hgweb: add support to explicitly access hidden changesets

This changeset adds a "global" `access-hidden` argument to hgweb. This argument
lift the "hidden" filtering. This means the request has access to hidden (eg:
obsolete) changesets. Secret changesets remains filtered.

This feature has multiple applications. The first main use case is to allow the
hgweb interface to display more obsolescence related data, such as the Anton
Shestakov work to add `obslog` support to hgweb.

The second foreseen usecase is support for a `--remote-hidden` argument to `hg
pull` and `hg clone`. This flag will make it possible to retrieve hidden
(typically obsolete) changeset under some conditions. This is useful when
digging up obsolescence history or when doing full mirroring. More on this
feature coming in later changesets.

To avoid exposing information by mistake, access to this feature is currently
controlled with the `experimental.server.allow-hidden-access` config option. The
option works the same way as `web.allow-push`. The current default is to not
allow any hidden access. However we might change it before the feature stop
being experimental.

mercurial/configitems.py

@@ -1,2970 +1,2975 b''
 # configitems.py - centralized declaration of configuration option
 #
 #  Copyright 2017 Pierre-Yves David <[e-mail]>
 #
 # This software may be used and distributed according to the terms of the
 # GNU General Public License version 2 or any later version.
 
 
 import functools
 import re
 
 from . import (
     encoding,
     error,
 )
 
 
 def loadconfigtable(ui, extname, configtable):
     """update config item known to the ui with the extension ones"""
     for section, items in sorted(configtable.items()):
         knownitems = ui._knownconfig.setdefault(section, itemregister())
         knownkeys = set(knownitems)
         newkeys = set(items)
         for key in sorted(knownkeys & newkeys):
             msg = b"extension '%s' overwrite config item '%s.%s'"
             msg %= (extname, section, key)
             ui.develwarn(msg, config=b'warn-config')
 
         knownitems.update(items)
 
 
 class configitem:
     """represent a known config item
 
     :section: the official config section where to find this item,
        :name: the official name within the section,
     :default: default value for this item,
     :alias: optional list of tuples as alternatives,
     :generic: this is a generic definition, match name using regular expression.
     """
 
     def __init__(
         self,
         section,
         name,
         default=None,
         alias=(),
         generic=False,
         priority=0,
         experimental=False,
     ):
         self.section = section
         self.name = name
         self.default = default
         self.alias = list(alias)
         self.generic = generic
         self.priority = priority
         self.experimental = experimental
         self._re = None
         if generic:
             self._re = re.compile(self.name)
 
 
 class itemregister(dict):
     """A specialized dictionary that can handle wild-card selection"""
 
     def __init__(self):
         super(itemregister, self).__init__()
         self._generics = set()
 
     def update(self, other):
         super(itemregister, self).update(other)
         self._generics.update(other._generics)
 
     def __setitem__(self, key, item):
         super(itemregister, self).__setitem__(key, item)
         if item.generic:
             self._generics.add(item)
 
     def get(self, key):
         baseitem = super(itemregister, self).get(key)
         if baseitem is not None and not baseitem.generic:
             return baseitem
 
         # search for a matching generic item
         generics = sorted(self._generics, key=(lambda x: (x.priority, x.name)))
         for item in generics:
             # we use 'match' instead of 'search' to make the matching simpler
             # for people unfamiliar with regular expression. Having the match
             # rooted to the start of the string will produce less surprising
             # result for user writing simple regex for sub-attribute.
             #
             # For example using "color\..*" match produces an unsurprising
             # result, while using search could suddenly match apparently
             # unrelated configuration that happens to contains "color."
             # anywhere. This is a tradeoff where we favor requiring ".*" on
             # some match to avoid the need to prefix most pattern with "^".
             # The "^" seems more error prone.
             if item._re.match(key):
                 return item
 
         return None
 
 
 coreitems = {}
 
 
 def _register(configtable, *args, **kwargs):
     item = configitem(*args, **kwargs)
     section = configtable.setdefault(item.section, itemregister())
     if item.name in section:
         msg = b"duplicated config item registration for '%s.%s'"
         raise error.ProgrammingError(msg % (item.section, item.name))
     section[item.name] = item
 
 
 # special value for case where the default is derived from other values
 dynamicdefault = object()
 
 # Registering actual config items
 
 
 def getitemregister(configtable):
     f = functools.partial(_register, configtable)
     # export pseudo enum as configitem.*
     f.dynamicdefault = dynamicdefault
     return f
 
 
 coreconfigitem = getitemregister(coreitems)
 
 
 def _registerdiffopts(section, configprefix=b''):
     coreconfigitem(
         section,
         configprefix + b'nodates',
         default=False,
     )
     coreconfigitem(
         section,
         configprefix + b'showfunc',
         default=False,
     )
     coreconfigitem(
         section,
         configprefix + b'unified',
         default=None,
     )
     coreconfigitem(
         section,
         configprefix + b'git',
         default=False,
     )
     coreconfigitem(
         section,
         configprefix + b'ignorews',
         default=False,
     )
     coreconfigitem(
         section,
         configprefix + b'ignorewsamount',
         default=False,
     )
     coreconfigitem(
         section,
         configprefix + b'ignoreblanklines',
         default=False,
     )
     coreconfigitem(
         section,
         configprefix + b'ignorewseol',
         default=False,
     )
     coreconfigitem(
         section,
         configprefix + b'nobinary',
         default=False,
     )
     coreconfigitem(
         section,
         configprefix + b'noprefix',
         default=False,
     )
     coreconfigitem(
         section,
         configprefix + b'word-diff',
         default=False,
     )
 
