acl: add bookmarks support

Originally submitted at
https://www.mercurial-scm.org/pipermail/mercurial-devel/2016-March/080650.html
as an RFC by timeless.

.. feature::

  The `acl` extension now has support for bookmarks as well as branches.

Differential Revision: https://phab.mercurial-scm.org/D3750

hgext/acl.py

@@ -1,380 +1,427
 # acl.py - changeset access control for mercurial
 #
 # Copyright 2006 Vadim Gelfer <[e-mail]>
 #
 # This software may be used and distributed according to the terms of the
 # GNU General Public License version 2 or any later version.
 
 '''hooks for controlling repository access
 
 This hook makes it possible to allow or deny write access to given
 branches and paths of a repository when receiving incoming changesets
 via pretxnchangegroup and pretxncommit.
 
 The authorization is matched based on the local user name on the
 system where the hook runs, and not the committer of the original
 changeset (since the latter is merely informative).
 
 The acl hook is best used along with a restricted shell like hgsh,
 preventing authenticating users from doing anything other than pushing
 or pulling. The hook is not safe to use if users have interactive
 shell access, as they can then disable the hook. Nor is it safe if
 remote users share an account, because then there is no way to
 distinguish them.
 
 The order in which access checks are performed is:
 
 1) Deny  list for branches (section ``acl.deny.branches``)
 2) Allow list for branches (section ``acl.allow.branches``)
 3) Deny  list for paths    (section ``acl.deny``)
 4) Allow list for paths    (section ``acl.allow``)
 
 The allow and deny sections take key-value pairs.
 
 Branch-based Access Control
 ---------------------------
 
 Use the ``acl.deny.branches`` and ``acl.allow.branches`` sections to
 have branch-based access control. Keys in these sections can be
 either:
 
 - a branch name, or
 - an asterisk, to match any branch;
 
 The corresponding values can be either:
 
 - a comma-separated list containing users and groups, or
 - an asterisk, to match anyone;
 
 You can add the "!" prefix to a user or group name to invert the sense
 of the match.
 
 Path-based Access Control
 -------------------------
 
 Use the ``acl.deny`` and ``acl.allow`` sections to have path-based
 access control. Keys in these sections accept a subtree pattern (with
 a glob syntax by default). The corresponding values follow the same
 syntax as the other sections above.
 
+Bookmark-based Access Control
+-----------------------------
+Use the ``acl.deny.bookmarks`` and ``acl.allow.bookmarks`` sections to
+have bookmark-based access control. Keys in these sections can be
+either:
+
+- a bookmark name, or
+- an asterisk, to match any bookmark;
+
+The corresponding values can be either:
+
+- a comma-separated list containing users and groups, or
+- an asterisk, to match anyone;
+
+You can add the "!" prefix to a user or group name to invert the sense
+of the match.
+
+Note: for interactions between clients and servers using Mercurial 3.6+
+a rejection will generally reject the entire push, for interactions
+involving older clients, the commit transactions will already be accepted,
+and only the bookmark movement will be rejected.
+
 Groups
 ------
 
 Group names must be prefixed with an ``@`` symbol. Specifying a group
 name has the same effect as specifying all the users in that group.
 
 You can define group members in the ``acl.groups`` section.
 If a group name is not defined there, and Mercurial is running under
 a Unix-like system, the list of users will be taken from the OS.
 Otherwise, an exception will be raised.
 
 Example Configuration
 ---------------------
 
 ::
 
   [hooks]
 
   # Use this if you want to check access restrictions at commit time
   pretxncommit.acl = python:hgext.acl.hook
 
   # Use this if you want to check access restrictions for pull, push,
   # bundle and serve.
   pretxnchangegroup.acl = python:hgext.acl.hook
 
   [acl]
   # Allow or deny access for incoming changes only if their source is
   # listed here, let them pass otherwise. Source is "serve" for all
   # remote access (http or ssh), "push", "pull" or "bundle" when the
   # related commands are run locally.
   # Default: serve
   sources = serve
 
   [acl.deny.branches]
 
   # Everyone is denied to the frozen branch:
   frozen-branch = *
 
   # A bad user is denied on all branches:
   * = bad-user
 
   [acl.allow.branches]
 
   # A few users are allowed on branch-a:
   branch-a = user-1, user-2, user-3
 
   # Only one user is allowed on branch-b:
   branch-b = user-1
 
   # The super user is allowed on any branch:
   * = super-user
 
   # Everyone is allowed on branch-for-tests:
   branch-for-tests = *
 
   [acl.deny]
   # This list is checked first. If a match is found, acl.allow is not
   # checked. All users are granted access if acl.deny is not present.
   # Format for both lists: glob pattern = user, ..., @group, ...
 
   # To match everyone, use an asterisk for the user:
   # my/glob/pattern = *
 
   # user6 will not have write access to any file:
   ** = user6
 
   # Group "hg-denied" will not have write access to any file:
   ** = @hg-denied
 
   # Nobody will be able to change "DONT-TOUCH-THIS.txt", despite
   # everyone being able to change all other files. See below.
   src/main/resources/DONT-TOUCH-THIS.txt = *
 
   [acl.allow]
   # if acl.allow is not present, all users are allowed by default
   # empty acl.allow = no users allowed
 
   # User "doc_writer" has write access to any file under the "docs"
   # folder:
   docs/** = doc_writer
 
   # User "jack" and group "designers" have write access to any file
   # under the "images" folder:
   images/** = jack, @designers
 
   # Everyone (except for "user6" and "@hg-denied" - see acl.deny above)
   # will have write access to any file under the "resources" folder
   # (except for 1 file. See acl.deny):
   src/main/resources/** = *
 
   .hgtags = release_engineer
 
 Examples using the "!" prefix
 .............................
 
 Suppose there's a branch that only a given user (or group) should be able to
 push to, and you don't want to restrict access to any other branch that may
 be created.
 
 The "!" prefix allows you to prevent anyone except a given user or group to
 push changesets in a given branch or path.
 
 In the examples below, we will:
 1) Deny access to branch "ring" to anyone but user "gollum"
 2) Deny access to branch "lake" to anyone but members of the group "hobbit"
 3) Deny access to a file to anyone but user "gollum"
 
 ::
 
   [acl.allow.branches]
   # Empty
 
   [acl.deny.branches]
 
   # 1) only 'gollum' can commit to branch 'ring';
   # 'gollum' and anyone else can still commit to any other branch.
   ring = !gollum
 
   # 2) only members of the group 'hobbit' can commit to branch 'lake';
   # 'hobbit' members and anyone else can still commit to any other branch.
   lake = !@hobbit
 
   # You can also deny access based on file paths:
 
   [acl.allow]
   # Empty
 
   [acl.deny]
   # 3) only 'gollum' can change the file below;
   # 'gollum' and anyone else can still change any other file.
   /misty/mountains/cave/ring = !gollum
 
 '''
 
 from __future__ import absolute_import
 
 from mercurial.i18n import _
 from mercurial import (
     error,
     extensions,
     match,
     registrar,
     util,
 )
 from mercurial.utils import (
     procutil,
 )
 
 urlreq = util.urlreq
 
 # Note for extension authors: ONLY specify testedwith = 'ships-with-hg-core' for
 # extensions which SHIP WITH MERCURIAL. Non-mainline extensions should
 # be specifying the version(s) of Mercurial they are tested with, or
 # leave the attribute unspecified.
 testedwith = 'ships-with-hg-core'
 
 configtable = {}
 configitem = registrar.configitem(configtable)
 
