acl: use of "!" prefix in user or group names

The "!" prefix allows you to prevent anyone except a given user or group to push
changesets in a given branch or path.

This patch enables a use case suggested by a user (Julien Bonnet):
There's a branch that only a given user (or group) should be able to push to,
and you don't want to restrict access to any other branch that may be created.

With the "!" prefix, you simply deny access to "!givenuser" (or "!@givengroup").

hgext/acl.py

@@ -1,259 +1,273
 # acl.py - changeset access control for mercurial
 #
 # Copyright 2006 Vadim Gelfer <[e-mail]>
 #
 # This software may be used and distributed according to the terms of the
 # GNU General Public License version 2 or any later version.
 
 '''hooks for controlling repository access
 
 This hook makes it possible to allow or deny write access to given
 branches and paths of a repository when receiving incoming changesets
 via pretxnchangegroup and pretxncommit.
 
 The authorization is matched based on the local user name on the
 system where the hook runs, and not the committer of the original
 changeset (since the latter is merely informative).
 
 The acl hook is best used along with a restricted shell like hgsh,
 preventing authenticating users from doing anything other than pushing
 or pulling. The hook is not safe to use if users have interactive
 shell access, as they can then disable the hook. Nor is it safe if
 remote users share an account, because then there is no way to
 distinguish them.
 
 The order in which access checks are performed is:
 
 1) Deny  list for branches (section ``acl.deny.branches``)
 2) Allow list for branches (section ``acl.allow.branches``)
 3) Deny  list for paths    (section ``acl.deny``)
 4) Allow list for paths    (section ``acl.allow``)
 
 The allow and deny sections take key-value pairs.
 
 Branch-based Access Control
 ...........................
 
 Use the ``acl.deny.branches`` and ``acl.allow.branches`` sections to
 have branch-based access control. Keys in these sections can be
 either:
 
 - a branch name, or
 - an asterisk, to match any branch;
 
 The corresponding values can be either:
 
 - a comma-separated list containing users and groups, or
 - an asterisk, to match anyone;
 
 Path-based Access Control
 .........................
 
 Use the ``acl.deny`` and ``acl.allow`` sections to have path-based
 access control. Keys in these sections accept a subtree pattern (with
 a glob syntax by default). The corresponding values follow the same
 syntax as the other sections above.
 
 Groups
 ......
 
 Group names must be prefixed with an ``@`` symbol. Specifying a group
 name has the same effect as specifying all the users in that group.
 
 You can define group members in the ``acl.groups`` section.
 If a group name is not defined there, and Mercurial is running under
 a Unix-like system, the list of users will be taken from the OS.
 Otherwise, an exception will be raised.
 
 Example Configuration
 .....................
 
 ::
 
   [hooks]
 
   # Use this if you want to check access restrictions at commit time
   pretxncommit.acl = python:hgext.acl.hook
 
   # Use this if you want to check access restrictions for pull, push,
   # bundle and serve.
   pretxnchangegroup.acl = python:hgext.acl.hook
 
   [acl]
   # Allow or deny access for incoming changes only if their source is
   # listed here, let them pass otherwise. Source is "serve" for all
   # remote access (http or ssh), "push", "pull" or "bundle" when the
   # related commands are run locally.
   # Default: serve
   sources = serve
 
   [acl.deny.branches]
 
   # Everyone is denied to the frozen branch:
   frozen-branch = *
 
   # A bad user is denied on all branches:
   * = bad-user
 
   [acl.allow.branches]
 
   # A few users are allowed on branch-a:
   branch-a = user-1, user-2, user-3
 
   # Only one user is allowed on branch-b:
   branch-b = user-1
 
   # The super user is allowed on any branch:
   * = super-user
 
   # Everyone is allowed on branch-for-tests:
   branch-for-tests = *
 
   [acl.deny]
   # This list is checked first. If a match is found, acl.allow is not
   # checked. All users are granted access if acl.deny is not present.
   # Format for both lists: glob pattern = user, ..., @group, ...
 
   # To match everyone, use an asterisk for the user:
   # my/glob/pattern = *
 
   # user6 will not have write access to any file:
   ** = user6
 
   # Group "hg-denied" will not have write access to any file:
   ** = @hg-denied
 
   # Nobody will be able to change "DONT-TOUCH-THIS.txt", despite
   # everyone being able to change all other files. See below.
   src/main/resources/DONT-TOUCH-THIS.txt = *
 
   [acl.allow]
   # if acl.allow is not present, all users are allowed by default
   # empty acl.allow = no users allowed
 
   # User "doc_writer" has write access to any file under the "docs"
   # folder:
   docs/** = doc_writer
 
   # User "jack" and group "designers" have write access to any file
   # under the "images" folder:
   images/** = jack, @designers
 
   # Everyone (except for "user6" and "@hg-denied" - see acl.deny above)
   # will have write access to any file under the "resources" folder
   # (except for 1 file. See acl.deny):
   src/main/resources/** = *
 
   .hgtags = release_engineer
 
 '''
 
 from mercurial.i18n import _
 from mercurial import util, match
 import getpass, urllib
 
 testedwith = 'internal'
 
 def _getusers(ui, group):
 
     # First, try to use group definition from section [acl.groups]
     hgrcusers = ui.configlist('acl.groups', group)
     if hgrcusers:
         return hgrcusers
 
     ui.debug('acl: "%s" not defined in [acl.groups]\n' % group)
     # If no users found in group definition, get users from OS-level group
     try:
         return util.groupmembers(group)
     except KeyError:
         raise util.Abort(_("group '%s' is undefined") % group)
 
 def _usermatch(ui, user, usersorgroups):
 
     if usersorgroups == '*':
         return True
 
     for ug in usersorgroups.replace(',', ' ').split():
-        if user == ug or ug.startswith('@') and user in _getusers(ui, ug[1:]):
+
+        if ug.startswith('!'):
+            # Test for excluded user or group. Format:
+            # if ug is a user  name: !username
+            # if ug is a group name: !@groupname
+            ug = ug[1:]
+            if not ug.startswith('@') and user != ug \
+                or ug.startswith('@') and user not in _getusers(ui, ug[1:]):
+                return True
+
+        # Test for user or group. Format:
+        # if ug is a user  name: username
+        # if ug is a group name: @groupname
+        elif user == ug \
+             or ug.startswith('@') and user in _getusers(ui, ug[1:]):
             return True
 
     return False
 
 def buildmatch(ui, repo, user, key):
     '''return tuple of (match function, list enabled).'''
     if not ui.has_section(key):
         ui.debug('acl: %s not enabled\n' % key)
         return None
 
     pats = [pat for pat, users in ui.configitems(key)
             if _usermatch(ui, user, users)]
     ui.debug('acl: %s enabled, %d entries for user %s\n' %
              (key, len(pats), user))
 
     # Branch-based ACL
     if not repo:
         if pats:
             # If there's an asterisk (meaning "any branch"), always return True;
             # Otherwise, test if b is in pats
             if '*' in pats:
                 return util.always
             return lambda b: b in pats
         return util.never
 
     # Path-based ACL
     if pats:
         return match.match(repo.root, '', pats)
     return util.never
 
 def hook(ui, repo, hooktype, node=None, source=None, **kwargs):
     if hooktype not in ['pretxnchangegroup', 'pretxncommit']:
         raise util.Abort(_('config error - hook type "%s" cannot stop '
                            'incoming changesets nor commits') % hooktype)
     if (hooktype == 'pretxnchangegroup' and
         source not in ui.config('acl', 'sources', 'serve').split()):
         ui.debug('acl: changes have source "%s" - skipping\n' % source)
         return
 
     user = None
     if source == 'serve' and 'url' in kwargs:
         url = kwargs['url'].split(':')
         if url[0] == 'remote' and url[1].startswith('http'):
             user = urllib.unquote(url[3])
 
     if user is None:
         user = getpass.getuser()
 
     ui.debug('acl: checking access for user "%s"\n' % user)
 
     cfg = ui.config('acl', 'config')
     if cfg:
         ui.readconfig(cfg, sections = ['acl.groups', 'acl.allow.branches',
         'acl.deny.branches', 'acl.allow', 'acl.deny'])
 
     allowbranches = buildmatch(ui, None, user, 'acl.allow.branches')
     denybranches = buildmatch(ui, None, user, 'acl.deny.branches')
     allow = buildmatch(ui, repo, user, 'acl.allow')
     deny = buildmatch(ui, repo, user, 'acl.deny')
 