 
 coreconfigitem(
     b'alias',
     b'.*',
     default=dynamicdefault,
     generic=True,
 )
 coreconfigitem(
     b'auth',
     b'cookiefile',
     default=None,
 )
 _registerdiffopts(section=b'annotate')
 # bookmarks.pushing: internal hack for discovery
 coreconfigitem(
     b'bookmarks',
     b'pushing',
     default=list,
 )
 # bundle.mainreporoot: internal hack for bundlerepo
 coreconfigitem(
     b'bundle',
     b'mainreporoot',
     default=b'',
 )
 coreconfigitem(
     b'censor',
     b'policy',
     default=b'abort',
     experimental=True,
 )
 coreconfigitem(
     b'chgserver',
     b'idletimeout',
     default=3600,
 )
 coreconfigitem(
     b'chgserver',
     b'skiphash',
     default=False,
 )
 coreconfigitem(
     b'cmdserver',
     b'log',
     default=None,
 )
 coreconfigitem(
     b'cmdserver',
     b'max-log-files',
     default=7,
 )
 coreconfigitem(
     b'cmdserver',
     b'max-log-size',
     default=b'1 MB',
 )
 coreconfigitem(
     b'cmdserver',
     b'max-repo-cache',
     default=0,
     experimental=True,
 )
 coreconfigitem(
     b'cmdserver',
     b'message-encodings',
     default=list,
 )
 coreconfigitem(
     b'cmdserver',
     b'track-log',
     default=lambda: [b'chgserver', b'cmdserver', b'repocache'],
 )
 coreconfigitem(
     b'cmdserver',
     b'shutdown-on-interrupt',
     default=True,
 )
 coreconfigitem(
     b'color',
     b'.*',
     default=None,
     generic=True,
 )
 coreconfigitem(
     b'color',
     b'mode',
     default=b'auto',
 )
 coreconfigitem(
     b'color',
     b'pagermode',
     default=dynamicdefault,
 )
 coreconfigitem(
     b'command-templates',
     b'graphnode',
     default=None,
     alias=[(b'ui', b'graphnodetemplate')],
 )
 coreconfigitem(
     b'command-templates',
     b'log',
     default=None,
     alias=[(b'ui', b'logtemplate')],
 )
 coreconfigitem(
     b'command-templates',
     b'mergemarker',
     default=(
         b'{node|short} '
         b'{ifeq(tags, "tip", "", '
         b'ifeq(tags, "", "", "{tags} "))}'
         b'{if(bookmarks, "{bookmarks} ")}'
         b'{ifeq(branch, "default", "", "{branch} ")}'
         b'- {author|user}: {desc|firstline}'
     ),
     alias=[(b'ui', b'mergemarkertemplate')],
 )
 coreconfigitem(
     b'command-templates',
     b'pre-merge-tool-output',
     default=None,
     alias=[(b'ui', b'pre-merge-tool-output-template')],
 )
 coreconfigitem(
     b'command-templates',
     b'oneline-summary',
     default=None,
 )
 coreconfigitem(
     b'command-templates',
     b'oneline-summary.*',
     default=dynamicdefault,
     generic=True,
 )
 _registerdiffopts(section=b'commands', configprefix=b'commit.interactive.')
 coreconfigitem(
     b'commands',
     b'commit.post-status',
     default=False,
 )
 coreconfigitem(
     b'commands',
     b'grep.all-files',
     default=False,
     experimental=True,
 )
 coreconfigitem(
     b'commands',
     b'merge.require-rev',
     default=False,
 )
 coreconfigitem(
     b'commands',
     b'push.require-revs',
     default=False,
 )
 coreconfigitem(
     b'commands',
     b'resolve.confirm',
     default=False,
 )
 coreconfigitem(
     b'commands',
     b'resolve.explicit-re-merge',
     default=False,
 )
 coreconfigitem(
     b'commands',
     b'resolve.mark-check',
     default=b'none',
 )
 _registerdiffopts(section=b'commands', configprefix=b'revert.interactive.')
 coreconfigitem(
     b'commands',
     b'show.aliasprefix',
     default=list,
 )
 coreconfigitem(
     b'commands',
     b'status.relative',
     default=False,
 )
 coreconfigitem(
     b'commands',
     b'status.skipstates',
     default=[],
     experimental=True,
 )
 coreconfigitem(
     b'commands',
     b'status.terse',
     default=b'',
 )
 coreconfigitem(
     b'commands',
     b'status.verbose',
     default=False,
 )
 coreconfigitem(
     b'commands',
     b'update.check',
     default=None,
 )
 coreconfigitem(
     b'commands',
     b'update.requiredest',
     default=False,
 )
 coreconfigitem(
     b'committemplate',
     b'.*',
     default=None,
     generic=True,
 )
 coreconfigitem(
     b'convert',
     b'bzr.saverev',
     default=True,
 )
 coreconfigitem(
     b'convert',
     b'cvsps.cache',
     default=True,
 )
 coreconfigitem(
     b'convert',
     b'cvsps.fuzz',
     default=60,
 )
 coreconfigitem(
     b'convert',
     b'cvsps.logencoding',
     default=None,
 )
 coreconfigitem(
     b'convert',
     b'cvsps.mergefrom',
     default=None,
 )
 coreconfigitem(
     b'convert',
     b'cvsps.mergeto',
     default=None,
 )
 coreconfigitem(
     b'convert',
     b'git.committeractions',
     default=lambda: [b'messagedifferent'],
 )
 coreconfigitem(
     b'convert',
     b'git.extrakeys',
     default=list,
 )
 coreconfigitem(
     b'convert',
     b'git.findcopiesharder',
     default=False,
 )
 coreconfigitem(
     b'convert',
     b'git.remoteprefix',
     default=b'remote',
 )
 coreconfigitem(
     b'convert',
     b'git.renamelimit',
     default=400,
 )
 coreconfigitem(
     b'convert',
     b'git.saverev',
     default=True,
 )
 coreconfigitem(
     b'convert',
     b'git.similarity',
     default=50,
 )
 coreconfigitem(
     b'convert',
     b'git.skipsubmodules',
     default=False,
 )
 coreconfigitem(
     b'convert',
     b'hg.clonebranches',
     default=False,
 )
 coreconfigitem(
     b'convert',
     b'hg.ignoreerrors',
     default=False,
 )
 coreconfigitem(
     b'convert',
     b'hg.preserve-hash',
     default=False,
 )
 coreconfigitem(
     b'convert',
     b'hg.revs',
     default=None,
 )
 coreconfigitem(
     b'convert',
     b'hg.saverev',
     default=False,
 )
 coreconfigitem(
     b'convert',
     b'hg.sourcename',
     default=None,
 )
 coreconfigitem(
     b'convert',
     b'hg.startrev',
     default=None,
 )
 coreconfigitem(
     b'convert',
     b'hg.tagsbranch',
     default=b'default',
 )
 coreconfigitem(
     b'convert',
     b'hg.usebranchnames',
     default=True,
 )
 coreconfigitem(
     b'convert',
     b'ignoreancestorcheck',
     default=False,
     experimental=True,
 )
 coreconfigitem(
     b'convert',
     b'localtimezone',
     default=False,
 )
 coreconfigitem(
     b'convert',
     b'p4.encoding',
     default=dynamicdefault,
 )
 coreconfigitem(
     b'convert',
     b'p4.startrev',
     default=0,
 )
 coreconfigitem(
     b'convert',
     b'skiptags',
     default=False,
 )
 coreconfigitem(
     b'convert',
     b'svn.debugsvnlog',
     default=True,
 )
 coreconfigitem(
     b'convert',
     b'svn.trunk',
     default=None,
 )
 coreconfigitem(
     b'convert',
     b'svn.tags',
     default=None,
 )
 coreconfigitem(
     b'convert',
     b'svn.branches',
     default=None,
 )
 coreconfigitem(
     b'convert',
     b'svn.startrev',
     default=0,
 )
 coreconfigitem(
     b'convert',
     b'svn.dangerous-set-commit-dates',
     default=False,
 )
 coreconfigitem(
     b'debug',
     b'dirstate.delaywrite',
     default=0,
 )
 coreconfigitem(
     b'debug',
     b'revlog.verifyposition.changelog',
     default=b'',
 )
 coreconfigitem(
     b'debug',
     b'revlog.debug-delta',
     default=False,
 )
 # display extra information about the bundling process
 coreconfigitem(
     b'debug',
     b'bundling-stats',
     default=False,
 )
 # display extra information about the unbundling process
 coreconfigitem(
     b'debug',
     b'unbundling-stats',
     default=False,
 )
 coreconfigitem(
     b'defaults',
     b'.*',
     default=None,
     generic=True,
 )
 coreconfigitem(
     b'devel',
     b'all-warnings',
     default=False,
 )
 coreconfigitem(
     b'devel',
     b'bundle2.debug',
     default=False,
 )
 coreconfigitem(
     b'devel',
     b'bundle.delta',
     default=b'',
 )
 coreconfigitem(
     b'devel',
     b'cache-vfs',
     default=None,
 )
 coreconfigitem(
     b'devel',
     b'check-locks',
     default=False,
 )
 coreconfigitem(
     b'devel',
     b'check-relroot',
     default=False,
 )
 # Track copy information for all file, not just "added" one (very slow)
 coreconfigitem(
     b'devel',
     b'copy-tracing.trace-all-files',
     default=False,
 )
 coreconfigitem(
     b'devel',
     b'default-date',
     default=None,
 )
 coreconfigitem(
     b'devel',
     b'deprec-warn',
     default=False,
 )
 # possible values:
 # - auto (the default)
 # - force-append
 # - force-new
 coreconfigitem(
     b'devel',
     b'dirstate.v2.data_update_mode',
     default="auto",
 )
 coreconfigitem(
     b'devel',
     b'disableloaddefaultcerts',
     default=False,
 )
 coreconfigitem(
     b'devel',
     b'warn-empty-changegroup',
     default=False,
 )
 coreconfigitem(
     b'devel',
     b'legacy.exchange',
     default=list,
 )
 # When True, revlogs use a special reference version of the nodemap, that is not
 # performant but is "known" to behave properly.
 coreconfigitem(
     b'devel',
     b'persistent-nodemap',
     default=False,
 )
 coreconfigitem(
     b'devel',
     b'servercafile',
     default=b'',
 )
 # This config option is intended for use in tests only. It is a giant
 # footgun to kill security. Don't define it.
 coreconfigitem(
     b'devel',
     b'server-insecure-exact-protocol',
     default=b'',
 )
 coreconfigitem(
     b'devel',
     b'serverrequirecert',
     default=False,
 )
 # Makes the status algorithm wait for the existence of this file
 # (or until a timeout of `devel.sync.status.pre-dirstate-write-file-timeout`
 # seconds) before taking the lock and writing the dirstate.
 # Status signals that it's ready to wait by creating a file
 # with the same name + `.waiting`.
 # Useful when testing race conditions.
 coreconfigitem(
     b'devel',
     b'sync.status.pre-dirstate-write-file',
     default=None,
 )
 coreconfigitem(
     b'devel',
     b'sync.status.pre-dirstate-write-file-timeout',
     default=2,
 )
 coreconfigitem(
     b'devel',
     b'sync.dirstate.post-docket-read-file',
     default=None,
 )
 coreconfigitem(
     b'devel',
     b'sync.dirstate.post-docket-read-file-timeout',
     default=2,
 )
 coreconfigitem(
     b'devel',
     b'sync.dirstate.pre-read-file',
     default=None,
 )
 coreconfigitem(
     b'devel',
     b'sync.dirstate.pre-read-file-timeout',
     default=2,
 )
 coreconfigitem(
     b'devel',
     b'strip-obsmarkers',
     default=True,
 )
 coreconfigitem(
     b'devel',
     b'warn-config',
     default=None,
 )
 coreconfigitem(
     b'devel',
     b'warn-config-default',
     default=None,
 )
 coreconfigitem(
     b'devel',
     b'user.obsmarker',
     default=None,
 )
 coreconfigitem(
     b'devel',
     b'warn-config-unknown',
     default=None,
 )
 coreconfigitem(
     b'devel',
     b'debug.copies',
     default=False,
 )
 coreconfigitem(
     b'devel',
     b'copy-tracing.multi-thread',
     default=True,
 )
 coreconfigitem(
     b'devel',
     b'debug.extensions',
     default=False,
 )
 coreconfigitem(
     b'devel',
     b'debug.repo-filters',
     default=False,
 )
 coreconfigitem(
     b'devel',
     b'debug.peer-request',
     default=False,
 )
 # If discovery.exchange-heads is False, the discovery will not start with
 # remote head fetching and local head querying.
 coreconfigitem(
     b'devel',
     b'discovery.exchange-heads',
     default=True,
 )
 # If devel.debug.abort-update is True, then any merge with the working copy,
 # e.g. [hg update], will be aborted after figuring out what needs to be done,
 # but before spawning the parallel worker
 coreconfigitem(
     b'devel',
     b'debug.abort-update',
     default=False,
 )
 # If discovery.grow-sample is False, the sample size used in set discovery will
 # not be increased through the process
 coreconfigitem(
     b'devel',
     b'discovery.grow-sample',
     default=True,
 )
 # When discovery.grow-sample.dynamic is True, the default, the sample size is
 # adapted to the shape of the undecided set (it is set to the max of:
 # <target-size>, len(roots(undecided)), len(heads(undecided)
 coreconfigitem(
     b'devel',
     b'discovery.grow-sample.dynamic',
     default=True,
 )
 # discovery.grow-sample.rate control the rate at which the sample grow
 coreconfigitem(
     b'devel',
     b'discovery.grow-sample.rate',
     default=1.05,
 )
 # If discovery.randomize is False, random sampling during discovery are
 # deterministic. It is meant for integration tests.
 coreconfigitem(
     b'devel',
     b'discovery.randomize',
     default=True,
 )
 # Control the initial size of the discovery sample
 coreconfigitem(
     b'devel',
     b'discovery.sample-size',
     default=200,
 )
 # Control the initial size of the discovery for initial change
 coreconfigitem(
     b'devel',
     b'discovery.sample-size.initial',
     default=100,
 )
 _registerdiffopts(section=b'diff')
 coreconfigitem(
     b'diff',
     b'merge',
     default=False,
     experimental=True,
 )
 coreconfigitem(
     b'email',
     b'bcc',
     default=None,
 )
 coreconfigitem(
     b'email',
     b'cc',
     default=None,
 )
 coreconfigitem(
     b'email',
     b'charsets',
     default=list,
 )
 coreconfigitem(
     b'email',
     b'from',
     default=None,
 )
 coreconfigitem(
     b'email',
     b'method',
     default=b'smtp',
 )
 coreconfigitem(
     b'email',
     b'reply-to',
     default=None,
 )
 coreconfigitem(
     b'email',
     b'to',
     default=None,
 )
 coreconfigitem(
     b'experimental',
     b'archivemetatemplate',
     default=dynamicdefault,
 )
 coreconfigitem(
     b'experimental',
     b'auto-publish',
     default=b'publish',
 )
 coreconfigitem(
     b'experimental',
     b'bundle-phases',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'bundle2-advertise',
     default=True,
 )
 coreconfigitem(
     b'experimental',
     b'bundle2-output-capture',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'bundle2.pushback',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'bundle2lazylocking',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'bundlecomplevel',
     default=None,
 )
 coreconfigitem(
     b'experimental',
     b'bundlecomplevel.bzip2',
     default=None,
 )
 coreconfigitem(
     b'experimental',
     b'bundlecomplevel.gzip',
     default=None,
 )
 coreconfigitem(
     b'experimental',
     b'bundlecomplevel.none',
     default=None,
 )
 coreconfigitem(
     b'experimental',
     b'bundlecomplevel.zstd',
     default=None,
 )
 coreconfigitem(
     b'experimental',
     b'bundlecompthreads',
     default=None,
 )
 coreconfigitem(
     b'experimental',
     b'bundlecompthreads.bzip2',
     default=None,
 )
 coreconfigitem(
     b'experimental',
     b'bundlecompthreads.gzip',
     default=None,
 )
 coreconfigitem(
     b'experimental',
     b'bundlecompthreads.none',
     default=None,
 )
 coreconfigitem(
     b'experimental',
     b'bundlecompthreads.zstd',
     default=None,
 )
 coreconfigitem(
     b'experimental',
     b'changegroup3',
     default=True,
 )
 coreconfigitem(
     b'experimental',
     b'changegroup4',
     default=False,
 )
 
