.get('logging.autoconfigure')):
             log.info('logging configuration based on main .ini file')
             return
 
         if logging_conf is None:
             logging_conf = self.settings.get('logging.logging_conf_file') or ''
 
         if not os.path.isfile(logging_conf):
             log.error('Unable to setup logging based on %s, '
                       'file does not exist.... specify path using logging.logging_conf_file= config setting. ', logging_conf)
             return
 
         with open(logging_conf, 'rt') as f:
             ini_template = textwrap.dedent(f.read())
             ini_template = string.Template(ini_template).safe_substitute(
                 RC_LOGGING_LEVEL=os.environ.get('RC_LOGGING_LEVEL', '') or level,
                 RC_LOGGING_FORMATTER=os.environ.get('RC_LOGGING_FORMATTER', '') or formatter
             )
 
         with tempfile.NamedTemporaryFile(prefix='rc_logging_', suffix='.ini', delete=False) as f:
             log.info('Saved Temporary LOGGING config at %s', f.name)
             f.write(ini_template)
 
         logging.config.fileConfig(f.name)
         os.remove(f.name)
 
     def make_setting(self, key, default, lower=False, default_when_empty=False, parser=None):
         input_val = self.settings.get(key, default)
 
         if default_when_empty and not input_val:
             # use default value when value is set in the config but it is empty
             input_val = default
 
         parser_func = {
             'bool': self._bool_func,
             'int': self._int_func,
             'float': self._float_func,
             'list': self._list_func,
             'list:newline': functools.partial(self._list_func, sep='/n'),
             'list:spacesep': functools.partial(self._list_func, sep=' '),
             'string': functools.partial(self._string_func, lower=lower),
             'string:noquote': functools.partial(self._string_no_quote_func, lower=lower),
             'dir': self._dir_func,
             'dir:ensured': functools.partial(self._dir_func, ensure_dir=True),
             'file': self._file_path_func,
             'file:ensured': functools.partial(self._file_path_func, ensure_dir=True),
             None: lambda i: i
         }[parser]
 
         envvar_value = self.maybe_env_key(key)
         if envvar_value:
             input_val = envvar_value
             set_keys[key] = input_val
 
         self.settings[key] = parser_func(input_val)
         return self.settings[key]

rhodecode/lib/middleware/utils/scm_app_http.py

@@ -1,193 +1,194 b''
 
 
 # Copyright (C) 2014-2023 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 Implementation of the scm_app interface using raw HTTP communication.
 """
 
 import base64
 import logging
 import urllib.parse
 import wsgiref.util
 
 import msgpack
 import requests
 import webob.request
 
 import rhodecode
 from rhodecode.lib.middleware.utils import get_path_info
 
 log = logging.getLogger(__name__)
 
 
 def create_git_wsgi_app(repo_path, repo_name, config):
     url = _vcs_streaming_url() + 'git/'
     return VcsHttpProxy(url, repo_path, repo_name, config)
 
 
 def create_hg_wsgi_app(repo_path, repo_name, config):
     url = _vcs_streaming_url() + 'hg/'
     return VcsHttpProxy(url, repo_path, repo_name, config)
 
 
 def _vcs_streaming_url():
     template = 'http://{}/stream/'
     return template.format(rhodecode.CONFIG['vcs.server'])
 
 
 # TODO: johbo: Avoid the global.
 session = requests.Session()
 # Requests speedup, avoid reading .netrc and similar
 session.trust_env = False
 
 # prevent urllib3 spawning our logs.
 logging.getLogger("requests.packages.urllib3.connectionpool").setLevel(
     logging.WARNING)
 
 
 class VcsHttpProxy(object):
     """
     A WSGI application which proxies vcs requests.
 
     The goal is to shuffle the data around without touching it. The only
     exception is the extra data from the config object which we send to the
     server as well.
     """
 
     def __init__(self, url, repo_path, repo_name, config):
         """
         :param str url: The URL of the VCSServer to call.
         """
         self._url = url
         self._repo_name = repo_name
         self._repo_path = repo_path
         self._config = config
         self.rc_extras = {}
         log.debug(
             "Creating VcsHttpProxy for repo %s, url %s",
             repo_name, url)
 
     def __call__(self, environ, start_response):
         config = self._config
         request = webob.request.Request(environ)
         request_headers = request.headers
 
         call_context = {
             # TODO: johbo: Remove this, rely on URL path only
             'repo_name': self._repo_name,
             'repo_path': self._repo_path,
             'path_info': get_path_info(environ),
 
             'repo_store': self.rc_extras.get('repo_store'),
             'server_config_file': self.rc_extras.get('config'),
 
             'auth_user': self.rc_extras.get('username'),
             'auth_user_id': str(self.rc_extras.get('user_id')),
             'auth_user_ip': self.rc_extras.get('ip'),
 
             'repo_config': config,
             'locked_status_code': rhodecode.CONFIG.get('lock_ret_code'),
         }
 
         request_headers.update({
             # TODO: johbo: Avoid encoding and put this into payload?
             'X_RC_VCS_STREAM_CALL_CONTEXT': base64.b64encode(msgpack.packb(call_context))
         })
 
         method = environ['REQUEST_METHOD']
 
         # Preserve the query string
         url = self._url
         url = urllib.parse.urljoin(url, self._repo_name)
         if environ.get('QUERY_STRING'):
             url += '?' + environ['QUERY_STRING']
 
         log.debug('http-app: preparing request to: %s', url)
         response = session.request(
             method,
             url,
             data=_maybe_stream_request(environ),
             headers=request_headers,
             stream=True)
 
         log.debug('http-app: got vcsserver response: %s', response)
         if response.status_code >= 500:
             log.error('Exception returned by vcsserver at: %s %s, %s',
                       url, response.status_code, response.content)
 
         # Preserve the headers of the response, except hop_by_hop ones
         response_headers = [
             (h, v) for h, v in response.headers.items()
             if not wsgiref.util.is_hop_by_hop(h)
         ]
 
         # Build status argument for start_response callable.
         status = '{status_code} {reason_phrase}'.format(
             status_code=response.status_code,
             reason_phrase=response.reason)
 
         start_response(status, response_headers)
         return _maybe_stream_response(response)
 
 
 def read_in_chunks(stream_obj, block_size=1024, chunks=-1):
     """
     Read Stream in chunks, default chunk size: 1k.
     """
     while chunks:
         data = stream_obj.read(block_size)
         if not data:
             break
         yield data
         chunks -= 1
 
 
 def _is_request_chunked(environ):
     stream = environ.get('HTTP_TRANSFER_ENCODING', '') == 'chunked'
     return stream
 
 
 def _maybe_stream_request(environ):
     path = get_path_info(environ)
     stream = _is_request_chunked(environ)
-    log.debug('handling request `%s` with stream support: %s', path, stream)
+    req_method = environ['REQUEST_METHOD']
+    log.debug('handling scm request: %s `%s` with stream support: %s', req_method, path, stream)
 
     if stream:
         # set stream by 256k
         return read_in_chunks(environ['wsgi.input'], block_size=1024 * 256)
     else:
         return environ['wsgi.input'].read()
 
 
 def _maybe_stream_response(response):
     """
     Try to generate chunks from the response if it is chunked.
     """
     stream = _is_chunked(response)
     log.debug('returning response with stream: %s', stream)
     if stream:
         # read in 256k Chunks
         return response.raw.read_chunked(amt=1024 * 256)
     else:
         return [response.content]
 
 
 def _is_chunked(response):
     return response.headers.get('Transfer-Encoding', '') == 'chunked'

rhodecode/lib/system_info.py

@@ -1,866 +1,893 b''
 # Copyright (C) 2017-2023 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 
 import os
 import sys
 import time
 import platform
 import collections
 import psutil
 from functools import wraps
 
 import pkg_resources
 import logging
 import resource
 
 import configparser
 
 from rc_license.models import LicenseModel
 from rhodecode.lib.str_utils import safe_str
 
 log = logging.getLogger(__name__)
 
 
 _NA = 'NOT AVAILABLE'
 _NA_FLOAT = 0.0
 
 STATE_OK = 'ok'
 STATE_ERR = 'error'
 STATE_WARN = 'warning'
 
 STATE_OK_DEFAULT = {'message': '', 'type': STATE_OK}
 
 
 registered_helpers = {}
 
 
 def register_sysinfo(func):
     """
     @register_helper
     def db_check():
         pass
 
     db_check == registered_helpers['db_check']
     """
     global registered_helpers
     registered_helpers[func.__name__] = func
 
     @wraps(func)
     def _wrapper(*args, **kwargs):
         return func(*args, **kwargs)
     return _wrapper
 
 
 # HELPERS
 def percentage(part: (int, float), whole: (int, float)):
     whole = float(whole)
     if whole > 0:
         return round(100 * float(part) / whole, 1)
     return 0.0
 
 
 def get_storage_size(storage_path):
     sizes = []
     for file_ in os.listdir(storage_path):
         storage_file = os.path.join(storage_path, file_)
         if os.path.isfile(storage_file):
             try:
                 sizes.append(os.path.getsize(storage_file))
             except OSError:
                 log.exception('Failed to get size of storage file %s', storage_file)
                 pass
 
     return sum(sizes)
 
 
 def get_resource(resource_type):
     try:
         return resource.getrlimit(resource_type)
     except Exception:
         return 'NOT_SUPPORTED'
 
 
 def get_cert_path(ini_path):
     default = '/etc/ssl/certs/ca-certificates.crt'
     control_ca_bundle = os.path.join(
         os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(ini_path)))),
         '/etc/ssl/certs/ca-certificates.crt')
     if os.path.isfile(control_ca_bundle):
         default = control_ca_bundle
 
     return default
 
 
 class SysInfoRes(object):
     def __init__(self, value, state=None, human_value=None):
         self.value = value
         self.state = state or STATE_OK_DEFAULT
         self.human_value = human_value or value
 
     def __json__(self):
         return {
             'value': self.value,
             'state': self.state,
             'human_value': self.human_value,
         }
 
     def get_value(self):
         return self.__json__()
 
     def __str__(self):
         return f'<SysInfoRes({self.__json__()})>'
 
 
 class SysInfo(object):
 
     def __init__(self, func_name, **kwargs):
         self.function_name = func_name
         self.value = _NA
         self.state = None
         self.kwargs = kwargs or {}
 
     def __call__(self):
         computed = self.compute(**self.kwargs)
         if not isinstance(computed, SysInfoRes):
             raise ValueError(
                 'computed value for {} is not instance of '
                 '{}, got {} instead'.format(
                     self.function_name, SysInfoRes, type(computed)))
         return computed.__json__()
 
     def __str__(self):
         return f'<SysInfo({self.function_name})>'
 
     def compute(self, **kwargs):
         return self.function_name(**kwargs)
 
 
 # SysInfo functions
 @register_sysinfo
 def python_info():
     value = dict(version=f'{platform.python_version()}:{platform.python_implementation()}',
                  executable=sys.executable)
     return SysInfoRes(value=value)
 
 
 @register_sysinfo
 def py_modules():
     mods = dict([(p.project_name, {'version': p.version, 'location': p.location})
                  for p in pkg_resources.working_set])
 
     value = sorted(mods.items(), key=lambda k: k[0].lower())
     return SysInfoRes(value=value)
 
 
 @register_sysinfo
 def platform_type():
     from rhodecode.lib.utils import generate_platform_uuid
 
     value = dict(
         name=safe_str(platform.platform()),
         uuid=generate_platform_uuid()
     )
     return SysInfoRes(value=value)
 
 
 @register_sysinfo
 def locale_info():
     import locale
 
     def safe_get_locale(locale_name):
         try:
             locale.getlocale(locale_name)
         except TypeError:
             return f'FAILED_LOCALE_GET:{locale_name}'
 
     value = dict(
         locale_default=locale.getlocale(),
         locale_lc_all=safe_get_locale(locale.LC_ALL),
         locale_lc_ctype=safe_get_locale(locale.LC_CTYPE),
         lang_env=os.environ.get('LANG'),
         lc_all_env=os.environ.get('LC_ALL'),
         local_archive_env=os.environ.get('LOCALE_ARCHIVE'),
     )
     human_value = \
         f"LANG: {value['lang_env']}, \
           locale LC_ALL: {value['locale_lc_all']},  \
           locale LC_CTYPE: {value['locale_lc_ctype']},  \
           Default locales: {value['locale_default']}"
 
     return SysInfoRes(value=value, human_value=human_value)
 
 
 @register_sysinfo
 def ulimit_info():
     data = collections.OrderedDict([
         ('cpu time (seconds)', get_resource(resource.RLIMIT_CPU)),
         ('file size', get_resource(resource.RLIMIT_FSIZE)),
         ('stack size', get_resource(resource.RLIMIT_STACK)),
         ('core file size', get_resource(resource.RLIMIT_CORE)),
         ('address space size', get_resource(resource.RLIMIT_AS)),
         ('locked in mem size', get_resource(resource.RLIMIT_MEMLOCK)),
         ('heap size', get_resource(resource.RLIMIT_DATA)),
         ('rss size', get_resource(resource.RLIMIT_RSS)),
         ('number of processes', get_resource(resource.RLIMIT_NPROC)),
         ('open files', get_resource(resource.RLIMIT_NOFILE)),
     ])
 
     text = ', '.join(f'{k}:{v}' for k, v in data.items())
 
     value = {
         'limits': data,
         'text': text,
     }
     return SysInfoRes(value=value)
 
 
 @register_sysinfo
 def uptime():
     from rhodecode.lib.helpers import age, time_to_datetime
     from rhodecode.translation import TranslationString
 
     value = dict(boot_time=0, uptime=0, text='')
     state = STATE_OK_DEFAULT
 
     boot_time = psutil.boot_time()
     value['boot_time'] = boot_time
     value['uptime'] = time.time() - boot_time
 
     date_or_age = age(time_to_datetime(boot_time))
     if isinstance(date_or_age, TranslationString):
         date_or_age = date_or_age.interpolate()
 
     human_value = value.copy()
     human_value['boot_time'] = time_to_datetime(boot_time)
     human_value['uptime'] = age(time_to_datetime(boot_time), show_suffix=False)
 
     human_value['text'] = f'Server started {date_or_age}'
     return SysInfoRes(value=value, human_value=human_value)
 
 
 @register_sysinfo
 def memory():
     from rhodecode.lib.helpers import format_byte_size_binary
     value = dict(available=0, used=0, used_real=0, cached=0, percent=0,
                  percent_used=0, free=0, inactive=0, active=0, shared=0,
                  total=0, buffers=0, text='')
 
     state = STATE_OK_DEFAULT
 
     value.update(dict(psutil.virtual_memory()._asdict()))
     value['used_real'] = value['total'] - value['available']
     value['percent_used'] = psutil._common.usage_percent(value['used_real'], value['total'], 1)
 
     human_value = value.copy()
     human_value['text'] = '{}/{}, {}% used'.format(
         format_byte_size_binary(value['used_real']),
         format_byte_size_binary(value['total']),
         value['percent_used'])
 
     keys = list(value.keys())[::]
     keys.pop(keys.index('percent'))
     keys.pop(keys.index('percent_used'))
     keys.pop(keys.index('text'))
     for k in keys:
         human_value[k] = format_byte_size_binary(value[k])
 
     if state['type'] == STATE_OK and value['percent_used'] > 90:
         msg = 'Critical: your available RAM memory is very low.'
         state = {'message': msg, 'type': STATE_ERR}
 
     elif state['type'] == STATE_OK and value['percent_used'] > 70:
         msg = 'Warning: your available RAM memory is running low.'
         state = {'message': msg, 'type': STATE_WARN}
 
     return SysInfoRes(value=value, state=state, human_value=human_value)
 
 
 @register_sysinfo
 def machine_load():
     value = {'1_min': _NA_FLOAT, '5_min': _NA_FLOAT, '15_min': _NA_FLOAT, 'text': ''}
     state = STATE_OK_DEFAULT
 
     # load averages
     if hasattr(psutil.os, 'getloadavg'):
         value.update(dict(
             list(zip(['1_min', '5_min', '15_min'], psutil.os.getloadavg()))
         ))
 
     human_value = value.copy()
     human_value['text'] = '1min: {}, 5min: {}, 15min: {}'.format(
         value['1_min'], value['5_min'], value['15_min'])
 
     if state['type'] == STATE_OK and value['15_min'] > 5.0:
         msg = 'Warning: your machine load is very high.'
         state = {'message': msg, 'type': STATE_WARN}
 
     return SysInfoRes(value=value, state=state, human_value=human_value)
 
 
 @register_sysinfo
 def cpu():
     value = {'cpu': 0, 'cpu_count': 0, 'cpu_usage': []}
     state = STATE_OK_DEFAULT
 
     value['cpu'] = psutil.cpu_percent(0.5)
     value['cpu_usage'] = psutil.cpu_percent(0.5, percpu=True)
     value['cpu_count'] = psutil.cpu_count()
 
     human_value = value.copy()
     human_value['text'] = f'{value["cpu_count"]} cores at {value["cpu"]} %'
 
     return SysInfoRes(value=value, state=state, human_value=human_value)
 
 
 @register_sysinfo
 def storage():
     from rhodecode.lib.helpers import format_byte_size_binary
     from rhodecode.lib.utils import get_rhodecode_repo_store_path
     path = get_rhodecode_repo_store_path()
 
     value = dict(percent=0, used=0, total=0, path=path, text='')
     state = STATE_OK_DEFAULT
 
     try:
         value.update(dict(psutil.disk_usage(path)._asdict()))
     except Exception as e:
         log.exception('Failed to fetch disk info')
         state = {'message': str(e), 'type': STATE_ERR}
 
     human_value = value.copy()
     human_value['used'] = format_byte_size_binary(value['used'])
     human_value['total'] = format_byte_size_binary(value['total'])
     human_value['text'] = "{}/{}, {}% used".format(
         format_byte_size_binary(value['used']),
         format_byte_size_binary(value['total']),
         value['percent'])
 
     if state['type'] == STATE_OK and value['percent'] > 90:
         msg = 'Critical: your disk space is very low.'
         state = {'message': msg, 'type': STATE_ERR}
 
     elif state['type'] == STATE_OK and value['percent'] > 70:
         msg = 'Warning: your disk space is running low.'
         state = {'message': msg, 'type': STATE_WARN}
 
     return SysInfoRes(value=value, state=state, human_value=human_value)
 
 
 @register_sysinfo
 def storage_inodes():
     from rhodecode.lib.utils import get_rhodecode_repo_store_path
     path = get_rhodecode_repo_store_path()
 
     value = dict(percent=0.0, free=0, used=0, total=0, path=path, text='')
     state = STATE_OK_DEFAULT
 
     try:
         i_stat = os.statvfs(path)
         value['free'] = i_stat.f_ffree
         value['used'] = i_stat.f_files-i_stat.f_favail
         value['total'] = i_stat.f_files
         value['percent'] = percentage(value['used'], value['total'])
     except Exception as e:
         log.exception('Failed to fetch disk inodes info')
         state = {'message': str(e), 'type': STATE_ERR}
 
     human_value = value.copy()
     human_value['text'] = "{}/{}, {}% used".format(
         value['used'], value['total'], value['percent'])
 
     if state['type'] == STATE_OK and value['percent'] > 90:
         msg = 'Critical: your disk free inodes are very low.'
         state = {'message': msg, 'type': STATE_ERR}
 
     elif state['type'] == STATE_OK and value['percent'] > 70:
         msg = 'Warning: your disk free inodes are running low.'
         state = {'message': msg, 'type': STATE_WARN}
 
     return SysInfoRes(value=value, state=state, human_value=human_value)
 
 
 @register_sysinfo
 def storage_artifacts():
     import rhodecode
     from rhodecode.lib.helpers import format_byte_size_binary
     from rhodecode.lib.archive_cache import get_archival_cache_store
 
     backend_type = rhodecode.ConfigGet().get_str('archive_cache.backend.type')
 
     value = dict(percent=0, used=0, total=0, items=0, path='', text='', type=backend_type)
     state = STATE_OK_DEFAULT
     try:
         d_cache = get_archival_cache_store(config=rhodecode.CONFIG)
         backend_type = str(d_cache)
 
         total_files, total_size, _directory_stats = d_cache.get_statistics()
 
         value.update({
             'percent': 100,
             'used': total_size,
             'total': total_size,
             'items': total_files,
             'path': d_cache.storage_path,
             'type': backend_type
         })
 
     except Exception as e:
         log.exception('failed to fetch archive cache storage')
         state = {'message': str(e), 'type': STATE_ERR}
 
     human_value = value.copy()
     human_value['used'] = format_byte_size_binary(value['used'])
     human_value['total'] = format_byte_size_binary(value['total'])
     human_value['text'] = f"{human_value['used']} ({value['items']} items)"
 
     return SysInfoRes(value=value, state=state, human_value=human_value)
 
 
 @register_sysinfo
 def storage_archives():
     import rhodecode
     from rhodecode.lib.helpers import format_byte_size_binary
     import rhodecode.apps.file_store.utils as store_utils
     from rhodecode import CONFIG
 
     backend_type = rhodecode.ConfigGet().get_str(store_utils.config_keys.backend_type)
 
     value = dict(percent=0, used=0, total=0, items=0, path='', text='', type=backend_type)
     state = STATE_OK_DEFAULT
     try:
         f_store = store_utils.get_filestore_backend(config=CONFIG)
         backend_type = str(f_store)
         total_files, total_size, _directory_stats = f_store.get_statistics()
 
         value.update({
             'percent': 100,
             'used': total_size,
             'total': total_size,
             'items': total_files,
             'path': f_store.storage_path,
             'type': backend_type
         })
 
     except Exception as e:
         log.exception('failed to fetch archive cache storage')
         state = {'message': str(e), 'type': STATE_ERR}
 
     human_value = value.copy()
     human_value['used'] = format_byte_size_binary(value['used'])
     human_value['total'] = format_byte_size_binary(value['total'])
     human_value['text'] = f"{human_value['used']} ({value['items']} items)"
 
     return SysInfoRes(value=value, state=state, human_value=human_value)
 
 
 @register_sysinfo
 def storage_gist():
     from rhodecode.model.gist import GIST_STORE_LOC
     from rhodecode.lib.utils import safe_str, get_rhodecode_repo_store_path
     from rhodecode.lib.helpers import format_byte_size_binary, get_directory_statistics
 
     path = safe_str(os.path.join(
         get_rhodecode_repo_store_path(), GIST_STORE_LOC))
 