 # deprecated config: acl.config
 configitem('acl', 'config',
     default=None,
 )
 configitem('acl.groups', '.*',
     default=None,
     generic=True,
 )
 configitem('acl.deny.branches', '.*',
     default=None,
     generic=True,
 )
 configitem('acl.allow.branches', '.*',
     default=None,
     generic=True,
 )
 configitem('acl.deny', '.*',
     default=None,
     generic=True,
 )
 configitem('acl.allow', '.*',
     default=None,
     generic=True,
 )
 configitem('acl', 'sources',
     default=lambda: ['serve'],
 )
 
 def _getusers(ui, group):
 
     # First, try to use group definition from section [acl.groups]
     hgrcusers = ui.configlist('acl.groups', group)
     if hgrcusers:
         return hgrcusers
 
     ui.debug('acl: "%s" not defined in [acl.groups]\n' % group)
     # If no users found in group definition, get users from OS-level group
     try:
         return util.groupmembers(group)
     except KeyError:
         raise error.Abort(_("group '%s' is undefined") % group)
 
 def _usermatch(ui, user, usersorgroups):
 
     if usersorgroups == '*':
         return True
 
     for ug in usersorgroups.replace(',', ' ').split():
 
         if ug.startswith('!'):
             # Test for excluded user or group. Format:
             # if ug is a user  name: !username
             # if ug is a group name: !@groupname
             ug = ug[1:]
             if not ug.startswith('@') and user != ug \
                 or ug.startswith('@') and user not in _getusers(ui, ug[1:]):
                 return True
 
         # Test for user or group. Format:
         # if ug is a user  name: username
         # if ug is a group name: @groupname
         elif user == ug \
              or ug.startswith('@') and user in _getusers(ui, ug[1:]):
             return True
 
     return False
 
 def buildmatch(ui, repo, user, key):
     '''return tuple of (match function, list enabled).'''
     if not ui.has_section(key):
         ui.debug('acl: %s not enabled\n' % key)
         return None
 
     pats = [pat for pat, users in ui.configitems(key)
             if _usermatch(ui, user, users)]
     ui.debug('acl: %s enabled, %d entries for user %s\n' %
              (key, len(pats), user))
 
     # Branch-based ACL
     if not repo:
         if pats:
             # If there's an asterisk (meaning "any branch"), always return True;
             # Otherwise, test if b is in pats
             if '*' in pats:
                 return util.always
             return lambda b: b in pats
         return util.never
 
     # Path-based ACL
     if pats:
         return match.match(repo.root, '', pats)
     return util.never
 
 def ensureenabled(ui):
     """make sure the extension is enabled when used as hook
 
     When acl is used through hooks, the extension is never formally loaded and
     enabled. This has some side effect, for example the config declaration is
     never loaded. This function ensure the extension is enabled when running
     hooks.
     """
     if 'acl' in ui._knownconfig:
         return
     ui.setconfig('extensions', 'acl', '', source='internal')
     extensions.loadall(ui, ['acl'])
 
 def hook(ui, repo, hooktype, node=None, source=None, **kwargs):
 
     ensureenabled(ui)
 
-    if hooktype not in ['pretxnchangegroup', 'pretxncommit']:
-        raise error.Abort(_('config error - hook type "%s" cannot stop '
-                           'incoming changesets nor commits') % hooktype)
+    if hooktype not in ['pretxnchangegroup', 'pretxncommit', 'prepushkey']:
+        raise error.Abort(
+            _('config error - hook type "%s" cannot stop '
+              'incoming changesets, commits, nor bookmarks') % hooktype)
     if (hooktype == 'pretxnchangegroup' and
         source not in ui.configlist('acl', 'sources')):
         ui.debug('acl: changes have source "%s" - skipping\n' % source)
         return
 
     user = None
     if source == 'serve' and r'url' in kwargs:
         url = kwargs[r'url'].split(':')
         if url[0] == 'remote' and url[1].startswith('http'):
             user = urlreq.unquote(url[3])
 
     if user is None:
         user = procutil.getuser()
 
     ui.debug('acl: checking access for user "%s"\n' % user)
 
+    if hooktype == 'prepushkey':
+        _pkhook(ui, repo, hooktype, node, source, user, **kwargs)
+    else:
+        _txnhook(ui, repo, hooktype, node, source, user, **kwargs)
+
+def _pkhook(ui, repo, hooktype, node, source, user, **kwargs):
+    if kwargs['namespace'] == 'bookmarks':
+        bookmark = kwargs['key']
+        ctx = kwargs['new']
+        allowbookmarks = buildmatch(ui, None, user, 'acl.allow.bookmarks')
+        denybookmarks = buildmatch(ui, None, user, 'acl.deny.bookmarks')
+
+        if denybookmarks and denybookmarks(bookmark):
+            raise error.Abort(_('acl: user "%s" denied on bookmark "%s"'
+                               ' (changeset "%s")')
+                               % (user, bookmark, ctx))
+        if allowbookmarks and not allowbookmarks(bookmark):
+            raise error.Abort(_('acl: user "%s" not allowed on bookmark "%s"'
+                               ' (changeset "%s")')
+                               % (user, bookmark, ctx))
+        ui.debug('acl: bookmark access granted: "%s" on bookmark "%s"\n'
+                 % (ctx, bookmark))
+
+def _txnhook(ui, repo, hooktype, node, source, user, **kwargs):
     # deprecated config: acl.config
     cfg = ui.config('acl', 'config')
     if cfg:
         ui.readconfig(cfg, sections=['acl.groups', 'acl.allow.branches',
             'acl.deny.branches', 'acl.allow', 'acl.deny'])
 
     allowbranches = buildmatch(ui, None, user, 'acl.allow.branches')
     denybranches = buildmatch(ui, None, user, 'acl.deny.branches')
     allow = buildmatch(ui, repo, user, 'acl.allow')
     deny = buildmatch(ui, repo, user, 'acl.deny')
 
     for rev in xrange(repo[node].rev(), len(repo)):
         ctx = repo[rev]
         branch = ctx.branch()
         if denybranches and denybranches(branch):
             raise error.Abort(_('acl: user "%s" denied on branch "%s"'
                                ' (changeset "%s")')
                                % (user, branch, ctx))
         if allowbranches and not allowbranches(branch):
             raise error.Abort(_('acl: user "%s" not allowed on branch "%s"'
                                ' (changeset "%s")')
                                % (user, branch, ctx))
         ui.debug('acl: branch access granted: "%s" on branch "%s"\n'
         % (ctx, branch))
 
         for f in ctx.files():
             if deny and deny(f):
                 raise error.Abort(_('acl: user "%s" denied on "%s"'
                 ' (changeset "%s")') % (user, f, ctx))
             if allow and not allow(f):
                 raise error.Abort(_('acl: user "%s" not allowed on "%s"'
                 ' (changeset "%s")') % (user, f, ctx))
         ui.debug('acl: path access granted: "%s"\n' % ctx)

tests/test-acl.t

@@ -1,2211 +1,2411
   > do_push()
   > {
   >     user=$1
   >     shift
   >     echo "Pushing as user $user"
   >     echo 'hgrc = """'
   >     sed -n '/\[[ha]/,$p' b/.hg/hgrc | grep -v fakegroups.py
   >     echo '"""'
   >     if test -f acl.config; then
   >         echo 'acl.config = """'
   >         cat acl.config
   >         echo '"""'
   >     fi
   >     # On AIX /etc/profile sets LOGNAME read-only. So
   >     #  LOGNAME=$user hg --cws a --debug push ../b
   >     # fails with "This variable is read only."
   >     # Use env to work around this.
-  >     env LOGNAME=$user hg --cwd a --debug push ../b
+  >     env LOGNAME=$user hg --cwd a --debug push ../b $*
   >     hg --cwd b rollback
   >     hg --cwd b --quiet tip
   >     echo
   > }
 