 # might remove rank configuration once the computation has no impact
 coreconfigitem(
     b'experimental',
     b'changelog-v2.compute-rank',
     default=True,
 )
 coreconfigitem(
     b'experimental',
     b'cleanup-as-archived',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'clientcompressionengines',
     default=list,
 )
 coreconfigitem(
     b'experimental',
     b'copytrace',
     default=b'on',
 )
 coreconfigitem(
     b'experimental',
     b'copytrace.movecandidateslimit',
     default=100,
 )
 coreconfigitem(
     b'experimental',
     b'copytrace.sourcecommitlimit',
     default=100,
 )
 coreconfigitem(
     b'experimental',
     b'copies.read-from',
     default=b"filelog-only",
 )
 coreconfigitem(
     b'experimental',
     b'copies.write-to',
     default=b'filelog-only',
 )
 coreconfigitem(
     b'experimental',
     b'crecordtest',
     default=None,
 )
 coreconfigitem(
     b'experimental',
     b'directaccess',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'directaccess.revnums',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'editortmpinhg',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'evolution',
     default=list,
 )
 coreconfigitem(
     b'experimental',
     b'evolution.allowdivergence',
     default=False,
     alias=[(b'experimental', b'allowdivergence')],
 )
 coreconfigitem(
     b'experimental',
     b'evolution.allowunstable',
     default=None,
 )
 coreconfigitem(
     b'experimental',
     b'evolution.createmarkers',
     default=None,
 )
 coreconfigitem(
     b'experimental',
     b'evolution.effect-flags',
     default=True,
     alias=[(b'experimental', b'effect-flags')],
 )
 coreconfigitem(
     b'experimental',
     b'evolution.exchange',
     default=None,
 )
 coreconfigitem(
     b'experimental',
     b'evolution.bundle-obsmarker',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'evolution.bundle-obsmarker:mandatory',
     default=True,
 )
 coreconfigitem(
     b'experimental',
     b'log.topo',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'evolution.report-instabilities',
     default=True,
 )
 coreconfigitem(
     b'experimental',
     b'evolution.track-operation',
     default=True,
 )
 # repo-level config to exclude a revset visibility
 #
 # The target use case is to use `share` to expose different subset of the same
 # repository, especially server side. See also `server.view`.
 coreconfigitem(
     b'experimental',
     b'extra-filter-revs',
     default=None,
 )
 coreconfigitem(
     b'experimental',
     b'maxdeltachainspan',
     default=-1,
 )
 # tracks files which were undeleted (merge might delete them but we explicitly
 # kept/undeleted them) and creates new filenodes for them
 coreconfigitem(
     b'experimental',
     b'merge-track-salvaged',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'mmapindexthreshold',
     default=None,
 )
 coreconfigitem(
     b'experimental',
     b'narrow',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'nonnormalparanoidcheck',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'exportableenviron',
     default=list,
 )
 coreconfigitem(
     b'experimental',
     b'extendedheader.index',
     default=None,
 )
 coreconfigitem(
     b'experimental',
     b'extendedheader.similarity',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'graphshorten',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'graphstyle.parent',
     default=dynamicdefault,
 )
 coreconfigitem(
     b'experimental',
     b'graphstyle.missing',
     default=dynamicdefault,
 )
 coreconfigitem(
     b'experimental',
     b'graphstyle.grandparent',
     default=dynamicdefault,
 )
 coreconfigitem(
     b'experimental',
     b'hook-track-tags',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'httppostargs',
     default=False,
 )
 coreconfigitem(b'experimental', b'nointerrupt', default=False)
 coreconfigitem(b'experimental', b'nointerrupt-interactiveonly', default=True)
 
 coreconfigitem(
     b'experimental',
     b'obsmarkers-exchange-debug',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'remotenames',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'removeemptydirs',
     default=True,
 )
 coreconfigitem(
     b'experimental',
     b'revert.interactive.select-to-keep',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'revisions.prefixhexnode',
     default=False,
 )
 # "out of experimental" todo list.
 #
 # * include management of a persistent nodemap in the main docket
 # * enforce a "no-truncate" policy for mmap safety
 #      - for censoring operation
 #      - for stripping operation
 #      - for rollback operation
 # * proper streaming (race free) of the docket file
 # * track garbage data to evemtually allow rewriting -existing- sidedata.
 # * Exchange-wise, we will also need to do something more efficient than
 #   keeping references to the affected revlogs, especially memory-wise when
 #   rewriting sidedata.
 # * introduce a proper solution to reduce the number of filelog related files.
 # * use caching for reading sidedata (similar to what we do for data).
 # * no longer set offset=0 if sidedata_size=0 (simplify cutoff computation).
 # * Improvement to consider
 #   - avoid compression header in chunk using the default compression?
 #   - forbid "inline" compression mode entirely?
 #   - split the data offset and flag field (the 2 bytes save are mostly trouble)
 #   - keep track of uncompressed -chunk- size (to preallocate memory better)
 #   - keep track of chain base or size (probably not that useful anymore)
 coreconfigitem(
     b'experimental',
     b'revlogv2',
     default=None,
 )
 coreconfigitem(
     b'experimental',
     b'revisions.disambiguatewithin',
     default=None,
 )
 coreconfigitem(
     b'experimental',
     b'rust.index',
     default=False,
 )
 coreconfigitem(
     b'experimental',
+    b'server.allow-hidden-access',
+    default=list,
+)
+coreconfigitem(
+    b'experimental',
     b'server.filesdata.recommended-batch-size',
     default=50000,
 )
 coreconfigitem(
     b'experimental',
     b'server.manifestdata.recommended-batch-size',
     default=100000,
 )
 coreconfigitem(
     b'experimental',
     b'server.stream-narrow-clones',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'single-head-per-branch',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'single-head-per-branch:account-closed-heads',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'single-head-per-branch:public-changes-only',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'sparse-read',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'sparse-read.density-threshold',
     default=0.50,
 )
 coreconfigitem(
     b'experimental',
     b'sparse-read.min-gap-size',
     default=b'65K',
 )
 coreconfigitem(
     b'experimental',
     b'treemanifest',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'update.atomic-file',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'web.full-garbage-collection-rate',
     default=1,  # still forcing a full collection on each request
 )
 coreconfigitem(
     b'experimental',
     b'worker.wdir-get-thread-safe',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'worker.repository-upgrade',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'xdiff',
     default=False,
 )
 coreconfigitem(
     b'extensions',
     b'[^:]*',
     default=None,
     generic=True,
 )
 coreconfigitem(
     b'extensions',
     b'[^:]*:required',
     default=False,
     generic=True,
 )
 coreconfigitem(
     b'extdata',
     b'.*',
     default=None,
     generic=True,
 )
 coreconfigitem(
     b'format',
     b'bookmarks-in-store',
     default=False,
 )
 coreconfigitem(
     b'format',
     b'chunkcachesize',
     default=None,
     experimental=True,
 )
 coreconfigitem(
     # Enable this dirstate format *when creating a new repository*.
     # Which format to use for existing repos is controlled by .hg/requires
     b'format',
     b'use-dirstate-v2',
     default=False,
     experimental=True,
     alias=[(b'format', b'exp-rc-dirstate-v2')],
 )
 coreconfigitem(
     b'format',
     b'use-dirstate-v2.automatic-upgrade-of-mismatching-repositories',
     default=False,
     experimental=True,
 )
 coreconfigitem(
     b'format',
     b'use-dirstate-v2.automatic-upgrade-of-mismatching-repositories:quiet',
     default=False,
     experimental=True,
 )
 coreconfigitem(
     b'format',
     b'use-dirstate-tracked-hint',
     default=False,
     experimental=True,
 )
 coreconfigitem(
     b'format',
     b'use-dirstate-tracked-hint.version',
     default=1,
     experimental=True,
 )
 coreconfigitem(
     b'format',
     b'use-dirstate-tracked-hint.automatic-upgrade-of-mismatching-repositories',
     default=False,
     experimental=True,
 )
 coreconfigitem(
     b'format',
     b'use-dirstate-tracked-hint.automatic-upgrade-of-mismatching-repositories:quiet',
     default=False,
     experimental=True,
 )
 coreconfigitem(
     b'format',
     b'dotencode',
     default=True,
 )
 coreconfigitem(
     b'format',
     b'generaldelta',
     default=False,
     experimental=True,
 )
 coreconfigitem(
     b'format',
     b'manifestcachesize',
     default=None,
     experimental=True,
 )
 coreconfigitem(
     b'format',
     b'maxchainlen',
     default=dynamicdefault,
     experimental=True,
 )
 coreconfigitem(
     b'format',
     b'obsstore-version',
     default=None,
 )
 coreconfigitem(
     b'format',
     b'sparse-revlog',
     default=True,
 )
 coreconfigitem(
     b'format',
     b'revlog-compression',
     default=lambda: [b'zstd', b'zlib'],
     alias=[(b'experimental', b'format.compression')],
 )
 # Experimental TODOs:
 #
 # * Same as for revlogv2 (but for the reduction of the number of files)
 # * Actually computing the rank of changesets
 # * Improvement to investigate
 #   - storing .hgtags fnode
 #   - storing branch related identifier
 
 coreconfigitem(
     b'format',
     b'exp-use-changelog-v2',
     default=None,
     experimental=True,
 )
 coreconfigitem(
     b'format',
     b'usefncache',
     default=True,
 )
 coreconfigitem(
     b'format',
     b'usegeneraldelta',
     default=True,
 )
 coreconfigitem(
     b'format',
     b'usestore',
     default=True,
 )
 
 
 def _persistent_nodemap_default():
     """compute `use-persistent-nodemap` default value
 
     The feature is disabled unless a fast implementation is available.
     """
     from . import policy
 
     return policy.importrust('revlog') is not None
 
 
 coreconfigitem(
     b'format',
     b'use-persistent-nodemap',
     default=_persistent_nodemap_default,
 )
 coreconfigitem(
     b'format',
     b'exp-use-copies-side-data-changeset',
     default=False,
     experimental=True,
 )
 coreconfigitem(
     b'format',
     b'use-share-safe',
     default=True,
 )
 coreconfigitem(
     b'format',
     b'use-share-safe.automatic-upgrade-of-mismatching-repositories',
     default=False,
     experimental=True,
 )
 coreconfigitem(
     b'format',
     b'use-share-safe.automatic-upgrade-of-mismatching-repositories:quiet',
     default=False,
     experimental=True,
 )
 
 # Moving this on by default means we are confident about the scaling of phases.
 # This is not garanteed to be the case at the time this message is written.
 coreconfigitem(
     b'format',
     b'use-internal-phase',
     default=False,
     experimental=True,
 )
 # The interaction between the archived phase and obsolescence markers needs to
 # be sorted out before wider usage of this are to be considered.
 #
 # At the time this message is written, behavior when archiving obsolete
 # changeset differ significantly from stripping. As part of stripping, we also
 # remove the obsolescence marker associated to the stripped changesets,
 # revealing the precedecessors changesets when applicable. When archiving, we
 # don't touch the obsolescence markers, keeping everything hidden. This can
 # result in quite confusing situation for people combining exchanging draft
 # with the archived phases. As some markers needed by others may be skipped
 # during exchange.
 coreconfigitem(
     b'format',
     b'exp-archived-phase',
     default=False,
     experimental=True,
 )
 coreconfigitem(
     b'shelve',
     b'store',
     default=b'internal',
     experimental=True,
 )
 coreconfigitem(
     b'fsmonitor',
     b'warn_when_unused',
     default=True,
 )
 coreconfigitem(
     b'fsmonitor',
     b'warn_update_file_count',
     default=50000,
 )
 coreconfigitem(
     b'fsmonitor',
     b'warn_update_file_count_rust',
     default=400000,
 )
 coreconfigitem(
     b'help',
     br'hidden-command\..*',
     default=False,
     generic=True,
 )
 coreconfigitem(
     b'help',
     br'hidden-topic\..*',
     default=False,
     generic=True,
 )
 coreconfigitem(
     b'hooks',
     b'[^:]*',
     default=dynamicdefault,
     generic=True,
 )
 coreconfigitem(
     b'hooks',
     b'.*:run-with-plain',
     default=True,
     generic=True,
 )
 coreconfigitem(
     b'hgweb-paths',
     b'.*',
     default=list,
     generic=True,
 )
 coreconfigitem(
     b'hostfingerprints',
     b'.*',
     default=list,
     generic=True,
 )
 coreconfigitem(
     b'hostsecurity',
     b'ciphers',
     default=None,
 )
 coreconfigitem(
     b'hostsecurity',
     b'minimumprotocol',
     default=dynamicdefault,
 )
 coreconfigitem(
     b'hostsecurity',
     b'.*:minimumprotocol$',
     default=dynamicdefault,
     generic=True,
 )
 coreconfigitem(
     b'hostsecurity',
     b'.*:ciphers$',
     default=dynamicdefault,
     generic=True,
 )
 coreconfigitem(
     b'hostsecurity',
     b'.*:fingerprints$',
     default=list,
     generic=True,
 )
 coreconfigitem(
     b'hostsecurity',
     b'.*:verifycertsfile$',
     default=None,
     generic=True,
 )
 
 coreconfigitem(
     b'http_proxy',
     b'always',
     default=False,
 )
 coreconfigitem(
     b'http_proxy',
     b'host',
     default=None,
 )
 coreconfigitem(
     b'http_proxy',
     b'no',
     default=list,
 )
 coreconfigitem(
     b'http_proxy',
     b'passwd',
     default=None,
 )
 coreconfigitem(
     b'http_proxy',
     b'user',
     default=None,
 )
 