     # gist storage
     value = dict(percent=0, used=0, total=0, items=0, path=path, text='')
     state = STATE_OK_DEFAULT
 
     try:
         total_files, total_size, _directory_stats = get_directory_statistics(path)
         value.update({
             'percent': 100,
             'used': total_size,
             'total': total_size,
             'items': total_files
         })
     except Exception as e:
         log.exception('failed to fetch gist storage items')
         state = {'message': str(e), 'type': STATE_ERR}
 
     human_value = value.copy()
     human_value['used'] = format_byte_size_binary(value['used'])
     human_value['total'] = format_byte_size_binary(value['total'])
     human_value['text'] = "{} ({} items)".format(
         human_value['used'], value['items'])
 
     return SysInfoRes(value=value, state=state, human_value=human_value)
 
 
 @register_sysinfo
 def storage_temp():
     import tempfile
     from rhodecode.lib.helpers import format_byte_size_binary
 
     path = tempfile.gettempdir()
     value = dict(percent=0, used=0, total=0, items=0, path=path, text='')
     state = STATE_OK_DEFAULT
 
     if not psutil:
         return SysInfoRes(value=value, state=state)
 
     try:
         value.update(dict(psutil.disk_usage(path)._asdict()))
     except Exception as e:
         log.exception('Failed to fetch temp dir info')
         state = {'message': str(e), 'type': STATE_ERR}
 
     human_value = value.copy()
     human_value['used'] = format_byte_size_binary(value['used'])
     human_value['total'] = format_byte_size_binary(value['total'])
     human_value['text'] = "{}/{}, {}% used".format(
         format_byte_size_binary(value['used']),
         format_byte_size_binary(value['total']),
         value['percent'])
 
     return SysInfoRes(value=value, state=state, human_value=human_value)
 
 
 @register_sysinfo
 def search_info():
     import rhodecode
     from rhodecode.lib.index import searcher_from_config
 
     backend = rhodecode.CONFIG.get('search.module', '')
     location = rhodecode.CONFIG.get('search.location', '')
 
     try:
         searcher = searcher_from_config(rhodecode.CONFIG)
         searcher = searcher.__class__.__name__
     except Exception:
         searcher = None
 
     value = dict(
         backend=backend, searcher=searcher, location=location, text='')
     state = STATE_OK_DEFAULT
 
     human_value = value.copy()
     human_value['text'] = "backend:`{}`".format(human_value['backend'])
 
     return SysInfoRes(value=value, state=state, human_value=human_value)
 
 
 @register_sysinfo
 def git_info():
     from rhodecode.lib.vcs.backends import git
     state = STATE_OK_DEFAULT
     value = human_value = ''
     try:
         value = git.discover_git_version(raise_on_exc=True)
         human_value = f'version reported from VCSServer: {value}'
     except Exception as e:
         state = {'message': str(e), 'type': STATE_ERR}
 
     return SysInfoRes(value=value, state=state, human_value=human_value)
 
 
 @register_sysinfo
 def hg_info():
     from rhodecode.lib.vcs.backends import hg
     state = STATE_OK_DEFAULT
     value = human_value = ''
     try:
         value = hg.discover_hg_version(raise_on_exc=True)
         human_value = f'version reported from VCSServer: {value}'
     except Exception as e:
         state = {'message': str(e), 'type': STATE_ERR}
     return SysInfoRes(value=value, state=state, human_value=human_value)
 
 
 @register_sysinfo
 def svn_info():
     from rhodecode.lib.vcs.backends import svn
     state = STATE_OK_DEFAULT
     value = human_value = ''
     try:
         value = svn.discover_svn_version(raise_on_exc=True)
         human_value = f'version reported from VCSServer: {value}'
     except Exception as e:
         state = {'message': str(e), 'type': STATE_ERR}
     return SysInfoRes(value=value, state=state, human_value=human_value)
 
 
 @register_sysinfo
 def vcs_backends():
     import rhodecode
     value = rhodecode.CONFIG.get('vcs.backends')
     human_value = 'Enabled backends in order: {}'.format(','.join(value))
     return SysInfoRes(value=value, human_value=human_value)
 
 
 @register_sysinfo
 def vcs_server():
     import rhodecode
     from rhodecode.lib.vcs.backends import get_vcsserver_service_data
 
     server_url = rhodecode.CONFIG.get('vcs.server')
     enabled = rhodecode.CONFIG.get('vcs.server.enable')
     protocol = rhodecode.CONFIG.get('vcs.server.protocol') or 'http'
     state = STATE_OK_DEFAULT
     version = None
     workers = 0
 
     try:
         data = get_vcsserver_service_data()
         if data and 'version' in data:
             version = data['version']
 
         if data and 'config' in data:
             conf = data['config']
             workers = conf.get('workers', 'NOT AVAILABLE')
 
         connection = 'connected'
     except Exception as e:
         connection = 'failed'
         state = {'message': str(e), 'type': STATE_ERR}
 
     value = dict(
         url=server_url,
         enabled=enabled,
         protocol=protocol,
         connection=connection,
         version=version,
         text='',
     )
 
     human_value = value.copy()
     human_value['text'] = \
         '{url}@ver:{ver} via {mode} mode[workers:{workers}], connection:{conn}'.format(
             url=server_url, ver=version, workers=workers, mode=protocol,
             conn=connection)
 
     return SysInfoRes(value=value, state=state, human_value=human_value)
 
 
 @register_sysinfo
 def vcs_server_config():
     from rhodecode.lib.vcs.backends import get_vcsserver_service_data
     state = STATE_OK_DEFAULT
 
     value = {}
     try:
         data = get_vcsserver_service_data()
         value = data['app_config']
     except Exception as e:
         state = {'message': str(e), 'type': STATE_ERR}
 
     human_value = value.copy()
     human_value['text'] = 'VCS Server config'
 
     return SysInfoRes(value=value, state=state, human_value=human_value)
 
+@register_sysinfo
+def rhodecode_server_config():
+    import rhodecode
+
+    state = STATE_OK_DEFAULT
+    config = rhodecode.CONFIG.copy()
+
+    secrets_lits = [
+        f'rhodecode_{LicenseModel.LICENSE_DB_KEY}',
+        'sqlalchemy.db1.url',
+        'channelstream.secret',
+        'beaker.session.secret',
+        'rhodecode.encrypted_values.secret',
+        'appenlight.api_key',
+        'smtp_password',
+        'file_store.objectstore.secret',
+        'archive_cache.objectstore.secret',
+        'app.service_api.token',
+    ]
+    for k in secrets_lits:
+        if k in config:
+            config[k] = '**OBFUSCATED**'
+
+    value = human_value = config
+    return SysInfoRes(value=value, state=state, human_value=human_value)
+
 
 @register_sysinfo
 def rhodecode_app_info():
     import rhodecode
     edition = rhodecode.CONFIG.get('rhodecode.edition')
 
     value = dict(
         rhodecode_version=rhodecode.__version__,
         rhodecode_lib_path=os.path.abspath(rhodecode.__file__),
         text=''
     )
     human_value = value.copy()
     human_value['text'] = 'RhodeCode {edition}, version {ver}'.format(
         edition=edition, ver=value['rhodecode_version']
     )
     return SysInfoRes(value=value, human_value=human_value)
 
 
 @register_sysinfo
 def rhodecode_config():
     import rhodecode
     path = rhodecode.CONFIG.get('__file__')
     rhodecode_ini_safe = rhodecode.CONFIG.copy()
     cert_path = get_cert_path(path)
 
     try:
         config = configparser.ConfigParser()
         config.read(path)
         parsed_ini = config
         if parsed_ini.has_section('server:main'):
             parsed_ini = dict(parsed_ini.items('server:main'))
     except Exception:
         log.exception('Failed to read .ini file for display')
         parsed_ini = {}
 
     rhodecode_ini_safe['server:main'] = parsed_ini
 
     blacklist = [
         f'rhodecode_{LicenseModel.LICENSE_DB_KEY}',
         'routes.map',
         'sqlalchemy.db1.url',
         'channelstream.secret',
         'beaker.session.secret',
         'rhodecode.encrypted_values.secret',
         'rhodecode_auth_github_consumer_key',
         'rhodecode_auth_github_consumer_secret',
         'rhodecode_auth_google_consumer_key',
         'rhodecode_auth_google_consumer_secret',
         'rhodecode_auth_bitbucket_consumer_secret',
         'rhodecode_auth_bitbucket_consumer_key',
         'rhodecode_auth_twitter_consumer_secret',
         'rhodecode_auth_twitter_consumer_key',
 
         'rhodecode_auth_twitter_secret',
         'rhodecode_auth_github_secret',
         'rhodecode_auth_google_secret',
         'rhodecode_auth_bitbucket_secret',
 
         'appenlight.api_key',
         ('app_conf', 'sqlalchemy.db1.url')
     ]
     for k in blacklist:
         if isinstance(k, tuple):
             section, key = k
             if section in rhodecode_ini_safe:
                 rhodecode_ini_safe[section] = '**OBFUSCATED**'
         else:
             rhodecode_ini_safe.pop(k, None)
 
     # TODO: maybe put some CONFIG checks here ?
     return SysInfoRes(value={'config': rhodecode_ini_safe,
                              'path': path, 'cert_path': cert_path})
 
 
 @register_sysinfo
 def database_info():
     import rhodecode
     from sqlalchemy.engine import url as engine_url
     from rhodecode.model import meta
     from rhodecode.model.meta import Session
     from rhodecode.model.db import DbMigrateVersion
 
     state = STATE_OK_DEFAULT
 
     db_migrate = DbMigrateVersion.query().filter(
         DbMigrateVersion.repository_id == 'rhodecode_db_migrations').one()
 
     db_url_obj = engine_url.make_url(rhodecode.CONFIG['sqlalchemy.db1.url'])
 
     try:
         engine = meta.get_engine()
         db_server_info = engine.dialect._get_server_version_info(
             Session.connection(bind=engine))
         db_version = '.'.join(map(str, db_server_info))
     except Exception:
         log.exception('failed to fetch db version')
         db_version = 'UNKNOWN'
 
     db_info = dict(
         migrate_version=db_migrate.version,
         type=db_url_obj.get_backend_name(),
         version=db_version,
         url=repr(db_url_obj)
     )
     current_version = db_migrate.version
     expected_version = rhodecode.__dbversion__
     if state['type'] == STATE_OK and current_version != expected_version:
         msg = 'Critical: database schema mismatch, ' \
               'expected version {}, got {}. ' \
               'Please run migrations on your database.'.format(
             expected_version, current_version)
         state = {'message': msg, 'type': STATE_ERR}
 
     human_value = db_info.copy()
     human_value['url'] = "{} @ migration version: {}".format(
         db_info['url'], db_info['migrate_version'])
     human_value['version'] = "{} {}".format(db_info['type'], db_info['version'])
     return SysInfoRes(value=db_info, state=state, human_value=human_value)
 
 
 @register_sysinfo
 def server_info(environ):
     import rhodecode
     from rhodecode.lib.base import get_server_ip_addr, get_server_port
 
     value = {
         'server_ip': '{}:{}'.format(
             get_server_ip_addr(environ, log_errors=False),
             get_server_port(environ)
         ),
         'server_id': rhodecode.CONFIG.get('instance_id'),
     }
     return SysInfoRes(value=value)
 
 
 @register_sysinfo
 def usage_info():
     from rhodecode.model.db import User, Repository, true
     value = {
         'users': User.query().count(),
         'users_active': User.query().filter(User.active == true()).count(),
         'repositories': Repository.query().count(),
         'repository_types': {
             'hg': Repository.query().filter(
                 Repository.repo_type == 'hg').count(),
             'git': Repository.query().filter(
                 Repository.repo_type == 'git').count(),
             'svn': Repository.query().filter(
                 Repository.repo_type == 'svn').count(),
         },
     }
     return SysInfoRes(value=value)
 
 
 def get_system_info(environ):
     environ = environ or {}
     return {
         'rhodecode_app': SysInfo(rhodecode_app_info)(),
         'rhodecode_config': SysInfo(rhodecode_config)(),
         'rhodecode_usage': SysInfo(usage_info)(),
         'python': SysInfo(python_info)(),
         'py_modules': SysInfo(py_modules)(),
 
         'platform': SysInfo(platform_type)(),
         'locale': SysInfo(locale_info)(),
         'server': SysInfo(server_info, environ=environ)(),
         'database': SysInfo(database_info)(),
         'ulimit': SysInfo(ulimit_info)(),
         'storage': SysInfo(storage)(),
         'storage_inodes': SysInfo(storage_inodes)(),
         'storage_archive': SysInfo(storage_archives)(),
         'storage_artifacts': SysInfo(storage_artifacts)(),
         'storage_gist': SysInfo(storage_gist)(),
         'storage_temp': SysInfo(storage_temp)(),
 
         'search': SysInfo(search_info)(),
 
         'uptime': SysInfo(uptime)(),
         'load': SysInfo(machine_load)(),
         'cpu': SysInfo(cpu)(),
         'memory': SysInfo(memory)(),
 
         'vcs_backends': SysInfo(vcs_backends)(),
         'vcs_server': SysInfo(vcs_server)(),
 
         'vcs_server_config': SysInfo(vcs_server_config)(),
+        'rhodecode_server_config': SysInfo(rhodecode_server_config)(),
 
         'git': SysInfo(git_info)(),
         'hg': SysInfo(hg_info)(),
         'svn': SysInfo(svn_info)(),
     }
 
 
 def load_system_info(key):
     """
     get_sys_info('vcs_server')
     get_sys_info('database')
     """
     return SysInfo(registered_helpers[key])()

rhodecode/model/repo.py

@@ -1,1203 +1,1212 b''
 # Copyright (C) 2010-2023 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import os
 import re
 import shutil
 import time
 import logging
 import traceback
 import datetime
 
 from pyramid.threadlocal import get_current_request
 from sqlalchemy.orm import aliased
 from zope.cachedescriptors.property import Lazy as LazyProperty
 
 from rhodecode import events
 from rhodecode.lib.auth import HasUserGroupPermissionAny
 from rhodecode.lib.caching_query import FromCache
 from rhodecode.lib.exceptions import AttachedForksError, AttachedPullRequestsError, AttachedArtifactsError
 from rhodecode.lib import hooks_base
 from rhodecode.lib.user_log_filter import user_log_filter
 from rhodecode.lib.utils import make_db_config
 from rhodecode.lib.utils2 import (
     safe_str, remove_prefix, obfuscate_url_pw,
     get_current_rhodecode_user, safe_int, action_logger_generic)
 from rhodecode.lib.vcs.backends import get_backend
 from rhodecode.lib.vcs.nodes import NodeKind
 from rhodecode.model import BaseModel
 from rhodecode.model.db import (
     _hash_key, func, case, joinedload, or_, in_filter_generator,
     Session, Repository, UserRepoToPerm, UserGroupRepoToPerm,
     UserRepoGroupToPerm, UserGroupRepoGroupToPerm, User, Permission,
     Statistics, UserGroup, RepoGroup, RepositoryField, UserLog)
 from rhodecode.model.permission import PermissionModel
 from rhodecode.model.settings import VcsSettingsModel
 
 log = logging.getLogger(__name__)
 
 
 class RepoModel(BaseModel):
 
     cls = Repository
 
     def _get_user_group(self, users_group):
         return self._get_instance(UserGroup, users_group,
                                   callback=UserGroup.get_by_group_name)
 
     def _get_repo_group(self, repo_group):
         return self._get_instance(RepoGroup, repo_group,
                                   callback=RepoGroup.get_by_group_name)
 
     def _create_default_perms(self, repository, private):
         # create default permission
         default = 'repository.read'
         def_user = User.get_default_user()
         for p in def_user.user_perms:
             if p.permission.permission_name.startswith('repository.'):
                 default = p.permission.permission_name
                 break
 
         default_perm = 'repository.none' if private else default
 
         repo_to_perm = UserRepoToPerm()
         repo_to_perm.permission = Permission.get_by_key(default_perm)
 
         repo_to_perm.repository = repository
         repo_to_perm.user = def_user
 
         return repo_to_perm
 
     def get(self, repo_id):
         repo = self.sa.query(Repository) \
             .filter(Repository.repo_id == repo_id)
 
         return repo.scalar()
 
     def get_repo(self, repository):
         return self._get_repo(repository)
 
     def get_by_repo_name(self, repo_name, cache=False):
         repo = self.sa.query(Repository) \
             .filter(Repository.repo_name == repo_name)
 
         if cache:
             name_key = _hash_key(repo_name)
             repo = repo.options(
                 FromCache("sql_cache_short", f"get_repo_{name_key}"))
         return repo.scalar()
 
     def _extract_id_from_repo_name(self, repo_name):
         if repo_name.startswith('/'):
             repo_name = repo_name.lstrip('/')
         by_id_match = re.match(r'^_(\d+)', repo_name)
         if by_id_match:
             return by_id_match.groups()[0]
 
     def get_repo_by_id(self, repo_name):
         """
         Extracts repo_name by id from special urls.
         Example url is _11/repo_name
 
         :param repo_name:
         :return: repo object if matched else None
         """
         _repo_id = None
         try:
             _repo_id = self._extract_id_from_repo_name(repo_name)
             if _repo_id:
                 return self.get(_repo_id)
         except Exception:
             log.exception('Failed to extract repo_name from URL')
             if _repo_id:
                 Session().rollback()
 
         return None
 
     def get_repos_for_root(self, root, traverse=False):
         if traverse:
             like_expression = u'{}%'.format(safe_str(root))
             repos = Repository.query().filter(
                 Repository.repo_name.like(like_expression)).all()
         else:
             if root and not isinstance(root, RepoGroup):
                 raise ValueError(
                     'Root must be an instance '
                     'of RepoGroup, got:{} instead'.format(type(root)))
             repos = Repository.query().filter(Repository.group == root).all()
         return repos
 
     def get_url(self, repo, request=None, permalink=False):
         if not request:
             request = get_current_request()
 
         if not request:
             return
 
         if permalink:
             return request.route_url(
                 'repo_summary', repo_name='_{}'.format(safe_str(repo.repo_id)))
         else:
             return request.route_url(
                 'repo_summary', repo_name=safe_str(repo.repo_name))
 
     def get_commit_url(self, repo, commit_id, request=None, permalink=False):
         if not request:
             request = get_current_request()
 
         if not request:
             return
 
         if permalink:
             return request.route_url(
                 'repo_commit', repo_name=safe_str(repo.repo_id),
                 commit_id=commit_id)
 
         else:
             return request.route_url(
                 'repo_commit', repo_name=safe_str(repo.repo_name),
                 commit_id=commit_id)
 
     def get_repo_log(self, repo, filter_term):
         repo_log = UserLog.query()\
             .filter(or_(UserLog.repository_id == repo.repo_id,
                         UserLog.repository_name == repo.repo_name))\
             .options(joinedload(UserLog.user))\
             .options(joinedload(UserLog.repository))\
             .order_by(UserLog.action_date.desc())
 
         repo_log = user_log_filter(repo_log, filter_term)
         return repo_log
 
     @classmethod
     def update_commit_cache(cls, repositories=None):
         if not repositories:
             repositories = Repository.getAll()
         for repo in repositories:
             repo.update_commit_cache()
 
     def get_repos_as_dict(self, repo_list=None, admin=False,
                           super_user_actions=False, short_name=None):
 
         _render = get_current_request().get_partial_renderer(
             'rhodecode:templates/data_table/_dt_elements.mako')
         c = _render.get_call_context()
         h = _render.get_helpers()
 
         def quick_menu(repo_name):
             return _render('quick_menu', repo_name)
 
         def repo_lnk(name, rtype, rstate, private, archived, fork_repo_name):
             if short_name is not None:
                 short_name_var = short_name
             else:
                 short_name_var = not admin
             return _render('repo_name', name, rtype, rstate, private, archived, fork_repo_name,
                            short_name=short_name_var, admin=False)
 
         def last_change(last_change):
             if admin and isinstance(last_change, datetime.datetime) and not last_change.tzinfo:
                 ts = time.time()
                 utc_offset = (datetime.datetime.fromtimestamp(ts)
                               - datetime.datetime.utcfromtimestamp(ts)).total_seconds()
                 last_change = last_change + datetime.timedelta(seconds=utc_offset)
 
             return _render("last_change", last_change)
 
         def rss_lnk(repo_name):
             return _render("rss", repo_name)
 
         def atom_lnk(repo_name):
             return _render("atom", repo_name)
 
         def last_rev(repo_name, cs_cache):
             return _render('revision', repo_name, cs_cache.get('revision'),
                            cs_cache.get('raw_id'), cs_cache.get('author'),
                            cs_cache.get('message'), cs_cache.get('date'))
 
         def desc(desc):
             return _render('repo_desc', desc, c.visual.stylify_metatags)
 
         def state(repo_state):
             return _render("repo_state", repo_state)
 
         def repo_actions(repo_name):
             return _render('repo_actions', repo_name, super_user_actions)
 
         def user_profile(username):
             return _render('user_profile', username)
 
         repos_data = []
         for repo in repo_list:
             # NOTE(marcink): because we use only raw column we need to load it like that
             changeset_cache = Repository._load_changeset_cache(
                 repo.repo_id, repo._changeset_cache)
 
             row = {
                 "menu": quick_menu(repo.repo_name),
 
                 "name": repo_lnk(repo.repo_name, repo.repo_type, repo.repo_state,
                                  repo.private, repo.archived, repo.fork_repo_name),
 
                 "desc": desc(h.escape(repo.description)),
 
                 "last_change": last_change(repo.updated_on),
 
                 "last_changeset": last_rev(repo.repo_name, changeset_cache),
                 "last_changeset_raw": changeset_cache.get('revision'),
 
                 "owner": user_profile(repo.owner_username),
 
                 "state": state(repo.repo_state),
                 "rss": rss_lnk(repo.repo_name),
                 "atom": atom_lnk(repo.repo_name),
             }
             if admin:
                 row.update({
                     "action": repo_actions(repo.repo_name),
                 })
             repos_data.append(row)
 
         return repos_data
 
     def get_repos_data_table(
             self, draw, start, limit,
             search_q, order_by, order_dir,
             auth_user, repo_group_id):
         from rhodecode.model.scm import RepoList
 