   > cat > posixgetuser.py <<'EOF'
   > import getpass
   > from mercurial import pycompat
   > from mercurial.utils import procutil
   > def posixgetuser():
   >     return pycompat.fsencode(getpass.getuser())
   > if not pycompat.isposix:
   >     procutil.getuser = posixgetuser  # forcibly trust $LOGNAME
   > EOF
 
   > init_config()
   > {
   >     cat > fakegroups.py <<EOF
   > from hgext import acl
   > def fakegetusers(ui, group):
   >     try:
   >         return acl._getusersorig(ui, group)
   >     except:
   >         return ["fred", "betty"]
   > acl._getusersorig = acl._getusers
   > acl._getusers = fakegetusers
   > EOF
   >     rm -f acl.config
   >     cat > $config <<EOF
   > [hooks]
   > pretxnchangegroup.acl = python:hgext.acl.hook
+  > prepushkey.acl = python:hgext.acl.hook
   > [acl]
   > sources = push
   > [extensions]
   > f=`pwd`/fakegroups.py
   > posixgetuser=$TESTTMP/posixgetuser.py
   > EOF
   > }
 
   $ hg init a
   $ cd a
   $ mkdir foo foo/Bar quux
   $ echo 'in foo' > foo/file.txt
   $ echo 'in foo/Bar' > foo/Bar/file.txt
   $ echo 'in quux' > quux/file.py
   $ hg add -q
   $ hg ci -m 'add files' -d '1000000 0'
   $ echo >> foo/file.txt
   $ hg ci -m 'change foo/file' -d '1000001 0'
   $ echo >> foo/Bar/file.txt
   $ hg ci -m 'change foo/Bar/file' -d '1000002 0'
   $ echo >> quux/file.py
   $ hg ci -m 'change quux/file' -d '1000003 0'
   $ hg tip --quiet
   3:911600dab2ae
 
   $ cd ..
   $ hg clone -r 0 a b
   adding changesets
   adding manifests
   adding file changes
   added 1 changesets with 3 changes to 3 files
   new changesets 6675d58eff77
   updating to branch default
   3 files updated, 0 files merged, 0 files removed, 0 files unresolved
 
   $ config=b/.hg/hgrc
   $ cat >> "$config" <<EOF
   > [extensions]
   > posixgetuser=$TESTTMP/posixgetuser.py
   > EOF
 
 Extension disabled for lack of a hook
 
   $ do_push fred
   Pushing as user fred
   hgrc = """
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 24 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 24 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 24
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   adding manifests
   adding file changes
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 3 changesets with 3 changes to 3 files
   bundle2-input-part: total payload size 1553
   bundle2-input-part: "phase-heads" supported
   bundle2-input-part: total payload size 24
   bundle2-input-bundle: 4 parts total
   updating the branch cache
   bundle2-output-bundle: "HG20", 1 parts total
   bundle2-output-part: "reply:changegroup" (advisory) (params: 0 advisory) empty payload
   bundle2-input-bundle: no-transaction
   bundle2-input-part: "reply:changegroup" (advisory) (params: 0 advisory) supported
   bundle2-input-bundle: 0 parts total
   listing keys for "phases"
   repository tip rolled back to revision 0 (undo push)
   0:6675d58eff77
   
 
   $ echo '[hooks]' >> $config
   $ echo 'pretxnchangegroup.acl = python:hgext.acl.hook' >> $config
+  $ echo 'prepushkey.acl = python:hgext.acl.hook' >> $config
 
 Extension disabled for lack of acl.sources
 
   $ do_push fred
   Pushing as user fred
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 24 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 24 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 24
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   adding manifests
   adding file changes
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: changes have source "push" - skipping
   bundle2-input-part: total payload size 1553
   bundle2-input-part: "phase-heads" supported
   bundle2-input-part: total payload size 24
   bundle2-input-bundle: 4 parts total
   updating the branch cache
   bundle2-output-bundle: "HG20", 1 parts total
   bundle2-output-part: "reply:changegroup" (advisory) (params: 0 advisory) empty payload
   bundle2-input-bundle: no-transaction
   bundle2-input-part: "reply:changegroup" (advisory) (params: 0 advisory) supported
   bundle2-input-bundle: 0 parts total
   listing keys for "phases"
   repository tip rolled back to revision 0 (undo push)
   0:6675d58eff77
   
 
 No [acl.allow]/[acl.deny]
 
   $ echo '[acl]' >> $config
   $ echo 'sources = push' >> $config
   $ do_push fred
   Pushing as user fred
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   [acl]
   sources = push
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 24 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 24 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 24
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   adding manifests
   adding file changes
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "fred"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow not enabled
   acl: acl.deny not enabled
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   acl: path access granted: "911600dab2ae"
   bundle2-input-part: total payload size 1553
   bundle2-input-part: "phase-heads" supported
   bundle2-input-part: total payload size 24
   bundle2-input-bundle: 4 parts total
   updating the branch cache
   bundle2-output-bundle: "HG20", 1 parts total
   bundle2-output-part: "reply:changegroup" (advisory) (params: 0 advisory) empty payload
   bundle2-input-bundle: no-transaction
   bundle2-input-part: "reply:changegroup" (advisory) (params: 0 advisory) supported
   bundle2-input-bundle: 0 parts total
   listing keys for "phases"
   repository tip rolled back to revision 0 (undo push)
   0:6675d58eff77
   
 
 Empty [acl.allow]
 
   $ echo '[acl.allow]' >> $config
   $ do_push fred
   Pushing as user fred
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [acl.allow]
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 24 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 24 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 24
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   adding manifests
   adding file changes
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "fred"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow enabled, 0 entries for user fred
   acl: acl.deny not enabled
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   error: pretxnchangegroup.acl hook failed: acl: user "fred" not allowed on "foo/file.txt" (changeset "ef1ea85a6374")
   bundle2-input-part: total payload size 1553
   bundle2-input-part: total payload size 24
   bundle2-input-bundle: 4 parts total
   transaction abort!
   rollback completed
   abort: acl: user "fred" not allowed on "foo/file.txt" (changeset "ef1ea85a6374")
   no rollback information available
   0:6675d58eff77
   
 
 fred is allowed inside foo/
 
   $ echo 'foo/** = fred' >> $config
   $ do_push fred
   Pushing as user fred
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [acl.allow]
   foo/** = fred
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 24 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 24 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 24
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   adding manifests
   adding file changes
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "fred"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow enabled, 1 entries for user fred
   acl: acl.deny not enabled
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   error: pretxnchangegroup.acl hook failed: acl: user "fred" not allowed on "quux/file.py" (changeset "911600dab2ae")
   bundle2-input-part: total payload size 1553
   bundle2-input-part: total payload size 24
   bundle2-input-bundle: 4 parts total
   transaction abort!
   rollback completed
   abort: acl: user "fred" not allowed on "quux/file.py" (changeset "911600dab2ae")
   no rollback information available
   0:6675d58eff77
   