 coreconfigitem(
     b'http',
     b'timeout',
     default=None,
 )
 
 coreconfigitem(
     b'logtoprocess',
     b'commandexception',
     default=None,
 )
 coreconfigitem(
     b'logtoprocess',
     b'commandfinish',
     default=None,
 )
 coreconfigitem(
     b'logtoprocess',
     b'command',
     default=None,
 )
 coreconfigitem(
     b'logtoprocess',
     b'develwarn',
     default=None,
 )
 coreconfigitem(
     b'logtoprocess',
     b'uiblocked',
     default=None,
 )
 coreconfigitem(
     b'merge',
     b'checkunknown',
     default=b'abort',
 )
 coreconfigitem(
     b'merge',
     b'checkignored',
     default=b'abort',
 )
 coreconfigitem(
     b'experimental',
     b'merge.checkpathconflicts',
     default=False,
 )
 coreconfigitem(
     b'merge',
     b'followcopies',
     default=True,
 )
 coreconfigitem(
     b'merge',
     b'on-failure',
     default=b'continue',
 )
 coreconfigitem(
     b'merge',
     b'preferancestor',
     default=lambda: [b'*'],
     experimental=True,
 )
 coreconfigitem(
     b'merge',
     b'strict-capability-check',
     default=False,
 )
 coreconfigitem(
     b'merge',
     b'disable-partial-tools',
     default=False,
     experimental=True,
 )
 coreconfigitem(
     b'partial-merge-tools',
     b'.*',
     default=None,
     generic=True,
     experimental=True,
 )
 coreconfigitem(
     b'partial-merge-tools',
     br'.*\.patterns',
     default=dynamicdefault,
     generic=True,
     priority=-1,
     experimental=True,
 )
 coreconfigitem(
     b'partial-merge-tools',
     br'.*\.executable$',
     default=dynamicdefault,
     generic=True,
     priority=-1,
     experimental=True,
 )
 coreconfigitem(
     b'partial-merge-tools',
     br'.*\.order',
     default=0,
     generic=True,
     priority=-1,
     experimental=True,
 )
 coreconfigitem(
     b'partial-merge-tools',
     br'.*\.args',
     default=b"$local $base $other",
     generic=True,
     priority=-1,
     experimental=True,
 )
 coreconfigitem(
     b'partial-merge-tools',
     br'.*\.disable',
     default=False,
     generic=True,
     priority=-1,
     experimental=True,
 )
 coreconfigitem(
     b'merge-tools',
     b'.*',
     default=None,
     generic=True,
 )
 coreconfigitem(
     b'merge-tools',
     br'.*\.args$',
     default=b"$local $base $other",
     generic=True,
     priority=-1,
 )
 coreconfigitem(
     b'merge-tools',
     br'.*\.binary$',
     default=False,
     generic=True,
     priority=-1,
 )
 coreconfigitem(
     b'merge-tools',
     br'.*\.check$',
     default=list,
     generic=True,
     priority=-1,
 )
 coreconfigitem(
     b'merge-tools',
     br'.*\.checkchanged$',
     default=False,
     generic=True,
     priority=-1,
 )
 coreconfigitem(
     b'merge-tools',
     br'.*\.executable$',
     default=dynamicdefault,
     generic=True,
     priority=-1,
 )
 coreconfigitem(
     b'merge-tools',
     br'.*\.fixeol$',
     default=False,
     generic=True,
     priority=-1,
 )
 coreconfigitem(
     b'merge-tools',
     br'.*\.gui$',
     default=False,
     generic=True,
     priority=-1,
 )
 coreconfigitem(
     b'merge-tools',
     br'.*\.mergemarkers$',
     default=b'basic',
     generic=True,
     priority=-1,
 )
 coreconfigitem(
     b'merge-tools',
     br'.*\.mergemarkertemplate$',
     default=dynamicdefault,  # take from command-templates.mergemarker
     generic=True,
     priority=-1,
 )
 coreconfigitem(
     b'merge-tools',
     br'.*\.priority$',
     default=0,
     generic=True,
     priority=-1,
 )
 coreconfigitem(
     b'merge-tools',
     br'.*\.premerge$',
     default=dynamicdefault,
     generic=True,
     priority=-1,
 )
 coreconfigitem(
     b'merge-tools',
     br'.*\.regappend$',
     default=b"",
     generic=True,
     priority=-1,
 )
 coreconfigitem(
     b'merge-tools',
     br'.*\.symlink$',
     default=False,
     generic=True,
     priority=-1,
 )
 coreconfigitem(
     b'pager',
     b'attend-.*',
     default=dynamicdefault,
     generic=True,
 )
 coreconfigitem(
     b'pager',
     b'ignore',
     default=list,
 )
 coreconfigitem(
     b'pager',
     b'pager',
     default=dynamicdefault,
 )
 coreconfigitem(
     b'patch',
     b'eol',
     default=b'strict',
 )
 coreconfigitem(
     b'patch',
     b'fuzz',
     default=2,
 )
 coreconfigitem(
     b'paths',
     b'default',
     default=None,
 )
 coreconfigitem(
     b'paths',
     b'default-push',
     default=None,
 )
 coreconfigitem(
     b'paths',
     b'[^:]*',
     default=None,
     generic=True,
 )
 coreconfigitem(
     b'paths',
     b'.*:bookmarks.mode',
     default='default',
     generic=True,
 )
 coreconfigitem(
     b'paths',
     b'.*:multi-urls',
     default=False,
     generic=True,
 )
 coreconfigitem(
     b'paths',
     b'.*:pushrev',
     default=None,
     generic=True,
 )
 coreconfigitem(
     b'paths',
     b'.*:pushurl',
     default=None,
     generic=True,
 )
 coreconfigitem(
     b'paths',
     b'.*:pulled-delta-reuse-policy',
     default=None,
     generic=True,
 )
 coreconfigitem(
     b'phases',
     b'checksubrepos',
     default=b'follow',
 )
 coreconfigitem(
     b'phases',
     b'new-commit',
     default=b'draft',
 )
 coreconfigitem(
     b'phases',
     b'publish',
     default=True,
 )
 coreconfigitem(
     b'profiling',
     b'enabled',
     default=False,
 )
 coreconfigitem(
     b'profiling',
     b'format',
     default=b'text',
 )
 coreconfigitem(
     b'profiling',
     b'freq',
     default=1000,
 )
 coreconfigitem(
     b'profiling',
     b'limit',
     default=30,
 )
 coreconfigitem(
     b'profiling',
     b'nested',
     default=0,
 )
 coreconfigitem(
     b'profiling',
     b'output',
     default=None,
 )
 coreconfigitem(
     b'profiling',
     b'showmax',
     default=0.999,
 )
 coreconfigitem(
     b'profiling',
     b'showmin',
     default=dynamicdefault,
 )
 coreconfigitem(
     b'profiling',
     b'showtime',
     default=True,
 )
 coreconfigitem(
     b'profiling',
     b'sort',
     default=b'inlinetime',
 )
 coreconfigitem(
     b'profiling',
     b'statformat',
     default=b'hotpath',
 )
 coreconfigitem(
     b'profiling',
     b'time-track',
     default=dynamicdefault,
 )
 coreconfigitem(
     b'profiling',
     b'type',
     default=b'stat',
 )
 coreconfigitem(
     b'progress',
     b'assume-tty',
     default=False,
 )
 coreconfigitem(
     b'progress',
     b'changedelay',
     default=1,
 )
 coreconfigitem(
     b'progress',
     b'clear-complete',
     default=True,
 )
 coreconfigitem(
     b'progress',
     b'debug',
     default=False,
 )
 coreconfigitem(
     b'progress',
     b'delay',
     default=3,
 )
 coreconfigitem(
     b'progress',
     b'disable',
     default=False,
 )
 coreconfigitem(
     b'progress',
     b'estimateinterval',
     default=60.0,
 )
 coreconfigitem(
     b'progress',
     b'format',
     default=lambda: [b'topic', b'bar', b'number', b'estimate'],
 )
 coreconfigitem(
     b'progress',
     b'refresh',
     default=0.1,
 )
 coreconfigitem(
     b'progress',
     b'width',
     default=dynamicdefault,
 )
 coreconfigitem(
     b'pull',
     b'confirm',
     default=False,
 )
 coreconfigitem(
     b'push',
     b'pushvars.server',
     default=False,
 )
 coreconfigitem(
     b'rewrite',
     b'backup-bundle',
     default=True,
     alias=[(b'ui', b'history-editing-backup')],
 )
 coreconfigitem(
     b'rewrite',
     b'update-timestamp',
     default=False,
 )
 coreconfigitem(
     b'rewrite',
     b'empty-successor',
     default=b'skip',
     experimental=True,
 )
 # experimental as long as format.use-dirstate-v2 is.
 coreconfigitem(
     b'storage',
     b'dirstate-v2.slow-path',
     default=b"abort",
     experimental=True,
 )
 coreconfigitem(
     b'storage',
     b'new-repo-backend',
     default=b'revlogv1',
     experimental=True,
 )
 coreconfigitem(
     b'storage',
     b'revlog.optimize-delta-parent-choice',
     default=True,
     alias=[(b'format', b'aggressivemergedeltas')],
 )
 coreconfigitem(
     b'storage',
     b'revlog.delta-parent-search.candidate-group-chunk-size',
     default=20,
 )
 coreconfigitem(
     b'storage',
     b'revlog.issue6528.fix-incoming',
     default=True,
 )
 # experimental as long as rust is experimental (or a C version is implemented)
 coreconfigitem(
     b'storage',
     b'revlog.persistent-nodemap.mmap',
     default=True,
 )
 # experimental as long as format.use-persistent-nodemap is.
 coreconfigitem(
     b'storage',
     b'revlog.persistent-nodemap.slow-path',
     default=b"abort",
 )
 