     for rev in xrange(repo[node], len(repo)):
         ctx = repo[rev]
         branch = ctx.branch()
         if denybranches and denybranches(branch):
             raise util.Abort(_('acl: user "%s" denied on branch "%s"'
                                ' (changeset "%s")')
                                % (user, branch, ctx))
         if allowbranches and not allowbranches(branch):
             raise util.Abort(_('acl: user "%s" not allowed on branch "%s"'
                                ' (changeset "%s")')
                                % (user, branch, ctx))
         ui.debug('acl: branch access granted: "%s" on branch "%s"\n'
         % (ctx, branch))
 
         for f in ctx.files():
             if deny and deny(f):
                 raise util.Abort(_('acl: user "%s" denied on "%s"'
                 ' (changeset "%s")') % (user, f, ctx))
             if allow and not allow(f):
                 raise util.Abort(_('acl: user "%s" not allowed on "%s"'
                 ' (changeset "%s")') % (user, f, ctx))
         ui.debug('acl: path access granted: "%s"\n' % ctx)

tests/test-acl.t

@@ -1,1921 +1,2073
   > do_push()
   > {
   >     user=$1
   >     shift
   >     echo "Pushing as user $user"
   >     echo 'hgrc = """'
   >     sed -e 1,2d b/.hg/hgrc | grep -v fakegroups.py
   >     echo '"""'
   >     if test -f acl.config; then
   >         echo 'acl.config = """'
   >         cat acl.config
   >         echo '"""'
   >     fi
   >     # On AIX /etc/profile sets LOGNAME read-only. So
   >     #  LOGNAME=$user hg --cws a --debug push ../b
   >     # fails with "This variable is read only."
   >     # Use env to work around this.
   >     env LOGNAME=$user hg --cwd a --debug push ../b
   >     hg --cwd b rollback
   >     hg --cwd b --quiet tip
   >     echo
   > }
 
   > init_config()
   > {
   >     cat > fakegroups.py <<EOF
   > from hgext import acl
   > def fakegetusers(ui, group):
   >     try:
   >         return acl._getusersorig(ui, group)
   >     except:
   >         return ["fred", "betty"]
   > acl._getusersorig = acl._getusers
   > acl._getusers = fakegetusers
   > EOF
   >     rm -f acl.config
   >     cat > $config <<EOF
   > [hooks]
   > pretxnchangegroup.acl = python:hgext.acl.hook
   > [acl]
   > sources = push
   > [extensions]
   > f=`pwd`/fakegroups.py
   > EOF
   > }
 
   $ hg init a
   $ cd a
   $ mkdir foo foo/Bar quux
   $ echo 'in foo' > foo/file.txt
   $ echo 'in foo/Bar' > foo/Bar/file.txt
   $ echo 'in quux' > quux/file.py
   $ hg add -q
   $ hg ci -m 'add files' -d '1000000 0'
   $ echo >> foo/file.txt
   $ hg ci -m 'change foo/file' -d '1000001 0'
   $ echo >> foo/Bar/file.txt
   $ hg ci -m 'change foo/Bar/file' -d '1000002 0'
   $ echo >> quux/file.py
   $ hg ci -m 'change quux/file' -d '1000003 0'
   $ hg tip --quiet
   3:911600dab2ae
 
   $ cd ..
   $ hg clone -r 0 a b
   adding changesets
   adding manifests
   adding file changes
   added 1 changesets with 3 changes to 3 files
   updating to branch default
   3 files updated, 0 files merged, 0 files removed, 0 files unresolved
 
   $ config=b/.hg/hgrc
 
 Extension disabled for lack of a hook
 
   $ do_push fred
   Pushing as user fred
   hgrc = """
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   adding changesets
   bundling: 1/3 changesets (33.33%)
   bundling: 2/3 changesets (66.67%)
   bundling: 3/3 changesets (100.00%)
   bundling: 1/3 manifests (33.33%)
   bundling: 2/3 manifests (66.67%)
   bundling: 3/3 manifests (100.00%)
   bundling: foo/Bar/file.txt 1/3 files (33.33%)
   bundling: foo/file.txt 2/3 files (66.67%)
   bundling: quux/file.py 3/3 files (100.00%)
   changesets: 1 chunks
   add changeset ef1ea85a6374
   changesets: 2 chunks
   add changeset f9cafe1212c8
   changesets: 3 chunks
   add changeset 911600dab2ae
   adding manifests
   manifests: 1/3 chunks (33.33%)
   manifests: 2/3 chunks (66.67%)
   manifests: 3/3 chunks (100.00%)
   adding file changes
   adding foo/Bar/file.txt revisions
   files: 1/3 chunks (33.33%)
   adding foo/file.txt revisions
   files: 2/3 chunks (66.67%)
   adding quux/file.py revisions
   files: 3/3 chunks (100.00%)
   added 3 changesets with 3 changes to 3 files
   updating the branch cache
   checking for updated bookmarks
   repository tip rolled back to revision 0 (undo push)
   0:6675d58eff77
   
 
   $ echo '[hooks]' >> $config
   $ echo 'pretxnchangegroup.acl = python:hgext.acl.hook' >> $config
 
 Extension disabled for lack of acl.sources
 
   $ do_push fred
   Pushing as user fred
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   invalidating branch cache (tip differs)
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   adding changesets
   bundling: 1/3 changesets (33.33%)
   bundling: 2/3 changesets (66.67%)
   bundling: 3/3 changesets (100.00%)
   bundling: 1/3 manifests (33.33%)
   bundling: 2/3 manifests (66.67%)
   bundling: 3/3 manifests (100.00%)
   bundling: foo/Bar/file.txt 1/3 files (33.33%)
   bundling: foo/file.txt 2/3 files (66.67%)
   bundling: quux/file.py 3/3 files (100.00%)
   changesets: 1 chunks
   add changeset ef1ea85a6374
   changesets: 2 chunks
   add changeset f9cafe1212c8
   changesets: 3 chunks
   add changeset 911600dab2ae
   adding manifests
   manifests: 1/3 chunks (33.33%)
   manifests: 2/3 chunks (66.67%)
   manifests: 3/3 chunks (100.00%)
   adding file changes
   adding foo/Bar/file.txt revisions
   files: 1/3 chunks (33.33%)
   adding foo/file.txt revisions
   files: 2/3 chunks (66.67%)
   adding quux/file.py revisions
   files: 3/3 chunks (100.00%)
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: changes have source "push" - skipping
   updating the branch cache
   checking for updated bookmarks
   repository tip rolled back to revision 0 (undo push)
   0:6675d58eff77
   
 
 No [acl.allow]/[acl.deny]
 
   $ echo '[acl]' >> $config
   $ echo 'sources = push' >> $config
   $ do_push fred
   Pushing as user fred
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
   [acl]
   sources = push
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   invalidating branch cache (tip differs)
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   adding changesets
   bundling: 1/3 changesets (33.33%)
   bundling: 2/3 changesets (66.67%)
   bundling: 3/3 changesets (100.00%)
   bundling: 1/3 manifests (33.33%)
   bundling: 2/3 manifests (66.67%)
   bundling: 3/3 manifests (100.00%)
   bundling: foo/Bar/file.txt 1/3 files (33.33%)
   bundling: foo/file.txt 2/3 files (66.67%)
   bundling: quux/file.py 3/3 files (100.00%)
   changesets: 1 chunks
   add changeset ef1ea85a6374
   changesets: 2 chunks
   add changeset f9cafe1212c8
   changesets: 3 chunks
   add changeset 911600dab2ae
   adding manifests
   manifests: 1/3 chunks (33.33%)
   manifests: 2/3 chunks (66.67%)
   manifests: 3/3 chunks (100.00%)
   adding file changes
   adding foo/Bar/file.txt revisions
   files: 1/3 chunks (33.33%)
   adding foo/file.txt revisions
   files: 2/3 chunks (66.67%)
   adding quux/file.py revisions
   files: 3/3 chunks (100.00%)
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "fred"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow not enabled
   acl: acl.deny not enabled
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   acl: path access granted: "911600dab2ae"
   updating the branch cache
   checking for updated bookmarks
   repository tip rolled back to revision 0 (undo push)
   0:6675d58eff77
   
 
 Empty [acl.allow]
 