 
 Empty [acl.deny]
 
   $ echo '[acl.deny]' >> $config
   $ do_push barney
   Pushing as user barney
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [acl.allow]
   foo/** = fred
   [acl.deny]
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 24 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 24 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 24
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   adding manifests
   adding file changes
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "barney"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow enabled, 0 entries for user barney
   acl: acl.deny enabled, 0 entries for user barney
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   error: pretxnchangegroup.acl hook failed: acl: user "barney" not allowed on "foo/file.txt" (changeset "ef1ea85a6374")
   bundle2-input-part: total payload size 1553
   bundle2-input-part: total payload size 24
   bundle2-input-bundle: 4 parts total
   transaction abort!
   rollback completed
   abort: acl: user "barney" not allowed on "foo/file.txt" (changeset "ef1ea85a6374")
   no rollback information available
   0:6675d58eff77
   
 
 fred is allowed inside foo/, but not foo/bar/ (case matters)
 
   $ echo 'foo/bar/** = fred' >> $config
   $ do_push fred
   Pushing as user fred
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [acl.allow]
   foo/** = fred
   [acl.deny]
   foo/bar/** = fred
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 24 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 24 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 24
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   adding manifests
   adding file changes
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "fred"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow enabled, 1 entries for user fred
   acl: acl.deny enabled, 1 entries for user fred
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   error: pretxnchangegroup.acl hook failed: acl: user "fred" not allowed on "quux/file.py" (changeset "911600dab2ae")
   bundle2-input-part: total payload size 1553
   bundle2-input-part: total payload size 24
   bundle2-input-bundle: 4 parts total
   transaction abort!
   rollback completed
   abort: acl: user "fred" not allowed on "quux/file.py" (changeset "911600dab2ae")
   no rollback information available
   0:6675d58eff77
   
 
 fred is allowed inside foo/, but not foo/Bar/
 
   $ echo 'foo/Bar/** = fred' >> $config
   $ do_push fred
   Pushing as user fred
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [acl.allow]
   foo/** = fred
   [acl.deny]
   foo/bar/** = fred
   foo/Bar/** = fred
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 24 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 24 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 24
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   adding manifests
   adding file changes
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "fred"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow enabled, 1 entries for user fred
   acl: acl.deny enabled, 2 entries for user fred
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   error: pretxnchangegroup.acl hook failed: acl: user "fred" denied on "foo/Bar/file.txt" (changeset "f9cafe1212c8")
   bundle2-input-part: total payload size 1553
   bundle2-input-part: total payload size 24
   bundle2-input-bundle: 4 parts total
   transaction abort!
   rollback completed
   abort: acl: user "fred" denied on "foo/Bar/file.txt" (changeset "f9cafe1212c8")
   no rollback information available
   0:6675d58eff77
   
 
   $ echo 'barney is not mentioned => not allowed anywhere'
   barney is not mentioned => not allowed anywhere
   $ do_push barney
   Pushing as user barney
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [acl.allow]
   foo/** = fred
   [acl.deny]
   foo/bar/** = fred
   foo/Bar/** = fred
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 24 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 24 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 24
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   adding manifests
   adding file changes
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "barney"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow enabled, 0 entries for user barney
   acl: acl.deny enabled, 0 entries for user barney
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   error: pretxnchangegroup.acl hook failed: acl: user "barney" not allowed on "foo/file.txt" (changeset "ef1ea85a6374")
   bundle2-input-part: total payload size 1553
   bundle2-input-part: total payload size 24
   bundle2-input-bundle: 4 parts total
   transaction abort!
   rollback completed
   abort: acl: user "barney" not allowed on "foo/file.txt" (changeset "ef1ea85a6374")
   no rollback information available
   0:6675d58eff77
   