 coreconfigitem(
     b'storage',
     b'revlog.reuse-external-delta',
     default=True,
 )
 # This option is True unless `format.generaldelta` is set.
 coreconfigitem(
     b'storage',
     b'revlog.reuse-external-delta-parent',
     default=None,
 )
 coreconfigitem(
     b'storage',
     b'revlog.zlib.level',
     default=None,
 )
 coreconfigitem(
     b'storage',
     b'revlog.zstd.level',
     default=None,
 )
 coreconfigitem(
     b'server',
     b'bookmarks-pushkey-compat',
     default=True,
 )
 coreconfigitem(
     b'server',
     b'bundle1',
     default=True,
 )
 coreconfigitem(
     b'server',
     b'bundle1gd',
     default=None,
 )
 coreconfigitem(
     b'server',
     b'bundle1.pull',
     default=None,
 )
 coreconfigitem(
     b'server',
     b'bundle1gd.pull',
     default=None,
 )
 coreconfigitem(
     b'server',
     b'bundle1.push',
     default=None,
 )
 coreconfigitem(
     b'server',
     b'bundle1gd.push',
     default=None,
 )
 coreconfigitem(
     b'server',
     b'bundle2.stream',
     default=True,
     alias=[(b'experimental', b'bundle2.stream')],
 )
 coreconfigitem(
     b'server',
     b'compressionengines',
     default=list,
 )
 coreconfigitem(
     b'server',
     b'concurrent-push-mode',
     default=b'check-related',
 )
 coreconfigitem(
     b'server',
     b'disablefullbundle',
     default=False,
 )
 coreconfigitem(
     b'server',
     b'maxhttpheaderlen',
     default=1024,
 )
 coreconfigitem(
     b'server',
     b'pullbundle',
     default=True,
 )
 coreconfigitem(
     b'server',
     b'preferuncompressed',
     default=False,
 )
 coreconfigitem(
     b'server',
     b'streamunbundle',
     default=False,
 )
 coreconfigitem(
     b'server',
     b'uncompressed',
     default=True,
 )
 coreconfigitem(
     b'server',
     b'uncompressedallowsecret',
     default=False,
 )
 coreconfigitem(
     b'server',
     b'view',
     default=b'served',
 )
 coreconfigitem(
     b'server',
     b'validate',
     default=False,
 )
 coreconfigitem(
     b'server',
     b'zliblevel',
     default=-1,
 )
 coreconfigitem(
     b'server',
     b'zstdlevel',
     default=3,
 )
 coreconfigitem(
     b'share',
     b'pool',
     default=None,
 )
 coreconfigitem(
     b'share',
     b'poolnaming',
     default=b'identity',
 )
 coreconfigitem(
     b'share',
     b'safe-mismatch.source-not-safe',
     default=b'abort',
 )
 coreconfigitem(
     b'share',
     b'safe-mismatch.source-safe',
     default=b'abort',
 )
 coreconfigitem(
     b'share',
     b'safe-mismatch.source-not-safe.warn',
     default=True,
 )
 coreconfigitem(
     b'share',
     b'safe-mismatch.source-safe.warn',
     default=True,
 )
 coreconfigitem(
     b'share',
     b'safe-mismatch.source-not-safe:verbose-upgrade',
     default=True,
 )
 coreconfigitem(
     b'share',
     b'safe-mismatch.source-safe:verbose-upgrade',
     default=True,
 )
 coreconfigitem(
     b'shelve',
     b'maxbackups',
     default=10,
 )
 coreconfigitem(
     b'smtp',
     b'host',
     default=None,
 )
 coreconfigitem(
     b'smtp',
     b'local_hostname',
     default=None,
 )
 coreconfigitem(
     b'smtp',
     b'password',
     default=None,
 )
 coreconfigitem(
     b'smtp',
     b'port',
     default=dynamicdefault,
 )
 coreconfigitem(
     b'smtp',
     b'tls',
     default=b'none',
 )
 coreconfigitem(
     b'smtp',
     b'username',
     default=None,
 )
 coreconfigitem(
     b'sparse',
     b'missingwarning',
     default=True,
     experimental=True,
 )
 coreconfigitem(
     b'subrepos',
     b'allowed',
     default=dynamicdefault,  # to make backporting simpler
 )
 coreconfigitem(
     b'subrepos',
     b'hg:allowed',
     default=dynamicdefault,
 )
 coreconfigitem(
     b'subrepos',
     b'git:allowed',
     default=dynamicdefault,
 )
 coreconfigitem(
     b'subrepos',
     b'svn:allowed',
     default=dynamicdefault,
 )
 coreconfigitem(
     b'templates',
     b'.*',
     default=None,
     generic=True,
 )
 coreconfigitem(
     b'templateconfig',
     b'.*',
     default=dynamicdefault,
     generic=True,
 )
 coreconfigitem(
     b'trusted',
     b'groups',
     default=list,
 )
 coreconfigitem(
     b'trusted',
     b'users',
     default=list,
 )
 coreconfigitem(
     b'ui',
     b'_usedassubrepo',
     default=False,
 )
 coreconfigitem(
     b'ui',
     b'allowemptycommit',
     default=False,
 )
 coreconfigitem(
     b'ui',
     b'archivemeta',
     default=True,
 )
 coreconfigitem(
     b'ui',
     b'askusername',
     default=False,
 )
 coreconfigitem(
     b'ui',
     b'available-memory',
     default=None,
 )
 
 coreconfigitem(
     b'ui',
     b'clonebundlefallback',
     default=False,
 )
 coreconfigitem(
     b'ui',
     b'clonebundleprefers',
     default=list,
 )
 coreconfigitem(
     b'ui',
     b'clonebundles',
     default=True,
 )
 coreconfigitem(
     b'ui',
     b'color',
     default=b'auto',
 )
 coreconfigitem(
     b'ui',
     b'commitsubrepos',
     default=False,
 )
 coreconfigitem(
     b'ui',
     b'debug',
     default=False,
 )
 coreconfigitem(
     b'ui',
     b'debugger',
     default=None,
 )
 coreconfigitem(
     b'ui',
     b'editor',
     default=dynamicdefault,
 )
 coreconfigitem(
     b'ui',
     b'detailed-exit-code',
     default=False,
     experimental=True,
 )
 coreconfigitem(
     b'ui',
     b'fallbackencoding',
     default=None,
 )
 coreconfigitem(
     b'ui',
     b'forcecwd',
     default=None,
 )
 coreconfigitem(
     b'ui',
     b'forcemerge',
     default=None,
 )
 coreconfigitem(
     b'ui',
     b'formatdebug',
     default=False,
 )
 coreconfigitem(
     b'ui',
     b'formatjson',
     default=False,
 )
 coreconfigitem(
     b'ui',
     b'formatted',
     default=None,
 )
 coreconfigitem(
     b'ui',
     b'interactive',
     default=None,
 )
 coreconfigitem(
     b'ui',
     b'interface',
     default=None,
 )
 coreconfigitem(
     b'ui',
     b'interface.chunkselector',
     default=None,
 )
 coreconfigitem(
     b'ui',
     b'large-file-limit',
     default=10 * (2 ** 20),
 )
 coreconfigitem(
     b'ui',
     b'logblockedtimes',
     default=False,
 )
 coreconfigitem(
     b'ui',
     b'merge',
     default=None,
 )
 coreconfigitem(
     b'ui',
     b'mergemarkers',
     default=b'basic',
 )
 coreconfigitem(
     b'ui',
     b'message-output',
     default=b'stdio',
 )
 coreconfigitem(
     b'ui',
     b'nontty',
     default=False,
 )
 coreconfigitem(
     b'ui',
     b'origbackuppath',
     default=None,
 )
 coreconfigitem(
     b'ui',
     b'paginate',
     default=True,
 )
 coreconfigitem(
     b'ui',
     b'patch',
     default=None,
 )
 coreconfigitem(
     b'ui',
     b'portablefilenames',
     default=b'warn',
 )
 coreconfigitem(
     b'ui',
     b'promptecho',
     default=False,
 )
 coreconfigitem(
     b'ui',
     b'quiet',
     default=False,
 )
 coreconfigitem(
     b'ui',
     b'quietbookmarkmove',
     default=False,
 )
 coreconfigitem(
     b'ui',
     b'relative-paths',
     default=b'legacy',
 )
 coreconfigitem(
     b'ui',
     b'remotecmd',
     default=b'hg',
 )
 coreconfigitem(
     b'ui',
     b'report_untrusted',
     default=True,
 )
 coreconfigitem(
     b'ui',
     b'rollback',
     default=True,
 )
 coreconfigitem(
     b'ui',
     b'signal-safe-lock',
     default=True,
 )
 coreconfigitem(
     b'ui',
     b'slash',
     default=False,
 )
 coreconfigitem(
     b'ui',
     b'ssh',
     default=b'ssh',
 )
 coreconfigitem(
     b'ui',
     b'ssherrorhint',
     default=None,
 )
 coreconfigitem(
     b'ui',
     b'statuscopies',
     default=False,
 )
 coreconfigitem(
     b'ui',
     b'strict',
     default=False,
 )
 coreconfigitem(
     b'ui',
     b'style',
     default=b'',
 )
 coreconfigitem(
     b'ui',
     b'supportcontact',
     default=None,
 )
 coreconfigitem(
     b'ui',
     b'textwidth',
     default=78,
 )
 coreconfigitem(
     b'ui',
     b'timeout',
     default=b'600',
 )
 coreconfigitem(
     b'ui',
     b'timeout.warn',
     default=0,
 )
 coreconfigitem(
     b'ui',
     b'timestamp-output',
     default=False,
 )
 coreconfigitem(
     b'ui',
     b'traceback',
     default=False,
 )
 coreconfigitem(
     b'ui',
     b'tweakdefaults',
     default=False,
 )
 coreconfigitem(b'ui', b'username', alias=[(b'ui', b'user')])
 coreconfigitem(
     b'ui',
     b'verbose',
     default=False,
 )
 coreconfigitem(
     b'verify',
     b'skipflags',
     default=0,
 )
 coreconfigitem(
     b'web',
     b'allowbz2',
     default=False,
 )
 coreconfigitem(
     b'web',
     b'allowgz',
     default=False,
 )
 coreconfigitem(
     b'web',
     b'allow-pull',
     alias=[(b'web', b'allowpull')],
     default=True,
 )
 coreconfigitem(
     b'web',
     b'allow-push',
     alias=[(b'web', b'allow_push')],
     default=list,
 )
 coreconfigitem(
     b'web',
     b'allowzip',
     default=False,
 )
 coreconfigitem(
     b'web',
     b'archivesubrepos',
     default=False,
 )
 coreconfigitem(
     b'web',
     b'cache',
     default=True,
 )
 coreconfigitem(
     b'web',
     b'comparisoncontext',
     default=5,
 )
 coreconfigitem(
     b'web',
     b'contact',
     default=None,
 )
 coreconfigitem(
     b'web',
     b'deny_push',
     default=list,
 )
 coreconfigitem(
     b'web',
     b'guessmime',
     default=False,
 )
 coreconfigitem(
     b'web',
     b'hidden',
     default=False,
 )
 coreconfigitem(
     b'web',
     b'labels',
     default=list,
 )
 coreconfigitem(
     b'web',
     b'logoimg',
     default=b'hglogo.png',
 )
 coreconfigitem(
     b'web',
     b'logourl',
     default=b'https://mercurial-scm.org/',
 )
 coreconfigitem(
     b'web',
     b'accesslog',
     default=b'-',
 )
 coreconfigitem(
     b'web',
     b'address',
     default=b'',
 )
 coreconfigitem(
     b'web',
     b'allow-archive',
     alias=[(b'web', b'allow_archive')],
     default=list,
 )
 coreconfigitem(
     b'web',
     b'allow_read',
     default=list,
 )
 coreconfigitem(
     b'web',
     b'baseurl',
     default=None,
 )
 coreconfigitem(
     b'web',
     b'cacerts',
     default=None,
 )
 coreconfigitem(
     b'web',
     b'certificate',
     default=None,
 )
 coreconfigitem(
     b'web',
     b'collapse',
     default=False,
 )
 coreconfigitem(
     b'web',
     b'csp',
     default=None,
 )
 coreconfigitem(
     b'web',
     b'deny_read',
     default=list,
 )
 coreconfigitem(
     b'web',
     b'descend',
     default=True,
 )
 coreconfigitem(
     b'web',
     b'description',
     default=b"",
 )
 coreconfigitem(
     b'web',
     b'encoding',
     default=lambda: encoding.encoding,
 )
 coreconfigitem(
     b'web',
     b'errorlog',
     default=b'-',
 )
 coreconfigitem(
     b'web',
     b'ipv6',
     default=False,
 )
 coreconfigitem(
     b'web',
     b'maxchanges',
     default=10,
 )
 coreconfigitem(
     b'web',
     b'maxfiles',
     default=10,
 )
 coreconfigitem(
     b'web',
     b'maxshortchanges',
     default=60,
 )
 coreconfigitem(
     b'web',
     b'motd',
     default=b'',
 )
 coreconfigitem(
     b'web',
     b'name',
     default=dynamicdefault,
 )
 coreconfigitem(
     b'web',
     b'port',
     default=8000,
 )
 coreconfigitem(
     b'web',
     b'prefix',
     default=b'',
 )
 coreconfigitem(
     b'web',
     b'push_ssl',
     default=True,
 )
 coreconfigitem(
     b'web',
     b'refreshinterval',
     default=20,
 )
 coreconfigitem(
     b'web',
     b'server-header',
     default=None,
 )
 coreconfigitem(
     b'web',
     b'static',
     default=None,
 )
 coreconfigitem(
     b'web',
     b'staticurl',
     default=None,
 )
 coreconfigitem(
     b'web',
     b'stripes',
     default=1,
 )
 coreconfigitem(
     b'web',
     b'style',
     default=b'paper',
 )
 coreconfigitem(
     b'web',
     b'templates',
     default=None,
 )
 coreconfigitem(
     b'web',
     b'view',
     default=b'served',
     experimental=True,
 )
 coreconfigitem(
     b'worker',
     b'backgroundclose',
     default=dynamicdefault,
 )
 # Windows defaults to a limit of 512 open files. A buffer of 128
 # should give us enough headway.
 coreconfigitem(
     b'worker',
     b'backgroundclosemaxqueue',
     default=384,
 )
 coreconfigitem(
     b'worker',
     b'backgroundcloseminfilecount',
     default=2048,
 )
 coreconfigitem(
     b'worker',
     b'backgroundclosethreadcount',
     default=4,
 )
 coreconfigitem(
     b'worker',
     b'enabled',
     default=True,
 )
 coreconfigitem(
     b'worker',
     b'numcpus',
     default=None,
 )
 