   $ echo '[acl.allow]' >> $config
   $ do_push fred
   Pushing as user fred
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [acl.allow]
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   invalidating branch cache (tip differs)
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   adding changesets
   bundling: 1/3 changesets (33.33%)
   bundling: 2/3 changesets (66.67%)
   bundling: 3/3 changesets (100.00%)
   bundling: 1/3 manifests (33.33%)
   bundling: 2/3 manifests (66.67%)
   bundling: 3/3 manifests (100.00%)
   bundling: foo/Bar/file.txt 1/3 files (33.33%)
   bundling: foo/file.txt 2/3 files (66.67%)
   bundling: quux/file.py 3/3 files (100.00%)
   changesets: 1 chunks
   add changeset ef1ea85a6374
   changesets: 2 chunks
   add changeset f9cafe1212c8
   changesets: 3 chunks
   add changeset 911600dab2ae
   adding manifests
   manifests: 1/3 chunks (33.33%)
   manifests: 2/3 chunks (66.67%)
   manifests: 3/3 chunks (100.00%)
   adding file changes
   adding foo/Bar/file.txt revisions
   files: 1/3 chunks (33.33%)
   adding foo/file.txt revisions
   files: 2/3 chunks (66.67%)
   adding quux/file.py revisions
   files: 3/3 chunks (100.00%)
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "fred"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow enabled, 0 entries for user fred
   acl: acl.deny not enabled
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   error: pretxnchangegroup.acl hook failed: acl: user "fred" not allowed on "foo/file.txt" (changeset "ef1ea85a6374")
   transaction abort!
   rollback completed
   abort: acl: user "fred" not allowed on "foo/file.txt" (changeset "ef1ea85a6374")
   no rollback information available
   0:6675d58eff77
   
 
 fred is allowed inside foo/
 
   $ echo 'foo/** = fred' >> $config
   $ do_push fred
   Pushing as user fred
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [acl.allow]
   foo/** = fred
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   adding changesets
   bundling: 1/3 changesets (33.33%)
   bundling: 2/3 changesets (66.67%)
   bundling: 3/3 changesets (100.00%)
   bundling: 1/3 manifests (33.33%)
   bundling: 2/3 manifests (66.67%)
   bundling: 3/3 manifests (100.00%)
   bundling: foo/Bar/file.txt 1/3 files (33.33%)
   bundling: foo/file.txt 2/3 files (66.67%)
   bundling: quux/file.py 3/3 files (100.00%)
   changesets: 1 chunks
   add changeset ef1ea85a6374
   changesets: 2 chunks
   add changeset f9cafe1212c8
   changesets: 3 chunks
   add changeset 911600dab2ae
   adding manifests
   manifests: 1/3 chunks (33.33%)
   manifests: 2/3 chunks (66.67%)
   manifests: 3/3 chunks (100.00%)
   adding file changes
   adding foo/Bar/file.txt revisions
   files: 1/3 chunks (33.33%)
   adding foo/file.txt revisions
   files: 2/3 chunks (66.67%)
   adding quux/file.py revisions
   files: 3/3 chunks (100.00%)
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "fred"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow enabled, 1 entries for user fred
   acl: acl.deny not enabled
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   error: pretxnchangegroup.acl hook failed: acl: user "fred" not allowed on "quux/file.py" (changeset "911600dab2ae")
   transaction abort!
   rollback completed
   abort: acl: user "fred" not allowed on "quux/file.py" (changeset "911600dab2ae")
   no rollback information available
   0:6675d58eff77
   
 
 Empty [acl.deny]
 
   $ echo '[acl.deny]' >> $config
   $ do_push barney
   Pushing as user barney
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [acl.allow]
   foo/** = fred
   [acl.deny]
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   adding changesets
   bundling: 1/3 changesets (33.33%)
   bundling: 2/3 changesets (66.67%)
   bundling: 3/3 changesets (100.00%)
   bundling: 1/3 manifests (33.33%)
   bundling: 2/3 manifests (66.67%)
   bundling: 3/3 manifests (100.00%)
   bundling: foo/Bar/file.txt 1/3 files (33.33%)
   bundling: foo/file.txt 2/3 files (66.67%)
   bundling: quux/file.py 3/3 files (100.00%)
   changesets: 1 chunks
   add changeset ef1ea85a6374
   changesets: 2 chunks
   add changeset f9cafe1212c8
   changesets: 3 chunks
   add changeset 911600dab2ae
   adding manifests
   manifests: 1/3 chunks (33.33%)
   manifests: 2/3 chunks (66.67%)
   manifests: 3/3 chunks (100.00%)
   adding file changes
   adding foo/Bar/file.txt revisions
   files: 1/3 chunks (33.33%)
   adding foo/file.txt revisions
   files: 2/3 chunks (66.67%)
   adding quux/file.py revisions
   files: 3/3 chunks (100.00%)
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "barney"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow enabled, 0 entries for user barney
   acl: acl.deny enabled, 0 entries for user barney
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   error: pretxnchangegroup.acl hook failed: acl: user "barney" not allowed on "foo/file.txt" (changeset "ef1ea85a6374")
   transaction abort!
   rollback completed
   abort: acl: user "barney" not allowed on "foo/file.txt" (changeset "ef1ea85a6374")
   no rollback information available
   0:6675d58eff77
   
 
 fred is allowed inside foo/, but not foo/bar/ (case matters)
 
   $ echo 'foo/bar/** = fred' >> $config
   $ do_push fred
   Pushing as user fred
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [acl.allow]
   foo/** = fred
   [acl.deny]
   foo/bar/** = fred
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   adding changesets
   bundling: 1/3 changesets (33.33%)
   bundling: 2/3 changesets (66.67%)
   bundling: 3/3 changesets (100.00%)
   bundling: 1/3 manifests (33.33%)
   bundling: 2/3 manifests (66.67%)
   bundling: 3/3 manifests (100.00%)
   bundling: foo/Bar/file.txt 1/3 files (33.33%)
   bundling: foo/file.txt 2/3 files (66.67%)
   bundling: quux/file.py 3/3 files (100.00%)
   changesets: 1 chunks
   add changeset ef1ea85a6374
   changesets: 2 chunks
   add changeset f9cafe1212c8
   changesets: 3 chunks
   add changeset 911600dab2ae
   adding manifests
   manifests: 1/3 chunks (33.33%)
   manifests: 2/3 chunks (66.67%)
   manifests: 3/3 chunks (100.00%)
   adding file changes
   adding foo/Bar/file.txt revisions
   files: 1/3 chunks (33.33%)
   adding foo/file.txt revisions
   files: 2/3 chunks (66.67%)
   adding quux/file.py revisions
   files: 3/3 chunks (100.00%)
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "fred"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow enabled, 1 entries for user fred
   acl: acl.deny enabled, 1 entries for user fred
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   error: pretxnchangegroup.acl hook failed: acl: user "fred" not allowed on "quux/file.py" (changeset "911600dab2ae")
   transaction abort!
   rollback completed
   abort: acl: user "fred" not allowed on "quux/file.py" (changeset "911600dab2ae")
   no rollback information available
   0:6675d58eff77
   
 
 fred is allowed inside foo/, but not foo/Bar/
 
   $ echo 'foo/Bar/** = fred' >> $config
   $ do_push fred
   Pushing as user fred
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [acl.allow]
   foo/** = fred
   [acl.deny]
   foo/bar/** = fred
   foo/Bar/** = fred
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   adding changesets
   bundling: 1/3 changesets (33.33%)
   bundling: 2/3 changesets (66.67%)
   bundling: 3/3 changesets (100.00%)
   bundling: 1/3 manifests (33.33%)
   bundling: 2/3 manifests (66.67%)
   bundling: 3/3 manifests (100.00%)
   bundling: foo/Bar/file.txt 1/3 files (33.33%)
   bundling: foo/file.txt 2/3 files (66.67%)
   bundling: quux/file.py 3/3 files (100.00%)
   changesets: 1 chunks
   add changeset ef1ea85a6374
   changesets: 2 chunks
   add changeset f9cafe1212c8
   changesets: 3 chunks
   add changeset 911600dab2ae
   adding manifests
   manifests: 1/3 chunks (33.33%)
   manifests: 2/3 chunks (66.67%)
   manifests: 3/3 chunks (100.00%)
   adding file changes
   adding foo/Bar/file.txt revisions
   files: 1/3 chunks (33.33%)
   adding foo/file.txt revisions
   files: 2/3 chunks (66.67%)
   adding quux/file.py revisions
   files: 3/3 chunks (100.00%)
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "fred"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow enabled, 1 entries for user fred
   acl: acl.deny enabled, 2 entries for user fred
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   error: pretxnchangegroup.acl hook failed: acl: user "fred" denied on "foo/Bar/file.txt" (changeset "f9cafe1212c8")
   transaction abort!
   rollback completed
   abort: acl: user "fred" denied on "foo/Bar/file.txt" (changeset "f9cafe1212c8")
   no rollback information available
   0:6675d58eff77
   