         _perms = ['repository.read', 'repository.write', 'repository.admin']
 
         repos = Repository.query() \
             .filter(Repository.group_id == repo_group_id) \
             .all()
         auth_repo_list = RepoList(
             repos, perm_set=_perms,
             extra_kwargs=dict(user=auth_user))
 
         allowed_ids = [-1]
         for repo in auth_repo_list:
             allowed_ids.append(repo.repo_id)
 
         repos_data_total_count = Repository.query() \
             .filter(Repository.group_id == repo_group_id) \
             .filter(or_(
                 # generate multiple IN to fix limitation problems
                 *in_filter_generator(Repository.repo_id, allowed_ids))
             ) \
             .count()
 
         RepoFork = aliased(Repository)
         OwnerUser = aliased(User)
         base_q = Session.query(
             Repository.repo_id,
             Repository.repo_name,
             Repository.description,
             Repository.repo_type,
             Repository.repo_state,
             Repository.private,
             Repository.archived,
             Repository.updated_on,
             Repository._changeset_cache,
             RepoFork.repo_name.label('fork_repo_name'),
             OwnerUser.username.label('owner_username'),
             ) \
             .filter(Repository.group_id == repo_group_id) \
             .filter(or_(
                 # generate multiple IN to fix limitation problems
                 *in_filter_generator(Repository.repo_id, allowed_ids))
             ) \
             .outerjoin(RepoFork, Repository.fork_id == RepoFork.repo_id) \
             .join(OwnerUser, Repository.user_id == OwnerUser.user_id)
 
         repos_data_total_filtered_count = base_q.count()
 
         sort_defined = False
         if order_by == 'repo_name':
             sort_col = func.lower(Repository.repo_name)
             sort_defined = True
         elif order_by == 'user_username':
             sort_col = User.username
         else:
             sort_col = getattr(Repository, order_by, None)
 
         if sort_defined or sort_col:
             if order_dir == 'asc':
                 sort_col = sort_col.asc()
             else:
                 sort_col = sort_col.desc()
 
         base_q = base_q.order_by(sort_col)
         base_q = base_q.offset(start).limit(limit)
 
         repos_list = base_q.all()
 
         repos_data = RepoModel().get_repos_as_dict(
             repo_list=repos_list, admin=False)
 
         data = ({
             'draw': draw,
             'data': repos_data,
             'recordsTotal': repos_data_total_count,
             'recordsFiltered': repos_data_total_filtered_count,
         })
         return data
 
     def _get_defaults(self, repo_name):
         """
         Gets information about repository, and returns a dict for
         usage in forms
 
         :param repo_name:
         """
 
         repo_info = Repository.get_by_repo_name(repo_name)
 
         if repo_info is None:
             return None
 
         defaults = repo_info.get_dict()
         defaults['repo_name'] = repo_info.just_name
 
         groups = repo_info.groups_with_parents
         parent_group = groups[-1] if groups else None
 
         # we use -1 as this is how in HTML, we mark an empty group
         defaults['repo_group'] = getattr(parent_group, 'group_id', -1)
 
         keys_to_process = (
             {'k': 'repo_type', 'strip': False},
             {'k': 'repo_enable_downloads', 'strip': True},
             {'k': 'repo_description', 'strip': True},
             {'k': 'repo_enable_locking', 'strip': True},
             {'k': 'repo_landing_rev', 'strip': True},
             {'k': 'clone_uri', 'strip': False},
             {'k': 'push_uri', 'strip': False},
             {'k': 'repo_private', 'strip': True},
             {'k': 'repo_enable_statistics', 'strip': True}
         )
 
         for item in keys_to_process:
             attr = item['k']
             if item['strip']:
                 attr = remove_prefix(item['k'], 'repo_')
 
             val = defaults[attr]
             if item['k'] == 'repo_landing_rev':
                 val = ':'.join(defaults[attr])
             defaults[item['k']] = val
             if item['k'] == 'clone_uri':
                 defaults['clone_uri_hidden'] = repo_info.clone_uri_hidden
             if item['k'] == 'push_uri':
                 defaults['push_uri_hidden'] = repo_info.push_uri_hidden
 
         # fill owner
         if repo_info.user:
             defaults.update({'user': repo_info.user.username})
         else:
             replacement_user = User.get_first_super_admin().username
             defaults.update({'user': replacement_user})
 
         return defaults
 
     def update(self, repo, **kwargs):
         try:
             cur_repo = self._get_repo(repo)
             source_repo_name = cur_repo.repo_name
 
             affected_user_ids = []
             if 'user' in kwargs:
                 old_owner_id = cur_repo.user.user_id
                 new_owner = User.get_by_username(kwargs['user'])
                 cur_repo.user = new_owner
 
                 if old_owner_id != new_owner.user_id:
                     affected_user_ids = [new_owner.user_id, old_owner_id]
 
             if 'repo_group' in kwargs:
                 cur_repo.group = RepoGroup.get(kwargs['repo_group'])
             log.debug('Updating repo %s with params:%s', cur_repo, kwargs)
 
             update_keys = [
                 (1, 'repo_description'),
                 (1, 'repo_landing_rev'),
                 (1, 'repo_private'),
                 (1, 'repo_enable_downloads'),
                 (1, 'repo_enable_locking'),
                 (1, 'repo_enable_statistics'),
                 (0, 'clone_uri'),
                 (0, 'push_uri'),
                 (0, 'fork_id')
             ]
             for strip, k in update_keys:
                 if k in kwargs:
                     val = kwargs[k]
                     if strip:
                         k = remove_prefix(k, 'repo_')
 
                     setattr(cur_repo, k, val)
 
+            new_name = source_repo_name
+            if 'repo_name' in kwargs:
             new_name = cur_repo.get_new_name(kwargs['repo_name'])
             cur_repo.repo_name = new_name
 
-            # if private flag is set, reset default permission to NONE
-            if kwargs.get('repo_private'):
+            if 'repo_private' in kwargs:
+                # if private flag is set to True, reset default permission to NONE
+                set_private_to = kwargs.get('repo_private')
+                if set_private_to:
                 EMPTY_PERM = 'repository.none'
                 RepoModel().grant_user_permission(
                     repo=cur_repo, user=User.DEFAULT_USER, perm=EMPTY_PERM
                 )
+                if set_private_to != cur_repo.private:
+                    # NOTE(dan): we change repo private mode we need to notify all USERS
+                    # this is just by having this value set to a different value then it was before
+                    affected_user_ids = User.get_all_user_ids()
+
             if kwargs.get('repo_landing_rev'):
                 landing_rev_val = kwargs['repo_landing_rev']
                 RepoModel().set_landing_rev(cur_repo, landing_rev_val)
 
             # handle extra fields
             for field in filter(lambda k: k.startswith(RepositoryField.PREFIX), kwargs):
                 k = RepositoryField.un_prefix_key(field)
                 ex_field = RepositoryField.get_by_key_name(
                     key=k, repo=cur_repo)
                 if ex_field:
                     ex_field.field_value = kwargs[field]
                     self.sa.add(ex_field)
 
             self.sa.add(cur_repo)
 
             if source_repo_name != new_name:
                 # rename repository
                 self._rename_filesystem_repo(
                     old=source_repo_name, new=new_name)
 
             if affected_user_ids:
                 PermissionModel().trigger_permission_flush(affected_user_ids)
 
             return cur_repo
         except Exception:
             log.error(traceback.format_exc())
             raise
 
     def _create_repo(self, repo_name, repo_type, description, owner,
                      private=False, clone_uri=None, repo_group=None,
                      landing_rev=None, fork_of=None,
                      copy_fork_permissions=False, enable_statistics=False,
                      enable_locking=False, enable_downloads=False,
                      copy_group_permissions=False,
                      state=Repository.STATE_PENDING):
         """
         Create repository inside database with PENDING state, this should be
         only executed by create() repo. With exception of importing existing
         repos
         """
         from rhodecode.model.scm import ScmModel
 
         owner = self._get_user(owner)
         fork_of = self._get_repo(fork_of)
         repo_group = self._get_repo_group(safe_int(repo_group))
         default_landing_ref, _lbl = ScmModel.backend_landing_ref(repo_type)
         landing_rev = landing_rev or default_landing_ref
 
         try:
             repo_name = safe_str(repo_name)
             description = safe_str(description)
             # repo name is just a name of repository
             # while repo_name_full is a full qualified name that is combined
             # with name and path of group
             repo_name_full = repo_name
             repo_name = repo_name.split(Repository.NAME_SEP)[-1]
 
             new_repo = Repository()
             new_repo.repo_state = state
             new_repo.enable_statistics = False
             new_repo.repo_name = repo_name_full
             new_repo.repo_type = repo_type
             new_repo.user = owner
             new_repo.group = repo_group
             new_repo.description = description or repo_name
             new_repo.private = private
             new_repo.archived = False
             new_repo.clone_uri = clone_uri
             new_repo.landing_rev = landing_rev
 
             new_repo.enable_statistics = enable_statistics
             new_repo.enable_locking = enable_locking
             new_repo.enable_downloads = enable_downloads
 
             if repo_group:
                 new_repo.enable_locking = repo_group.enable_locking
 
             if fork_of:
                 parent_repo = fork_of
                 new_repo.fork = parent_repo
 
             events.trigger(events.RepoPreCreateEvent(new_repo))
 
             self.sa.add(new_repo)
 
             EMPTY_PERM = 'repository.none'
             if fork_of and copy_fork_permissions:
                 repo = fork_of
                 user_perms = UserRepoToPerm.query() \
                     .filter(UserRepoToPerm.repository == repo).all()
                 group_perms = UserGroupRepoToPerm.query() \
                     .filter(UserGroupRepoToPerm.repository == repo).all()
 
                 for perm in user_perms:
                     UserRepoToPerm.create(
                         perm.user, new_repo, perm.permission)
 
                 for perm in group_perms:
                     UserGroupRepoToPerm.create(
                         perm.users_group, new_repo, perm.permission)
                 # in case we copy permissions and also set this repo to private
                 # override the default user permission to make it a private repo
                 if private:
                     RepoModel(self.sa).grant_user_permission(
                         repo=new_repo, user=User.DEFAULT_USER, perm=EMPTY_PERM)
 
             elif repo_group and copy_group_permissions:
                 user_perms = UserRepoGroupToPerm.query() \
                     .filter(UserRepoGroupToPerm.group == repo_group).all()
 
                 group_perms = UserGroupRepoGroupToPerm.query() \
                     .filter(UserGroupRepoGroupToPerm.group == repo_group).all()
 
                 for perm in user_perms:
                     perm_name = perm.permission.permission_name.replace(
                         'group.', 'repository.')
                     perm_obj = Permission.get_by_key(perm_name)
                     UserRepoToPerm.create(perm.user, new_repo, perm_obj)
 
                 for perm in group_perms:
                     perm_name = perm.permission.permission_name.replace(
                         'group.', 'repository.')
                     perm_obj = Permission.get_by_key(perm_name)
                     UserGroupRepoToPerm.create(perm.users_group, new_repo, perm_obj)
 
                 if private:
                     RepoModel(self.sa).grant_user_permission(
                         repo=new_repo, user=User.DEFAULT_USER, perm=EMPTY_PERM)
 
             else:
                 perm_obj = self._create_default_perms(new_repo, private)
                 self.sa.add(perm_obj)
 
             # now automatically start following this repository as owner
             ScmModel(self.sa).toggle_following_repo(new_repo.repo_id, owner.user_id)
 
             # we need to flush here, in order to check if database won't
             # throw any exceptions, create filesystem dirs at the very end
             self.sa.flush()
             events.trigger(events.RepoCreateEvent(new_repo, actor=owner))
             return new_repo
 
         except Exception:
             log.error(traceback.format_exc())
             raise
 
     def create(self, form_data, cur_user):
         """
         Create repository using celery tasks
 
         :param form_data:
         :param cur_user:
         """
         from rhodecode.lib.celerylib import tasks, run_task
         return run_task(tasks.create_repo, form_data, cur_user)
 
     def update_permissions(self, repo, perm_additions=None, perm_updates=None,
                            perm_deletions=None, check_perms=True,
                            cur_user=None):
         if not perm_additions:
             perm_additions = []
         if not perm_updates:
             perm_updates = []
         if not perm_deletions:
             perm_deletions = []
 
         req_perms = ('usergroup.read', 'usergroup.write', 'usergroup.admin')
 
         changes = {
             'added': [],
             'updated': [],
             'deleted': [],
             'default_user_changed': None
         }
 
         repo = self._get_repo(repo)
 
         # update permissions
         for member_id, perm, member_type in perm_updates:
             member_id = int(member_id)
             if member_type == 'user':
                 member_name = User.get(member_id).username
                 if member_name == User.DEFAULT_USER:
                     # NOTE(dan): detect if we changed permissions for default user
                     perm_obj = self.sa.query(UserRepoToPerm) \
                         .filter(UserRepoToPerm.user_id == member_id) \
                         .filter(UserRepoToPerm.repository == repo) \
                         .scalar()
                     if perm_obj and perm_obj.permission.permission_name != perm:
                         changes['default_user_changed'] = True
 
                 # this updates also current one if found
                 self.grant_user_permission(
                     repo=repo, user=member_id, perm=perm)
             elif member_type == 'user_group':
                 # check if we have permissions to alter this usergroup
                 member_name = UserGroup.get(member_id).users_group_name
                 if not check_perms or HasUserGroupPermissionAny(
                         *req_perms)(member_name, user=cur_user):
                     self.grant_user_group_permission(
                         repo=repo, group_name=member_id, perm=perm)
             else:
                 raise ValueError("member_type must be 'user' or 'user_group' "
                                  "got {} instead".format(member_type))
             changes['updated'].append({'type': member_type, 'id': member_id,
                                        'name': member_name, 'new_perm': perm})
 
         # set new permissions
         for member_id, perm, member_type in perm_additions:
             member_id = int(member_id)
             if member_type == 'user':
                 member_name = User.get(member_id).username
                 self.grant_user_permission(
                     repo=repo, user=member_id, perm=perm)
             elif member_type == 'user_group':
                 # check if we have permissions to alter this usergroup
                 member_name = UserGroup.get(member_id).users_group_name
                 if not check_perms or HasUserGroupPermissionAny(
                         *req_perms)(member_name, user=cur_user):
                     self.grant_user_group_permission(
                         repo=repo, group_name=member_id, perm=perm)
             else:
                 raise ValueError("member_type must be 'user' or 'user_group' "
                                  "got {} instead".format(member_type))
 
             changes['added'].append({'type': member_type, 'id': member_id,
                                      'name': member_name, 'new_perm': perm})
         # delete permissions
         for member_id, perm, member_type in perm_deletions:
             member_id = int(member_id)
             if member_type == 'user':
                 member_name = User.get(member_id).username
                 self.revoke_user_permission(repo=repo, user=member_id)
             elif member_type == 'user_group':
                 # check if we have permissions to alter this usergroup
                 member_name = UserGroup.get(member_id).users_group_name
                 if not check_perms or HasUserGroupPermissionAny(
                         *req_perms)(member_name, user=cur_user):
                     self.revoke_user_group_permission(
                         repo=repo, group_name=member_id)
             else:
                 raise ValueError("member_type must be 'user' or 'user_group' "
                                  "got {} instead".format(member_type))
 
             changes['deleted'].append({'type': member_type, 'id': member_id,
                                        'name': member_name, 'new_perm': perm})
         return changes
 
     def create_fork(self, form_data, cur_user):
         """
         Simple wrapper into executing celery task for fork creation
 
         :param form_data:
         :param cur_user:
         """
         from rhodecode.lib.celerylib import tasks, run_task
         return run_task(tasks.create_repo_fork, form_data, cur_user)
 
     def archive(self, repo):
         """
         Archive given repository. Set archive flag.
 
         :param repo:
         """
         repo = self._get_repo(repo)
         if repo:
 
             try:
                 repo.archived = True
                 self.sa.add(repo)
                 self.sa.commit()
             except Exception:
                 log.error(traceback.format_exc())
                 raise
 
     def delete(self, repo, forks=None, pull_requests=None, artifacts=None, fs_remove=True, cur_user=None):
         """
         Delete given repository, forks parameter defines what do do with
         attached forks. Throws AttachedForksError if deleted repo has attached
         forks
 
         :param repo:
         :param forks: str 'delete' or 'detach'
         :param pull_requests: str 'delete' or None
         :param artifacts: str 'delete' or None
         :param fs_remove: remove(archive) repo from filesystem
         """
         if not cur_user:
             cur_user = getattr(get_current_rhodecode_user(), 'username', None)
         repo = self._get_repo(repo)
         if repo:
             if forks == 'detach':
                 for r in repo.forks:
                     r.fork = None
                     self.sa.add(r)
             elif forks == 'delete':
                 for r in repo.forks:
                     self.delete(r, forks='delete')
             elif [f for f in repo.forks]:
                 raise AttachedForksError()
 
             # check for pull requests
             pr_sources = repo.pull_requests_source
             pr_targets = repo.pull_requests_target
             if pull_requests != 'delete' and (pr_sources or pr_targets):
                 raise AttachedPullRequestsError()
 
             artifacts_objs = repo.artifacts
             if artifacts == 'delete':
                 for a in artifacts_objs:
                     self.sa.delete(a)
             elif [a for a in artifacts_objs]:
                 raise AttachedArtifactsError()
 
             old_repo_dict = repo.get_dict()
             events.trigger(events.RepoPreDeleteEvent(repo))
             try:
                 self.sa.delete(repo)
                 if fs_remove:
                     self._delete_filesystem_repo(repo)
                 else:
                     log.debug('skipping removal from filesystem')
                 old_repo_dict.update({
                     'deleted_by': cur_user,
                     'deleted_on': time.time(),
                 })
                 hooks_base.delete_repository(**old_repo_dict)
                 events.trigger(events.RepoDeleteEvent(repo))
             except Exception:
                 log.error(traceback.format_exc())
                 raise
 
     def grant_user_permission(self, repo, user, perm):
         """
         Grant permission for user on given repository, or update existing one
         if found
 
         :param repo: Instance of Repository, repository_id, or repository name
         :param user: Instance of User, user_id or username
         :param perm: Instance of Permission, or permission_name
         """
         user = self._get_user(user)
         repo = self._get_repo(repo)
         permission = self._get_perm(perm)
 
         # check if we have that permission already
         obj = self.sa.query(UserRepoToPerm) \
             .filter(UserRepoToPerm.user == user) \
             .filter(UserRepoToPerm.repository == repo) \
             .scalar()
         if obj is None:
             # create new !
             obj = UserRepoToPerm()
         obj.repository = repo
         obj.user = user
         obj.permission = permission
         self.sa.add(obj)
         log.debug('Granted perm %s to %s on %s', perm, user, repo)
         action_logger_generic(
             'granted permission: {} to user: {} on repo: {}'.format(
                 perm, user, repo), namespace='security.repo')
         return obj
 
     def revoke_user_permission(self, repo, user):
         """
         Revoke permission for user on given repository
 
         :param repo: Instance of Repository, repository_id, or repository name
         :param user: Instance of User, user_id or username
         """
 
         user = self._get_user(user)
         repo = self._get_repo(repo)
 
         obj = self.sa.query(UserRepoToPerm) \
             .filter(UserRepoToPerm.repository == repo) \
             .filter(UserRepoToPerm.user == user) \
             .scalar()
         if obj:
             self.sa.delete(obj)
             log.debug('Revoked perm on %s on %s', repo, user)
             action_logger_generic(
                 'revoked permission from user: {} on repo: {}'.format(
                     user, repo), namespace='security.repo')
 
     def grant_user_group_permission(self, repo, group_name, perm):
         """
         Grant permission for user group on given repository, or update
         existing one if found
 
         :param repo: Instance of Repository, repository_id, or repository name
         :param group_name: Instance of UserGroup, users_group_id,
             or user group name
         :param perm: Instance of Permission, or permission_name
         """
         repo = self._get_repo(repo)
         group_name = self._get_user_group(group_name)
         permission = self._get_perm(perm)
 
         # check if we have that permission already
         obj = self.sa.query(UserGroupRepoToPerm) \
             .filter(UserGroupRepoToPerm.users_group == group_name) \
             .filter(UserGroupRepoToPerm.repository == repo) \
             .scalar()
 
         if obj is None:
             # create new
             obj = UserGroupRepoToPerm()
 
         obj.repository = repo
         obj.users_group = group_name
         obj.permission = permission
         self.sa.add(obj)
         log.debug('Granted perm %s to %s on %s', perm, group_name, repo)
         action_logger_generic(
             'granted permission: {} to usergroup: {} on repo: {}'.format(
                 perm, group_name, repo), namespace='security.repo')
 
         return obj
 
     def revoke_user_group_permission(self, repo, group_name):
         """
         Revoke permission for user group on given repository
 
         :param repo: Instance of Repository, repository_id, or repository name
         :param group_name: Instance of UserGroup, users_group_id,
             or user group name
         """
         repo = self._get_repo(repo)
         group_name = self._get_user_group(group_name)
 
         obj = self.sa.query(UserGroupRepoToPerm) \
             .filter(UserGroupRepoToPerm.repository == repo) \
             .filter(UserGroupRepoToPerm.users_group == group_name) \
             .scalar()
         if obj:
             self.sa.delete(obj)
             log.debug('Revoked perm to %s on %s', repo, group_name)
             action_logger_generic(
                 'revoked permission from usergroup: {} on repo: {}'.format(
                     group_name, repo), namespace='security.repo')
 
     def delete_stats(self, repo_name):
         """
         removes stats for given repo
 
         :param repo_name:
         """
         repo = self._get_repo(repo_name)
         try:
             obj = self.sa.query(Statistics) \
                 .filter(Statistics.repository == repo).scalar()
             if obj:
                 self.sa.delete(obj)
         except Exception:
             log.error(traceback.format_exc())
             raise
 
     def add_repo_field(self, repo_name, field_key, field_label, field_value='',
                        field_type='str', field_desc=''):
 
         repo = self._get_repo(repo_name)
 
         new_field = RepositoryField()
         new_field.repository = repo
         new_field.field_key = field_key
         new_field.field_type = field_type  # python type
         new_field.field_value = field_value
         new_field.field_desc = field_desc
         new_field.field_label = field_label
         self.sa.add(new_field)
         return new_field
 
     def delete_repo_field(self, repo_name, field_key):
         repo = self._get_repo(repo_name)
         field = RepositoryField.get_by_key_name(field_key, repo)
         if field:
             self.sa.delete(field)
 
     def set_landing_rev(self, repo, landing_rev_name):
         if landing_rev_name.startswith('branch:'):
             landing_rev_name = landing_rev_name.split('branch:')[-1]
         scm_instance = repo.scm_instance()
         if scm_instance:
             return scm_instance._remote.set_head_ref(landing_rev_name)
 
     def _create_filesystem_repo(self, repo_name, repo_type, repo_group,
                                 clone_uri=None, repo_store_location=None,
                                 use_global_config=False, install_hooks=True):
         """
         makes repository on filesystem. It's group aware means it'll create
         a repository within a group, and alter the paths accordingly of
         group location
 