 
+fred is not blocked from moving bookmarks
+
+  $ hg -R a book -q moving-bookmark -r 1
+  $ hg -R b book -q moving-bookmark -r 0
+  $ cp $config normalconfig
+  $ do_push fred -r 1
+  Pushing as user fred
+  hgrc = """
+  [hooks]
+  pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
+  [acl]
+  sources = push
+  [acl.allow]
+  foo/** = fred
+  [acl.deny]
+  foo/bar/** = fred
+  foo/Bar/** = fred
+  """
+  pushing to ../b
+  query 1; heads
+  searching for changes
+  all remote heads known locally
+  listing keys for "phases"
+  checking for updated bookmarks
+  listing keys for "bookmarks"
+  listing keys for "bookmarks"
+  1 changesets found
+  list of changesets:
+  ef1ea85a6374b77d6da9dcda9541f498f2d17df7
+  bundle2-output-bundle: "HG20", 7 parts total
+  bundle2-output-part: "replycaps" 205 bytes payload
+  bundle2-output-part: "check:bookmarks" 37 bytes payload
+  bundle2-output-part: "check:phases" 24 bytes payload
+  bundle2-output-part: "check:heads" streamed payload
+  bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
+  bundle2-output-part: "phase-heads" 24 bytes payload
+  bundle2-output-part: "bookmarks" 37 bytes payload
+  bundle2-input-bundle: with-transaction
+  bundle2-input-part: "replycaps" supported
+  bundle2-input-part: total payload size 205
+  bundle2-input-part: "check:bookmarks" supported
+  bundle2-input-part: total payload size 37
+  bundle2-input-part: "check:phases" supported
+  bundle2-input-part: total payload size 24
+  bundle2-input-part: "check:heads" supported
+  bundle2-input-part: total payload size 20
+  bundle2-input-part: "changegroup" (params: 1 mandatory) supported
+  adding changesets
+  add changeset ef1ea85a6374
+  adding manifests
+  adding file changes
+  adding foo/file.txt revisions
+  added 1 changesets with 1 changes to 1 files
+  calling hook pretxnchangegroup.acl: hgext.acl.hook
+  acl: checking access for user "fred"
+  acl: acl.allow.branches not enabled
+  acl: acl.deny.branches not enabled
+  acl: acl.allow enabled, 1 entries for user fred
+  acl: acl.deny enabled, 2 entries for user fred
+  acl: branch access granted: "ef1ea85a6374" on branch "default"
+  acl: path access granted: "ef1ea85a6374"
+  bundle2-input-part: total payload size 520
+  bundle2-input-part: "phase-heads" supported
+  bundle2-input-part: total payload size 24
+  bundle2-input-part: "bookmarks" supported
+  bundle2-input-part: total payload size 37
+  calling hook prepushkey.acl: hgext.acl.hook
+  acl: checking access for user "fred"
+  acl: acl.allow.bookmarks not enabled
+  acl: acl.deny.bookmarks not enabled
+  acl: bookmark access granted: "ef1ea85a6374b77d6da9dcda9541f498f2d17df7" on bookmark "moving-bookmark"
+  bundle2-input-bundle: 6 parts total
+  updating the branch cache
+  bundle2-output-bundle: "HG20", 1 parts total
+  bundle2-output-part: "reply:changegroup" (advisory) (params: 0 advisory) empty payload
+  bundle2-input-bundle: no-transaction
+  bundle2-input-part: "reply:changegroup" (advisory) (params: 0 advisory) supported
+  bundle2-input-bundle: 0 parts total
+  updating bookmark moving-bookmark
+  listing keys for "phases"
+  repository tip rolled back to revision 0 (undo push)
+  0:6675d58eff77
+  
+
+fred is not allowed to move bookmarks
+
+  $ echo '[acl.deny.bookmarks]' >> $config
+  $ echo '* = fred' >> $config
+  $ do_push fred -r 1
+  Pushing as user fred
+  hgrc = """
+  [hooks]
+  pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
+  [acl]
+  sources = push
+  [acl.allow]
+  foo/** = fred
+  [acl.deny]
+  foo/bar/** = fred
+  foo/Bar/** = fred
+  [acl.deny.bookmarks]
+  * = fred
+  """
+  pushing to ../b
+  query 1; heads
+  searching for changes
+  all remote heads known locally
+  listing keys for "phases"
+  checking for updated bookmarks
+  listing keys for "bookmarks"
+  listing keys for "bookmarks"
+  1 changesets found
+  list of changesets:
+  ef1ea85a6374b77d6da9dcda9541f498f2d17df7
+  bundle2-output-bundle: "HG20", 7 parts total
+  bundle2-output-part: "replycaps" 205 bytes payload
+  bundle2-output-part: "check:bookmarks" 37 bytes payload
+  bundle2-output-part: "check:phases" 24 bytes payload
+  bundle2-output-part: "check:heads" streamed payload
+  bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
+  bundle2-output-part: "phase-heads" 24 bytes payload
+  bundle2-output-part: "bookmarks" 37 bytes payload
+  bundle2-input-bundle: with-transaction
+  bundle2-input-part: "replycaps" supported
+  bundle2-input-part: total payload size 205
+  bundle2-input-part: "check:bookmarks" supported
+  bundle2-input-part: total payload size 37
+  bundle2-input-part: "check:phases" supported
+  bundle2-input-part: total payload size 24
+  bundle2-input-part: "check:heads" supported
+  bundle2-input-part: total payload size 20
+  bundle2-input-part: "changegroup" (params: 1 mandatory) supported
+  adding changesets
+  add changeset ef1ea85a6374
+  adding manifests
+  adding file changes
+  adding foo/file.txt revisions
+  added 1 changesets with 1 changes to 1 files
+  calling hook pretxnchangegroup.acl: hgext.acl.hook
+  acl: checking access for user "fred"
+  acl: acl.allow.branches not enabled
+  acl: acl.deny.branches not enabled
+  acl: acl.allow enabled, 1 entries for user fred
+  acl: acl.deny enabled, 2 entries for user fred
+  acl: branch access granted: "ef1ea85a6374" on branch "default"
+  acl: path access granted: "ef1ea85a6374"
+  bundle2-input-part: total payload size 520
+  bundle2-input-part: "phase-heads" supported
+  bundle2-input-part: total payload size 24
+  bundle2-input-part: "bookmarks" supported
+  bundle2-input-part: total payload size 37
+  calling hook prepushkey.acl: hgext.acl.hook
+  acl: checking access for user "fred"
+  acl: acl.allow.bookmarks not enabled
+  acl: acl.deny.bookmarks enabled, 1 entries for user fred
+  error: prepushkey.acl hook failed: acl: user "fred" denied on bookmark "moving-bookmark" (changeset "ef1ea85a6374b77d6da9dcda9541f498f2d17df7")
+  bundle2-input-bundle: 6 parts total
+  transaction abort!
+  rollback completed
+  abort: acl: user "fred" denied on bookmark "moving-bookmark" (changeset "ef1ea85a6374b77d6da9dcda9541f498f2d17df7")
+  no rollback information available
+  0:6675d58eff77
+  
+
+cleanup bookmark stuff
+
+  $ hg book -R a -d moving-bookmark
+  $ hg book -R b -d moving-bookmark
+  $ cp normalconfig $config
+
 barney is allowed everywhere
 
   $ echo '[acl.allow]' >> $config
   $ echo '** = barney' >> $config
   $ do_push barney
   Pushing as user barney
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [acl.allow]
   foo/** = fred
   [acl.deny]
   foo/bar/** = fred
   foo/Bar/** = fred
   [acl.allow]
   ** = barney
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 24 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 24 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 24
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   adding manifests
   adding file changes
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "barney"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow enabled, 1 entries for user barney
   acl: acl.deny enabled, 0 entries for user barney
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   acl: path access granted: "911600dab2ae"
   bundle2-input-part: total payload size 1553
   bundle2-input-part: "phase-heads" supported
   bundle2-input-part: total payload size 24
   bundle2-input-bundle: 4 parts total
   updating the branch cache
   bundle2-output-bundle: "HG20", 1 parts total
   bundle2-output-part: "reply:changegroup" (advisory) (params: 0 advisory) empty payload
   bundle2-input-bundle: no-transaction
   bundle2-input-part: "reply:changegroup" (advisory) (params: 0 advisory) supported
   bundle2-input-bundle: 0 parts total
   listing keys for "phases"
   repository tip rolled back to revision 0 (undo push)
   0:6675d58eff77
   
 
 wilma can change files with a .txt extension
 
   $ echo '**/*.txt = wilma' >> $config
   $ do_push wilma
   Pushing as user wilma
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [acl.allow]
   foo/** = fred
   [acl.deny]
   foo/bar/** = fred
   foo/Bar/** = fred
   [acl.allow]
   ** = barney
   **/*.txt = wilma
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 24 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 24 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 24
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   adding manifests
   adding file changes
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "wilma"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow enabled, 1 entries for user wilma
   acl: acl.deny enabled, 0 entries for user wilma
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   error: pretxnchangegroup.acl hook failed: acl: user "wilma" not allowed on "quux/file.py" (changeset "911600dab2ae")
   bundle2-input-part: total payload size 1553
   bundle2-input-part: total payload size 24
   bundle2-input-bundle: 4 parts total
   transaction abort!
   rollback completed
   abort: acl: user "wilma" not allowed on "quux/file.py" (changeset "911600dab2ae")
   no rollback information available
   0:6675d58eff77
   
 
 file specified by acl.config does not exist
 
   $ echo '[acl]' >> $config
   $ echo 'config = ../acl.config' >> $config
   $ do_push barney
   Pushing as user barney
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [acl.allow]
   foo/** = fred
   [acl.deny]
   foo/bar/** = fred
   foo/Bar/** = fred
   [acl.allow]
   ** = barney
   **/*.txt = wilma
   [acl]
   config = ../acl.config
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 24 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 24 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 24
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   adding manifests
   adding file changes
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "barney"
   error: pretxnchangegroup.acl hook raised an exception: [Errno *] * (glob)
   bundle2-input-part: total payload size 1553
   bundle2-input-part: total payload size 24
   bundle2-input-bundle: 4 parts total
   transaction abort!
   rollback completed
   abort: $ENOENT$: ../acl.config
   no rollback information available
   0:6675d58eff77
   
 
 betty is allowed inside foo/ by a acl.config file
 
   $ echo '[acl.allow]' >> acl.config
   $ echo 'foo/** = betty' >> acl.config
   $ do_push betty
   Pushing as user betty
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [acl.allow]
   foo/** = fred
   [acl.deny]
   foo/bar/** = fred
   foo/Bar/** = fred
   [acl.allow]
   ** = barney
   **/*.txt = wilma
   [acl]
   config = ../acl.config
   """
   acl.config = """
   [acl.allow]
   foo/** = betty
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 24 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 24 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 24
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   adding manifests
   adding file changes
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "betty"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow enabled, 1 entries for user betty
   acl: acl.deny enabled, 0 entries for user betty
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   error: pretxnchangegroup.acl hook failed: acl: user "betty" not allowed on "quux/file.py" (changeset "911600dab2ae")
   bundle2-input-part: total payload size 1553
   bundle2-input-part: total payload size 24
   bundle2-input-bundle: 4 parts total
   transaction abort!
   rollback completed
   abort: acl: user "betty" not allowed on "quux/file.py" (changeset "911600dab2ae")
   no rollback information available
   0:6675d58eff77
   
 
 acl.config can set only [acl.allow]/[acl.deny]
 