 # Rebase related configuration moved to core because other extension are doing
 # strange things. For example, shelve import the extensions to reuse some bit
 # without formally loading it.
 coreconfigitem(
     b'commands',
     b'rebase.requiredest',
     default=False,
 )
 coreconfigitem(
     b'experimental',
     b'rebaseskipobsolete',
     default=True,
 )
 coreconfigitem(
     b'rebase',
     b'singletransaction',
     default=False,
 )
 coreconfigitem(
     b'rebase',
     b'experimental.inmemory',
     default=False,
 )
 
 # This setting controls creation of a rebase_source extra field
 # during rebase. When False, no such field is created. This is
 # useful eg for incrementally converting changesets and then
 # rebasing them onto an existing repo.
 # WARNING: this is an advanced setting reserved for people who know
 # exactly what they are doing. Misuse of this setting can easily
 # result in obsmarker cycles and a vivid headache.
 coreconfigitem(
     b'rebase',
     b'store-source',
     default=True,
     experimental=True,
 )

mercurial/hgweb/common.py

@@ -1,287 +1,314 b''
 # hgweb/common.py - Utility functions needed by hgweb_mod and hgwebdir_mod
 #
 # Copyright 21 May 2005 - (c) 2005 Jake Edge <[e-mail]>
 # Copyright 2005, 2006 Olivia Mackall <[e-mail]>
 #
 # This software may be used and distributed according to the terms of the
 # GNU General Public License version 2 or any later version.
 
 
 import base64
 import errno
 import mimetypes
 import os
 import stat
 
+from ..i18n import _
 from ..pycompat import (
     getattr,
     open,
 )
 from .. import (
     encoding,
     pycompat,
     templater,
     util,
 )
 
 httpserver = util.httpserver
 
 HTTP_OK = 200
 HTTP_CREATED = 201
 HTTP_NOT_MODIFIED = 304
 HTTP_BAD_REQUEST = 400
 HTTP_UNAUTHORIZED = 401
 HTTP_FORBIDDEN = 403
 HTTP_NOT_FOUND = 404
 HTTP_METHOD_NOT_ALLOWED = 405
 HTTP_NOT_ACCEPTABLE = 406
 HTTP_UNSUPPORTED_MEDIA_TYPE = 415
 HTTP_SERVER_ERROR = 500
 
 
 def ismember(ui, username, userlist):
     """Check if username is a member of userlist.
 
     If userlist has a single '*' member, all users are considered members.
     Can be overridden by extensions to provide more complex authorization
     schemes.
     """
     return userlist == [b'*'] or username in userlist
 
 
+def hashiddenaccess(repo, req):
+    if bool(req.qsparams.get(b'access-hidden')):
+        # Disable this by default for now. Main risk is to get critical
+        # information exposed through this. This is expecially risky if
+        # someone decided to make a changeset secret for good reason, but
+        # its predecessors are still draft.
+        #
+        # The feature is currently experimental, so we can still decide to
+        # change the default.
+        ui = repo.ui
+        allow = ui.configlist(b'experimental', b'server.allow-hidden-access')
+        user = req.remoteuser
+        if allow and ismember(ui, user, allow):
+            return True
+        else:
+            msg = (
+                _(
+                    b'ignoring request to access hidden changeset by '
+                    b'unauthorized user: %r\n'
+                )
+                % user
+            )
+            ui.warn(msg)
+    return False
+
+
 def checkauthz(hgweb, req, op):
     """Check permission for operation based on request data (including
     authentication info). Return if op allowed, else raise an ErrorResponse
     exception."""
 
     user = req.remoteuser
 
     deny_read = hgweb.configlist(b'web', b'deny_read')
     if deny_read and (not user or ismember(hgweb.repo.ui, user, deny_read)):
         raise ErrorResponse(HTTP_UNAUTHORIZED, b'read not authorized')
 
     allow_read = hgweb.configlist(b'web', b'allow_read')
     if allow_read and (not ismember(hgweb.repo.ui, user, allow_read)):
         raise ErrorResponse(HTTP_UNAUTHORIZED, b'read not authorized')
 
     if op == b'pull' and not hgweb.allowpull:
         raise ErrorResponse(HTTP_UNAUTHORIZED, b'pull not authorized')
     elif op == b'pull' or op is None:  # op is None for interface requests
         return
 
     # Allow LFS uploading via PUT requests
     if op == b'upload':
         if req.method != b'PUT':
             msg = b'upload requires PUT request'
             raise ErrorResponse(HTTP_METHOD_NOT_ALLOWED, msg)
     # enforce that you can only push using POST requests
     elif req.method != b'POST':
         msg = b'push requires POST request'
         raise ErrorResponse(HTTP_METHOD_NOT_ALLOWED, msg)
 
     # require ssl by default for pushing, auth info cannot be sniffed
     # and replayed
     if hgweb.configbool(b'web', b'push_ssl') and req.urlscheme != b'https':
         raise ErrorResponse(HTTP_FORBIDDEN, b'ssl required')
 
     deny = hgweb.configlist(b'web', b'deny_push')
     if deny and (not user or ismember(hgweb.repo.ui, user, deny)):
         raise ErrorResponse(HTTP_UNAUTHORIZED, b'push not authorized')
 
     allow = hgweb.configlist(b'web', b'allow-push')
     if not (allow and ismember(hgweb.repo.ui, user, allow)):
         raise ErrorResponse(HTTP_UNAUTHORIZED, b'push not authorized')
 
 
 # Hooks for hgweb permission checks; extensions can add hooks here.
 # Each hook is invoked like this: hook(hgweb, request, operation),
 # where operation is either read, pull, push or upload. Hooks should either
 # raise an ErrorResponse exception, or just return.
 #
 # It is possible to do both authentication and authorization through
 # this.
 permhooks = [checkauthz]
 
 
 class ErrorResponse(Exception):
     def __init__(self, code, message=None, headers=None):
         if message is None:
             message = _statusmessage(code)
         Exception.__init__(self, pycompat.sysstr(message))
         self.code = code
         if headers is None:
             headers = []
         self.headers = headers
         self.message = message
 
 
 class continuereader:
     """File object wrapper to handle HTTP 100-continue.
 
     This is used by servers so they automatically handle Expect: 100-continue
     request headers. On first read of the request body, the 100 Continue
     response is sent. This should trigger the client into actually sending
     the request body.
     """
 
     def __init__(self, f, write):
         self.f = f
         self._write = write
         self.continued = False
 
     def read(self, amt=-1):
         if not self.continued:
             self.continued = True
             self._write(b'HTTP/1.1 100 Continue\r\n\r\n')
         return self.f.read(amt)
 
     def __getattr__(self, attr):
         if attr in (b'close', b'readline', b'readlines', b'__iter__'):
             return getattr(self.f, attr)
         raise AttributeError
 
 
 def _statusmessage(code):
     responses = httpserver.basehttprequesthandler.responses
     return pycompat.bytesurl(responses.get(code, ('Error', 'Unknown error'))[0])
 
 
 def statusmessage(code, message=None):
     return b'%d %s' % (code, message or _statusmessage(code))
 
 
 def get_stat(spath, fn):
     """stat fn if it exists, spath otherwise"""
     cl_path = os.path.join(spath, fn)
     if os.path.exists(cl_path):
         return os.stat(cl_path)
     else:
         return os.stat(spath)
 
 
 def get_mtime(spath):
     return get_stat(spath, b"00changelog.i")[stat.ST_MTIME]
 
 
 def ispathsafe(path):
     """Determine if a path is safe to use for filesystem access."""
     parts = path.split(b'/')
     for part in parts:
         if (
             part in (b'', pycompat.oscurdir, pycompat.ospardir)
             or pycompat.ossep in part
             or pycompat.osaltsep is not None
             and pycompat.osaltsep in part
         ):
             return False
 
     return True
 
 
 def staticfile(templatepath, directory, fname, res):
     """return a file inside directory with guessed Content-Type header
 
     fname always uses '/' as directory separator and isn't allowed to
     contain unusual path components.
     Content-Type is guessed using the mimetypes module.
     Return an empty string if fname is illegal or file not found.
 
     """
     if not ispathsafe(fname):
         return
 
     if not directory:
         tp = templatepath or templater.templatedir()
         if tp is not None:
             directory = os.path.join(tp, b'static')
 
     fpath = os.path.join(*fname.split(b'/'))
     ct = pycompat.sysbytes(
         mimetypes.guess_type(pycompat.fsdecode(fpath))[0] or r"text/plain"
     )
     path = os.path.join(directory, fpath)
     try:
         os.stat(path)
         with open(path, b'rb') as fh:
             data = fh.read()
     except TypeError:
         raise ErrorResponse(HTTP_SERVER_ERROR, b'illegal filename')
     except OSError as err:
         if err.errno == errno.ENOENT:
             raise ErrorResponse(HTTP_NOT_FOUND)
         else:
             raise ErrorResponse(
                 HTTP_SERVER_ERROR, encoding.strtolocal(err.strerror)
             )
 
     res.headers[b'Content-Type'] = ct
     res.setbodybytes(data)
     return res
 
 
 def paritygen(stripecount, offset=0):
     """count parity of horizontal stripes for easier reading"""
     if stripecount and offset:
         # account for offset, e.g. due to building the list in reverse
         count = (stripecount + offset) % stripecount
         parity = (stripecount + offset) // stripecount & 1
     else:
         count = 0
         parity = 0
     while True:
         yield parity
         count += 1
         if stripecount and count >= stripecount:
             parity = 1 - parity
             count = 0
 
 
 def get_contact(config):
     """Return repo contact information or empty string.
 
     web.contact is the primary source, but if that is not set, try
     ui.username or $EMAIL as a fallback to display something useful.
     """
     return (
         config(b"web", b"contact")
         or config(b"ui", b"username")
         or encoding.environ.get(b"EMAIL")
         or b""
     )
 
 
 def cspvalues(ui):
     """Obtain the Content-Security-Policy header and nonce value.
 
     Returns a 2-tuple of the CSP header value and the nonce value.
 