         :param repo_name:
         :param alias:
         :param parent:
         :param clone_uri:
         :param repo_store_location:
         """
         from rhodecode.lib.utils import is_valid_repo, is_valid_repo_group
         from rhodecode.model.scm import ScmModel
 
         if Repository.NAME_SEP in repo_name:
             raise ValueError(
                 'repo_name must not contain groups got `%s`' % repo_name)
 
         if isinstance(repo_group, RepoGroup):
             new_parent_path = os.sep.join(repo_group.full_path_splitted)
         else:
             new_parent_path = repo_group or ''
 
         if repo_store_location:
             _paths = [repo_store_location]
         else:
             _paths = [self.repos_path, new_parent_path, repo_name]
             # we need to make it str for mercurial
         repo_path = os.path.join(*map(lambda x: safe_str(x), _paths))
 
         # check if this path is not a repository
         if is_valid_repo(repo_path, self.repos_path):
             raise Exception(f'This path {repo_path} is a valid repository')
 
         # check if this path is a group
         if is_valid_repo_group(repo_path, self.repos_path):
             raise Exception(f'This path {repo_path} is a valid group')
 
         log.info('creating repo %s in %s from url: `%s`',
                  repo_name, safe_str(repo_path),
                  obfuscate_url_pw(clone_uri))
 
         backend = get_backend(repo_type)
 
         config_repo = None if use_global_config else repo_name
         if config_repo and new_parent_path:
             config_repo = Repository.NAME_SEP.join(
                 (new_parent_path, config_repo))
         config = make_db_config(clear_session=False, repo=config_repo)
         config.set('extensions', 'largefiles', '')
 
         # patch and reset hooks section of UI config to not run any
         # hooks on creating remote repo
         config.clear_section('hooks')
 
         # TODO: johbo: Unify this, hardcoded "bare=True" does not look nice
         if repo_type == 'git':
             repo = backend(
                 repo_path, config=config, create=True, src_url=clone_uri, bare=True,
                 with_wire={"cache": False})
         else:
             repo = backend(
                 repo_path, config=config, create=True, src_url=clone_uri,
                 with_wire={"cache": False})
 
         if install_hooks:
             repo.install_hooks()
 
         log.debug('Created repo %s with %s backend',
                   safe_str(repo_name), safe_str(repo_type))
         return repo
 
     def _rename_filesystem_repo(self, old, new):
         """
         renames repository on filesystem
 
         :param old: old name
         :param new: new name
         """
         log.info('renaming repo from %s to %s', old, new)
 
         old_path = os.path.join(self.repos_path, old)
         new_path = os.path.join(self.repos_path, new)
         if os.path.isdir(new_path):
             raise Exception(
                 'Was trying to rename to already existing dir %s' % new_path
             )
         shutil.move(old_path, new_path)
 
     def _delete_filesystem_repo(self, repo):
         """
         removes repo from filesystem, the removal is actually made by
         added rm__ prefix into dir, and rename internal .hg/.git dirs so this
         repository is no longer valid for rhodecode, can be undeleted later on
         by reverting the renames on this repository
 
         :param repo: repo object
         """
         rm_path = os.path.join(self.repos_path, repo.repo_name)
         repo_group = repo.group
         log.info("delete_filesystem_repo: removing repository %s", rm_path)
         # disable hg/git internal that it doesn't get detected as repo
         alias = repo.repo_type
 
         config = make_db_config(clear_session=False)
         config.set('extensions', 'largefiles', '')
         bare = getattr(repo.scm_instance(config=config), 'bare', False)
 
         # skip this for bare git repos
         if not bare:
             # disable VCS repo
             vcs_path = os.path.join(rm_path, '.%s' % alias)
             if os.path.exists(vcs_path):
                 shutil.move(vcs_path, os.path.join(rm_path, 'rm__.%s' % alias))
 
         _now = datetime.datetime.now()
         _ms = str(_now.microsecond).rjust(6, '0')
         _d = 'rm__{}__{}'.format(_now.strftime('%Y%m%d_%H%M%S_' + _ms),
                              repo.just_name)
         if repo_group:
             # if repository is in group, prefix the removal path with the group
             args = repo_group.full_path_splitted + [_d]
             _d = os.path.join(*args)
 
         if os.path.isdir(rm_path):
             shutil.move(rm_path, os.path.join(self.repos_path, _d))
 
         # finally cleanup diff-cache if it exists
         cached_diffs_dir = repo.cached_diffs_dir
         if os.path.isdir(cached_diffs_dir):
             shutil.rmtree(cached_diffs_dir)
 
 
 class ReadmeFinder:
     """
     Utility which knows how to find a readme for a specific commit.
 
     The main idea is that this is a configurable algorithm. When creating an
     instance you can define parameters, currently only the `default_renderer`.
     Based on this configuration the method :meth:`search` behaves slightly
     different.
     """
 
     readme_re = re.compile(r'^readme(\.[^\.]+)?$', re.IGNORECASE)
     path_re = re.compile(r'^docs?', re.IGNORECASE)
 
     default_priorities = {
         None:        0,
         '.rst':      1,
         '.md':       1,
         '.rest':     2,
         '.mkdn':     2,
         '.text':     2,
         '.txt':      3,
         '.mdown':    3,
         '.markdown': 4,
     }
 
     path_priority = {
         'doc':  0,
         'docs': 1,
     }
 
     FALLBACK_PRIORITY = 99
 
     RENDERER_TO_EXTENSION = {
         'rst': ['.rst', '.rest'],
         'markdown': ['.md', 'mkdn', '.mdown', '.markdown'],
     }
 
     def __init__(self, default_renderer=None):
         self._default_renderer = default_renderer
         self._renderer_extensions = self.RENDERER_TO_EXTENSION.get(
             default_renderer, [])
 
     def search(self, commit, path='/'):
         """
         Find a readme in the given `commit`.
         """
         # firstly, check the PATH type if it is actually a DIR
         if commit.get_node(path).kind != NodeKind.DIR:
             return None
 
         nodes = commit.get_nodes(path)
         matches = self._match_readmes(nodes)
         matches = self._sort_according_to_priority(matches)
         if matches:
             return matches[0].node
 
         paths = self._match_paths(nodes)
         paths = self._sort_paths_according_to_priority(paths)
         for path in paths:
             match = self.search(commit, path=path)
             if match:
                 return match
 
         return None
 
     def _match_readmes(self, nodes):
         for node in nodes:
             if not node.is_file():
                 continue
             path = node.path.rsplit('/', 1)[-1]
             match = self.readme_re.match(path)
             if match:
                 extension = match.group(1)
                 yield ReadmeMatch(node, match, self._priority(extension))
 
     def _match_paths(self, nodes):
         for node in nodes:
             if not node.is_dir():
                 continue
             match = self.path_re.match(node.path)
             if match:
                 yield node.path
 
     def _priority(self, extension):
         renderer_priority = (
             0 if extension in self._renderer_extensions else 1)
         extension_priority = self.default_priorities.get(
             extension, self.FALLBACK_PRIORITY)
         return (renderer_priority, extension_priority)
 
     def _sort_according_to_priority(self, matches):
 
         def priority_and_path(match):
             return (match.priority, match.path)
 
         return sorted(matches, key=priority_and_path)
 
     def _sort_paths_according_to_priority(self, paths):
 
         def priority_and_path(path):
             return (self.path_priority.get(path, self.FALLBACK_PRIORITY), path)
 
         return sorted(paths, key=priority_and_path)
 
 
 class ReadmeMatch:
 
     def __init__(self, node, match, priority):
         self.node = node
         self._match = match
         self.priority = priority
 
     @property
     def path(self):
         return self.node.path
 
     def __repr__(self):
         return f'<ReadmeMatch {self.path} priority={self.priority}'

rhodecode/model/repo_group.py

@@ -1,886 +1,889 b''
-# Copyright (C) 2011-2023 RhodeCode GmbH
+# Copyright (C) 2011-2024 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 
 """
 repo group model for RhodeCode
 """
 
 import os
 import datetime
 import itertools
 import logging
 import shutil
 import time
 import traceback
 import string
 
-from zope.cachedescriptors.property import Lazy as LazyProperty
 
 from rhodecode import events
 from rhodecode.model import BaseModel
 from rhodecode.model.db import (_hash_key, func, or_, in_filter_generator,
     Session, RepoGroup, UserRepoGroupToPerm, User, Permission, UserGroupRepoGroupToPerm,
     UserGroup, Repository)
 from rhodecode.model.permission import PermissionModel
-from rhodecode.model.settings import VcsSettingsModel, SettingsModel
+from rhodecode.model.settings import SettingsModel
 from rhodecode.lib.caching_query import FromCache
 from rhodecode.lib.utils2 import action_logger_generic
 
 log = logging.getLogger(__name__)
 
 
 class RepoGroupModel(BaseModel):
 
     cls = RepoGroup
     PERSONAL_GROUP_DESC = 'personal repo group of user `%(username)s`'
     PERSONAL_GROUP_PATTERN = '${username}'  # default
 
     def _get_user_group(self, users_group):
         return self._get_instance(UserGroup, users_group,
                                   callback=UserGroup.get_by_group_name)
 
     def _get_repo_group(self, repo_group):
         return self._get_instance(RepoGroup, repo_group,
                                   callback=RepoGroup.get_by_group_name)
 
     def get_repo_group(self, repo_group):
         return self._get_repo_group(repo_group)
 
     def get_by_group_name(self, repo_group_name, cache=None):
         repo = self.sa.query(RepoGroup) \
             .filter(RepoGroup.group_name == repo_group_name)
 
         if cache:
             name_key = _hash_key(repo_group_name)
             repo = repo.options(
                 FromCache("sql_cache_short", f"get_repo_group_{name_key}"))
         return repo.scalar()
 
     def get_default_create_personal_repo_group(self):
         value = SettingsModel().get_setting_by_name(
             'create_personal_repo_group')
         return value.app_settings_value if value else None or False
 
     def get_personal_group_name_pattern(self):
         value = SettingsModel().get_setting_by_name(
             'personal_repo_group_pattern')
         val = value.app_settings_value if value else None
         group_template = val or self.PERSONAL_GROUP_PATTERN
 
         group_template = group_template.lstrip('/')
         return group_template
 
     def get_personal_group_name(self, user):
         template = self.get_personal_group_name_pattern()
         return string.Template(template).safe_substitute(
             username=user.username,
             user_id=user.user_id,
             first_name=user.first_name,
             last_name=user.last_name,
         )
 
     def create_personal_repo_group(self, user, commit_early=True):
         desc = self.PERSONAL_GROUP_DESC % {'username': user.username}
         personal_repo_group_name = self.get_personal_group_name(user)
 
         # create a new one
         RepoGroupModel().create(
             group_name=personal_repo_group_name,
             group_description=desc,
             owner=user.username,
             personal=True,
             commit_early=commit_early)
 
     def _create_default_perms(self, new_group):
         # create default permission
         default_perm = 'group.read'
         def_user = User.get_default_user()
         for p in def_user.user_perms:
             if p.permission.permission_name.startswith('group.'):
                 default_perm = p.permission.permission_name
                 break
 
         repo_group_to_perm = UserRepoGroupToPerm()
         repo_group_to_perm.permission = Permission.get_by_key(default_perm)
 
         repo_group_to_perm.group = new_group
         repo_group_to_perm.user = def_user
         return repo_group_to_perm
 
     def _get_group_name_and_parent(self, group_name_full, repo_in_path=False,
                                    get_object=False):
         """
         Get's the group name and a parent group name from given group name.
         If repo_in_path is set to truth, we asume the full path also includes
         repo name, in such case we clean the last element.
 
         :param group_name_full:
         """
         split_paths = 1
         if repo_in_path:
             split_paths = 2
         _parts = group_name_full.rsplit(RepoGroup.url_sep(), split_paths)
 
         if repo_in_path and len(_parts) > 1:
             # such case last element is the repo_name
             _parts.pop(-1)
         group_name_cleaned = _parts[-1]  # just the group name
         parent_repo_group_name = None
 
         if len(_parts) > 1:
             parent_repo_group_name = _parts[0]
 
         parent_group = None
         if parent_repo_group_name:
             parent_group = RepoGroup.get_by_group_name(parent_repo_group_name)
 
         if get_object:
             return group_name_cleaned, parent_repo_group_name, parent_group
 
         return group_name_cleaned, parent_repo_group_name
 
     def check_exist_filesystem(self, group_name, exc_on_failure=True):
         create_path = os.path.join(self.repos_path, group_name)
         log.debug('creating new group in %s', create_path)
 
         if os.path.isdir(create_path):
             if exc_on_failure:
                 abs_create_path = os.path.abspath(create_path)
                 raise Exception(f'Directory `{abs_create_path}` already exists !')
             return False
         return True
 
     def _create_group(self, group_name):
         """
         makes repository group on filesystem
 
         :param repo_name:
         :param parent_id:
         """
 
         self.check_exist_filesystem(group_name)
         create_path = os.path.join(self.repos_path, group_name)
         log.debug('creating new group in %s', create_path)
         os.makedirs(create_path, mode=0o755)
         log.debug('created group in %s', create_path)
 
     def _rename_group(self, old, new):
         """
         Renames a group on filesystem
 
         :param group_name:
         """
 
         if old == new:
             log.debug('skipping group rename')
             return
 
         log.debug('renaming repository group from %s to %s', old, new)
 
         old_path = os.path.join(self.repos_path, old)
         new_path = os.path.join(self.repos_path, new)
 
         log.debug('renaming repos paths from %s to %s', old_path, new_path)
 
         if os.path.isdir(new_path):
             raise Exception('Was trying to rename to already '
                             'existing dir %s' % new_path)
         shutil.move(old_path, new_path)
 
     def _delete_filesystem_group(self, group, force_delete=False):
         """
         Deletes a group from a filesystem
 
         :param group: instance of group from database
         :param force_delete: use shutil rmtree to remove all objects
         """
         paths = group.full_path.split(RepoGroup.url_sep())
         paths = os.sep.join(paths)
 
         rm_path = os.path.join(self.repos_path, paths)
         log.info("Removing group %s", rm_path)
         # delete only if that path really exists
         if os.path.isdir(rm_path):
             if force_delete:
                 shutil.rmtree(rm_path)
             else:
                 # archive that group`
                 _now = datetime.datetime.now()
                 _ms = str(_now.microsecond).rjust(6, '0')
                 _d = 'rm__{}_GROUP_{}'.format(
                     _now.strftime('%Y%m%d_%H%M%S_' + _ms), group.name)
                 shutil.move(rm_path, os.path.join(self.repos_path, _d))
 
     def create(self, group_name, group_description, owner, just_db=False,
                copy_permissions=False, personal=None, commit_early=True):
 
         (group_name_cleaned,
          parent_group_name) = RepoGroupModel()._get_group_name_and_parent(group_name)
 
         parent_group = None
         if parent_group_name:
             parent_group = self._get_repo_group(parent_group_name)
             if not parent_group:
                 # we tried to create a nested group, but the parent is not
                 # existing
                 raise ValueError(
                     'Parent group `%s` given in `%s` group name '
                     'is not yet existing.' % (parent_group_name, group_name))
 
         # because we are doing a cleanup, we need to check if such directory
         # already exists. If we don't do that we can accidentally delete
         # existing directory via cleanup that can cause data issues, since
         # delete does a folder rename to special syntax later cleanup
         # functions can delete this
         cleanup_group = self.check_exist_filesystem(group_name,
                                                     exc_on_failure=False)
         user = self._get_user(owner)
         if not user:
             raise ValueError('Owner %s not found as rhodecode user', owner)
 
         try:
             new_repo_group = RepoGroup()
             new_repo_group.user = user
             new_repo_group.group_description = group_description or group_name
             new_repo_group.parent_group = parent_group
             new_repo_group.group_name = group_name
             new_repo_group.personal = personal
 
             self.sa.add(new_repo_group)
 
             # create an ADMIN permission for owner except if we're super admin,
             # later owner should go into the owner field of groups
             if not user.is_admin:
                 self.grant_user_permission(repo_group=new_repo_group,
                                            user=owner, perm='group.admin')
 
             if parent_group and copy_permissions:
                 # copy permissions from parent
                 user_perms = UserRepoGroupToPerm.query() \
                     .filter(UserRepoGroupToPerm.group == parent_group).all()
 
                 group_perms = UserGroupRepoGroupToPerm.query() \
                     .filter(UserGroupRepoGroupToPerm.group == parent_group).all()
 
                 for perm in user_perms:
                     # don't copy over the permission for user who is creating
                     # this group, if he is not super admin he get's admin
                     # permission set above
                     if perm.user != user or user.is_admin:
                         UserRepoGroupToPerm.create(
                             perm.user, new_repo_group, perm.permission)
 
                 for perm in group_perms:
                     UserGroupRepoGroupToPerm.create(
                         perm.users_group, new_repo_group, perm.permission)
             else:
                 perm_obj = self._create_default_perms(new_repo_group)
                 self.sa.add(perm_obj)
 
             # now commit the changes, earlier so we are sure everything is in
             # the database.
             if commit_early:
                 self.sa.commit()
             if not just_db:
                 self._create_group(new_repo_group.group_name)
 
             # trigger the post hook
             from rhodecode.lib import hooks_base
             repo_group = RepoGroup.get_by_group_name(group_name)
 
             # update repo group commit caches initially
             repo_group.update_commit_cache()
 
             hooks_base.create_repository_group(
                 created_by=user.username, **repo_group.get_dict())
 
             # Trigger create event.
             events.trigger(events.RepoGroupCreateEvent(repo_group))
 
             return new_repo_group
         except Exception:
             self.sa.rollback()
             log.exception('Exception occurred when creating repository group, '
                           'doing cleanup...')
             # rollback things manually !
             repo_group = RepoGroup.get_by_group_name(group_name)
             if repo_group:
                 RepoGroup.delete(repo_group.group_id)
                 self.sa.commit()
                 if cleanup_group:
                     RepoGroupModel()._delete_filesystem_group(repo_group)
             raise
 
     def update_permissions(
             self, repo_group, perm_additions=None, perm_updates=None,
             perm_deletions=None, recursive=None, check_perms=True,
             cur_user=None):
         from rhodecode.model.repo import RepoModel
         from rhodecode.lib.auth import HasUserGroupPermissionAny
 
         if not perm_additions:
             perm_additions = []
         if not perm_updates:
             perm_updates = []
         if not perm_deletions:
             perm_deletions = []
 
         req_perms = ('usergroup.read', 'usergroup.write', 'usergroup.admin')
 
         changes = {
             'added': [],
             'updated': [],
             'deleted': [],
             'default_user_changed': None
         }
 
-        def _set_perm_user(obj, user, perm):
-            if isinstance(obj, RepoGroup):
-                self.grant_user_permission(
-                    repo_group=obj, user=user, perm=perm)
-            elif isinstance(obj, Repository):
+        def _set_perm_user(_obj: RepoGroup | Repository, _user_obj: User, _perm):
+
+            if isinstance(_obj, RepoGroup):
+                self.grant_user_permission(repo_group=_obj, user=_user_obj, perm=_perm)
+            elif isinstance(_obj, Repository):
                 # private repos will not allow to change the default
                 # permissions using recursive mode
-                if obj.private and user == User.DEFAULT_USER:
+                if _obj.private and _user_obj.username == User.DEFAULT_USER:
+                    log.debug('Skipping private repo %s for user %s', _obj, _user_obj)
                     return
 
-                # we set group permission but we have to switch to repo
-                # permission
-                perm = perm.replace('group.', 'repository.')
-                RepoModel().grant_user_permission(
-                    repo=obj, user=user, perm=perm)
+                # we set group permission, we have to switch to repo permission definition
+                new_perm = _perm.replace('group.', 'repository.')
+                RepoModel().grant_user_permission(repo=_obj, user=_user_obj, perm=new_perm)
+
+        def _set_perm_group(_obj: RepoGroup | Repository, users_group: UserGroup, _perm):
+            if isinstance(_obj, RepoGroup):
+                self.grant_user_group_permission(repo_group=_obj, group_name=users_group, perm=_perm)
+            elif isinstance(_obj, Repository):
+                # we set group permission, we have to switch to repo permission definition
+                new_perm = _perm.replace('group.', 'repository.')
+                RepoModel().grant_user_group_permission(repo=_obj, group_name=users_group, perm=new_perm)
 
-        def _set_perm_group(obj, users_group, perm):
-            if isinstance(obj, RepoGroup):
-                self.grant_user_group_permission(
-                    repo_group=obj, group_name=users_group, perm=perm)
-            elif isinstance(obj, Repository):
-                # we set group permission but we have to switch to repo
-                # permission
-                perm = perm.replace('group.', 'repository.')
-                RepoModel().grant_user_group_permission(
-                    repo=obj, group_name=users_group, perm=perm)
+        def _revoke_perm_user(_obj: RepoGroup | Repository, _user_obj: User):
+            if isinstance(_obj, RepoGroup):
+                self.revoke_user_permission(repo_group=_obj, user=_user_obj)
+            elif isinstance(_obj, Repository):
+                # private repos will not allow to change the default
+                # permissions using recursive mode, also there's no revocation fo default user, just update
+                if _user_obj.username == User.DEFAULT_USER:
+                    log.debug('Skipping private repo %s for user %s', _obj, _user_obj)
+                    return
+                RepoModel().revoke_user_permission(repo=_obj, user=_user_obj)
 
-        def _revoke_perm_user(obj, user):
-            if isinstance(obj, RepoGroup):
-                self.revoke_user_permission(repo_group=obj, user=user)
-            elif isinstance(obj, Repository):
-                RepoModel().revoke_user_permission(repo=obj, user=user)
-
-        def _revoke_perm_group(obj, user_group):
-            if isinstance(obj, RepoGroup):
-                self.revoke_user_group_permission(
-                    repo_group=obj, group_name=user_group)
-            elif isinstance(obj, Repository):
-                RepoModel().revoke_user_group_permission(
-                    repo=obj, group_name=user_group)
+        def _revoke_perm_group(_obj: RepoGroup | Repository, user_group: UserGroup):
+            if isinstance(_obj, RepoGroup):
+                self.revoke_user_group_permission(repo_group=_obj, group_name=user_group)
+            elif isinstance(_obj, Repository):
+                RepoModel().revoke_user_group_permission(repo=_obj, group_name=user_group)
 