 
   $ echo 'barney is not mentioned => not allowed anywhere'
   barney is not mentioned => not allowed anywhere
   $ do_push barney
   Pushing as user barney
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [acl.allow]
   foo/** = fred
   [acl.deny]
   foo/bar/** = fred
   foo/Bar/** = fred
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   adding changesets
   bundling: 1/3 changesets (33.33%)
   bundling: 2/3 changesets (66.67%)
   bundling: 3/3 changesets (100.00%)
   bundling: 1/3 manifests (33.33%)
   bundling: 2/3 manifests (66.67%)
   bundling: 3/3 manifests (100.00%)
   bundling: foo/Bar/file.txt 1/3 files (33.33%)
   bundling: foo/file.txt 2/3 files (66.67%)
   bundling: quux/file.py 3/3 files (100.00%)
   changesets: 1 chunks
   add changeset ef1ea85a6374
   changesets: 2 chunks
   add changeset f9cafe1212c8
   changesets: 3 chunks
   add changeset 911600dab2ae
   adding manifests
   manifests: 1/3 chunks (33.33%)
   manifests: 2/3 chunks (66.67%)
   manifests: 3/3 chunks (100.00%)
   adding file changes
   adding foo/Bar/file.txt revisions
   files: 1/3 chunks (33.33%)
   adding foo/file.txt revisions
   files: 2/3 chunks (66.67%)
   adding quux/file.py revisions
   files: 3/3 chunks (100.00%)
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "barney"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow enabled, 0 entries for user barney
   acl: acl.deny enabled, 0 entries for user barney
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   error: pretxnchangegroup.acl hook failed: acl: user "barney" not allowed on "foo/file.txt" (changeset "ef1ea85a6374")
   transaction abort!
   rollback completed
   abort: acl: user "barney" not allowed on "foo/file.txt" (changeset "ef1ea85a6374")
   no rollback information available
   0:6675d58eff77
   
 
 barney is allowed everywhere
 
   $ echo '[acl.allow]' >> $config
   $ echo '** = barney' >> $config
   $ do_push barney
   Pushing as user barney
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [acl.allow]
   foo/** = fred
   [acl.deny]
   foo/bar/** = fred
   foo/Bar/** = fred
   [acl.allow]
   ** = barney
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   adding changesets
   bundling: 1/3 changesets (33.33%)
   bundling: 2/3 changesets (66.67%)
   bundling: 3/3 changesets (100.00%)
   bundling: 1/3 manifests (33.33%)
   bundling: 2/3 manifests (66.67%)
   bundling: 3/3 manifests (100.00%)
   bundling: foo/Bar/file.txt 1/3 files (33.33%)
   bundling: foo/file.txt 2/3 files (66.67%)
   bundling: quux/file.py 3/3 files (100.00%)
   changesets: 1 chunks
   add changeset ef1ea85a6374
   changesets: 2 chunks
   add changeset f9cafe1212c8
   changesets: 3 chunks
   add changeset 911600dab2ae
   adding manifests
   manifests: 1/3 chunks (33.33%)
   manifests: 2/3 chunks (66.67%)
   manifests: 3/3 chunks (100.00%)
   adding file changes
   adding foo/Bar/file.txt revisions
   files: 1/3 chunks (33.33%)
   adding foo/file.txt revisions
   files: 2/3 chunks (66.67%)
   adding quux/file.py revisions
   files: 3/3 chunks (100.00%)
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "barney"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow enabled, 1 entries for user barney
   acl: acl.deny enabled, 0 entries for user barney
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   acl: path access granted: "911600dab2ae"
   updating the branch cache
   checking for updated bookmarks
   repository tip rolled back to revision 0 (undo push)
   0:6675d58eff77
   
 
 wilma can change files with a .txt extension
 
   $ echo '**/*.txt = wilma' >> $config
   $ do_push wilma
   Pushing as user wilma
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [acl.allow]
   foo/** = fred
   [acl.deny]
   foo/bar/** = fred
   foo/Bar/** = fred
   [acl.allow]
   ** = barney
   **/*.txt = wilma
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   invalidating branch cache (tip differs)
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   adding changesets
   bundling: 1/3 changesets (33.33%)
   bundling: 2/3 changesets (66.67%)
   bundling: 3/3 changesets (100.00%)
   bundling: 1/3 manifests (33.33%)
   bundling: 2/3 manifests (66.67%)
   bundling: 3/3 manifests (100.00%)
   bundling: foo/Bar/file.txt 1/3 files (33.33%)
   bundling: foo/file.txt 2/3 files (66.67%)
   bundling: quux/file.py 3/3 files (100.00%)
   changesets: 1 chunks
   add changeset ef1ea85a6374
   changesets: 2 chunks
   add changeset f9cafe1212c8
   changesets: 3 chunks
   add changeset 911600dab2ae
   adding manifests
   manifests: 1/3 chunks (33.33%)
   manifests: 2/3 chunks (66.67%)
   manifests: 3/3 chunks (100.00%)
   adding file changes
   adding foo/Bar/file.txt revisions
   files: 1/3 chunks (33.33%)
   adding foo/file.txt revisions
   files: 2/3 chunks (66.67%)
   adding quux/file.py revisions
   files: 3/3 chunks (100.00%)
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "wilma"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow enabled, 1 entries for user wilma
   acl: acl.deny enabled, 0 entries for user wilma
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   error: pretxnchangegroup.acl hook failed: acl: user "wilma" not allowed on "quux/file.py" (changeset "911600dab2ae")
   transaction abort!
   rollback completed
   abort: acl: user "wilma" not allowed on "quux/file.py" (changeset "911600dab2ae")
   no rollback information available
   0:6675d58eff77
   
 
 file specified by acl.config does not exist
 
   $ echo '[acl]' >> $config
   $ echo 'config = ../acl.config' >> $config
   $ do_push barney
   Pushing as user barney
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [acl.allow]
   foo/** = fred
   [acl.deny]
   foo/bar/** = fred
   foo/Bar/** = fred
   [acl.allow]
   ** = barney
   **/*.txt = wilma
   [acl]
   config = ../acl.config
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   adding changesets
   bundling: 1/3 changesets (33.33%)
   bundling: 2/3 changesets (66.67%)
   bundling: 3/3 changesets (100.00%)
   bundling: 1/3 manifests (33.33%)
   bundling: 2/3 manifests (66.67%)
   bundling: 3/3 manifests (100.00%)
   bundling: foo/Bar/file.txt 1/3 files (33.33%)
   bundling: foo/file.txt 2/3 files (66.67%)
   bundling: quux/file.py 3/3 files (100.00%)
   changesets: 1 chunks
   add changeset ef1ea85a6374
   changesets: 2 chunks
   add changeset f9cafe1212c8
   changesets: 3 chunks
   add changeset 911600dab2ae
   adding manifests
   manifests: 1/3 chunks (33.33%)
   manifests: 2/3 chunks (66.67%)
   manifests: 3/3 chunks (100.00%)
   adding file changes
   adding foo/Bar/file.txt revisions
   files: 1/3 chunks (33.33%)
   adding foo/file.txt revisions
   files: 2/3 chunks (66.67%)
   adding quux/file.py revisions
   files: 3/3 chunks (100.00%)
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "barney"
   error: pretxnchangegroup.acl hook raised an exception: [Errno 2] *: '../acl.config' (glob)
   transaction abort!
   rollback completed
   abort: *: ../acl.config (glob)
   no rollback information available
   0:6675d58eff77
   
 
 betty is allowed inside foo/ by a acl.config file
 
   $ echo '[acl.allow]' >> acl.config
   $ echo 'foo/** = betty' >> acl.config
   $ do_push betty
   Pushing as user betty
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [acl.allow]
   foo/** = fred
   [acl.deny]
   foo/bar/** = fred
   foo/Bar/** = fred
   [acl.allow]
   ** = barney
   **/*.txt = wilma
   [acl]
   config = ../acl.config
   """
   acl.config = """
   [acl.allow]
   foo/** = betty
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   adding changesets
   bundling: 1/3 changesets (33.33%)
   bundling: 2/3 changesets (66.67%)
   bundling: 3/3 changesets (100.00%)
   bundling: 1/3 manifests (33.33%)
   bundling: 2/3 manifests (66.67%)
   bundling: 3/3 manifests (100.00%)
   bundling: foo/Bar/file.txt 1/3 files (33.33%)
   bundling: foo/file.txt 2/3 files (66.67%)
   bundling: quux/file.py 3/3 files (100.00%)
   changesets: 1 chunks
   add changeset ef1ea85a6374
   changesets: 2 chunks
   add changeset f9cafe1212c8
   changesets: 3 chunks
   add changeset 911600dab2ae
   adding manifests
   manifests: 1/3 chunks (33.33%)
   manifests: 2/3 chunks (66.67%)
   manifests: 3/3 chunks (100.00%)
   adding file changes
   adding foo/Bar/file.txt revisions
   files: 1/3 chunks (33.33%)
   adding foo/file.txt revisions
   files: 2/3 chunks (66.67%)
   adding quux/file.py revisions
   files: 3/3 chunks (100.00%)
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "betty"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow enabled, 1 entries for user betty
   acl: acl.deny enabled, 0 entries for user betty
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   error: pretxnchangegroup.acl hook failed: acl: user "betty" not allowed on "quux/file.py" (changeset "911600dab2ae")
   transaction abort!
   rollback completed
   abort: acl: user "betty" not allowed on "quux/file.py" (changeset "911600dab2ae")
   no rollback information available
   0:6675d58eff77
   
 
 acl.config can set only [acl.allow]/[acl.deny]
 