   $ echo '[hooks]' >> acl.config
   $ echo 'changegroup.acl = false' >> acl.config
   $ do_push barney
   Pushing as user barney
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [acl.allow]
   foo/** = fred
   [acl.deny]
   foo/bar/** = fred
   foo/Bar/** = fred
   [acl.allow]
   ** = barney
   **/*.txt = wilma
   [acl]
   config = ../acl.config
   """
   acl.config = """
   [acl.allow]
   foo/** = betty
   [hooks]
   changegroup.acl = false
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 24 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 24 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 24
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   adding manifests
   adding file changes
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "barney"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow enabled, 1 entries for user barney
   acl: acl.deny enabled, 0 entries for user barney
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   acl: path access granted: "911600dab2ae"
   bundle2-input-part: total payload size 1553
   bundle2-input-part: "phase-heads" supported
   bundle2-input-part: total payload size 24
   bundle2-input-bundle: 4 parts total
   updating the branch cache
   bundle2-output-bundle: "HG20", 1 parts total
   bundle2-output-part: "reply:changegroup" (advisory) (params: 0 advisory) empty payload
   bundle2-input-bundle: no-transaction
   bundle2-input-part: "reply:changegroup" (advisory) (params: 0 advisory) supported
   bundle2-input-bundle: 0 parts total
   listing keys for "phases"
   repository tip rolled back to revision 0 (undo push)
   0:6675d58eff77
   
 
 asterisk
 
   $ init_config
 
 asterisk test
 
   $ echo '[acl.allow]' >> $config
   $ echo "** = fred" >> $config
 
 fred is always allowed
 
   $ do_push fred
   Pushing as user fred
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [extensions]
   posixgetuser=$TESTTMP/posixgetuser.py
   [acl.allow]
   ** = fred
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 24 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 24 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 24
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   adding manifests
   adding file changes
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "fred"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow enabled, 1 entries for user fred
   acl: acl.deny not enabled
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   acl: path access granted: "911600dab2ae"
   bundle2-input-part: total payload size 1553
   bundle2-input-part: "phase-heads" supported
   bundle2-input-part: total payload size 24
   bundle2-input-bundle: 4 parts total
   updating the branch cache
   bundle2-output-bundle: "HG20", 1 parts total
   bundle2-output-part: "reply:changegroup" (advisory) (params: 0 advisory) empty payload
   bundle2-input-bundle: no-transaction
   bundle2-input-part: "reply:changegroup" (advisory) (params: 0 advisory) supported
   bundle2-input-bundle: 0 parts total
   listing keys for "phases"
   repository tip rolled back to revision 0 (undo push)
   0:6675d58eff77
   
 
   $ echo '[acl.deny]' >> $config
   $ echo "foo/Bar/** = *" >> $config
 
 no one is allowed inside foo/Bar/
 
   $ do_push fred
   Pushing as user fred
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [extensions]
   posixgetuser=$TESTTMP/posixgetuser.py
   [acl.allow]
   ** = fred
   [acl.deny]
   foo/Bar/** = *
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 24 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 24 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 24
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   adding manifests
   adding file changes
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "fred"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow enabled, 1 entries for user fred
   acl: acl.deny enabled, 1 entries for user fred
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   error: pretxnchangegroup.acl hook failed: acl: user "fred" denied on "foo/Bar/file.txt" (changeset "f9cafe1212c8")
   bundle2-input-part: total payload size 1553
   bundle2-input-part: total payload size 24
   bundle2-input-bundle: 4 parts total
   transaction abort!
   rollback completed
   abort: acl: user "fred" denied on "foo/Bar/file.txt" (changeset "f9cafe1212c8")
   no rollback information available
   0:6675d58eff77
   
 
 Groups
 
   $ init_config
 
 OS-level groups
 
   $ echo '[acl.allow]' >> $config
   $ echo "** = @group1" >> $config
 
 @group1 is always allowed
 
   $ do_push fred
   Pushing as user fred
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [extensions]
   posixgetuser=$TESTTMP/posixgetuser.py
   [acl.allow]
   ** = @group1
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 24 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 24 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 24
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   adding manifests
   adding file changes
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "fred"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: "group1" not defined in [acl.groups]
   acl: acl.allow enabled, 1 entries for user fred
   acl: acl.deny not enabled
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   acl: path access granted: "911600dab2ae"
   bundle2-input-part: total payload size 1553
   bundle2-input-part: "phase-heads" supported
   bundle2-input-part: total payload size 24
   bundle2-input-bundle: 4 parts total
   updating the branch cache
   bundle2-output-bundle: "HG20", 1 parts total
   bundle2-output-part: "reply:changegroup" (advisory) (params: 0 advisory) empty payload
   bundle2-input-bundle: no-transaction
   bundle2-input-part: "reply:changegroup" (advisory) (params: 0 advisory) supported
   bundle2-input-bundle: 0 parts total
   listing keys for "phases"
   repository tip rolled back to revision 0 (undo push)
   0:6675d58eff77
   
 
   $ echo '[acl.deny]' >> $config
   $ echo "foo/Bar/** = @group1" >> $config
 
 @group is allowed inside anything but foo/Bar/
 
   $ do_push fred
   Pushing as user fred
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [extensions]
   posixgetuser=$TESTTMP/posixgetuser.py
   [acl.allow]
   ** = @group1
   [acl.deny]
   foo/Bar/** = @group1
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 24 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 24 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 24
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   adding manifests
   adding file changes
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "fred"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: "group1" not defined in [acl.groups]
   acl: acl.allow enabled, 1 entries for user fred
   acl: "group1" not defined in [acl.groups]
   acl: acl.deny enabled, 1 entries for user fred
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   error: pretxnchangegroup.acl hook failed: acl: user "fred" denied on "foo/Bar/file.txt" (changeset "f9cafe1212c8")
   bundle2-input-part: total payload size 1553
   bundle2-input-part: total payload size 24
   bundle2-input-bundle: 4 parts total
   transaction abort!
   rollback completed
   abort: acl: user "fred" denied on "foo/Bar/file.txt" (changeset "f9cafe1212c8")
   no rollback information available
   0:6675d58eff77
   