         # start updates
         log.debug('Now updating permissions for %s in recursive mode:%s',
                   repo_group, recursive)
 
         # initialize check function, we'll call that multiple times
         has_group_perm = HasUserGroupPermissionAny(*req_perms)
 
         for obj in repo_group.recursive_groups_and_repos():
             # iterated obj is an instance of a repos group or repository in
             # that group, recursive option can be: none, repos, groups, all
             if recursive == 'all':
                 obj = obj
             elif recursive == 'repos':
                 # skip groups, other than this one
                 if isinstance(obj, RepoGroup) and not obj == repo_group:
                     continue
             elif recursive == 'groups':
                 # skip repos
                 if isinstance(obj, Repository):
                     continue
             else:  # recursive == 'none':
                 #  DEFAULT option - don't apply to iterated objects
                 # also we do a break at the end of this loop. if we are not
                 # in recursive mode
                 obj = repo_group
 
             change_obj = obj.get_api_data()
 
             # update permissions
             for member_id, perm, member_type in perm_updates:
                 member_id = int(member_id)
                 if member_type == 'user':
-                    member_name = User.get(member_id).username
+                    member_obj = User.get(member_id)
+                    member_name = member_obj.username
                     if isinstance(obj, RepoGroup) and obj == repo_group and member_name == User.DEFAULT_USER:
                         # NOTE(dan): detect if we changed permissions for default user
                         perm_obj = self.sa.query(UserRepoGroupToPerm) \
                             .filter(UserRepoGroupToPerm.user_id == member_id) \
                             .filter(UserRepoGroupToPerm.group == repo_group) \
                             .scalar()
                         if perm_obj and perm_obj.permission.permission_name != perm:
                             changes['default_user_changed'] = True
 
                     # this updates also current one if found
-                    _set_perm_user(obj, user=member_id, perm=perm)
+                    _set_perm_user(obj, member_obj, perm)
                 elif member_type == 'user_group':
-                    member_name = UserGroup.get(member_id).users_group_name
-                    if not check_perms or has_group_perm(member_name,
-                                                         user=cur_user):
-                        _set_perm_group(obj, users_group=member_id, perm=perm)
+                    member_obj = UserGroup.get(member_id)
+                    member_name = member_obj.users_group_name
+                    if not check_perms or has_group_perm(member_name, user=cur_user):
+                        _set_perm_group(obj, member_obj, perm)
                 else:
-                    raise ValueError("member_type must be 'user' or 'user_group' "
-                                     "got {} instead".format(member_type))
+                    raise ValueError(
+                        f"member_type must be 'user' or 'user_group' got {member_type} instead"
+                    )
 
                 changes['updated'].append(
                     {'change_obj': change_obj, 'type': member_type,
                      'id': member_id, 'name': member_name, 'new_perm': perm})
 
             # set new permissions
             for member_id, perm, member_type in perm_additions:
                 member_id = int(member_id)
                 if member_type == 'user':
-                    member_name = User.get(member_id).username
-                    _set_perm_user(obj, user=member_id, perm=perm)
+                    member_obj = User.get(member_id)
+                    member_name = member_obj.username
+                    _set_perm_user(obj, member_obj, perm)
                 elif member_type == 'user_group':
                     # check if we have permissions to alter this usergroup
-                    member_name = UserGroup.get(member_id).users_group_name
-                    if not check_perms or has_group_perm(member_name,
-                                                         user=cur_user):
-                        _set_perm_group(obj, users_group=member_id, perm=perm)
+                    member_obj = UserGroup.get(member_id)
+                    member_name = member_obj.users_group_name
+                    if not check_perms or has_group_perm(member_name, user=cur_user):
+                        _set_perm_group(obj, member_obj, perm)
                 else:
-                    raise ValueError("member_type must be 'user' or 'user_group' "
-                                     "got {} instead".format(member_type))
+                    raise ValueError(
+                        f"member_type must be 'user' or 'user_group' got {member_type} instead"
+                    )
 
                 changes['added'].append(
                     {'change_obj': change_obj, 'type': member_type,
                      'id': member_id, 'name': member_name, 'new_perm': perm})
 
             # delete permissions
             for member_id, perm, member_type in perm_deletions:
                 member_id = int(member_id)
                 if member_type == 'user':
-                    member_name = User.get(member_id).username
-                    _revoke_perm_user(obj, user=member_id)
+                    member_obj = User.get(member_id)
+                    member_name = member_obj.username
+                    _revoke_perm_user(obj, member_obj)
                 elif member_type == 'user_group':
                     # check if we have permissions to alter this usergroup
-                    member_name = UserGroup.get(member_id).users_group_name
-                    if not check_perms or has_group_perm(member_name,
-                                                         user=cur_user):
-                        _revoke_perm_group(obj, user_group=member_id)
+                    member_obj = UserGroup.get(member_id)
+                    member_name = member_obj.users_group_name
+                    if not check_perms or has_group_perm(member_name, user=cur_user):
+                        _revoke_perm_group(obj, member_obj)
                 else:
-                    raise ValueError("member_type must be 'user' or 'user_group' "
-                                     "got {} instead".format(member_type))
-
+                    raise ValueError(
+                        f"member_type must be 'user' or 'user_group' got {member_type} instead"
+                    )
                 changes['deleted'].append(
                     {'change_obj': change_obj, 'type': member_type,
                      'id': member_id, 'name': member_name, 'new_perm': perm})
 
             # if it's not recursive call for all,repos,groups
             # break the loop and don't proceed with other changes
             if recursive not in ['all', 'repos', 'groups']:
                 break
 
         return changes
 
     def update(self, repo_group, form_data):
         try:
             repo_group = self._get_repo_group(repo_group)
             old_path = repo_group.full_path
 
             # change properties
             if 'group_description' in form_data:
                 repo_group.group_description = form_data['group_description']
 
             if 'enable_locking' in form_data:
                 repo_group.enable_locking = form_data['enable_locking']
 
             if 'group_parent_id' in form_data:
                 parent_group = (
                     self._get_repo_group(form_data['group_parent_id']))
                 repo_group.group_parent_id = (
                     parent_group.group_id if parent_group else None)
                 repo_group.parent_group = parent_group
 
             # mikhail: to update the full_path, we have to explicitly
             # update group_name
             group_name = form_data.get('group_name', repo_group.name)
             repo_group.group_name = repo_group.get_new_name(group_name)
 
             new_path = repo_group.full_path
 
             affected_user_ids = []
             if 'user' in form_data:
                 old_owner_id = repo_group.user.user_id
                 new_owner = User.get_by_username(form_data['user'])
                 repo_group.user = new_owner
 
                 if old_owner_id != new_owner.user_id:
                     affected_user_ids = [new_owner.user_id, old_owner_id]
 
             self.sa.add(repo_group)
 
             # iterate over all members of this groups and do fixes
             # set locking if given
             # if obj is a repoGroup also fix the name of the group according
             # to the parent
             # if obj is a Repo fix it's name
             # this can be potentially heavy operation
             for obj in repo_group.recursive_groups_and_repos():
                 # set the value from it's parent
                 obj.enable_locking = repo_group.enable_locking
                 if isinstance(obj, RepoGroup):
                     new_name = obj.get_new_name(obj.name)
                     log.debug('Fixing group %s to new name %s',
                               obj.group_name, new_name)
                     obj.group_name = new_name
 
                 elif isinstance(obj, Repository):
                     # we need to get all repositories from this new group and
                     # rename them accordingly to new group path
                     new_name = obj.get_new_name(obj.just_name)
                     log.debug('Fixing repo %s to new name %s',
                               obj.repo_name, new_name)
                     obj.repo_name = new_name
 
                 self.sa.add(obj)
 
             self._rename_group(old_path, new_path)
 
             # Trigger update event.
             events.trigger(events.RepoGroupUpdateEvent(repo_group))
 
             if affected_user_ids:
                 PermissionModel().trigger_permission_flush(affected_user_ids)
 
             return repo_group
         except Exception:
             log.error(traceback.format_exc())
             raise
 
     def delete(self, repo_group, force_delete=False, fs_remove=True):
         repo_group = self._get_repo_group(repo_group)
         if not repo_group:
             return False
         try:
             self.sa.delete(repo_group)
             if fs_remove:
                 self._delete_filesystem_group(repo_group, force_delete)
             else:
                 log.debug('skipping removal from filesystem')
 
             # Trigger delete event.
             events.trigger(events.RepoGroupDeleteEvent(repo_group))
             return True
 
         except Exception:
             log.error('Error removing repo_group %s', repo_group)
             raise
 
     def grant_user_permission(self, repo_group, user, perm):
         """
         Grant permission for user on given repository group, or update
         existing one if found
 
         :param repo_group: Instance of RepoGroup, repositories_group_id,
             or repositories_group name
         :param user: Instance of User, user_id or username
         :param perm: Instance of Permission, or permission_name
         """
 
         repo_group = self._get_repo_group(repo_group)
         user = self._get_user(user)
         permission = self._get_perm(perm)
 
         # check if we have that permission already
         obj = self.sa.query(UserRepoGroupToPerm)\
             .filter(UserRepoGroupToPerm.user == user)\
             .filter(UserRepoGroupToPerm.group == repo_group)\
             .scalar()
         if obj is None:
             # create new !
             obj = UserRepoGroupToPerm()
         obj.group = repo_group
         obj.user = user
         obj.permission = permission
         self.sa.add(obj)
         log.debug('Granted perm %s to %s on %s', perm, user, repo_group)
         action_logger_generic(
             'granted permission: {} to user: {} on repogroup: {}'.format(
                 perm, user, repo_group), namespace='security.repogroup')
         return obj
 
     def revoke_user_permission(self, repo_group, user):
         """
         Revoke permission for user on given repository group
 
         :param repo_group: Instance of RepoGroup, repositories_group_id,
             or repositories_group name
         :param user: Instance of User, user_id or username
         """
 
         repo_group = self._get_repo_group(repo_group)
         user = self._get_user(user)
 
         obj = self.sa.query(UserRepoGroupToPerm)\
             .filter(UserRepoGroupToPerm.user == user)\
             .filter(UserRepoGroupToPerm.group == repo_group)\
             .scalar()
         if obj:
             self.sa.delete(obj)
             log.debug('Revoked perm on %s on %s', repo_group, user)
             action_logger_generic(
                 'revoked permission from user: {} on repogroup: {}'.format(
                     user, repo_group), namespace='security.repogroup')
 
     def grant_user_group_permission(self, repo_group, group_name, perm):
         """
         Grant permission for user group on given repository group, or update
         existing one if found
 
         :param repo_group: Instance of RepoGroup, repositories_group_id,
             or repositories_group name
         :param group_name: Instance of UserGroup, users_group_id,
             or user group name
         :param perm: Instance of Permission, or permission_name
         """
         repo_group = self._get_repo_group(repo_group)
         group_name = self._get_user_group(group_name)
         permission = self._get_perm(perm)
 
         # check if we have that permission already
         obj = self.sa.query(UserGroupRepoGroupToPerm)\
             .filter(UserGroupRepoGroupToPerm.group == repo_group)\
             .filter(UserGroupRepoGroupToPerm.users_group == group_name)\
             .scalar()
 
         if obj is None:
             # create new
             obj = UserGroupRepoGroupToPerm()
 
         obj.group = repo_group
         obj.users_group = group_name
         obj.permission = permission
         self.sa.add(obj)
         log.debug('Granted perm %s to %s on %s', perm, group_name, repo_group)
         action_logger_generic(
             'granted permission: {} to usergroup: {} on repogroup: {}'.format(
                 perm, group_name, repo_group), namespace='security.repogroup')
         return obj
 
     def revoke_user_group_permission(self, repo_group, group_name):
         """
         Revoke permission for user group on given repository group
 
         :param repo_group: Instance of RepoGroup, repositories_group_id,
             or repositories_group name
         :param group_name: Instance of UserGroup, users_group_id,
             or user group name
         """
         repo_group = self._get_repo_group(repo_group)
         group_name = self._get_user_group(group_name)
 
         obj = self.sa.query(UserGroupRepoGroupToPerm)\
             .filter(UserGroupRepoGroupToPerm.group == repo_group)\
             .filter(UserGroupRepoGroupToPerm.users_group == group_name)\
             .scalar()
         if obj:
             self.sa.delete(obj)
             log.debug('Revoked perm to %s on %s', repo_group, group_name)
             action_logger_generic(
                 'revoked permission from usergroup: {} on repogroup: {}'.format(
                     group_name, repo_group), namespace='security.repogroup')
 
     @classmethod
     def update_commit_cache(cls, repo_groups=None):
         if not repo_groups:
             repo_groups = RepoGroup.getAll()
         for repo_group in repo_groups:
             repo_group.update_commit_cache()
 
     def get_repo_groups_as_dict(self, repo_group_list=None, admin=False,
                                 super_user_actions=False):
 
         from pyramid.threadlocal import get_current_request
         _render = get_current_request().get_partial_renderer(
             'rhodecode:templates/data_table/_dt_elements.mako')
         c = _render.get_call_context()
         h = _render.get_helpers()
 
         def quick_menu(repo_group_name):
             return _render('quick_repo_group_menu', repo_group_name)
 
         def repo_group_lnk(repo_group_name):
             return _render('repo_group_name', repo_group_name)
 
         def last_change(last_change):
             if admin and isinstance(last_change, datetime.datetime) and not last_change.tzinfo:
                 ts = time.time()
                 utc_offset = (datetime.datetime.fromtimestamp(ts)
                               - datetime.datetime.utcfromtimestamp(ts)).total_seconds()
                 last_change = last_change + datetime.timedelta(seconds=utc_offset)
             return _render("last_change", last_change)
 
         def desc(desc, personal):
             return _render(
                 'repo_group_desc', desc, personal, c.visual.stylify_metatags)
 
         def repo_group_actions(repo_group_id, repo_group_name, gr_count):
             return _render(
                 'repo_group_actions', repo_group_id, repo_group_name, gr_count)
 
         def repo_group_name(repo_group_name, children_groups):
             return _render("repo_group_name", repo_group_name, children_groups)
 
         def user_profile(username):
             return _render('user_profile', username)
 
         repo_group_data = []
         for group in repo_group_list:
             # NOTE(marcink): because we use only raw column we need to load it like that
             changeset_cache = RepoGroup._load_changeset_cache(
                 '', group._changeset_cache)
             last_commit_change = RepoGroup._load_commit_change(changeset_cache)
             row = {
                 "menu": quick_menu(group.group_name),
                 "name": repo_group_lnk(group.group_name),
                 "name_raw": group.group_name,
 
                 "last_change": last_change(last_commit_change),
 
                 "last_changeset": "",
                 "last_changeset_raw": "",
 
                 "desc": desc(h.escape(group.group_description), group.personal),
                 "top_level_repos": 0,
                 "owner": user_profile(group.User.username)
             }
             if admin:
                 repo_count = group.repositories.count()
                 children_groups = list(map(
                     h.safe_str,
                     itertools.chain((g.name for g in group.parents),
                                     (x.name for x in [group]))))
                 row.update({
                     "action": repo_group_actions(
                         group.group_id, group.group_name, repo_count),
                     "top_level_repos": repo_count,
                     "name": repo_group_name(group.group_name, children_groups),
 
                 })
             repo_group_data.append(row)
 
         return repo_group_data
 
     def get_repo_groups_data_table(
             self, draw, start, limit,
             search_q, order_by, order_dir,
             auth_user, repo_group_id):
         from rhodecode.model.scm import RepoGroupList
 
         _perms = ['group.read', 'group.write', 'group.admin']
         repo_groups = RepoGroup.query() \
             .filter(RepoGroup.group_parent_id == repo_group_id) \
             .all()
         auth_repo_group_list = RepoGroupList(
             repo_groups, perm_set=_perms,
             extra_kwargs=dict(user=auth_user))
 
         allowed_ids = [-1]
         for repo_group in auth_repo_group_list:
             allowed_ids.append(repo_group.group_id)
 
         repo_groups_data_total_count = RepoGroup.query() \
             .filter(RepoGroup.group_parent_id == repo_group_id) \
             .filter(or_(
                 # generate multiple IN to fix limitation problems
                 *in_filter_generator(RepoGroup.group_id, allowed_ids))
             ) \
             .count()
 
         base_q = Session.query(
             RepoGroup.group_name,
             RepoGroup.group_name_hash,
             RepoGroup.group_description,
             RepoGroup.group_id,
             RepoGroup.personal,
             RepoGroup.updated_on,
             RepoGroup._changeset_cache,
             User,
             ) \
             .filter(RepoGroup.group_parent_id == repo_group_id) \
             .filter(or_(
                 # generate multiple IN to fix limitation problems
                 *in_filter_generator(RepoGroup.group_id, allowed_ids))
             ) \
             .join(User, User.user_id == RepoGroup.user_id) \
             .group_by(RepoGroup, User)
 
         repo_groups_data_total_filtered_count = base_q.count()
 
         sort_defined = False
 
         if order_by == 'group_name':
             sort_col = func.lower(RepoGroup.group_name)
             sort_defined = True
         elif order_by == 'user_username':
             sort_col = User.username
         else:
             sort_col = getattr(RepoGroup, order_by, None)
 
         if sort_defined or sort_col:
             if order_dir == 'asc':
                 sort_col = sort_col.asc()
             else:
                 sort_col = sort_col.desc()
 
         base_q = base_q.order_by(sort_col)
         base_q = base_q.offset(start).limit(limit)
 
         repo_group_list = base_q.all()
 
         repo_groups_data = RepoGroupModel().get_repo_groups_as_dict(
             repo_group_list=repo_group_list, admin=False)
 
         data = ({
             'draw': draw,
             'data': repo_groups_data,
             'recordsTotal': repo_groups_data_total_count,
             'recordsFiltered': repo_groups_data_total_filtered_count,
         })
         return data
 
     def _get_defaults(self, repo_group_name):
         repo_group = RepoGroup.get_by_group_name(repo_group_name)
 
         if repo_group is None:
             return None
 
         defaults = repo_group.get_dict()
         defaults['repo_group_name'] = repo_group.name
         defaults['repo_group_description'] = repo_group.group_description
         defaults['repo_group_enable_locking'] = repo_group.enable_locking
 
         # we use -1 as this is how in HTML, we mark an empty group
         defaults['repo_group'] = defaults['group_parent_id'] or -1
 
         # fill owner
         if repo_group.user:
             defaults.update({'user': repo_group.user.username})
         else:
             replacement_user = User.get_first_super_admin().username
             defaults.update({'user': replacement_user})
 
         return defaults

rhodecode/model/update.py

@@ -1,83 +1,83 b''
 # Copyright (C) 2013-2023 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import logging
 import urllib.request
 import urllib.error
 import urllib.parse
 from packaging.version import Version
 
 import rhodecode
 from rhodecode.lib.ext_json import json
 from rhodecode.model import BaseModel
 from rhodecode.model.meta import Session
 from rhodecode.model.settings import SettingsModel
 
 
 log = logging.getLogger(__name__)
 
 
 class UpdateModel(BaseModel):
     UPDATE_SETTINGS_KEY = 'update_version'
     UPDATE_URL_SETTINGS_KEY = 'rhodecode_update_url'
 
     @staticmethod
     def get_update_data(update_url):
         """Return the JSON update data."""
         ver = rhodecode.__version__
         log.debug('Checking for upgrade on `%s` server', update_url)
         opener = urllib.request.build_opener()
-        opener.addheaders = [('User-agent', 'RhodeCode-SCM/%s' % ver)]
+        opener.addheaders = [('User-agent', f'RhodeCode-SCM/{ver.strip()}')]
         response = opener.open(update_url)
         response_data = response.read()
         data = json.loads(response_data)
         log.debug('update server returned data')
         return data
 
     def get_update_url(self):
         settings = SettingsModel().get_all_settings()
         return settings.get(self.UPDATE_URL_SETTINGS_KEY)
 
     def store_version(self, version):
         log.debug('Storing version %s into settings', version)
         setting = SettingsModel().create_or_update_setting(
             self.UPDATE_SETTINGS_KEY, version)
         Session().add(setting)
         Session().commit()
 
     def get_stored_version(self, fallback=None):
         obj = SettingsModel().get_setting_by_name(self.UPDATE_SETTINGS_KEY)
         if obj:
             return obj.app_settings_value
         return fallback or '0.0.0'
 
     def _sanitize_version(self, version):
         """
         Cleanup our custom ver.
         e.g 4.11.0_20171204_204825_CE_default_EE_default to 4.11.0
         """
         return version.split('_')[0]
 
     def is_outdated(self, cur_version, latest_version=None):
         latest_version = latest_version or self.get_stored_version()
         try:
             cur_version = self._sanitize_version(cur_version)
             return Version(latest_version) > Version(cur_version)
         except Exception:
             # could be invalid version, etc
             return False

rhodecode/templates/admin/settings/settings_system.mako

@@ -1,89 +1,103 b''
 
 <div id="update_notice" style="display: none; margin: 0px 0px 30px 0px">
     <div>${_('Checking for updates...')}</div>
 </div>
 
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('System Info')}</h3>
         % if c.allowed_to_snapshot:
             <a href="${h.route_path('admin_settings_system', _query={'snapshot':1})}" class="panel-edit">${_('create summary snapshot')}</a>
         % endif
     </div>
     <div class="panel-body">
         <dl class="dl-horizontal settings dt-400">
         % for dt, dd, warn in c.data_items:
           <dt>${dt}${':' if dt else '---'}</dt>
           <dd>${dd}${'' if dt else '---'}
               % if warn and warn['message']:
                   <div class="alert-${warn['type']}">
                     <strong>${warn['message']}</strong>
                   </div>
               % endif
           </dd>
         % endfor
         </dl>
     </div>
 </div>
 