   $ echo '[hooks]' >> acl.config
   $ echo 'changegroup.acl = false' >> acl.config
   $ do_push barney
   Pushing as user barney
   hgrc = """
   [hooks]
   pretxnchangegroup.acl = python:hgext.acl.hook
   [acl]
   sources = push
   [acl.allow]
   foo/** = fred
   [acl.deny]
   foo/bar/** = fred
   foo/Bar/** = fred
   [acl.allow]
   ** = barney
   **/*.txt = wilma
   [acl]
   config = ../acl.config
   """
   acl.config = """
   [acl.allow]
   foo/** = betty
   [hooks]
   changegroup.acl = false
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   adding changesets
   bundling: 1/3 changesets (33.33%)
   bundling: 2/3 changesets (66.67%)
   bundling: 3/3 changesets (100.00%)
   bundling: 1/3 manifests (33.33%)
   bundling: 2/3 manifests (66.67%)
   bundling: 3/3 manifests (100.00%)
   bundling: foo/Bar/file.txt 1/3 files (33.33%)
   bundling: foo/file.txt 2/3 files (66.67%)
   bundling: quux/file.py 3/3 files (100.00%)
   changesets: 1 chunks
   add changeset ef1ea85a6374
   changesets: 2 chunks
   add changeset f9cafe1212c8
   changesets: 3 chunks
   add changeset 911600dab2ae
   adding manifests
   manifests: 1/3 chunks (33.33%)
   manifests: 2/3 chunks (66.67%)
   manifests: 3/3 chunks (100.00%)
   adding file changes
   adding foo/Bar/file.txt revisions
   files: 1/3 chunks (33.33%)
   adding foo/file.txt revisions
   files: 2/3 chunks (66.67%)
   adding quux/file.py revisions
   files: 3/3 chunks (100.00%)
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "barney"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow enabled, 1 entries for user barney
   acl: acl.deny enabled, 0 entries for user barney
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   acl: path access granted: "911600dab2ae"
   updating the branch cache
   checking for updated bookmarks
   repository tip rolled back to revision 0 (undo push)
   0:6675d58eff77
   
 
 asterisk
 
   $ init_config
 
 asterisk test
 
   $ echo '[acl.allow]' >> $config
   $ echo "** = fred" >> $config
 
 fred is always allowed
 
   $ do_push fred
   Pushing as user fred
   hgrc = """
   [acl]
   sources = push
   [extensions]
   [acl.allow]
   ** = fred
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   invalidating branch cache (tip differs)
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   adding changesets
   bundling: 1/3 changesets (33.33%)
   bundling: 2/3 changesets (66.67%)
   bundling: 3/3 changesets (100.00%)
   bundling: 1/3 manifests (33.33%)
   bundling: 2/3 manifests (66.67%)
   bundling: 3/3 manifests (100.00%)
   bundling: foo/Bar/file.txt 1/3 files (33.33%)
   bundling: foo/file.txt 2/3 files (66.67%)
   bundling: quux/file.py 3/3 files (100.00%)
   changesets: 1 chunks
   add changeset ef1ea85a6374
   changesets: 2 chunks
   add changeset f9cafe1212c8
   changesets: 3 chunks
   add changeset 911600dab2ae
   adding manifests
   manifests: 1/3 chunks (33.33%)
   manifests: 2/3 chunks (66.67%)
   manifests: 3/3 chunks (100.00%)
   adding file changes
   adding foo/Bar/file.txt revisions
   files: 1/3 chunks (33.33%)
   adding foo/file.txt revisions
   files: 2/3 chunks (66.67%)
   adding quux/file.py revisions
   files: 3/3 chunks (100.00%)
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "fred"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow enabled, 1 entries for user fred
   acl: acl.deny not enabled
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   acl: path access granted: "911600dab2ae"
   updating the branch cache
   checking for updated bookmarks
   repository tip rolled back to revision 0 (undo push)
   0:6675d58eff77
   
 
   $ echo '[acl.deny]' >> $config
   $ echo "foo/Bar/** = *" >> $config
 
 no one is allowed inside foo/Bar/
 
   $ do_push fred
   Pushing as user fred
   hgrc = """
   [acl]
   sources = push
   [extensions]
   [acl.allow]
   ** = fred
   [acl.deny]
   foo/Bar/** = *
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   invalidating branch cache (tip differs)
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   adding changesets
   bundling: 1/3 changesets (33.33%)
   bundling: 2/3 changesets (66.67%)
   bundling: 3/3 changesets (100.00%)
   bundling: 1/3 manifests (33.33%)
   bundling: 2/3 manifests (66.67%)
   bundling: 3/3 manifests (100.00%)
   bundling: foo/Bar/file.txt 1/3 files (33.33%)
   bundling: foo/file.txt 2/3 files (66.67%)
   bundling: quux/file.py 3/3 files (100.00%)
   changesets: 1 chunks
   add changeset ef1ea85a6374
   changesets: 2 chunks
   add changeset f9cafe1212c8
   changesets: 3 chunks
   add changeset 911600dab2ae
   adding manifests
   manifests: 1/3 chunks (33.33%)
   manifests: 2/3 chunks (66.67%)
   manifests: 3/3 chunks (100.00%)
   adding file changes
   adding foo/Bar/file.txt revisions
   files: 1/3 chunks (33.33%)
   adding foo/file.txt revisions
   files: 2/3 chunks (66.67%)
   adding quux/file.py revisions
   files: 3/3 chunks (100.00%)
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "fred"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow enabled, 1 entries for user fred
   acl: acl.deny enabled, 1 entries for user fred
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   error: pretxnchangegroup.acl hook failed: acl: user "fred" denied on "foo/Bar/file.txt" (changeset "f9cafe1212c8")
   transaction abort!
   rollback completed
   abort: acl: user "fred" denied on "foo/Bar/file.txt" (changeset "f9cafe1212c8")
   no rollback information available
   0:6675d58eff77
   
 
 Groups
 
   $ init_config
 
 OS-level groups
 
   $ echo '[acl.allow]' >> $config
   $ echo "** = @group1" >> $config
 
 @group1 is always allowed
 
   $ do_push fred
   Pushing as user fred
   hgrc = """
   [acl]
   sources = push
   [extensions]
   [acl.allow]
   ** = @group1
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   adding changesets
   bundling: 1/3 changesets (33.33%)
   bundling: 2/3 changesets (66.67%)
   bundling: 3/3 changesets (100.00%)
   bundling: 1/3 manifests (33.33%)
   bundling: 2/3 manifests (66.67%)
   bundling: 3/3 manifests (100.00%)
   bundling: foo/Bar/file.txt 1/3 files (33.33%)
   bundling: foo/file.txt 2/3 files (66.67%)
   bundling: quux/file.py 3/3 files (100.00%)
   changesets: 1 chunks
   add changeset ef1ea85a6374
   changesets: 2 chunks
   add changeset f9cafe1212c8
   changesets: 3 chunks
   add changeset 911600dab2ae
   adding manifests
   manifests: 1/3 chunks (33.33%)
   manifests: 2/3 chunks (66.67%)
   manifests: 3/3 chunks (100.00%)
   adding file changes
   adding foo/Bar/file.txt revisions
   files: 1/3 chunks (33.33%)
   adding foo/file.txt revisions
   files: 2/3 chunks (66.67%)
   adding quux/file.py revisions
   files: 3/3 chunks (100.00%)
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "fred"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: "group1" not defined in [acl.groups]
   acl: acl.allow enabled, 1 entries for user fred
   acl: acl.deny not enabled
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   acl: path access granted: "911600dab2ae"
   updating the branch cache
   checking for updated bookmarks
   repository tip rolled back to revision 0 (undo push)
   0:6675d58eff77
   