 
 Invalid group
 
 Disable the fakegroups trick to get real failures
 
   $ grep -v fakegroups $config > config.tmp
   $ mv config.tmp $config
   $ echo '[acl.allow]' >> $config
   $ echo "** = @unlikelytoexist" >> $config
   $ do_push fred 2>&1 | grep unlikelytoexist
   ** = @unlikelytoexist
   acl: "unlikelytoexist" not defined in [acl.groups]
   error: pretxnchangegroup.acl hook failed: group 'unlikelytoexist' is undefined
   abort: group 'unlikelytoexist' is undefined
 
 
 Branch acl tests setup
 
   $ init_config
   $ cd b
   $ hg up
   0 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ hg branch foobar
   marked working directory as branch foobar
   (branches are permanent and global, did you want a bookmark?)
   $ hg commit -m 'create foobar'
   $ echo 'foo contents' > abc.txt
   $ hg add abc.txt
   $ hg commit -m 'foobar contents'
   $ cd ..
   $ hg --cwd a pull ../b
   pulling from ../b
   searching for changes
   adding changesets
   adding manifests
   adding file changes
   added 2 changesets with 1 changes to 1 files (+1 heads)
   new changesets 81fbf4469322:fb35475503ef
   (run 'hg heads' to see heads)
 
 Create additional changeset on foobar branch
 
   $ cd a
   $ hg up -C foobar
   4 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ echo 'foo contents2' > abc.txt
   $ hg commit -m 'foobar contents2'
   $ cd ..
 
 
 No branch acls specified
 
   $ do_push astro
   Pushing as user astro
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [extensions]
   posixgetuser=$TESTTMP/posixgetuser.py
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   4 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   e8fc755d4d8217ee5b0c2bb41558c40d43b92c01
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 48 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 48 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 48
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   add changeset e8fc755d4d82
   adding manifests
   adding file changes
   adding abc.txt revisions
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 4 changesets with 4 changes to 4 files (+1 heads)
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "astro"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow not enabled
   acl: acl.deny not enabled
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   acl: path access granted: "911600dab2ae"
   acl: branch access granted: "e8fc755d4d82" on branch "foobar"
   acl: path access granted: "e8fc755d4d82"
   bundle2-input-part: total payload size 2068
   bundle2-input-part: "phase-heads" supported
   bundle2-input-part: total payload size 48
   bundle2-input-bundle: 4 parts total
   updating the branch cache
   bundle2-output-bundle: "HG20", 1 parts total
   bundle2-output-part: "reply:changegroup" (advisory) (params: 0 advisory) empty payload
   bundle2-input-bundle: no-transaction
   bundle2-input-part: "reply:changegroup" (advisory) (params: 0 advisory) supported
   bundle2-input-bundle: 0 parts total
   listing keys for "phases"
   repository tip rolled back to revision 2 (undo push)
   2:fb35475503ef
   
 
 Branch acl deny test
 
   $ echo "[acl.deny.branches]" >> $config
   $ echo "foobar = *" >> $config
   $ do_push astro
   Pushing as user astro
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [extensions]
   posixgetuser=$TESTTMP/posixgetuser.py
   [acl.deny.branches]
   foobar = *
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   4 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   e8fc755d4d8217ee5b0c2bb41558c40d43b92c01
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 48 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 48 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 48
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   add changeset e8fc755d4d82
   adding manifests
   adding file changes
   adding abc.txt revisions
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 4 changesets with 4 changes to 4 files (+1 heads)
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "astro"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches enabled, 1 entries for user astro
   acl: acl.allow not enabled
   acl: acl.deny not enabled
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   acl: path access granted: "911600dab2ae"
   error: pretxnchangegroup.acl hook failed: acl: user "astro" denied on branch "foobar" (changeset "e8fc755d4d82")
   bundle2-input-part: total payload size 2068
   bundle2-input-part: total payload size 48
   bundle2-input-bundle: 4 parts total
   transaction abort!
   rollback completed
   abort: acl: user "astro" denied on branch "foobar" (changeset "e8fc755d4d82")
   no rollback information available
   2:fb35475503ef
   
 
 Branch acl empty allow test
 
   $ init_config
   $ echo "[acl.allow.branches]" >> $config
   $ do_push astro
   Pushing as user astro
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [extensions]
   posixgetuser=$TESTTMP/posixgetuser.py
   [acl.allow.branches]
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   4 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   e8fc755d4d8217ee5b0c2bb41558c40d43b92c01
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 48 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 48 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 48
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   add changeset e8fc755d4d82
   adding manifests
   adding file changes
   adding abc.txt revisions
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 4 changesets with 4 changes to 4 files (+1 heads)
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "astro"
   acl: acl.allow.branches enabled, 0 entries for user astro
   acl: acl.deny.branches not enabled
   acl: acl.allow not enabled
   acl: acl.deny not enabled
   error: pretxnchangegroup.acl hook failed: acl: user "astro" not allowed on branch "default" (changeset "ef1ea85a6374")
   bundle2-input-part: total payload size 2068
   bundle2-input-part: total payload size 48
   bundle2-input-bundle: 4 parts total
   transaction abort!
   rollback completed
   abort: acl: user "astro" not allowed on branch "default" (changeset "ef1ea85a6374")
   no rollback information available
   2:fb35475503ef
   
 
 Branch acl allow other
 
   $ init_config
   $ echo "[acl.allow.branches]" >> $config
   $ echo "* = george" >> $config
   $ do_push astro
   Pushing as user astro
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [extensions]
   posixgetuser=$TESTTMP/posixgetuser.py
   [acl.allow.branches]
   * = george
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   4 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   e8fc755d4d8217ee5b0c2bb41558c40d43b92c01
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 48 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 48 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 48
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   add changeset e8fc755d4d82
   adding manifests
   adding file changes
   adding abc.txt revisions
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 4 changesets with 4 changes to 4 files (+1 heads)
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "astro"
   acl: acl.allow.branches enabled, 0 entries for user astro
   acl: acl.deny.branches not enabled
   acl: acl.allow not enabled
   acl: acl.deny not enabled
   error: pretxnchangegroup.acl hook failed: acl: user "astro" not allowed on branch "default" (changeset "ef1ea85a6374")
   bundle2-input-part: total payload size 2068
   bundle2-input-part: total payload size 48
   bundle2-input-bundle: 4 parts total
   transaction abort!
   rollback completed
   abort: acl: user "astro" not allowed on branch "default" (changeset "ef1ea85a6374")
   no rollback information available
   2:fb35475503ef
   
   $ do_push george
   Pushing as user george
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [extensions]
   posixgetuser=$TESTTMP/posixgetuser.py
   [acl.allow.branches]
   * = george
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   4 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   e8fc755d4d8217ee5b0c2bb41558c40d43b92c01
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 48 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 48 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 48
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   add changeset e8fc755d4d82
   adding manifests
   adding file changes
   adding abc.txt revisions
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 4 changesets with 4 changes to 4 files (+1 heads)
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "george"
   acl: acl.allow.branches enabled, 1 entries for user george
   acl: acl.deny.branches not enabled
   acl: acl.allow not enabled
   acl: acl.deny not enabled
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   acl: path access granted: "911600dab2ae"
   acl: branch access granted: "e8fc755d4d82" on branch "foobar"
   acl: path access granted: "e8fc755d4d82"
   bundle2-input-part: total payload size 2068
   bundle2-input-part: "phase-heads" supported
   bundle2-input-part: total payload size 48
   bundle2-input-bundle: 4 parts total
   updating the branch cache
   bundle2-output-bundle: "HG20", 1 parts total
   bundle2-output-part: "reply:changegroup" (advisory) (params: 0 advisory) empty payload
   bundle2-input-bundle: no-transaction
   bundle2-input-part: "reply:changegroup" (advisory) (params: 0 advisory) supported
   bundle2-input-bundle: 0 parts total
   listing keys for "phases"
   repository tip rolled back to revision 2 (undo push)
   2:fb35475503ef
   