 <div class="panel panel-default">
     <div class="panel-heading">
-        <h3 class="panel-title">${_('VCS Server')}</h3>
+        <h3 class="panel-title">${_('RhodeCode Server Config')}</h3>
+    </div>
+    <div class="panel-body">
+        <dl class="dl-horizontal settings dt-400">
+        % for dt, dd in c.rhodecode_data_items:
+          <dt>${dt}${':' if dt else '---'}</dt>
+          <dd>${dd}${'' if dt else '---'}</dd>
+        % endfor
+        </dl>
+    </div>
+</div>
+
+<div class="panel panel-default">
+    <div class="panel-heading">
+        <h3 class="panel-title">${_('VCS Server Config')}</h3>
     </div>
     <div class="panel-body">
         <dl class="dl-horizontal settings dt-400">
         % for dt, dd in c.vcsserver_data_items:
           <dt>${dt}${':' if dt else '---'}</dt>
           <dd>${dd}${'' if dt else '---'}</dd>
         % endfor
         </dl>
     </div>
 </div>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Python Packages')}</h3>
     </div>
     <div class="panel-body">
         <table>
             <th></th>
             <th></th>
             <th></th>
             % for name, package_data in c.py_modules['human_value']:
                 <tr>
                     <td>${name.lower()}</td>
                     <td>${package_data['version']}</td>
                     <td>(${package_data['location']})</td>
                 </tr>
             % endfor
         </table>
 
     </div>
 </div>
 
 <div class="panel panel-default">
     <div class="panel-heading">
         <h3 class="panel-title">${_('Env Variables')}</h3>
     </div>
     <div class="panel-body">
         <table>
             <th></th>
             <th></th>
             % for env_key, env_val in c.env_data:
                 <tr>
                     <td style="vertical-align: top">${env_key}</td>
                     <td>${env_val}</td>
                 </tr>
             % endfor
         </table>
 
     </div>
 </div>
 
 <script>
     $('#check_for_update').click(function(e){
         $('#update_notice').show();
         $('#update_notice').load("${h.route_path('admin_settings_system_update', _query={'ver': request.GET.get('ver')})}");
     })
 </script>

rhodecode/tests/models/test_permissions.py

@@ -1,743 +1,811 b''
 
 # Copyright (C) 2010-2023 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import pytest
 
 from rhodecode.lib.auth import AuthUser
 from rhodecode.model.db import (
     RepoGroup, User, UserGroupRepoGroupToPerm, Permission, UserToPerm,
     UserGroupToPerm)
 from rhodecode.model.meta import Session
 from rhodecode.model.permission import PermissionModel
 from rhodecode.model.repo import RepoModel
 from rhodecode.model.repo_group import RepoGroupModel
 from rhodecode.model.user import UserModel
 from rhodecode.model.user_group import UserGroupModel
 from rhodecode.tests.fixture import Fixture
 
 
 fixture = Fixture()
 
 
 @pytest.fixture()
 def repo_name(backend_hg):
     return backend_hg.repo_name
 
 
 class TestPermissions(object):
 
     @pytest.fixture(scope='class', autouse=True)
     def default_permissions(self, request, baseapp):
         # recreate default user to get a clean start
         PermissionModel().create_default_user_permissions(
             user=User.DEFAULT_USER, force=True)
         Session().commit()
 
     @pytest.fixture(autouse=True)
     def prepare_users(self, request):
         # TODO: User creation is a duplicate of test_nofitications, check
         # if that can be unified
         self.u1 = UserModel().create_or_update(
             username=u'u1', password=u'qweqwe',
             email=u'[e-mail]', firstname=u'u1', lastname=u'u1'
         )
         self.u2 = UserModel().create_or_update(
             username=u'u2', password=u'qweqwe',
             email=u'[e-mail]', firstname=u'u2', lastname=u'u2'
         )
         self.u3 = UserModel().create_or_update(
             username=u'u3', password=u'qweqwe',
             email=u'[e-mail]', firstname=u'u3', lastname=u'u3'
         )
         self.anon = User.get_default_user()
         self.a1 = UserModel().create_or_update(
             username=u'a1', password=u'qweqwe',
             email=u'[e-mail]', firstname=u'a1', lastname=u'a1',
             admin=True
         )
         Session().commit()
 
         request.addfinalizer(self.cleanup)
 
     def cleanup(self):
         if hasattr(self, 'test_repo'):
             RepoModel().delete(repo=self.test_repo)
             Session().commit()
 
         if hasattr(self, 'g1'):
             RepoGroupModel().delete(self.g1.group_id)
         if hasattr(self, 'g2'):
             RepoGroupModel().delete(self.g2.group_id)
         Session().commit()
 
         UserModel().delete(self.u1, handle_repos='delete', handle_repo_groups='delete')
         UserModel().delete(self.u2, handle_repos='delete', handle_repo_groups='delete')
         UserModel().delete(self.u3, handle_repos='delete', handle_repo_groups='delete')
         UserModel().delete(self.a1, handle_repos='delete', handle_repo_groups='delete')
         Session().commit()
 
         if hasattr(self, 'ug1'):
             UserGroupModel().delete(self.ug1, force=True)
             Session().commit()
 
     def test_default_perms_set(self, repo_name):
         assert repo_perms(self.u1)[repo_name] == 'repository.read'
         new_perm = 'repository.write'
         RepoModel().grant_user_permission(repo=repo_name, user=self.u1,
                                           perm=new_perm)
         Session().commit()
         assert repo_perms(self.u1)[repo_name] == new_perm
 
     def test_default_admin_perms_set(self, repo_name):
         assert repo_perms(self.a1)[repo_name] == 'repository.admin'
         RepoModel().grant_user_permission(repo=repo_name, user=self.a1,
                                           perm='repository.write')
         Session().commit()
         # cannot really downgrade admins permissions !? they still gets set as
         # admin !
         assert repo_perms(self.a1)[repo_name] == 'repository.admin'
 
     def test_default_group_perms(self, repo_name):
         self.g1 = fixture.create_repo_group('test1', skip_if_exists=True)
         self.g2 = fixture.create_repo_group('test2', skip_if_exists=True)
 
         assert repo_perms(self.u1)[repo_name] == 'repository.read'
         assert group_perms(self.u1) == {
             'test1': 'group.read', 'test2': 'group.read'}
         assert global_perms(self.u1) == set(
             Permission.DEFAULT_USER_PERMISSIONS)
 
     def test_default_admin_group_perms(self, repo_name):
         self.g1 = fixture.create_repo_group('test1', skip_if_exists=True)
         self.g2 = fixture.create_repo_group('test2', skip_if_exists=True)
 
         assert repo_perms(self.a1)[repo_name] == 'repository.admin'
         assert group_perms(self.a1) == {
             'test1': 'group.admin', 'test2': 'group.admin'}
 
     def test_default_owner_repo_perms(self, backend, user_util, test_repo):
         user = user_util.create_user()
         repo = test_repo('minimal', backend.alias)
         org_owner = repo.user
         assert repo_perms(user)[repo.repo_name] == 'repository.read'
 
         repo.user = user
         assert repo_perms(user)[repo.repo_name] == 'repository.admin'
         repo.user = org_owner
 
     def test_default_owner_branch_perms(self, user_util, test_user_group):
         user = user_util.create_user()
         assert branch_perms(user) == {}
 
     def test_default_owner_repo_group_perms(self, user_util, test_repo_group):
         user = user_util.create_user()
         org_owner = test_repo_group.user
 
         assert group_perms(user)[test_repo_group.group_name] == 'group.read'
 
         test_repo_group.user = user
         assert group_perms(user)[test_repo_group.group_name] == 'group.admin'
         test_repo_group.user = org_owner
 
     def test_default_owner_user_group_perms(self, user_util, test_user_group):
         user = user_util.create_user()
         org_owner = test_user_group.user
 
         assert user_group_perms(user)[test_user_group.users_group_name] == 'usergroup.read'
 
         test_user_group.user = user
         assert user_group_perms(user)[test_user_group.users_group_name] == 'usergroup.admin'
 
         test_user_group.user = org_owner
 
+    def test_propagated_permissions_from_repo_group_to_private_repo(self, repo_name):
+        # make group
+        self.g1 = fixture.create_repo_group('TOP_LEVEL', skip_if_exists=True)
+        # both perms should be read !
+        assert group_perms(self.anon) == {
+            'TOP_LEVEL': 'group.read'
+        }
+
+        # Create repo inside the TOP_LEVEL
+        repo_name_in_group = RepoGroup.url_sep().join([self.g1.group_name, 'test_perm_on_private_repo'])
+        self.test_repo = fixture.create_repo(name=repo_name_in_group,
+                                             repo_type='hg',
+                                             repo_group=self.g1,
+                                             cur_user=self.u1,)
+        assert repo_perms(self.anon) == {
+            repo_name_in_group: 'repository.read',
+            'vcs_test_git': 'repository.read',
+            'vcs_test_hg': 'repository.read',
+            'vcs_test_svn': 'repository.read',
+        }
+        # Now change default user permissions
+        new_perm = 'repository.write'
+        perm_updates = [
+            [self.anon.user_id, new_perm, 'user']
+        ]
+        RepoGroupModel().update_permissions(
+            repo_group=self.g1, perm_updates=perm_updates, recursive='all')
+
+        Session().commit()
+        assert repo_perms(self.anon) == {
+            repo_name_in_group: new_perm,
+            'vcs_test_git': 'repository.read',
+            'vcs_test_hg': 'repository.read',
+            'vcs_test_svn': 'repository.read',
+        }
+
+        # NOW MARK repo as private
+        changes = {
+            'repo_private': True
+        }
+        repo = RepoModel().get_by_repo_name(repo_name_in_group)
+        RepoModel().update(repo, **changes)
+        Session().commit()
+
+        # Private repo sets 'none' permission for default user
+        assert repo_perms(self.anon) == {
+            repo_name_in_group: 'repository.none',
+            'vcs_test_git': 'repository.read',
+            'vcs_test_hg': 'repository.read',
+            'vcs_test_svn': 'repository.read',
+        }
+
+        # apply same logic of "updated" recursive, but now the anon permissions should be not be impacted
+        new_perm = 'repository.write'
+        perm_updates = [
+            [self.anon.user_id, new_perm, 'user']
+        ]
+        RepoGroupModel().update_permissions(
+            repo_group=self.g1, perm_updates=perm_updates, recursive='all')
+
+        Session().commit()
+        assert repo_perms(self.anon) == {
+            repo_name_in_group: 'repository.none',
+            'vcs_test_git': 'repository.read',
+            'vcs_test_hg': 'repository.read',
+            'vcs_test_svn': 'repository.read',
+        }
+
     def test_propagated_permission_from_users_group_by_explicit_perms_exist(
             self, repo_name):
         # make group
         self.ug1 = fixture.create_user_group('G1')
         UserGroupModel().add_user_to_group(self.ug1, self.u1)
 
         # set permission to lower
         new_perm = 'repository.none'
         RepoModel().grant_user_permission(
             repo=repo_name, user=self.u1, perm=new_perm)
         Session().commit()
         assert repo_perms(self.u1)[repo_name] == new_perm
 
         # grant perm for group this should not override permission from user
         # since it has explicitly set
         new_perm_gr = 'repository.write'
         RepoModel().grant_user_group_permission(
             repo=repo_name, group_name=self.ug1, perm=new_perm_gr)
         Session().commit()
 
         assert repo_perms(self.u1)[repo_name] == new_perm
         assert group_perms(self.u1) == {}
 
     def test_propagated_permission_from_users_group(self, repo_name):
         # make group
         self.ug1 = fixture.create_user_group('G1')
         UserGroupModel().add_user_to_group(self.ug1, self.u3)
 
         # grant perm for group
         # this should override default permission from user
         new_perm_gr = 'repository.write'
         RepoModel().grant_user_group_permission(
             repo=repo_name, group_name=self.ug1, perm=new_perm_gr)
         Session().commit()
 
         assert repo_perms(self.u3)[repo_name] == new_perm_gr
         assert group_perms(self.u3) == {}
 
     def test_propagated_permission_from_users_group_lower_weight(
             self, repo_name):
         # make group with user
         self.ug1 = fixture.create_user_group('G1')
         UserGroupModel().add_user_to_group(self.ug1, self.u1)
 
         # set permission to lower
         new_perm_h = 'repository.write'
         RepoModel().grant_user_permission(
             repo=repo_name, user=self.u1, perm=new_perm_h)
         Session().commit()
 
         assert repo_perms(self.u1)[repo_name] == new_perm_h
 
         # grant perm for group this should NOT override permission from user
         # since it's lower than granted
         new_perm_l = 'repository.read'
         RepoModel().grant_user_group_permission(
             repo=repo_name, group_name=self.ug1, perm=new_perm_l)
         Session().commit()
 
         assert repo_perms(self.u1)[repo_name] == new_perm_h
         assert group_perms(self.u1) == {}
 
     def test_repo_in_group_permissions(self):
         self.g1 = fixture.create_repo_group('group1', skip_if_exists=True)
         self.g2 = fixture.create_repo_group('group2', skip_if_exists=True)
         # both perms should be read !
         assert group_perms(self.u1) == \
             {u'group1': u'group.read', u'group2': u'group.read'}
 
         assert group_perms(self.anon) == \
             {u'group1': u'group.read', u'group2': u'group.read'}
 
         # Change perms to none for both groups
         RepoGroupModel().grant_user_permission(
             repo_group=self.g1, user=self.anon, perm='group.none')
         RepoGroupModel().grant_user_permission(
             repo_group=self.g2, user=self.anon, perm='group.none')
 
         assert group_perms(self.u1) == \
             {u'group1': u'group.none', u'group2': u'group.none'}
         assert group_perms(self.anon) == \
             {u'group1': u'group.none', u'group2': u'group.none'}
 
         # add repo to group
         name = RepoGroup.url_sep().join([self.g1.group_name, 'test_perm'])
         self.test_repo = fixture.create_repo(name=name,
                                              repo_type='hg',
                                              repo_group=self.g1,
                                              cur_user=self.u1,)
 
         assert group_perms(self.u1) == \
             {u'group1': u'group.none', u'group2': u'group.none'}
         assert group_perms(self.anon) == \
             {u'group1': u'group.none', u'group2': u'group.none'}
 
         # grant permission for u2 !
         RepoGroupModel().grant_user_permission(
             repo_group=self.g1, user=self.u2, perm='group.read')
         RepoGroupModel().grant_user_permission(
             repo_group=self.g2, user=self.u2, perm='group.read')
         Session().commit()
         assert self.u1 != self.u2
 
         # u1 and anon should have not change perms while u2 should !
         assert group_perms(self.u1) == \
             {u'group1': u'group.none', u'group2': u'group.none'}
         assert group_perms(self.u2) == \
             {u'group1': u'group.read', u'group2': u'group.read'}
         assert group_perms(self.anon) == \
             {u'group1': u'group.none', u'group2': u'group.none'}
 
     def test_repo_group_user_as_user_group_member(self):
         # create Group1
         self.g1 = fixture.create_repo_group('group1', skip_if_exists=True)
         assert group_perms(self.anon) == {u'group1': u'group.read'}
 
         # set default permission to none
         RepoGroupModel().grant_user_permission(
             repo_group=self.g1, user=self.anon, perm='group.none')
         Session().commit()
 
         # make group
         self.ug1 = fixture.create_user_group('G1')
         # add user to group
         UserGroupModel().add_user_to_group(self.ug1, self.u1)
         Session().commit()
 
         # check if user is in the group
         ug1 = UserGroupModel().get(self.ug1.users_group_id)
         members = [x.user_id for x in ug1.members]
         assert members == [self.u1.user_id]
         # add some user to that group
 
         # check his permissions
         assert group_perms(self.anon) == {u'group1': u'group.none'}
         assert group_perms(self.u1) == {u'group1': u'group.none'}
 
         # grant ug1 read permissions for
         RepoGroupModel().grant_user_group_permission(
             repo_group=self.g1, group_name=self.ug1, perm='group.read')
         Session().commit()
 
         # check if the
         obj = Session().query(UserGroupRepoGroupToPerm)\
             .filter(UserGroupRepoGroupToPerm.group == self.g1)\
             .filter(UserGroupRepoGroupToPerm.users_group == self.ug1)\
             .scalar()
         assert obj.permission.permission_name == 'group.read'
 
         assert group_perms(self.anon) == {u'group1': u'group.none'}
         assert group_perms(self.u1) == {u'group1': u'group.read'}
 
     def test_inherited_permissions_from_default_on_user_enabled(self):
         # enable fork and create on default user
         _form_result = {
             'default_repo_create': 'hg.create.repository',
             'default_fork_create': 'hg.fork.repository'
         }
         PermissionModel().set_new_user_perms(
             User.get_default_user(), _form_result)
         Session().commit()
 
         # make sure inherit flag is turned on
         self.u1.inherit_default_permissions = True
         Session().commit()
 
         # this user will have inherited permissions from default user
         assert global_perms(self.u1) == default_perms()
 
     def test_inherited_permissions_from_default_on_user_disabled(self):
         # disable fork and create on default user
         _form_result = {
             'default_repo_create': 'hg.create.none',
             'default_fork_create': 'hg.fork.none'
         }
         PermissionModel().set_new_user_perms(
             User.get_default_user(), _form_result)
         Session().commit()
 
         # make sure inherit flag is turned on
         self.u1.inherit_default_permissions = True
         Session().commit()
 
         # this user will have inherited permissions from default user
         expected_perms = default_perms(
             added=['hg.create.none', 'hg.fork.none'],
             removed=['hg.create.repository', 'hg.fork.repository'])
         assert global_perms(self.u1) == expected_perms
 
     def test_non_inherited_permissions_from_default_on_user_enabled(self):
         user_model = UserModel()
         # enable fork and create on default user
         usr = User.DEFAULT_USER
         user_model.revoke_perm(usr, 'hg.create.none')
         user_model.grant_perm(usr, 'hg.create.repository')
         user_model.revoke_perm(usr, 'hg.fork.none')
         user_model.grant_perm(usr, 'hg.fork.repository')
 
         # disable global perms on specific user
         user_model.revoke_perm(self.u1, 'hg.create.repository')
         user_model.grant_perm(self.u1, 'hg.create.none')
         user_model.revoke_perm(self.u1, 'hg.fork.repository')
         user_model.grant_perm(self.u1, 'hg.fork.none')
 
         # TODO(marcink): check branch permissions now ?
 
         # make sure inherit flag is turned off
         self.u1.inherit_default_permissions = False
         Session().commit()
 
         # this user will have non inherited permissions from he's
         # explicitly set permissions
         assert global_perms(self.u1) == {
             'hg.create.none',
             'hg.fork.none',
             'hg.register.manual_activate',
             'hg.password_reset.enabled',
             'hg.extern_activate.auto',
             'repository.read',
             'group.read',
             'usergroup.read',
             'branch.push_force',
         }
 
     def test_non_inherited_permissions_from_default_on_user_disabled(self):
         user_model = UserModel()
         # disable fork and create on default user
         usr = User.DEFAULT_USER
         user_model.revoke_perm(usr, 'hg.create.repository')
         user_model.grant_perm(usr, 'hg.create.none')
         user_model.revoke_perm(usr, 'hg.fork.repository')
         user_model.grant_perm(usr, 'hg.fork.none')
 
         # enable global perms on specific user
         user_model.revoke_perm(self.u1, 'hg.create.none')
         user_model.grant_perm(self.u1, 'hg.create.repository')
         user_model.revoke_perm(self.u1, 'hg.fork.none')
         user_model.grant_perm(self.u1, 'hg.fork.repository')
 
         # make sure inherit flag is turned off
         self.u1.inherit_default_permissions = False
         Session().commit()
 
         # TODO(marcink): check branch perms
 
         # this user will have non inherited permissions from he's
         # explicitly set permissions
         assert global_perms(self.u1) == {
             'hg.create.repository',
             'hg.fork.repository',
             'hg.register.manual_activate',
             'hg.password_reset.enabled',
             'hg.extern_activate.auto',
             'repository.read',
             'group.read',
             'usergroup.read',
             'branch.push_force',
         }
 
     @pytest.mark.parametrize('perm, expected_perm', [
         ('hg.inherit_default_perms.false', 'repository.none', ),
         ('hg.inherit_default_perms.true', 'repository.read', ),
     ])
     def test_inherited_permissions_on_objects(self, perm, expected_perm):
         _form_result = {
             'default_inherit_default_permissions': perm,
         }
         PermissionModel().set_new_user_perms(
             User.get_default_user(), _form_result)
         Session().commit()
 
         # make sure inherit flag is turned on
         self.u1.inherit_default_permissions = True
         Session().commit()
 
         # TODO(marcink): check branch perms
 
         # this user will have inherited permissions from default user
         assert global_perms(self.u1) == {
             'hg.create.none',
             'hg.fork.none',
             'hg.register.manual_activate',
             'hg.password_reset.enabled',
             'hg.extern_activate.auto',
             'repository.read',
             'group.read',
             'usergroup.read',
             'branch.push_force',
             'hg.create.write_on_repogroup.true',
             'hg.usergroup.create.false',
             'hg.repogroup.create.false',
             perm
         }
 
         assert set(repo_perms(self.u1).values()) == set([expected_perm])
 
     def test_repo_owner_permissions_not_overwritten_by_group(self):
         # create repo as USER,
         self.test_repo = fixture.create_repo(name='myownrepo',
                                              repo_type='hg',
                                              cur_user=self.u1)
 
         # he has permissions of admin as owner
         assert repo_perms(self.u1)['myownrepo'] == 'repository.admin'
 
         # set his permission as user group, he should still be admin
         self.ug1 = fixture.create_user_group('G1')
         UserGroupModel().add_user_to_group(self.ug1, self.u1)
         RepoModel().grant_user_group_permission(
             self.test_repo,
             group_name=self.ug1,
             perm='repository.none')
         Session().commit()
 
         assert repo_perms(self.u1)['myownrepo'] == 'repository.admin'
 
     def test_repo_owner_permissions_not_overwritten_by_others(self):
         # create repo as USER,
         self.test_repo = fixture.create_repo(name='myownrepo',
                                              repo_type='hg',
                                              cur_user=self.u1)
 
         # he has permissions of admin as owner
         assert repo_perms(self.u1)['myownrepo'] == 'repository.admin'
 
         # set his permission as user, he should still be admin
         RepoModel().grant_user_permission(
             self.test_repo, user=self.u1, perm='repository.none')
         Session().commit()
 
         assert repo_perms(self.u1)['myownrepo'] == 'repository.admin'
 
     def test_repo_group_owner_permissions_not_overwritten_by_group(self):
         # "u1" shall be owner without any special permission assigned
         self.g1 = fixture.create_repo_group('test1')
 