     First value is ``None`` if CSP isn't enabled. Second value is ``None``
     if CSP isn't enabled or if the CSP header doesn't need a nonce.
     """
     # Without demandimport, "import uuid" could have an immediate side-effect
     # running "ldconfig" on Linux trying to find libuuid.
     # With Python <= 2.7.12, that "ldconfig" is run via a shell and the shell
     # may pollute the terminal with:
     #
     #   shell-init: error retrieving current directory: getcwd: cannot access
     #   parent directories: No such file or directory
     #
     # Python >= 2.7.13 has fixed it by running "ldconfig" directly without a
     # shell (hg changeset a09ae70f3489).
     #
     # Moved "import uuid" from here so it's executed after we know we have
     # a sane cwd (i.e. after dispatch.py cwd check).
     #
     # We can move it back once we no longer need Python <= 2.7.12 support.
     import uuid
 
     # Don't allow untrusted CSP setting since it be disable protections
     # from a trusted/global source.
     csp = ui.config(b'web', b'csp', untrusted=False)
     nonce = None
 
     if csp and b'%nonce%' in csp:
         nonce = base64.urlsafe_b64encode(uuid.uuid4().bytes).rstrip(b'=')
         csp = csp.replace(b'%nonce%', nonce)
 
     return csp, nonce

mercurial/hgweb/hgweb_mod.py

@@ -1,516 +1,527 b''
 # hgweb/hgweb_mod.py - Web interface for a repository.
 #
 # Copyright 21 May 2005 - (c) 2005 Jake Edge <[e-mail]>
 # Copyright 2005-2007 Olivia Mackall <[e-mail]>
 #
 # This software may be used and distributed according to the terms of the
 # GNU General Public License version 2 or any later version.
 
 
 import contextlib
 import os
 
 from .common import (
     ErrorResponse,
     HTTP_BAD_REQUEST,
     cspvalues,
     permhooks,
     statusmessage,
 )
 from ..pycompat import getattr
 
 from .. import (
     encoding,
     error,
     extensions,
     formatter,
     hg,
     hook,
     profiling,
     pycompat,
     registrar,
     repoview,
     templatefilters,
     templater,
     templateutil,
     ui as uimod,
     util,
     wireprotoserver,
 )
 
 from . import (
+    common,
     request as requestmod,
     webcommands,
     webutil,
     wsgicgi,
 )
 
 
 def getstyle(req, configfn, templatepath):
     styles = (
         req.qsparams.get(b'style', None),
         configfn(b'web', b'style'),
         b'paper',
     )
     return styles, _stylemap(styles, templatepath)
 
 
 def _stylemap(styles, path=None):
     """Return path to mapfile for a given style.
 
     Searches mapfile in the following locations:
     1. templatepath/style/map
     2. templatepath/map-style
     3. templatepath/map
     """
 
     for style in styles:
         # only plain name is allowed to honor template paths
         if (
             not style
             or style in (pycompat.oscurdir, pycompat.ospardir)
             or pycompat.ossep in style
             or pycompat.osaltsep
             and pycompat.osaltsep in style
         ):
             continue
         locations = (os.path.join(style, b'map'), b'map-' + style, b'map')
 
         for location in locations:
             mapfile, fp = templater.try_open_template(location, path)
             if mapfile:
                 return style, mapfile, fp
 
     raise RuntimeError(b"No hgweb templates found in %r" % path)
 
 
 def makebreadcrumb(url, prefix=b''):
     """Return a 'URL breadcrumb' list
 
     A 'URL breadcrumb' is a list of URL-name pairs,
     corresponding to each of the path items on a URL.
     This can be used to create path navigation entries.
     """
     if url.endswith(b'/'):
         url = url[:-1]
     if prefix:
         url = b'/' + prefix + url
     relpath = url
     if relpath.startswith(b'/'):
         relpath = relpath[1:]
 
     breadcrumb = []
     urlel = url
     pathitems = [b''] + relpath.split(b'/')
     for pathel in reversed(pathitems):
         if not pathel or not urlel:
             break
         breadcrumb.append({b'url': urlel, b'name': pathel})
         urlel = os.path.dirname(urlel)
     return templateutil.mappinglist(reversed(breadcrumb))
 
 
 class requestcontext:
     """Holds state/context for an individual request.
 
     Servers can be multi-threaded. Holding state on the WSGI application
     is prone to race conditions. Instances of this class exist to hold
     mutable and race-free state for requests.
     """
 
     def __init__(self, app, repo, req, res):
         self.repo = repo
         self.reponame = app.reponame
         self.req = req
         self.res = res
 
+        # Only works if the filter actually support being upgraded to show
+        # visible changesets
+        current_filter = repo.filtername
+        if (
+            common.hashiddenaccess(repo, req)
+            and current_filter is not None
+            and current_filter + b'.hidden' in repoview.filtertable
+        ):
+            self.repo = self.repo.filtered(repo.filtername + b'.hidden')
+
         self.maxchanges = self.configint(b'web', b'maxchanges')
         self.stripecount = self.configint(b'web', b'stripes')
         self.maxshortchanges = self.configint(b'web', b'maxshortchanges')
         self.maxfiles = self.configint(b'web', b'maxfiles')
         self.allowpull = self.configbool(b'web', b'allow-pull')
 
         # we use untrusted=False to prevent a repo owner from using
         # web.templates in .hg/hgrc to get access to any file readable
         # by the user running the CGI script
         self.templatepath = self.config(b'web', b'templates', untrusted=False)
 
         # This object is more expensive to build than simple config values.
         # It is shared across requests. The app will replace the object
         # if it is updated. Since this is a reference and nothing should
         # modify the underlying object, it should be constant for the lifetime
         # of the request.
         self.websubtable = app.websubtable
 
         self.csp, self.nonce = cspvalues(self.repo.ui)
 
     # Trust the settings from the .hg/hgrc files by default.
     def config(self, *args, **kwargs):
         kwargs.setdefault('untrusted', True)
         return self.repo.ui.config(*args, **kwargs)
 
     def configbool(self, *args, **kwargs):
         kwargs.setdefault('untrusted', True)
         return self.repo.ui.configbool(*args, **kwargs)
 
     def configint(self, *args, **kwargs):
         kwargs.setdefault('untrusted', True)
         return self.repo.ui.configint(*args, **kwargs)
 
     def configlist(self, *args, **kwargs):
         kwargs.setdefault('untrusted', True)
         return self.repo.ui.configlist(*args, **kwargs)
 
     def archivelist(self, nodeid):
         return webutil.archivelist(self.repo.ui, nodeid)
 
     def templater(self, req):
         # determine scheme, port and server name
         # this is needed to create absolute urls
         logourl = self.config(b'web', b'logourl')
         logoimg = self.config(b'web', b'logoimg')
         staticurl = (
             self.config(b'web', b'staticurl')
             or req.apppath.rstrip(b'/') + b'/static/'
         )
         if not staticurl.endswith(b'/'):
             staticurl += b'/'
 
         # figure out which style to use
 
         vars = {}
         styles, (style, mapfile, fp) = getstyle(
             req, self.config, self.templatepath
         )
         if style == styles[0]:
             vars[b'style'] = style
 
         sessionvars = webutil.sessionvars(vars, b'?')
 
         if not self.reponame:
             self.reponame = (
                 self.config(b'web', b'name', b'')
                 or req.reponame
                 or req.apppath
                 or self.repo.root
             )
 
         filters = {}
         templatefilter = registrar.templatefilter(filters)
 
         @templatefilter(b'websub', intype=bytes)
         def websubfilter(text):
             return templatefilters.websub(text, self.websubtable)
 
         # create the templater
         # TODO: export all keywords: defaults = templatekw.keywords.copy()
         defaults = {
             b'url': req.apppath + b'/',
             b'logourl': logourl,
             b'logoimg': logoimg,
             b'staticurl': staticurl,
             b'urlbase': req.advertisedbaseurl,
             b'repo': self.reponame,
             b'encoding': encoding.encoding,
             b'sessionvars': sessionvars,
             b'pathdef': makebreadcrumb(req.apppath),
             b'style': style,
             b'nonce': self.nonce,
         }
         templatekeyword = registrar.templatekeyword(defaults)
 
         @templatekeyword(b'motd', requires=())
         def motd(context, mapping):
             yield self.config(b'web', b'motd')
 
         tres = formatter.templateresources(self.repo.ui, self.repo)
         return templater.templater.frommapfile(
             mapfile, fp=fp, filters=filters, defaults=defaults, resources=tres
         )
 
     def sendtemplate(self, name, **kwargs):
         """Helper function to send a response generated from a template."""
         if self.req.method != b'HEAD':
             kwargs = pycompat.byteskwargs(kwargs)
             self.res.setbodygen(self.tmpl.generate(name, kwargs))
         return self.res.sendresponse()
 
 
 class hgweb:
     """HTTP server for individual repositories.
 
     Instances of this class serve HTTP responses for a particular
     repository.
 
     Instances are typically used as WSGI applications.
 
     Some servers are multi-threaded. On these servers, there may
     be multiple active threads inside __call__.
     """
 
     def __init__(self, repo, name=None, baseui=None):
         if isinstance(repo, bytes):
             if baseui:
                 u = baseui.copy()
             else:
                 u = uimod.ui.load()
                 extensions.loadall(u)
                 extensions.populateui(u)
             r = hg.repository(u, repo)
         else:
             # we trust caller to give us a private copy
             r = repo
 
         r.ui.setconfig(b'ui', b'report_untrusted', b'off', b'hgweb')
         r.baseui.setconfig(b'ui', b'report_untrusted', b'off', b'hgweb')
         r.ui.setconfig(b'ui', b'nontty', b'true', b'hgweb')
         r.baseui.setconfig(b'ui', b'nontty', b'true', b'hgweb')
         # resolve file patterns relative to repo root
         r.ui.setconfig(b'ui', b'forcecwd', r.root, b'hgweb')
         r.baseui.setconfig(b'ui', b'forcecwd', r.root, b'hgweb')
         # it's unlikely that we can replace signal handlers in WSGI server,
         # and mod_wsgi issues a big warning. a plain hgweb process (with no
         # threading) could replace signal handlers, but we don't bother
         # conditionally enabling it.
         r.ui.setconfig(b'ui', b'signal-safe-lock', b'false', b'hgweb')
         r.baseui.setconfig(b'ui', b'signal-safe-lock', b'false', b'hgweb')
         # displaying bundling progress bar while serving feel wrong and may
         # break some wsgi implementation.
         r.ui.setconfig(b'progress', b'disable', b'true', b'hgweb')
         r.baseui.setconfig(b'progress', b'disable', b'true', b'hgweb')
         self._repos = [hg.cachedlocalrepo(self._webifyrepo(r))]
         self._lastrepo = self._repos[0]
         hook.redirect(True)
         self.reponame = name
 
     def _webifyrepo(self, repo):
         repo = getwebview(repo)
         self.websubtable = webutil.getwebsubs(repo)
         return repo
 
     @contextlib.contextmanager
     def _obtainrepo(self):
         """Obtain a repo unique to the caller.
 
         Internally we maintain a stack of cachedlocalrepo instances
         to be handed out. If one is available, we pop it and return it,
         ensuring it is up to date in the process. If one is not available,
         we clone the most recently used repo instance and return it.
 
         It is currently possible for the stack to grow without bounds
         if the server allows infinite threads. However, servers should
         have a thread limit, thus establishing our limit.
         """
         if self._repos:
             cached = self._repos.pop()
             r, created = cached.fetch()
         else:
             cached = self._lastrepo.copy()
             r, created = cached.fetch()
         if created:
             r = self._webifyrepo(r)
 
         self._lastrepo = cached
         self.mtime = cached.mtime
         try:
             yield r
         finally:
             self._repos.append(cached)
 
     def run(self):
         """Start a server from CGI environment.
 
         Modern servers should be using WSGI and should avoid this
         method, if possible.
         """
         if not encoding.environ.get(b'GATEWAY_INTERFACE', b'').startswith(
             b"CGI/1."
         ):
             raise RuntimeError(
                 b"This function is only intended to be "
                 b"called while running as a CGI script."
             )
         wsgicgi.launch(self)
 
     def __call__(self, env, respond):
         """Run the WSGI application.
 
         This may be called by multiple threads.
         """
         req = requestmod.parserequestfromenv(env)
         res = requestmod.wsgiresponse(req, respond)
 
         return self.run_wsgi(req, res)
 
     def run_wsgi(self, req, res):
         """Internal method to run the WSGI application.
 