 
 Branch acl conflicting allow
 asterisk ends up applying to all branches and allowing george to
 push foobar into the remote
 
   $ init_config
   $ echo "[acl.allow.branches]" >> $config
   $ echo "foobar = astro" >> $config
   $ echo "* = george" >> $config
   $ do_push george
   Pushing as user george
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [extensions]
   posixgetuser=$TESTTMP/posixgetuser.py
   [acl.allow.branches]
   foobar = astro
   * = george
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   4 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   e8fc755d4d8217ee5b0c2bb41558c40d43b92c01
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 48 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 48 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 48
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   add changeset e8fc755d4d82
   adding manifests
   adding file changes
   adding abc.txt revisions
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 4 changesets with 4 changes to 4 files (+1 heads)
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "george"
   acl: acl.allow.branches enabled, 1 entries for user george
   acl: acl.deny.branches not enabled
   acl: acl.allow not enabled
   acl: acl.deny not enabled
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   acl: path access granted: "911600dab2ae"
   acl: branch access granted: "e8fc755d4d82" on branch "foobar"
   acl: path access granted: "e8fc755d4d82"
   bundle2-input-part: total payload size 2068
   bundle2-input-part: "phase-heads" supported
   bundle2-input-part: total payload size 48
   bundle2-input-bundle: 4 parts total
   updating the branch cache
   bundle2-output-bundle: "HG20", 1 parts total
   bundle2-output-part: "reply:changegroup" (advisory) (params: 0 advisory) empty payload
   bundle2-input-bundle: no-transaction
   bundle2-input-part: "reply:changegroup" (advisory) (params: 0 advisory) supported
   bundle2-input-bundle: 0 parts total
   listing keys for "phases"
   repository tip rolled back to revision 2 (undo push)
   2:fb35475503ef
   
 Branch acl conflicting deny
 
   $ init_config
   $ echo "[acl.deny.branches]" >> $config
   $ echo "foobar = astro" >> $config
   $ echo "default = astro" >> $config
   $ echo "* = george" >> $config
   $ do_push george
   Pushing as user george
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [extensions]
   posixgetuser=$TESTTMP/posixgetuser.py
   [acl.deny.branches]
   foobar = astro
   default = astro
   * = george
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   4 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   e8fc755d4d8217ee5b0c2bb41558c40d43b92c01
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 48 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 48 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 48
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   add changeset e8fc755d4d82
   adding manifests
   adding file changes
   adding abc.txt revisions
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 4 changesets with 4 changes to 4 files (+1 heads)
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "george"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches enabled, 1 entries for user george
   acl: acl.allow not enabled
   acl: acl.deny not enabled
   error: pretxnchangegroup.acl hook failed: acl: user "george" denied on branch "default" (changeset "ef1ea85a6374")
   bundle2-input-part: total payload size 2068
   bundle2-input-part: total payload size 48
   bundle2-input-bundle: 4 parts total
   transaction abort!
   rollback completed
   abort: acl: user "george" denied on branch "default" (changeset "ef1ea85a6374")
   no rollback information available
   2:fb35475503ef
   
 User 'astro' must not be denied
 
   $ init_config
   $ echo "[acl.deny.branches]" >> $config
   $ echo "default = !astro" >> $config
   $ do_push astro
   Pushing as user astro
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [extensions]
   posixgetuser=$TESTTMP/posixgetuser.py
   [acl.deny.branches]
   default = !astro
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   4 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   e8fc755d4d8217ee5b0c2bb41558c40d43b92c01
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 48 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 48 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 48
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   add changeset e8fc755d4d82
   adding manifests
   adding file changes
   adding abc.txt revisions
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 4 changesets with 4 changes to 4 files (+1 heads)
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "astro"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches enabled, 0 entries for user astro
   acl: acl.allow not enabled
   acl: acl.deny not enabled
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   acl: path access granted: "911600dab2ae"
   acl: branch access granted: "e8fc755d4d82" on branch "foobar"
   acl: path access granted: "e8fc755d4d82"
   bundle2-input-part: total payload size 2068
   bundle2-input-part: "phase-heads" supported
   bundle2-input-part: total payload size 48
   bundle2-input-bundle: 4 parts total
   updating the branch cache
   bundle2-output-bundle: "HG20", 1 parts total
   bundle2-output-part: "reply:changegroup" (advisory) (params: 0 advisory) empty payload
   bundle2-input-bundle: no-transaction
   bundle2-input-part: "reply:changegroup" (advisory) (params: 0 advisory) supported
   bundle2-input-bundle: 0 parts total
   listing keys for "phases"
   repository tip rolled back to revision 2 (undo push)
   2:fb35475503ef
   
 
 Non-astro users must be denied
 
   $ do_push george
   Pushing as user george
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
+  prepushkey.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [extensions]
   posixgetuser=$TESTTMP/posixgetuser.py
   [acl.deny.branches]
   default = !astro
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   listing keys for "phases"
   checking for updated bookmarks
   listing keys for "bookmarks"
   listing keys for "bookmarks"
   4 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   e8fc755d4d8217ee5b0c2bb41558c40d43b92c01
   bundle2-output-bundle: "HG20", 5 parts total
   bundle2-output-part: "replycaps" 205 bytes payload
   bundle2-output-part: "check:phases" 48 bytes payload
   bundle2-output-part: "check:heads" streamed payload
   bundle2-output-part: "changegroup" (params: 1 mandatory) streamed payload
   bundle2-output-part: "phase-heads" 48 bytes payload
   bundle2-input-bundle: with-transaction
   bundle2-input-part: "replycaps" supported
   bundle2-input-part: total payload size 205
   bundle2-input-part: "check:phases" supported
   bundle2-input-part: total payload size 48
   bundle2-input-part: "check:heads" supported
   bundle2-input-part: total payload size 20
   bundle2-input-part: "changegroup" (params: 1 mandatory) supported
   adding changesets
   add changeset ef1ea85a6374
   add changeset f9cafe1212c8
   add changeset 911600dab2ae
   add changeset e8fc755d4d82
   adding manifests
   adding file changes
   adding abc.txt revisions
   adding foo/Bar/file.txt revisions
   adding foo/file.txt revisions
   adding quux/file.py revisions
   added 4 changesets with 4 changes to 4 files (+1 heads)
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "george"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches enabled, 1 entries for user george
   acl: acl.allow not enabled
   acl: acl.deny not enabled
   error: pretxnchangegroup.acl hook failed: acl: user "george" denied on branch "default" (changeset "ef1ea85a6374")
   bundle2-input-part: total payload size 2068
   bundle2-input-part: total payload size 48
   bundle2-input-bundle: 4 parts total
   transaction abort!
   rollback completed
   abort: acl: user "george" denied on branch "default" (changeset "ef1ea85a6374")
   no rollback information available
   2:fb35475503ef