         # Make user group and grant a permission to user group
         self.ug1 = fixture.create_user_group('G1')
         UserGroupModel().add_user_to_group(self.ug1, self.u1)
         RepoGroupModel().grant_user_group_permission(
             repo_group=self.g1, group_name=self.ug1, perm='group.write')
         Session().commit()
 
         # Verify that user does not get any special permission if he is not
         # owner
         assert group_perms(self.u1) == {'test1': 'group.write'}
 
         # Make him owner of the repo group
         self.g1.user = self.u1
         assert group_perms(self.u1) == {'test1': 'group.admin'}
 
     def test_repo_group_owner_permissions_not_overwritten_by_others(self):
         # "u1" shall be owner without any special permission assigned
         self.g1 = fixture.create_repo_group('test1')
         RepoGroupModel().grant_user_permission(
             repo_group=self.g1, user=self.u1, perm='group.write')
         Session().commit()
 
         # Verify that user does not get any special permission if he is not
         # owner
         assert group_perms(self.u1) == {'test1': 'group.write'}
 
         # Make him owner of the repo group
         self.g1.user = self.u1
         assert group_perms(self.u1) == {u'test1': 'group.admin'}
 
     def assert_user_perm_equal(
             self, user, change_factor=0, compare_keys=None):
         perms = UserToPerm.query().filter(UserToPerm.user == user).all()
         assert len(perms) == \
             len(Permission.DEFAULT_USER_PERMISSIONS) + change_factor
         if compare_keys:
             assert set(
                 x.permissions.permission_name for x in perms) == compare_keys
 
     def assert_def_user_group_perm_equal(
             self, user_group, change_factor=0, compare_keys=None):
         perms = UserGroupToPerm.query().filter(
             UserGroupToPerm.users_group == user_group).all()
         assert len(perms) == \
             len(Permission.DEFAULT_USER_PERMISSIONS) + change_factor
         if compare_keys:
             assert set(
                 x.permissions.permission_name for x in perms) == compare_keys
 
     def test_set_default_permissions(self):
         PermissionModel().create_default_user_permissions(user=self.u1)
         self.assert_user_perm_equal(user=self.u1)
 
     def test_set_default_permissions_after_one_is_missing(self):
         PermissionModel().create_default_user_permissions(user=self.u1)
         self.assert_user_perm_equal(user=self.u1)
         # now we delete one, it should be re-created after another call
         perms = UserToPerm.query().filter(UserToPerm.user == self.u1).all()
         Session().delete(perms[0])
         Session().commit()
 
         self.assert_user_perm_equal(user=self.u1, change_factor=-1)
 
         # create missing one !
         PermissionModel().create_default_user_permissions(user=self.u1)
         self.assert_user_perm_equal(user=self.u1)
 
     @pytest.mark.parametrize("perm, modify_to", [
         ('repository.read', 'repository.none'),
         ('group.read', 'group.none'),
         ('usergroup.read', 'usergroup.none'),
         ('hg.create.repository', 'hg.create.none'),
         ('hg.fork.repository', 'hg.fork.none'),
         ('hg.register.manual_activate', 'hg.register.auto_activate',)
     ])
     def test_set_default_permissions_after_modification(self, perm, modify_to):
         PermissionModel().create_default_user_permissions(user=self.u1)
         self.assert_user_perm_equal(user=self.u1)
 
         old = Permission.get_by_key(perm)
         new = Permission.get_by_key(modify_to)
         assert old is not None
         assert new is not None
 
         # now modify permissions
         p = UserToPerm.query().filter(
             UserToPerm.user == self.u1).filter(
             UserToPerm.permission == old).one()
         p.permission = new
         Session().add(p)
         Session().commit()
 
         PermissionModel().create_default_user_permissions(user=self.u1)
         self.assert_user_perm_equal(user=self.u1)
 
     def test_clear_user_perms(self):
         PermissionModel().create_default_user_permissions(user=self.u1)
         self.assert_user_perm_equal(user=self.u1)
 
         # now clear permissions
         cleared = PermissionModel()._clear_user_perms(self.u1.user_id)
         self.assert_user_perm_equal(user=self.u1,
                                     change_factor=len(cleared)*-1)
 
     def test_clear_user_group_perms(self):
         self.ug1 = fixture.create_user_group('G1')
         PermissionModel().create_default_user_group_permissions(
             user_group=self.ug1)
         self.assert_def_user_group_perm_equal(user_group=self.ug1)
 
         # now clear permissions
         cleared = PermissionModel()._clear_user_group_perms(
             self.ug1.users_group_id)
         self.assert_def_user_group_perm_equal(user_group=self.ug1,
                                               change_factor=len(cleared)*-1)
 
     @pytest.mark.parametrize("form_result", [
         {},
         {'default_repo_create': 'hg.create.repository'},
         {'default_repo_create': 'hg.create.repository',
          'default_repo_perm': 'repository.read'},
         {'default_repo_create': 'hg.create.none',
          'default_repo_perm': 'repository.write',
          'default_fork_create': 'hg.fork.none'},
     ])
     def test_set_new_user_permissions(self, form_result):
         _form_result = {}
         _form_result.update(form_result)
         PermissionModel().set_new_user_perms(self.u1, _form_result)
         Session().commit()
         change_factor = -1 * (len(Permission.DEFAULT_USER_PERMISSIONS)
                               - len(form_result.keys()))
         self.assert_user_perm_equal(
             self.u1, change_factor=change_factor)
 
     @pytest.mark.parametrize("form_result", [
         {},
         {'default_repo_create': 'hg.create.repository'},
         {'default_repo_create': 'hg.create.repository',
          'default_repo_perm': 'repository.read'},
         {'default_repo_create': 'hg.create.none',
          'default_repo_perm': 'repository.write',
          'default_fork_create': 'hg.fork.none'},
     ])
     def test_set_new_user_group_permissions(self, form_result):
         _form_result = {}
         _form_result.update(form_result)
         self.ug1 = fixture.create_user_group('G1')
         PermissionModel().set_new_user_group_perms(self.ug1, _form_result)
         Session().commit()
         change_factor = -1 * (len(Permission.DEFAULT_USER_PERMISSIONS)
                               - len(form_result.keys()))
         self.assert_def_user_group_perm_equal(
             self.ug1, change_factor=change_factor)
 
     @pytest.mark.parametrize("group_active, expected_perm", [
         (True, 'repository.admin'),
         (False, 'repository.read'),
     ])
     def test_get_default_repo_perms_from_user_group_with_active_group(
             self, backend, user_util, group_active, expected_perm):
         repo = backend.create_repo()
         user = user_util.create_user()
         user_group = user_util.create_user_group(
             members=[user], users_group_active=group_active)
 
         user_util.grant_user_group_permission_to_repo(
             repo, user_group, 'repository.admin')
         permissions = repo_perms(user)
         repo_permission = permissions.get(repo.repo_name)
         assert repo_permission == expected_perm
 
     @pytest.mark.parametrize("group_active, expected_perm", [
         (True, 'group.admin'),
         (False, 'group.read')
     ])
     def test_get_default_group_perms_from_user_group_with_active_group(
             self, user_util, group_active, expected_perm):
         user = user_util.create_user()
         repo_group = user_util.create_repo_group()
         user_group = user_util.create_user_group(
             members=[user], users_group_active=group_active)
 
         user_util.grant_user_group_permission_to_repo_group(
             repo_group, user_group, 'group.admin')
         permissions = group_perms(user)
         group_permission = permissions.get(repo_group.name)
         assert group_permission == expected_perm
 
     @pytest.mark.parametrize("group_active, expected_perm", [
         (True, 'usergroup.admin'),
         (False, 'usergroup.read')
     ])
     def test_get_default_user_group_perms_from_user_group_with_active_group(
             self, user_util, group_active, expected_perm):
         user = user_util.create_user()
         user_group = user_util.create_user_group(
             members=[user], users_group_active=group_active)
         target_user_group = user_util.create_user_group()
 
         user_util.grant_user_group_permission_to_user_group(
             target_user_group, user_group, 'usergroup.admin')
         permissions = user_group_perms(user)
         group_permission = permissions.get(target_user_group.users_group_name)
         assert group_permission == expected_perm
 
 
 def repo_perms(user):
     auth_user = AuthUser(user_id=user.user_id)
     return auth_user.permissions['repositories']
 
 
 def branch_perms(user):
     auth_user = AuthUser(user_id=user.user_id)
     return auth_user.permissions['repository_branches']
 
 
 def group_perms(user):
     auth_user = AuthUser(user_id=user.user_id)
     return auth_user.permissions['repositories_groups']
 
 
 def user_group_perms(user):
     auth_user = AuthUser(user_id=user.user_id)
     return auth_user.permissions['user_groups']
 
 
 def global_perms(user):
     auth_user = AuthUser(user_id=user.user_id)
     return auth_user.permissions['global']
 
 
 def default_perms(added=None, removed=None):
     expected_perms = set(Permission.DEFAULT_USER_PERMISSIONS)
     if removed:
         expected_perms.difference_update(removed)
     if added:
         expected_perms.update(added)
     return expected_perms

rhodecode/tests/rhodecode.ini

@@ -1,881 +1,897 b''
 
 ; #########################################
 ; RHODECODE COMMUNITY EDITION CONFIGURATION
 ; #########################################
 
 [DEFAULT]
 ; Debug flag sets all loggers to debug, and enables request tracking
 debug = true
 
 ; ########################################################################
 ; EMAIL CONFIGURATION
 ; These settings will be used by the RhodeCode mailing system
 ; ########################################################################
 
 ; prefix all emails subjects with given prefix, helps filtering out emails
 #email_prefix = [RhodeCode]
 
 ; email FROM address all mails will be sent
 #app_email_from = rhodecode-noreply@localhost
 
 #smtp_server = mail.server.com
 #smtp_username =
 #smtp_password =
 #smtp_port =
 #smtp_use_tls = false
 #smtp_use_ssl = true
 
 [server:main]
 ; COMMON HOST/IP CONFIG, This applies mostly to develop setup,
 ; Host port for gunicorn are controlled by gunicorn_conf.py
 host = 127.0.0.1
 port = 10020
 
 
 ; ###########################
 ; GUNICORN APPLICATION SERVER
 ; ###########################
 
 ; run with gunicorn  --config gunicorn_conf.py --paste rhodecode.ini
 
 ; Module to use, this setting shouldn't be changed
 use = egg:gunicorn#main
 
 ; Prefix middleware for RhodeCode.
 ; recommended when using proxy setup.
 ; allows to set RhodeCode under a prefix in server.
 ; eg https://server.com/custom_prefix. Enable `filter-with =` option below as well.
 ; And set your prefix like: `prefix = /custom_prefix`
 ; be sure to also set beaker.session.cookie_path = /custom_prefix if you need
 ; to make your cookies only work on prefix url
 [filter:proxy-prefix]
 use = egg:PasteDeploy#prefix
 prefix = /
 
 [app:main]
 ; The %(here)s variable will be replaced with the absolute path of parent directory
 ; of this file
 ; Each option in the app:main can be override by an environmental variable
 ;
 ;To override an option:
 ;
 ;RC_<KeyName>
 ;Everything should be uppercase, . and - should be replaced by _.
 ;For example, if you have these configuration settings:
 ;rc_cache.repo_object.backend = foo
 ;can be overridden by
 ;export RC_CACHE_REPO_OBJECT_BACKEND=foo
 
 use = egg:rhodecode-enterprise-ce
 
 ; enable proxy prefix middleware, defined above
 #filter-with = proxy-prefix
 
+; control if environmental variables to be expanded into the .ini settings
+rhodecode.env_expand = false
+
 ; encryption key used to encrypt social plugin tokens,
 ; remote_urls with credentials etc, if not set it defaults to
 ; `beaker.session.secret`
 #rhodecode.encrypted_values.secret =
 
 ; decryption strict mode (enabled by default). It controls if decryption raises
 ; `SignatureVerificationError` in case of wrong key, or damaged encryption data.
 #rhodecode.encrypted_values.strict = false
 
 ; Pick algorithm for encryption. Either fernet (more secure) or aes (default)
 ; fernet is safer, and we strongly recommend switching to it.
 ; Due to backward compatibility aes is used as default.
 #rhodecode.encrypted_values.algorithm = fernet
 
 ; Return gzipped responses from RhodeCode (static files/application)
 gzip_responses = false
 
 ; Auto-generate javascript routes file on startup
 generate_js_files = false
 
 ; System global default language.
 ; All available languages: en (default), be, de, es, fr, it, ja, pl, pt, ru, zh
 lang = en
 
 ; Perform a full repository scan and import on each server start.
 ; Settings this to true could lead to very long startup time.
 startup.import_repos = true
 
 ; URL at which the application is running. This is used for Bootstrapping
 ; requests in context when no web request is available. Used in ishell, or
 ; SSH calls. Set this for events to receive proper url for SSH calls.
 app.base_url = http://rhodecode.local
 
 ; Host at which the Service API is running.
 app.service_api.host = http://rhodecode.local:10020
 
 ; Secret for Service API authentication.
 app.service_api.token =
 
 ; Unique application ID. Should be a random unique string for security.
 app_instance_uuid = rc-production
 
 ; Cut off limit for large diffs (size in bytes). If overall diff size on
 ; commit, or pull request exceeds this limit this diff will be displayed
 ; partially. E.g 512000 == 512Kb
 cut_off_limit_diff = 1024000
 
 ; Cut off limit for large files inside diffs (size in bytes). Each individual
 ; file inside diff which exceeds this limit will be displayed partially.
 ;  E.g 128000 == 128Kb
 cut_off_limit_file = 256000
 
 ; Use cached version of vcs repositories everywhere. Recommended to be `true`
 vcs_full_cache = false
 
 ; Force https in RhodeCode, fixes https redirects, assumes it's always https.
 ; Normally this is controlled by proper flags sent from http server such as Nginx or Apache
 force_https = false
 
 ; use Strict-Transport-Security headers
 use_htsts = false
 
 ; Set to true if your repos are exposed using the dumb protocol
 git_update_server_info = false
 
 ; RSS/ATOM feed options
 rss_cut_off_limit = 256000
 rss_items_per_page = 10
 rss_include_diff = false
 
 ; gist URL alias, used to create nicer urls for gist. This should be an
 ; url that does rewrites to _admin/gists/{gistid}.
 ; example: http://gist.rhodecode.org/{gistid}. Empty means use the internal
 ; RhodeCode url, ie. http[s]://rhodecode.server/_admin/gists/{gistid}
 gist_alias_url =
 
 ; List of views (using glob pattern syntax) that AUTH TOKENS could be
 ; used for access.
 ; Adding ?auth_token=TOKEN_HASH to the url authenticates this request as if it
 ; came from the the logged in user who own this authentication token.
 ; Additionally @TOKEN syntax can be used to bound the view to specific
 ; authentication token. Such view would be only accessible when used together
 ; with this authentication token
 ; list of all views can be found under `/_admin/permissions/auth_token_access`
 ; The list should be "," separated and on a single line.
 ; Most common views to enable:
 
 #    RepoCommitsView:repo_commit_download
 #    RepoCommitsView:repo_commit_patch
 #    RepoCommitsView:repo_commit_raw
 #    RepoCommitsView:repo_commit_raw@TOKEN
 #    RepoFilesView:repo_files_diff
 #    RepoFilesView:repo_archivefile
 #    RepoFilesView:repo_file_raw
 #    GistView:*
 api_access_controllers_whitelist =
 
 ; Default encoding used to convert from and to unicode
 ; can be also a comma separated list of encoding in case of mixed encodings
 default_encoding = UTF-8
 
 ; instance-id prefix
 ; a prefix key for this instance used for cache invalidation when running
 ; multiple instances of RhodeCode, make sure it's globally unique for
 ; all running RhodeCode instances. Leave empty if you don't use it
 instance_id =
 
 ; Fallback authentication plugin. Set this to a plugin ID to force the usage
 ; of an authentication plugin also if it is disabled by it's settings.
 ; This could be useful if you are unable to log in to the system due to broken
 ; authentication settings. Then you can enable e.g. the internal RhodeCode auth
 ; module to log in again and fix the settings.
 ; Available builtin plugin IDs (hash is part of the ID):
 ; egg:rhodecode-enterprise-ce#rhodecode
 ; egg:rhodecode-enterprise-ce#pam
 ; egg:rhodecode-enterprise-ce#ldap
 ; egg:rhodecode-enterprise-ce#jasig_cas
 ; egg:rhodecode-enterprise-ce#headers
 ; egg:rhodecode-enterprise-ce#crowd
 
 #rhodecode.auth_plugin_fallback = egg:rhodecode-enterprise-ce#rhodecode
 
 ; Flag to control loading of legacy plugins in py:/path format
 auth_plugin.import_legacy_plugins = true
 
 ; alternative return HTTP header for failed authentication. Default HTTP
 ; response is 401 HTTPUnauthorized. Currently HG clients have troubles with
 ; handling that causing a series of failed authentication calls.
 ; Set this variable to 403 to return HTTPForbidden, or any other HTTP code
 ; This will be served instead of default 401 on bad authentication
 auth_ret_code =
 
 ; use special detection method when serving auth_ret_code, instead of serving
 ; ret_code directly, use 401 initially (Which triggers credentials prompt)
 ; and then serve auth_ret_code to clients
 auth_ret_code_detection = false
 
 ; locking return code. When repository is locked return this HTTP code. 2XX
 ; codes don't break the transactions while 4XX codes do
 lock_ret_code = 423
 
 ; Filesystem location were repositories should be stored
 repo_store.path = /var/opt/rhodecode_repo_store
 
 ; allows to setup custom hooks in settings page
 allow_custom_hooks_settings = true
 
 ; Generated license token required for EE edition license.
 ; New generated token value can be found in Admin > settings > license page.
 license_token = abra-cada-bra1-rce3
 
 ; This flag hides sensitive information on the license page such as token, and license data
 license.hide_license_info = false
 
+; Import EE license from this license path
+#license.import_path = %(here)s/rhodecode_enterprise.license
+
+; import license 'if-missing' or 'force' (always override)
+; if-missing means apply license if it doesn't exist. 'force' option always overrides it
+license.import_path_mode = if-missing
+
 ; supervisor connection uri, for managing supervisor and logs.
 supervisor.uri =
 
 ; supervisord group name/id we only want this RC instance to handle
 supervisor.group_id = dev
 
 ; Display extended labs settings
 labs_settings_active = true
 
 ; Custom exception store path, defaults to TMPDIR
 ; This is used to store exception from RhodeCode in shared directory
 #exception_tracker.store_path =
 
 ; Send email with exception details when it happens
 #exception_tracker.send_email = false
 
 ; Comma separated list of recipients for exception emails,
 ; e.g [e-mail],[e-mail]
 ; Can be left empty, then emails will be sent to ALL super-admins
 #exception_tracker.send_email_recipients =
 
 ; optional prefix to Add to email Subject
 #exception_tracker.email_prefix = [RHODECODE ERROR]
 
 ; NOTE: this setting IS DEPRECATED:
 ; file_store backend is always enabled
 #file_store.enabled = true
 
 ; NOTE: this setting IS DEPRECATED:
 ; file_store.backend = X -> use `file_store.backend.type = filesystem_v2` instead
 ; Storage backend, available options are: local
 #file_store.backend = local
 
 ; NOTE: this setting IS DEPRECATED:
 ; file_store.storage_path = X -> use `file_store.filesystem_v2.storage_path = X` instead
 ; path to store the uploaded binaries and artifacts
 #file_store.storage_path = /var/opt/rhodecode_data/file_store
 
 ; Artifacts file-store, is used to store comment attachments and artifacts uploads.
 ; file_store backend type: filesystem_v1, filesystem_v2 or objectstore (s3-based) are available as options
 ; filesystem_v1 is backwards compat with pre 5.1 storage changes
 ; new installations should choose filesystem_v2 or objectstore (s3-based), pick filesystem when migrating from
 ; previous installations to keep the artifacts without a need of migration
 file_store.backend.type = filesystem_v1
 
 ; filesystem options...
 file_store.filesystem_v1.storage_path = /var/opt/rhodecode_data/test_artifacts_file_store
 
 ; filesystem_v2 options...
 file_store.filesystem_v2.storage_path = /var/opt/rhodecode_data/test_artifacts_file_store_2
 file_store.filesystem_v2.shards = 8
 
 ; objectstore options...
 ; url for s3 compatible storage that allows to upload artifacts
 ; e.g http://minio:9000
 #file_store.backend.type = objectstore
 file_store.objectstore.url = http://s3-minio:9000
 
 ; a top-level bucket to put all other shards in
 ; objects will be stored in rhodecode-file-store/shard-N based on the bucket_shards number
 file_store.objectstore.bucket = rhodecode-file-store-tests
 
 ; number of sharded buckets to create to distribute archives across
 ; default is 8 shards
 file_store.objectstore.bucket_shards = 8
 
 ; key for s3 auth
 file_store.objectstore.key = s3admin
 
 ; secret for s3 auth
 file_store.objectstore.secret = s3secret4
 
 ;region for s3 storage
 file_store.objectstore.region = eu-central-1
 
 ; Redis url to acquire/check generation of archives locks
 archive_cache.locking.url = redis://redis:6379/1
 
 ; Storage backend, only 'filesystem' and 'objectstore' are available now
 archive_cache.backend.type = filesystem
 
 ; url for s3 compatible storage that allows to upload artifacts
 ; e.g http://minio:9000
 archive_cache.objectstore.url = http://s3-minio:9000
 
 ; key for s3 auth
 archive_cache.objectstore.key = key
 
 ; secret for s3 auth
 archive_cache.objectstore.secret = secret
 
 ;region for s3 storage
 archive_cache.objectstore.region = eu-central-1
 
 ; number of sharded buckets to create to distribute archives across
 ; default is 8 shards
 archive_cache.objectstore.bucket_shards = 8
 
 ; a top-level bucket to put all other shards in
 ; objects will be stored in rhodecode-archive-cache/shard-N based on the bucket_shards number
 archive_cache.objectstore.bucket = rhodecode-archive-cache
 
 ; if true, this cache will try to retry with retry_attempts=N times waiting retry_backoff time
 archive_cache.objectstore.retry = false
 
 ; number of seconds to wait for next try using retry
 archive_cache.objectstore.retry_backoff = 1
 
 ; how many tries do do a retry fetch from this backend
 archive_cache.objectstore.retry_attempts = 10
 