         This is typically only called by Mercurial. External consumers
         should be using instances of this class as the WSGI application.
         """
         with self._obtainrepo() as repo:
             profile = repo.ui.configbool(b'profiling', b'enabled')
             with profiling.profile(repo.ui, enabled=profile):
                 for r in self._runwsgi(req, res, repo):
                     yield r
 
     def _runwsgi(self, req, res, repo):
         rctx = requestcontext(self, repo, req, res)
 
         # This state is global across all threads.
         encoding.encoding = rctx.config(b'web', b'encoding')
         rctx.repo.ui.environ = req.rawenv
 
         if rctx.csp:
             # hgwebdir may have added CSP header. Since we generate our own,
             # replace it.
             res.headers[b'Content-Security-Policy'] = rctx.csp
 
         handled = wireprotoserver.handlewsgirequest(
             rctx, req, res, self.check_perm
         )
         if handled:
             return res.sendresponse()
 
         # Old implementations of hgweb supported dispatching the request via
         # the initial query string parameter instead of using PATH_INFO.
         # If PATH_INFO is present (signaled by ``req.dispatchpath`` having
         # a value), we use it. Otherwise fall back to the query string.
         if req.dispatchpath is not None:
             query = req.dispatchpath
         else:
             query = req.querystring.partition(b'&')[0].partition(b';')[0]
 
         # translate user-visible url structure to internal structure
 
         args = query.split(b'/', 2)
         if b'cmd' not in req.qsparams and args and args[0]:
             cmd = args.pop(0)
             style = cmd.rfind(b'-')
             if style != -1:
                 req.qsparams[b'style'] = cmd[:style]
                 cmd = cmd[style + 1 :]
 
             # avoid accepting e.g. style parameter as command
             if util.safehasattr(webcommands, cmd):
                 req.qsparams[b'cmd'] = cmd
 
             if cmd == b'static':
                 req.qsparams[b'file'] = b'/'.join(args)
             else:
                 if args and args[0]:
                     node = args.pop(0).replace(b'%2F', b'/')
                     req.qsparams[b'node'] = node
                 if args:
                     if b'file' in req.qsparams:
                         del req.qsparams[b'file']
                     for a in args:
                         req.qsparams.add(b'file', a)
 
             ua = req.headers.get(b'User-Agent', b'')
             if cmd == b'rev' and b'mercurial' in ua:
                 req.qsparams[b'style'] = b'raw'
 
             if cmd == b'archive':
                 fn = req.qsparams[b'node']
                 for type_, spec in webutil.archivespecs.items():
                     ext = spec[2]
                     if fn.endswith(ext):
                         req.qsparams[b'node'] = fn[: -len(ext)]
                         req.qsparams[b'type'] = type_
         else:
             cmd = req.qsparams.get(b'cmd', b'')
 
         # process the web interface request
 
         try:
             rctx.tmpl = rctx.templater(req)
             ctype = rctx.tmpl.render(
                 b'mimetype', {b'encoding': encoding.encoding}
             )
 
             # check read permissions non-static content
             if cmd != b'static':
                 self.check_perm(rctx, req, None)
 
             if cmd == b'':
                 req.qsparams[b'cmd'] = rctx.tmpl.render(b'default', {})
                 cmd = req.qsparams[b'cmd']
 
             # Don't enable caching if using a CSP nonce because then it wouldn't
             # be a nonce.
             if rctx.configbool(b'web', b'cache') and not rctx.nonce:
                 tag = b'W/"%d"' % self.mtime
                 if req.headers.get(b'If-None-Match') == tag:
                     res.status = b'304 Not Modified'
                     # Content-Type may be defined globally. It isn't valid on a
                     # 304, so discard it.
                     try:
                         del res.headers[b'Content-Type']
                     except KeyError:
                         pass
                     # Response body not allowed on 304.
                     res.setbodybytes(b'')
                     return res.sendresponse()
 
                 res.headers[b'ETag'] = tag
 
             if cmd not in webcommands.__all__:
                 msg = b'no such method: %s' % cmd
                 raise ErrorResponse(HTTP_BAD_REQUEST, msg)
             else:
                 # Set some globals appropriate for web handlers. Commands can
                 # override easily enough.
                 res.status = b'200 Script output follows'
                 res.headers[b'Content-Type'] = ctype
                 return getattr(webcommands, cmd)(rctx)
 
         except (error.LookupError, error.RepoLookupError) as err:
             msg = pycompat.bytestr(err)
             if util.safehasattr(err, b'name') and not isinstance(
                 err, error.ManifestLookupError
             ):
                 msg = b'revision not found: %s' % err.name
 
             res.status = b'404 Not Found'
             res.headers[b'Content-Type'] = ctype
             return rctx.sendtemplate(b'error', error=msg)
         except (error.RepoError, error.StorageError) as e:
             res.status = b'500 Internal Server Error'
             res.headers[b'Content-Type'] = ctype
             return rctx.sendtemplate(b'error', error=pycompat.bytestr(e))
         except error.Abort as e:
             res.status = b'403 Forbidden'
             res.headers[b'Content-Type'] = ctype
             return rctx.sendtemplate(b'error', error=e.message)
         except ErrorResponse as e:
             for k, v in e.headers:
                 res.headers[k] = v
             res.status = statusmessage(e.code, pycompat.bytestr(e))
             res.headers[b'Content-Type'] = ctype
             return rctx.sendtemplate(b'error', error=pycompat.bytestr(e))
 
     def check_perm(self, rctx, req, op):
         for permhook in permhooks:
             permhook(rctx, req, op)
 
 
 def getwebview(repo):
     """The 'web.view' config controls changeset filter to hgweb. Possible
     values are ``served``, ``visible`` and ``all``. Default is ``served``.
     The ``served`` filter only shows changesets that can be pulled from the
     hgweb instance.  The``visible`` filter includes secret changesets but
     still excludes "hidden" one.
 
     See the repoview module for details.
 
     The option has been around undocumented since Mercurial 2.5, but no
     user ever asked about it. So we better keep it undocumented for now."""
     # experimental config: web.view
     viewconfig = repo.ui.config(b'web', b'view', untrusted=True)
     if viewconfig == b'all':
         return repo.unfiltered()
     elif viewconfig in repoview.filtertable:
         return repo.filtered(viewconfig)
     else:
         return repo.filtered(b'served')

tests/test-remote-hidden.t

@@ -1,113 +1,157 b''
 ========================================================
 Test the ability to access a hidden revision on a server
 ========================================================
 
 #require serve
 
   $ . $TESTDIR/testlib/obsmarker-common.sh
   $ cat >> $HGRCPATH << EOF
   > [phases]
   > # public changeset are not obsolete
   > publish=false
   > [experimental]
   > evolution=all
   > [ui]
   > logtemplate='{rev}:{node|short} {desc} [{phase}]\n'
   > EOF
 
 Setup a simple repository with some hidden revisions
 ----------------------------------------------------
 
 Testing the `served.hidden` view
 
   $ hg init repo-with-hidden
   $ cd repo-with-hidden
 
   $ echo 0 > a
   $ hg ci -qAm "c_Public"
   $ hg phase --public
   $ echo 1 > a
   $ hg ci -m "c_Amend_Old"
   $ echo 2 > a
   $ hg ci -m "c_Amend_New" --amend
   $ hg up ".^"
   1 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ echo 3 > a
   $ hg ci -m "c_Pruned"
   created new head
   $ hg debugobsolete --record-parents `getid 'desc("c_Pruned")'` -d '0 0'
   1 new obsolescence markers
   obsoleted 1 changesets
   $ hg up ".^"
   1 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ echo 4 > a
   $ hg ci -m "c_Secret" --secret
   created new head
   $ echo 5 > a
   $ hg ci -m "c_Secret_Pruned" --secret
   $ hg debugobsolete --record-parents `getid 'desc("c_Secret_Pruned")'` -d '0 0'
   1 new obsolescence markers
   obsoleted 1 changesets
   $ hg up null
   0 files updated, 0 files merged, 1 files removed, 0 files unresolved
 
   $ hg log -G -T '{rev}:{node|short} {desc} [{phase}]\n' --hidden
   x  5:8d28cbe335f3 c_Secret_Pruned [secret]
   |
   o  4:1c6afd79eb66 c_Secret [secret]
   |
   | x  3:5d1575e42c25 c_Pruned [draft]
   |/
   | o  2:c33affeb3f6b c_Amend_New [draft]
   |/
   | x  1:be215fbb8c50 c_Amend_Old [draft]
   |/
   o  0:5f354f46e585 c_Public [public]
   
   $ hg debugobsolete
   be215fbb8c5090028b00154c1fe877ad1b376c61 c33affeb3f6b4e9621d1839d6175ddc07708807c 0 (Thu Jan 01 00:00:00 1970 +0000) {'ef1': '9', 'operation': 'amend', 'user': 'test'}
   5d1575e42c25b7f2db75cd4e0b881b1c35158fae 0 {5f354f46e5853535841ec7a128423e991ca4d59b} (Thu Jan 01 00:00:00 1970 +0000) {'user': 'test'}
   8d28cbe335f311bc89332d7bbe8a07889b6914a0 0 {1c6afd79eb6663275bbe30097e162b1c24ced0f0} (Thu Jan 01 00:00:00 1970 +0000) {'user': 'test'}
 
   $ cd ..
 
 Test the feature
 ================
 
 Check cache pre-warm
 --------------------
 
   $ ls -1 repo-with-hidden/.hg/cache
   branch2
   branch2-base
   branch2-served
   branch2-served.hidden
   branch2-visible
   rbc-names-v1
   rbc-revs-v1
   tags2
   tags2-visible
 
 Check that the `served.hidden` repoview
 ---------------------------------------
 
   $ hg -R repo-with-hidden serve -p $HGPORT -d --pid-file hg.pid --config web.view=served.hidden
   $ cat hg.pid >> $DAEMON_PIDS
 
 changesets in secret and higher phases are not visible through hgweb
 
   $ hg -R repo-with-hidden log --template "revision:    {rev}\\n" --rev "reverse(not secret())"
   revision:    2
   revision:    0
   $ hg -R repo-with-hidden log --template "revision:    {rev}\\n" --rev "reverse(not secret())" --hidden
   revision:    3
   revision:    2
   revision:    1
   revision:    0
   $ get-with-headers.py localhost:$HGPORT 'log?style=raw' | grep revision:
   revision:    3
   revision:    2
   revision:    1
   revision:    0
 
   $ killdaemons.py
+
+Test accessing hidden changeset through hgweb
+---------------------------------------------
+
+  $ hg -R repo-with-hidden serve -p $HGPORT -d --pid-file hg.pid --config "experimental.server.allow-hidden-access=*" -E error.log --accesslog access.log
+  $ cat hg.pid >> $DAEMON_PIDS
+
+Hidden changeset are hidden by default:
+
+  $ get-with-headers.py localhost:$HGPORT 'log?style=raw' | grep revision:
+  revision:    2
+  revision:    0
+
+Hidden changeset are visible when requested:
+
+  $ get-with-headers.py localhost:$HGPORT 'log?style=raw&access-hidden=1' | grep revision:
+  revision:    3
+  revision:    2
+  revision:    1
+  revision:    0
+
+Same check on a server that do not allow hidden access:
+```````````````````````````````````````````````````````
+
+  $ hg -R repo-with-hidden serve -p $HGPORT1 -d --pid-file hg2.pid --config "experimental.server.allow-hidden-access=" -E error.log --accesslog access.log
+  $ cat hg2.pid >> $DAEMON_PIDS
+
+Hidden changeset are hidden by default:
+
+  $ get-with-headers.py localhost:$HGPORT1 'log?style=raw' | grep revision:
+  revision:    2
+  revision:    0
+
+Hidden changeset are still hidden despite being the hidden access request:
+
+  $ get-with-headers.py localhost:$HGPORT1 'log?style=raw&access-hidden=1' | grep revision:
+  revision:    2
+  revision:    0
+
+=============
+Final cleanup
+=============
+
+  $ killdaemons.py