 
   $ echo '[acl.deny]' >> $config
   $ echo "foo/Bar/** = @group1" >> $config
 
 @group is allowed inside anything but foo/Bar/
 
   $ do_push fred
   Pushing as user fred
   hgrc = """
   [acl]
   sources = push
   [extensions]
   [acl.allow]
   ** = @group1
   [acl.deny]
   foo/Bar/** = @group1
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   invalidating branch cache (tip differs)
   3 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   adding changesets
   bundling: 1/3 changesets (33.33%)
   bundling: 2/3 changesets (66.67%)
   bundling: 3/3 changesets (100.00%)
   bundling: 1/3 manifests (33.33%)
   bundling: 2/3 manifests (66.67%)
   bundling: 3/3 manifests (100.00%)
   bundling: foo/Bar/file.txt 1/3 files (33.33%)
   bundling: foo/file.txt 2/3 files (66.67%)
   bundling: quux/file.py 3/3 files (100.00%)
   changesets: 1 chunks
   add changeset ef1ea85a6374
   changesets: 2 chunks
   add changeset f9cafe1212c8
   changesets: 3 chunks
   add changeset 911600dab2ae
   adding manifests
   manifests: 1/3 chunks (33.33%)
   manifests: 2/3 chunks (66.67%)
   manifests: 3/3 chunks (100.00%)
   adding file changes
   adding foo/Bar/file.txt revisions
   files: 1/3 chunks (33.33%)
   adding foo/file.txt revisions
   files: 2/3 chunks (66.67%)
   adding quux/file.py revisions
   files: 3/3 chunks (100.00%)
   added 3 changesets with 3 changes to 3 files
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "fred"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: "group1" not defined in [acl.groups]
   acl: acl.allow enabled, 1 entries for user fred
   acl: "group1" not defined in [acl.groups]
   acl: acl.deny enabled, 1 entries for user fred
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   error: pretxnchangegroup.acl hook failed: acl: user "fred" denied on "foo/Bar/file.txt" (changeset "f9cafe1212c8")
   transaction abort!
   rollback completed
   abort: acl: user "fred" denied on "foo/Bar/file.txt" (changeset "f9cafe1212c8")
   no rollback information available
   0:6675d58eff77
   
 
 Invalid group
 
 Disable the fakegroups trick to get real failures
 
   $ grep -v fakegroups $config > config.tmp
   $ mv config.tmp $config
   $ echo '[acl.allow]' >> $config
   $ echo "** = @unlikelytoexist" >> $config
   $ do_push fred 2>&1 | grep unlikelytoexist
   ** = @unlikelytoexist
   acl: "unlikelytoexist" not defined in [acl.groups]
   error: pretxnchangegroup.acl hook failed: group 'unlikelytoexist' is undefined
   abort: group 'unlikelytoexist' is undefined
 
 
 Branch acl tests setup
 
   $ init_config
   $ cd b
   $ hg up
   0 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ hg branch foobar
   marked working directory as branch foobar
   (branches are permanent and global, did you want a bookmark?)
   $ hg commit -m 'create foobar'
   $ echo 'foo contents' > abc.txt
   $ hg add abc.txt
   $ hg commit -m 'foobar contents'
   $ cd ..
   $ hg --cwd a pull ../b
   pulling from ../b
   searching for changes
   adding changesets
   adding manifests
   adding file changes
   added 2 changesets with 1 changes to 1 files (+1 heads)
   (run 'hg heads' to see heads)
 
 Create additional changeset on foobar branch
 
   $ cd a
   $ hg up -C foobar
   4 files updated, 0 files merged, 0 files removed, 0 files unresolved
   $ echo 'foo contents2' > abc.txt
   $ hg commit -m 'foobar contents2'
   $ cd ..
 
 
 No branch acls specified
 
   $ do_push astro
   Pushing as user astro
   hgrc = """
   [acl]
   sources = push
   [extensions]
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   4 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   e8fc755d4d8217ee5b0c2bb41558c40d43b92c01
   adding changesets
   bundling: 1/4 changesets (25.00%)
   bundling: 2/4 changesets (50.00%)
   bundling: 3/4 changesets (75.00%)
   bundling: 4/4 changesets (100.00%)
   bundling: 1/4 manifests (25.00%)
   bundling: 2/4 manifests (50.00%)
   bundling: 3/4 manifests (75.00%)
   bundling: 4/4 manifests (100.00%)
   bundling: abc.txt 1/4 files (25.00%)
   bundling: foo/Bar/file.txt 2/4 files (50.00%)
   bundling: foo/file.txt 3/4 files (75.00%)
   bundling: quux/file.py 4/4 files (100.00%)
   changesets: 1 chunks
   add changeset ef1ea85a6374
   changesets: 2 chunks
   add changeset f9cafe1212c8
   changesets: 3 chunks
   add changeset 911600dab2ae
   changesets: 4 chunks
   add changeset e8fc755d4d82
   adding manifests
   manifests: 1/4 chunks (25.00%)
   manifests: 2/4 chunks (50.00%)
   manifests: 3/4 chunks (75.00%)
   manifests: 4/4 chunks (100.00%)
   adding file changes
   adding abc.txt revisions
   files: 1/4 chunks (25.00%)
   adding foo/Bar/file.txt revisions
   files: 2/4 chunks (50.00%)
   adding foo/file.txt revisions
   files: 3/4 chunks (75.00%)
   adding quux/file.py revisions
   files: 4/4 chunks (100.00%)
   added 4 changesets with 4 changes to 4 files (+1 heads)
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "astro"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches not enabled
   acl: acl.allow not enabled
   acl: acl.deny not enabled
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   acl: path access granted: "911600dab2ae"
   acl: branch access granted: "e8fc755d4d82" on branch "foobar"
   acl: path access granted: "e8fc755d4d82"
   updating the branch cache
   checking for updated bookmarks
   repository tip rolled back to revision 2 (undo push)
   2:fb35475503ef
   
 
 Branch acl deny test
 
   $ echo "[acl.deny.branches]" >> $config
   $ echo "foobar = *" >> $config
   $ do_push astro
   Pushing as user astro
   hgrc = """
   [acl]
   sources = push
   [extensions]
   [acl.deny.branches]
   foobar = *
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   invalidating branch cache (tip differs)
   4 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   e8fc755d4d8217ee5b0c2bb41558c40d43b92c01
   adding changesets
   bundling: 1/4 changesets (25.00%)
   bundling: 2/4 changesets (50.00%)
   bundling: 3/4 changesets (75.00%)
   bundling: 4/4 changesets (100.00%)
   bundling: 1/4 manifests (25.00%)
   bundling: 2/4 manifests (50.00%)
   bundling: 3/4 manifests (75.00%)
   bundling: 4/4 manifests (100.00%)
   bundling: abc.txt 1/4 files (25.00%)
   bundling: foo/Bar/file.txt 2/4 files (50.00%)
   bundling: foo/file.txt 3/4 files (75.00%)
   bundling: quux/file.py 4/4 files (100.00%)
   changesets: 1 chunks
   add changeset ef1ea85a6374
   changesets: 2 chunks
   add changeset f9cafe1212c8
   changesets: 3 chunks
   add changeset 911600dab2ae
   changesets: 4 chunks
   add changeset e8fc755d4d82
   adding manifests
   manifests: 1/4 chunks (25.00%)
   manifests: 2/4 chunks (50.00%)
   manifests: 3/4 chunks (75.00%)
   manifests: 4/4 chunks (100.00%)
   adding file changes
   adding abc.txt revisions
   files: 1/4 chunks (25.00%)
   adding foo/Bar/file.txt revisions
   files: 2/4 chunks (50.00%)
   adding foo/file.txt revisions
   files: 3/4 chunks (75.00%)
   adding quux/file.py revisions
   files: 4/4 chunks (100.00%)
   added 4 changesets with 4 changes to 4 files (+1 heads)
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "astro"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches enabled, 1 entries for user astro
   acl: acl.allow not enabled
   acl: acl.deny not enabled
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   acl: path access granted: "911600dab2ae"
   error: pretxnchangegroup.acl hook failed: acl: user "astro" denied on branch "foobar" (changeset "e8fc755d4d82")
   transaction abort!
   rollback completed
   abort: acl: user "astro" denied on branch "foobar" (changeset "e8fc755d4d82")
   no rollback information available
   2:fb35475503ef
   