 ; Default is $cache_dir/archive_cache if not set
 ; Generated repo archives will be cached at this location
 ; and served from the cache during subsequent requests for the same archive of
 ; the repository. This path is important to be shared across filesystems and with
 ; RhodeCode and vcsserver
 archive_cache.filesystem.store_dir = %(here)s/rc-tests/archive_cache
 
 ; The limit in GB sets how much data we cache before recycling last used, defaults to 10 gb
 archive_cache.filesystem.cache_size_gb = 2
 
 ; Eviction policy used to clear out after cache_size_gb limit is reached
 archive_cache.filesystem.eviction_policy = least-recently-stored
 
 ; By default cache uses sharding technique, this specifies how many shards are there
 ; default is 8 shards
 archive_cache.filesystem.cache_shards = 8
 
 ; if true, this cache will try to retry with retry_attempts=N times waiting retry_backoff time
 archive_cache.filesystem.retry = false
 
 ; number of seconds to wait for next try using retry
 archive_cache.filesystem.retry_backoff = 1
 
 ; how many tries do do a retry fetch from this backend
 archive_cache.filesystem.retry_attempts = 10
 
 
 ; #############
 ; CELERY CONFIG
 ; #############
 
 ; manually run celery: /path/to/celery worker --task-events --beat --app rhodecode.lib.celerylib.loader --scheduler rhodecode.lib.celerylib.scheduler.RcScheduler --loglevel DEBUG --ini /path/to/rhodecode.ini
 
 use_celery = false
 
 ; path to store schedule database
 #celerybeat-schedule.path =
 
 ; connection url to the message broker (default redis)
 celery.broker_url = redis://redis:6379/8
 
 ; results backend to get results for (default redis)
 celery.result_backend = redis://redis:6379/8
 
 ; rabbitmq example
 #celery.broker_url = amqp://rabbitmq:qweqwe@localhost:5672/rabbitmqhost
 
 ; maximum tasks to execute before worker restart
 celery.max_tasks_per_child = 20
 
 ; tasks will never be sent to the queue, but executed locally instead.
 celery.task_always_eager = true
 celery.task_store_eager_result = true
 
 ; #############
 ; DOGPILE CACHE
 ; #############
 
 ; Default cache dir for caches. Putting this into a ramdisk can boost performance.
 ; eg. /tmpfs/data_ramdisk, however this directory might require large amount of space
 cache_dir = %(here)s/rc-test-data
 
 ; *********************************************
 ; `sql_cache_short` cache for heavy SQL queries
 ; Only supported backend is `memory_lru`
 ; *********************************************
 rc_cache.sql_cache_short.backend = dogpile.cache.rc.memory_lru
 rc_cache.sql_cache_short.expiration_time = 0
 
 
 ; *****************************************************
 ; `cache_repo_longterm` cache for repo object instances
 ; Only supported backend is `memory_lru`
 ; *****************************************************
 rc_cache.cache_repo_longterm.backend = dogpile.cache.rc.memory_lru
 ; by default we use 30 Days, cache is still invalidated on push
 rc_cache.cache_repo_longterm.expiration_time = 2592000
 ; max items in LRU cache, set to smaller number to save memory, and expire last used caches
 rc_cache.cache_repo_longterm.max_size = 10000
 
 
 ; *********************************************
 ; `cache_general` cache for general purpose use
 ; for simplicity use rc.file_namespace backend,
 ; for performance and scale use rc.redis
 ; *********************************************
 rc_cache.cache_general.backend = dogpile.cache.rc.file_namespace
 rc_cache.cache_general.expiration_time = 43200
 ; file cache store path. Defaults to `cache_dir =` value or tempdir if both values are not set
 rc_cache.cache_general.arguments.filename = %(here)s/rc-tests/cache-backend/cache_general_db
 
 ; alternative `cache_general` redis backend with distributed lock
 #rc_cache.cache_general.backend = dogpile.cache.rc.redis
 #rc_cache.cache_general.expiration_time = 300
 
 ; redis_expiration_time needs to be greater then expiration_time
 #rc_cache.cache_general.arguments.redis_expiration_time = 7200
 
 #rc_cache.cache_general.arguments.host = localhost
 #rc_cache.cache_general.arguments.port = 6379
 #rc_cache.cache_general.arguments.db = 0
 #rc_cache.cache_general.arguments.socket_timeout = 30
 ; more Redis options: https://dogpilecache.sqlalchemy.org/en/latest/api.html#redis-backends
 #rc_cache.cache_general.arguments.distributed_lock = true
 
 ; auto-renew lock to prevent stale locks, slower but safer. Use only if problems happen
 #rc_cache.cache_general.arguments.lock_auto_renewal = true
 
 ; *************************************************
 ; `cache_perms` cache for permission tree, auth TTL
 ; for simplicity use rc.file_namespace backend,
 ; for performance and scale use rc.redis
 ; *************************************************
 rc_cache.cache_perms.backend = dogpile.cache.rc.file_namespace
 rc_cache.cache_perms.expiration_time = 0
 ; file cache store path. Defaults to `cache_dir =` value or tempdir if both values are not set
 rc_cache.cache_perms.arguments.filename = %(here)s/rc-tests/cache-backend/cache_perms_db
 
 ; alternative `cache_perms` redis backend with distributed lock
 #rc_cache.cache_perms.backend = dogpile.cache.rc.redis
 #rc_cache.cache_perms.expiration_time = 300
 
 ; redis_expiration_time needs to be greater then expiration_time
 #rc_cache.cache_perms.arguments.redis_expiration_time = 7200
 
 #rc_cache.cache_perms.arguments.host = localhost
 #rc_cache.cache_perms.arguments.port = 6379
 #rc_cache.cache_perms.arguments.db = 0
 #rc_cache.cache_perms.arguments.socket_timeout = 30
 ; more Redis options: https://dogpilecache.sqlalchemy.org/en/latest/api.html#redis-backends
 #rc_cache.cache_perms.arguments.distributed_lock = true
 
 ; auto-renew lock to prevent stale locks, slower but safer. Use only if problems happen
 #rc_cache.cache_perms.arguments.lock_auto_renewal = true
 
 ; ***************************************************
 ; `cache_repo` cache for file tree, Readme, RSS FEEDS
 ; for simplicity use rc.file_namespace backend,
 ; for performance and scale use rc.redis
 ; ***************************************************
 rc_cache.cache_repo.backend = dogpile.cache.rc.file_namespace
 rc_cache.cache_repo.expiration_time = 2592000
 ; file cache store path. Defaults to `cache_dir =` value or tempdir if both values are not set
 rc_cache.cache_repo.arguments.filename = %(here)s/rc-tests/cache-backend/cache_repo_db
 
 ; alternative `cache_repo` redis backend with distributed lock
 #rc_cache.cache_repo.backend = dogpile.cache.rc.redis
 #rc_cache.cache_repo.expiration_time = 2592000
 
 ; redis_expiration_time needs to be greater then expiration_time
 #rc_cache.cache_repo.arguments.redis_expiration_time = 2678400
 
 #rc_cache.cache_repo.arguments.host = localhost
 #rc_cache.cache_repo.arguments.port = 6379
 #rc_cache.cache_repo.arguments.db = 1
 #rc_cache.cache_repo.arguments.socket_timeout = 30
 ; more Redis options: https://dogpilecache.sqlalchemy.org/en/latest/api.html#redis-backends
 #rc_cache.cache_repo.arguments.distributed_lock = true
 
 ; auto-renew lock to prevent stale locks, slower but safer. Use only if problems happen
 #rc_cache.cache_repo.arguments.lock_auto_renewal = true
 
 ; ##############
 ; BEAKER SESSION
 ; ##############
 
 ; beaker.session.type is type of storage options for the logged users sessions. Current allowed
 ; types are file, ext:redis, ext:database, ext:memcached
 ; Fastest ones are ext:redis and ext:database, DO NOT use memory type for session
 beaker.session.type = file
 beaker.session.data_dir = %(here)s/rc-tests/data/sessions
 
 ; Redis based sessions
 #beaker.session.type = ext:redis
 #beaker.session.url = redis://redis:6379/2
 
 ; DB based session, fast, and allows easy management over logged in users
 #beaker.session.type = ext:database
 #beaker.session.table_name = db_session
 #beaker.session.sa.url = postgresql://postgres:secret@localhost/rhodecode
 #beaker.session.sa.url = mysql://root:secret@127.0.0.1/rhodecode
 #beaker.session.sa.pool_recycle = 3600
 #beaker.session.sa.echo = false
 
 beaker.session.key = rhodecode
 beaker.session.secret = test-rc-uytcxaz
 beaker.session.lock_dir = %(here)s/rc-tests/data/sessions/lock
 
 ; Secure encrypted cookie. Requires AES and AES python libraries
 ; you must disable beaker.session.secret to use this
 #beaker.session.encrypt_key = key_for_encryption
 #beaker.session.validate_key = validation_key
 
 ; Sets session as invalid (also logging out user) if it haven not been
 ; accessed for given amount of time in seconds
 beaker.session.timeout = 2592000
 beaker.session.httponly = true
 
 ; Path to use for the cookie. Set to prefix if you use prefix middleware
 #beaker.session.cookie_path = /custom_prefix
 
 ; Set https secure cookie
 beaker.session.secure = false
 
 ; default cookie expiration time in seconds, set to `true` to set expire
 ; at browser close
 #beaker.session.cookie_expires = 3600
 
 ; #############################
 ; SEARCH INDEXING CONFIGURATION
 ; #############################
 
 ; Full text search indexer is available in rhodecode-tools under
 ; `rhodecode-tools index` command
 
 ; WHOOSH Backend, doesn't require additional services to run
 ; it works good with few dozen repos
 search.module = rhodecode.lib.index.whoosh
 search.location = %(here)s/rc-tests/data/index
 
 ; ####################
 ; CHANNELSTREAM CONFIG
 ; ####################
 
 ; channelstream enables persistent connections and live notification
 ; in the system. It's also used by the chat system
 
 channelstream.enabled = false
 
 ; server address for channelstream server on the backend
 channelstream.server = channelstream:9800
 
 ; location of the channelstream server from outside world
 ; use ws:// for http or wss:// for https. This address needs to be handled
 ; by external HTTP server such as Nginx or Apache
 ; see Nginx/Apache configuration examples in our docs
 channelstream.ws_url = ws://rhodecode.yourserver.com/_channelstream
 channelstream.secret = ENV_GENERATED
 channelstream.history.location = %(here)s/rc-tests/channelstream_history
 
 ; Internal application path that Javascript uses to connect into.
 ; If you use proxy-prefix the prefix should be added before /_channelstream
 channelstream.proxy_path = /_channelstream
 
 
 ; ##############################
 ; MAIN RHODECODE DATABASE CONFIG
 ; ##############################
 
 #sqlalchemy.db1.url = sqlite:///%(here)s/rhodecode.db?timeout=30
 #sqlalchemy.db1.url = postgresql://postgres:qweqwe@localhost/rhodecode
 #sqlalchemy.db1.url = mysql://root:qweqwe@localhost/rhodecode?charset=utf8
 ; pymysql is an alternative driver for MySQL, use in case of problems with default one
 #sqlalchemy.db1.url = mysql+pymysql://root:qweqwe@localhost/rhodecode
 
 sqlalchemy.db1.url = sqlite:///%(here)s/rc-tests/rhodecode_test.db?timeout=30
 
 ; see sqlalchemy docs for other advanced settings
 ; print the sql statements to output
 sqlalchemy.db1.echo = false
 
 ; recycle the connections after this amount of seconds
 sqlalchemy.db1.pool_recycle = 3600
 
 ; the number of connections to keep open inside the connection pool.
 ; 0 indicates no limit
 ; the general calculus with gevent is:
 ; if your system allows 500 concurrent greenlets (max_connections) that all do database access,
 ; then increase pool size + max overflow so that they add up to 500.
 #sqlalchemy.db1.pool_size = 5
 
 ; The number of connections to allow in connection pool "overflow", that is
 ; connections that can be opened above and beyond the pool_size setting,
 ; which defaults to five.
 #sqlalchemy.db1.max_overflow = 10
 
 ; Connection check ping, used to detect broken database connections
 ; could be enabled to better handle cases if MySQL has gone away errors
 #sqlalchemy.db1.ping_connection = true
 
 ; ##########
 ; VCS CONFIG
 ; ##########
 vcs.server.enable = true
 vcs.server = vcsserver:10010
 
 ; Web server connectivity protocol, responsible for web based VCS operations
 ; Available protocols are:
 ; `http` - use http-rpc backend (default)
 vcs.server.protocol = http
 
 ; Push/Pull operations protocol, available options are:
 ; `http` - use http-rpc backend (default)
 vcs.scm_app_implementation = http
 
 ; Push/Pull operations hooks protocol, available options are:
 ; `http` - use http-rpc backend (default)
 ; `celery` - use celery based hooks
 #DEPRECATED:vcs.hooks.protocol = http
 vcs.hooks.protocol = http
 
 ; Host on which this instance is listening for hooks. vcsserver will call this host to pull/push hooks so it should be
 ; accessible via network.
 ; Use vcs.hooks.host = "*" to bind to current hostname (for Docker)
 vcs.hooks.host = *
 
 ; Start VCSServer with this instance as a subprocess, useful for development
 vcs.start_server = false
 
 ; List of enabled VCS backends, available options are:
 ; `hg`  - mercurial
 ; `git` - git
 ; `svn` - subversion
 vcs.backends = hg, git, svn
 
 ; Wait this number of seconds before killing connection to the vcsserver
 vcs.connection_timeout = 3600
 
 ; Cache flag to cache vcsserver remote calls locally
 ; It uses cache_region `cache_repo`
 vcs.methods.cache = false
 
+; Filesystem location where Git lfs objects should be stored
+vcs.git.lfs.storage_location = /var/opt/rhodecode_repo_store/.cache/git_lfs_store
+
+; Filesystem location where Mercurial largefile objects should be stored
+vcs.hg.largefiles.storage_location = /var/opt/rhodecode_repo_store/.cache/hg_largefiles_store
+
 ; ####################################################
 ; Subversion proxy support (mod_dav_svn)
 ; Maps RhodeCode repo groups into SVN paths for Apache
 ; ####################################################
 
 ; Compatibility version when creating SVN repositories. Defaults to newest version when commented out.
 ; Set a numeric version for your current SVN e.g 1.8, or 1.12
 ; Legacy available options are: pre-1.4-compatible, pre-1.5-compatible, pre-1.6-compatible, pre-1.8-compatible, pre-1.9-compatible
 #vcs.svn.compatible_version = 1.8
 
 ; Redis connection settings for svn integrations logic
 ; This connection string needs to be the same on ce and vcsserver
 vcs.svn.redis_conn = redis://redis:6379/0
 
 ; Enable SVN proxy of requests over HTTP
 vcs.svn.proxy.enabled = true
 
 ; host to connect to running SVN subsystem
 vcs.svn.proxy.host = http://svn:8090
 
 ; Enable or disable the config file generation.
 svn.proxy.generate_config = false
 
 ; Generate config file with `SVNListParentPath` set to `On`.
 svn.proxy.list_parent_path = true
 
 ; Set location and file name of generated config file.
 svn.proxy.config_file_path = %(here)s/rc-tests/mod_dav_svn.conf
 
 ; alternative mod_dav config template. This needs to be a valid mako template
 ; Example template can be found in the source code:
 ; rhodecode/apps/svn_support/templates/mod-dav-svn.conf.mako
 #svn.proxy.config_template = ~/.rccontrol/enterprise-1/custom_svn_conf.mako
 
 ; Used as a prefix to the `Location` block in the generated config file.
 ; In most cases it should be set to `/`.
 svn.proxy.location_root = /
 
 ; Command to reload the mod dav svn configuration on change.
 ; Example: `/etc/init.d/apache2 reload` or /home/USER/apache_reload.sh
 ; Make sure user who runs RhodeCode process is allowed to reload Apache
 #svn.proxy.reload_cmd = /etc/init.d/apache2 reload
 
 ; If the timeout expires before the reload command finishes, the command will
 ; be killed. Setting it to zero means no timeout. Defaults to 10 seconds.
 #svn.proxy.reload_timeout = 10
 
 ; ####################
 ; SSH Support Settings
 ; ####################
 
 ; Defines if a custom authorized_keys file should be created and written on
 ; any change user ssh keys. Setting this to false also disables possibility
 ; of adding SSH keys by users from web interface. Super admins can still
 ; manage SSH Keys.
 ssh.generate_authorized_keyfile = true
 
 ; Options for ssh, default is `no-pty,no-port-forwarding,no-X11-forwarding,no-agent-forwarding`
 # ssh.authorized_keys_ssh_opts =
 
 ; Path to the authorized_keys file where the generate entries are placed.
 ; It is possible to have multiple key files specified in `sshd_config` e.g.
 ; AuthorizedKeysFile %h/.ssh/authorized_keys %h/.ssh/authorized_keys_rhodecode
 ssh.authorized_keys_file_path = %(here)s/rc-tests/authorized_keys_rhodecode
 
 ; Command to execute the SSH wrapper. The binary is available in the
 ; RhodeCode installation directory.
 ; legacy: /usr/local/bin/rhodecode_bin/bin/rc-ssh-wrapper
 ; new rewrite: /usr/local/bin/rhodecode_bin/bin/rc-ssh-wrapper-v2
 #DEPRECATED: ssh.wrapper_cmd = /usr/local/bin/rhodecode_bin/bin/rc-ssh-wrapper
 ssh.wrapper_cmd.v2 = /usr/local/bin/rhodecode_bin/bin/rc-ssh-wrapper-v2
 
 ; Allow shell when executing the ssh-wrapper command
 ssh.wrapper_cmd_allow_shell = false
 
 ; Enables logging, and detailed output send back to the client during SSH
 ; operations. Useful for debugging, shouldn't be used in production.
 ssh.enable_debug_logging = true
 
 ; Paths to binary executable, by default they are the names, but we can
 ; override them if we want to use a custom one
 ssh.executable.hg = /usr/local/bin/rhodecode_bin/vcs_bin/hg
 ssh.executable.git = /usr/local/bin/rhodecode_bin/vcs_bin/git
 ssh.executable.svn = /usr/local/bin/rhodecode_bin/vcs_bin/svnserve
 
 ; Enables SSH key generator web interface. Disabling this still allows users
 ; to add their own keys.
 ssh.enable_ui_key_generator = true
 
 ; Statsd client config, this is used to send metrics to statsd
 ; We recommend setting statsd_exported and scrape them using Prometheus
 #statsd.enabled = false
 #statsd.statsd_host = 0.0.0.0
 #statsd.statsd_port = 8125
 #statsd.statsd_prefix =
 #statsd.statsd_ipv6 = false
 
 ; configure logging automatically at server startup set to false
 ; to use the below custom logging config.
 ; RC_LOGGING_FORMATTER
 ; RC_LOGGING_LEVEL
 ; env variables can control the settings for logging in case of autoconfigure
 
 logging.autoconfigure = false
 
 ; specify your own custom logging config file to configure logging
 #logging.logging_conf_file = /path/to/custom_logging.ini
 
 ; Dummy marker to add new entries after.
 ; Add any custom entries below. Please don't remove this marker.
 custom.conf = 1
 
 
 ; #####################
 ; LOGGING CONFIGURATION
 ; #####################
 
 [loggers]
 keys = root, sqlalchemy, beaker, celery, rhodecode, ssh_wrapper, dogpile
 
 [handlers]
 keys = console, console_sql
 
 [formatters]
 keys = generic, json, color_formatter, color_formatter_sql
 
 ; #######
 ; LOGGERS
 ; #######
 [logger_root]
 level = NOTSET
 handlers = console
 
 [logger_routes]
 level = DEBUG
 handlers =
 qualname = routes.middleware
 ## "level = DEBUG" logs the route matched and routing variables.
 propagate = 1
 
 [logger_sqlalchemy]
 level = INFO
 handlers = console_sql
 qualname = sqlalchemy.engine
 propagate = 0
 
 [logger_beaker]
 level = DEBUG
 handlers =
 qualname = beaker.container
 propagate = 1
 
 [logger_dogpile]
 level = INFO
 handlers = console
 qualname = dogpile
 propagate = 1
 
 [logger_rhodecode]
 level = DEBUG
 handlers =
 qualname = rhodecode
 propagate = 1
 
 [logger_ssh_wrapper]
 level = DEBUG
 handlers =
 qualname = ssh_wrapper
 propagate = 1
 
 [logger_celery]
 level = DEBUG
 handlers =
 qualname = celery
 
 
 ; ########
 ; HANDLERS
 ; ########
 
 [handler_console]
 class = StreamHandler
 args = (sys.stderr, )
 level = DEBUG
 ; To enable JSON formatted logs replace 'generic/color_formatter' with 'json'
 ; This allows sending properly formatted logs to grafana loki or elasticsearch
 formatter = generic
 
 [handler_console_sql]
 ; "level = DEBUG" logs SQL queries and results.
 ; "level = INFO" logs SQL queries.
 ; "level = WARN" logs neither.  (Recommended for production systems.)
 class = StreamHandler
 args = (sys.stderr, )
 level = WARN
 ; To enable JSON formatted logs replace 'generic/color_formatter_sql' with 'json'
 ; This allows sending properly formatted logs to grafana loki or elasticsearch
 formatter = generic
 
 ; ##########
 ; FORMATTERS
 ; ##########
 
 [formatter_generic]
 class = rhodecode.lib.logging_formatter.ExceptionAwareFormatter
 format = %(asctime)s.%(msecs)03d [%(process)d] %(levelname)-5.5s [%(name)s] %(message)s
 datefmt = %Y-%m-%d %H:%M:%S
 
 [formatter_color_formatter]
 class = rhodecode.lib.logging_formatter.ColorFormatter
 format = %(asctime)s.%(msecs)03d [%(process)d] %(levelname)-5.5s [%(name)s] %(message)s
 datefmt = %Y-%m-%d %H:%M:%S
 
 [formatter_color_formatter_sql]
 class = rhodecode.lib.logging_formatter.ColorFormatterSql
 format = %(asctime)s.%(msecs)03d [%(process)d] %(levelname)-5.5s [%(name)s] %(message)s
 datefmt = %Y-%m-%d %H:%M:%S
 
 [formatter_json]
 format = %(timestamp)s %(levelname)s %(name)s %(message)s %(req_id)s
 class = rhodecode.lib._vendor.jsonlogger.JsonFormatter