# HG changeset patch
# User Marcin Kuzminski <marcin@python-works.com>
# Date 2013-04-14 23:46:32
# Node ID 78c7e8efe6583b7692aae2992769f706065b1e8c
# Parent  244f184f5fc3a8c9b16ca6477ab050c9ae0ce94e

new feature: API access white list definition from .ini files

diff --git a/development.ini b/development.ini
--- a/development.ini
+++ b/development.ini
@@ -111,6 +111,12 @@ rss_include_diff = false
 show_sha_length = 12
 show_revision_number = true
 
+## white list of API enabled controllers. This allows to add list of
+## controllers to which access will be enabled by api_key. eg: to enable
+## api access to raw_files put `FilesController:raw`, to enable access to patches
+## add `ChangesetController:changeset_patch`. This list should be "," separated
+## Syntax is <ControllerClass>:<function>. Check debug logs for generated names
+api_access_controllers_whitelist =
 
 ## alternative_gravatar_url allows you to use your own avatar server application
 ## the following parts of the URL will be replaced
diff --git a/production.ini b/production.ini
--- a/production.ini
+++ b/production.ini
@@ -111,6 +111,12 @@ rss_include_diff = false
 show_sha_length = 12
 show_revision_number = true
 
+## white list of API enabled controllers. This allows to add list of
+## controllers to which access will be enabled by api_key. eg: to enable
+## api access to raw_files put `FilesController:raw`, to enable access to patches
+## add `ChangesetController:changeset_patch`. This list should be "," separated
+## Syntax is <ControllerClass>:<function>. Check debug logs for generated names
+api_access_controllers_whitelist =
 
 ## alternative_gravatar_url allows you to use your own avatar server application
 ## the following parts of the URL will be replaced
diff --git a/rhodecode/config/deployment.ini_tmpl b/rhodecode/config/deployment.ini_tmpl
--- a/rhodecode/config/deployment.ini_tmpl
+++ b/rhodecode/config/deployment.ini_tmpl
@@ -111,6 +111,12 @@ rss_include_diff = false
 show_sha_length = 12
 show_revision_number = true
 
+## white list of API enabled controllers. This allows to add list of
+## controllers to which access will be enabled by api_key. eg: to enable
+## api access to raw_files put `FilesController:raw`, to enable access to patches
+## add `ChangesetController:changeset_patch`. This list should be "," separated
+## Syntax is <ControllerClass>:<function>. Check debug logs for generated names
+api_access_controllers_whitelist =
 
 ## alternative_gravatar_url allows you to use your own avatar server application
 ## the following parts of the URL will be replaced
diff --git a/rhodecode/lib/auth.py b/rhodecode/lib/auth.py
--- a/rhodecode/lib/auth.py
+++ b/rhodecode/lib/auth.py
@@ -39,7 +39,7 @@ from sqlalchemy.orm.exc import ObjectDel
 from rhodecode import __platform__, is_windows, is_unix
 from rhodecode.model.meta import Session
 
-from rhodecode.lib.utils2 import str2bool, safe_unicode
+from rhodecode.lib.utils2 import str2bool, safe_unicode, aslist
 from rhodecode.lib.exceptions import LdapPasswordError, LdapUsernameError,\
     LdapImportError
 from rhodecode.lib.utils import get_repo_slug, get_repos_group_slug,\
@@ -531,7 +531,12 @@ class LoginRequired(object):
         cls = fargs[0]
         user = cls.rhodecode_user
         loc = "%s:%s" % (cls.__class__.__name__, func.__name__)
-
+        # defined whitelist of controllers which API access will be enabled
+        whitelist = aslist(config.get('api_access_controllers_whitelist'),
+                           sep=',')
+        api_access_whitelist = loc in whitelist
+        log.debug('loc:%s is in API whitelist:%s:%s' % (loc, whitelist,
+                                                        api_access_whitelist))
         #check IP
         ip_access_ok = True
         if not user.ip_allowed:
@@ -541,7 +546,7 @@ class LoginRequired(object):
             ip_access_ok = False
 
         api_access_ok = False
-        if self.api_access:
+        if self.api_access or api_access_whitelist:
             log.debug('Checking API KEY access for %s' % cls)
             if user.api_key == request.GET.get('api_key'):
                 api_access_ok = True