 
 Branch acl empty allow test
 
   $ init_config
   $ echo "[acl.allow.branches]" >> $config
   $ do_push astro
   Pushing as user astro
   hgrc = """
   [acl]
   sources = push
   [extensions]
   [acl.allow.branches]
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   4 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   e8fc755d4d8217ee5b0c2bb41558c40d43b92c01
   adding changesets
   bundling: 1/4 changesets (25.00%)
   bundling: 2/4 changesets (50.00%)
   bundling: 3/4 changesets (75.00%)
   bundling: 4/4 changesets (100.00%)
   bundling: 1/4 manifests (25.00%)
   bundling: 2/4 manifests (50.00%)
   bundling: 3/4 manifests (75.00%)
   bundling: 4/4 manifests (100.00%)
   bundling: abc.txt 1/4 files (25.00%)
   bundling: foo/Bar/file.txt 2/4 files (50.00%)
   bundling: foo/file.txt 3/4 files (75.00%)
   bundling: quux/file.py 4/4 files (100.00%)
   changesets: 1 chunks
   add changeset ef1ea85a6374
   changesets: 2 chunks
   add changeset f9cafe1212c8
   changesets: 3 chunks
   add changeset 911600dab2ae
   changesets: 4 chunks
   add changeset e8fc755d4d82
   adding manifests
   manifests: 1/4 chunks (25.00%)
   manifests: 2/4 chunks (50.00%)
   manifests: 3/4 chunks (75.00%)
   manifests: 4/4 chunks (100.00%)
   adding file changes
   adding abc.txt revisions
   files: 1/4 chunks (25.00%)
   adding foo/Bar/file.txt revisions
   files: 2/4 chunks (50.00%)
   adding foo/file.txt revisions
   files: 3/4 chunks (75.00%)
   adding quux/file.py revisions
   files: 4/4 chunks (100.00%)
   added 4 changesets with 4 changes to 4 files (+1 heads)
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "astro"
   acl: acl.allow.branches enabled, 0 entries for user astro
   acl: acl.deny.branches not enabled
   acl: acl.allow not enabled
   acl: acl.deny not enabled
   error: pretxnchangegroup.acl hook failed: acl: user "astro" not allowed on branch "default" (changeset "ef1ea85a6374")
   transaction abort!
   rollback completed
   abort: acl: user "astro" not allowed on branch "default" (changeset "ef1ea85a6374")
   no rollback information available
   2:fb35475503ef
   
 
 Branch acl allow other
 
   $ init_config
   $ echo "[acl.allow.branches]" >> $config
   $ echo "* = george" >> $config
   $ do_push astro
   Pushing as user astro
   hgrc = """
   [acl]
   sources = push
   [extensions]
   [acl.allow.branches]
   * = george
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   4 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   e8fc755d4d8217ee5b0c2bb41558c40d43b92c01
   adding changesets
   bundling: 1/4 changesets (25.00%)
   bundling: 2/4 changesets (50.00%)
   bundling: 3/4 changesets (75.00%)
   bundling: 4/4 changesets (100.00%)
   bundling: 1/4 manifests (25.00%)
   bundling: 2/4 manifests (50.00%)
   bundling: 3/4 manifests (75.00%)
   bundling: 4/4 manifests (100.00%)
   bundling: abc.txt 1/4 files (25.00%)
   bundling: foo/Bar/file.txt 2/4 files (50.00%)
   bundling: foo/file.txt 3/4 files (75.00%)
   bundling: quux/file.py 4/4 files (100.00%)
   changesets: 1 chunks
   add changeset ef1ea85a6374
   changesets: 2 chunks
   add changeset f9cafe1212c8
   changesets: 3 chunks
   add changeset 911600dab2ae
   changesets: 4 chunks
   add changeset e8fc755d4d82
   adding manifests
   manifests: 1/4 chunks (25.00%)
   manifests: 2/4 chunks (50.00%)
   manifests: 3/4 chunks (75.00%)
   manifests: 4/4 chunks (100.00%)
   adding file changes
   adding abc.txt revisions
   files: 1/4 chunks (25.00%)
   adding foo/Bar/file.txt revisions
   files: 2/4 chunks (50.00%)
   adding foo/file.txt revisions
   files: 3/4 chunks (75.00%)
   adding quux/file.py revisions
   files: 4/4 chunks (100.00%)
   added 4 changesets with 4 changes to 4 files (+1 heads)
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "astro"
   acl: acl.allow.branches enabled, 0 entries for user astro
   acl: acl.deny.branches not enabled
   acl: acl.allow not enabled
   acl: acl.deny not enabled
   error: pretxnchangegroup.acl hook failed: acl: user "astro" not allowed on branch "default" (changeset "ef1ea85a6374")
   transaction abort!
   rollback completed
   abort: acl: user "astro" not allowed on branch "default" (changeset "ef1ea85a6374")
   no rollback information available
   2:fb35475503ef
   
   $ do_push george
   Pushing as user george
   hgrc = """
   [acl]
   sources = push
   [extensions]
   [acl.allow.branches]
   * = george
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   4 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   e8fc755d4d8217ee5b0c2bb41558c40d43b92c01
   adding changesets
   bundling: 1/4 changesets (25.00%)
   bundling: 2/4 changesets (50.00%)
   bundling: 3/4 changesets (75.00%)
   bundling: 4/4 changesets (100.00%)
   bundling: 1/4 manifests (25.00%)
   bundling: 2/4 manifests (50.00%)
   bundling: 3/4 manifests (75.00%)
   bundling: 4/4 manifests (100.00%)
   bundling: abc.txt 1/4 files (25.00%)
   bundling: foo/Bar/file.txt 2/4 files (50.00%)
   bundling: foo/file.txt 3/4 files (75.00%)
   bundling: quux/file.py 4/4 files (100.00%)
   changesets: 1 chunks
   add changeset ef1ea85a6374
   changesets: 2 chunks
   add changeset f9cafe1212c8
   changesets: 3 chunks
   add changeset 911600dab2ae
   changesets: 4 chunks
   add changeset e8fc755d4d82
   adding manifests
   manifests: 1/4 chunks (25.00%)
   manifests: 2/4 chunks (50.00%)
   manifests: 3/4 chunks (75.00%)
   manifests: 4/4 chunks (100.00%)
   adding file changes
   adding abc.txt revisions
   files: 1/4 chunks (25.00%)
   adding foo/Bar/file.txt revisions
   files: 2/4 chunks (50.00%)
   adding foo/file.txt revisions
   files: 3/4 chunks (75.00%)
   adding quux/file.py revisions
   files: 4/4 chunks (100.00%)
   added 4 changesets with 4 changes to 4 files (+1 heads)
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "george"
   acl: acl.allow.branches enabled, 1 entries for user george
   acl: acl.deny.branches not enabled
   acl: acl.allow not enabled
   acl: acl.deny not enabled
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   acl: path access granted: "911600dab2ae"
   acl: branch access granted: "e8fc755d4d82" on branch "foobar"
   acl: path access granted: "e8fc755d4d82"
   updating the branch cache
   checking for updated bookmarks
   repository tip rolled back to revision 2 (undo push)
   2:fb35475503ef
   
 
 Branch acl conflicting allow
 asterisk ends up applying to all branches and allowing george to
 push foobar into the remote
 
   $ init_config
   $ echo "[acl.allow.branches]" >> $config
   $ echo "foobar = astro" >> $config
   $ echo "* = george" >> $config
   $ do_push george
   Pushing as user george
   hgrc = """
   [acl]
   sources = push
   [extensions]
   [acl.allow.branches]
   foobar = astro
   * = george
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   invalidating branch cache (tip differs)
   4 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   e8fc755d4d8217ee5b0c2bb41558c40d43b92c01
   adding changesets
   bundling: 1/4 changesets (25.00%)
   bundling: 2/4 changesets (50.00%)
   bundling: 3/4 changesets (75.00%)
   bundling: 4/4 changesets (100.00%)
   bundling: 1/4 manifests (25.00%)
   bundling: 2/4 manifests (50.00%)
   bundling: 3/4 manifests (75.00%)
   bundling: 4/4 manifests (100.00%)
   bundling: abc.txt 1/4 files (25.00%)
   bundling: foo/Bar/file.txt 2/4 files (50.00%)
   bundling: foo/file.txt 3/4 files (75.00%)
   bundling: quux/file.py 4/4 files (100.00%)
   changesets: 1 chunks
   add changeset ef1ea85a6374
   changesets: 2 chunks
   add changeset f9cafe1212c8
   changesets: 3 chunks
   add changeset 911600dab2ae
   changesets: 4 chunks
   add changeset e8fc755d4d82
   adding manifests
   manifests: 1/4 chunks (25.00%)
   manifests: 2/4 chunks (50.00%)
   manifests: 3/4 chunks (75.00%)
   manifests: 4/4 chunks (100.00%)
   adding file changes
   adding abc.txt revisions
   files: 1/4 chunks (25.00%)
   adding foo/Bar/file.txt revisions
   files: 2/4 chunks (50.00%)
   adding foo/file.txt revisions
   files: 3/4 chunks (75.00%)
   adding quux/file.py revisions
   files: 4/4 chunks (100.00%)
   added 4 changesets with 4 changes to 4 files (+1 heads)
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "george"
   acl: acl.allow.branches enabled, 1 entries for user george
   acl: acl.deny.branches not enabled
   acl: acl.allow not enabled
   acl: acl.deny not enabled
   acl: branch access granted: "ef1ea85a6374" on branch "default"
   acl: path access granted: "ef1ea85a6374"
   acl: branch access granted: "f9cafe1212c8" on branch "default"
   acl: path access granted: "f9cafe1212c8"
   acl: branch access granted: "911600dab2ae" on branch "default"
   acl: path access granted: "911600dab2ae"
   acl: branch access granted: "e8fc755d4d82" on branch "foobar"
   acl: path access granted: "e8fc755d4d82"
   updating the branch cache
   checking for updated bookmarks
   repository tip rolled back to revision 2 (undo push)
   2:fb35475503ef
   
 Branch acl conflicting deny
 
   $ init_config
   $ echo "[acl.deny.branches]" >> $config
   $ echo "foobar = astro" >> $config
   $ echo "default = astro" >> $config
   $ echo "* = george" >> $config
   $ do_push george
   Pushing as user george
   hgrc = """
   [acl]
   sources = push
   [extensions]
   [acl.deny.branches]
   foobar = astro
   default = astro
   * = george
   """
   pushing to ../b
   query 1; heads
   searching for changes
   all remote heads known locally
   invalidating branch cache (tip differs)
   4 changesets found
   list of changesets:
   ef1ea85a6374b77d6da9dcda9541f498f2d17df7
   f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
   911600dab2ae7a9baff75958b84fe606851ce955
   e8fc755d4d8217ee5b0c2bb41558c40d43b92c01
   adding changesets
   bundling: 1/4 changesets (25.00%)
   bundling: 2/4 changesets (50.00%)
   bundling: 3/4 changesets (75.00%)
   bundling: 4/4 changesets (100.00%)
   bundling: 1/4 manifests (25.00%)
   bundling: 2/4 manifests (50.00%)
   bundling: 3/4 manifests (75.00%)
   bundling: 4/4 manifests (100.00%)
   bundling: abc.txt 1/4 files (25.00%)
   bundling: foo/Bar/file.txt 2/4 files (50.00%)
   bundling: foo/file.txt 3/4 files (75.00%)
   bundling: quux/file.py 4/4 files (100.00%)
   changesets: 1 chunks
   add changeset ef1ea85a6374
   changesets: 2 chunks
   add changeset f9cafe1212c8
   changesets: 3 chunks
   add changeset 911600dab2ae
   changesets: 4 chunks
   add changeset e8fc755d4d82
   adding manifests
   manifests: 1/4 chunks (25.00%)
   manifests: 2/4 chunks (50.00%)
   manifests: 3/4 chunks (75.00%)
   manifests: 4/4 chunks (100.00%)
   adding file changes
   adding abc.txt revisions
   files: 1/4 chunks (25.00%)
   adding foo/Bar/file.txt revisions
   files: 2/4 chunks (50.00%)
   adding foo/file.txt revisions
   files: 3/4 chunks (75.00%)
   adding quux/file.py revisions
   files: 4/4 chunks (100.00%)
   added 4 changesets with 4 changes to 4 files (+1 heads)
   calling hook pretxnchangegroup.acl: hgext.acl.hook
   acl: checking access for user "george"
   acl: acl.allow.branches not enabled
   acl: acl.deny.branches enabled, 1 entries for user george
   acl: acl.allow not enabled
   acl: acl.deny not enabled
   error: pretxnchangegroup.acl hook failed: acl: user "george" denied on branch "default" (changeset "ef1ea85a6374")
   transaction abort!
   rollback completed
   abort: acl: user "george" denied on branch "default" (changeset "ef1ea85a6374")
   no rollback information available
   2:fb35475503ef
   
+User 'astro' must not be denied
+
+  $ init_config
+  $ echo "[acl.deny.branches]" >> $config
+  $ echo "default = !astro" >> $config
+  $ do_push astro
+  Pushing as user astro
+  hgrc = """
+  [acl]
+  sources = push
+  [extensions]
+  [acl.deny.branches]
+  default = !astro
+  """
+  pushing to ../b
+  query 1; heads
+  searching for changes
+  all remote heads known locally
+  4 changesets found
+  list of changesets:
+  ef1ea85a6374b77d6da9dcda9541f498f2d17df7
+  f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
+  911600dab2ae7a9baff75958b84fe606851ce955
+  e8fc755d4d8217ee5b0c2bb41558c40d43b92c01
+  adding changesets
+  bundling: 1/4 changesets (25.00%)
+  bundling: 2/4 changesets (50.00%)
+  bundling: 3/4 changesets (75.00%)
+  bundling: 4/4 changesets (100.00%)
+  bundling: 1/4 manifests (25.00%)
+  bundling: 2/4 manifests (50.00%)
+  bundling: 3/4 manifests (75.00%)
+  bundling: 4/4 manifests (100.00%)
+  bundling: abc.txt 1/4 files (25.00%)
+  bundling: foo/Bar/file.txt 2/4 files (50.00%)
+  bundling: foo/file.txt 3/4 files (75.00%)
+  bundling: quux/file.py 4/4 files (100.00%)
+  changesets: 1 chunks
+  add changeset ef1ea85a6374
+  changesets: 2 chunks
+  add changeset f9cafe1212c8
+  changesets: 3 chunks
+  add changeset 911600dab2ae
+  changesets: 4 chunks
+  add changeset e8fc755d4d82
+  adding manifests
+  manifests: 1/4 chunks (25.00%)
+  manifests: 2/4 chunks (50.00%)
+  manifests: 3/4 chunks (75.00%)
+  manifests: 4/4 chunks (100.00%)
+  adding file changes
+  adding abc.txt revisions
+  files: 1/4 chunks (25.00%)
+  adding foo/Bar/file.txt revisions
+  files: 2/4 chunks (50.00%)
+  adding foo/file.txt revisions
+  files: 3/4 chunks (75.00%)
+  adding quux/file.py revisions
+  files: 4/4 chunks (100.00%)
+  added 4 changesets with 4 changes to 4 files (+1 heads)
+  calling hook pretxnchangegroup.acl: hgext.acl.hook
+  acl: checking access for user "astro"
+  acl: acl.allow.branches not enabled
+  acl: acl.deny.branches enabled, 0 entries for user astro
+  acl: acl.allow not enabled
+  acl: acl.deny not enabled
+  acl: branch access granted: "ef1ea85a6374" on branch "default"
+  acl: path access granted: "ef1ea85a6374"
+  acl: branch access granted: "f9cafe1212c8" on branch "default"
+  acl: path access granted: "f9cafe1212c8"
+  acl: branch access granted: "911600dab2ae" on branch "default"
+  acl: path access granted: "911600dab2ae"
+  acl: branch access granted: "e8fc755d4d82" on branch "foobar"
+  acl: path access granted: "e8fc755d4d82"
+  updating the branch cache
+  checking for updated bookmarks
+  repository tip rolled back to revision 2 (undo push)
+  2:fb35475503ef
+  
+
+Non-astro users must be denied
+
+  $ do_push george
+  Pushing as user george
+  hgrc = """
+  [acl]
+  sources = push
+  [extensions]
+  [acl.deny.branches]
+  default = !astro
+  """
+  pushing to ../b
+  query 1; heads
+  searching for changes
+  all remote heads known locally
+  invalidating branch cache (tip differs)
+  4 changesets found
+  list of changesets:
+  ef1ea85a6374b77d6da9dcda9541f498f2d17df7
+  f9cafe1212c8c6fa1120d14a556e18cc44ff8bdd
+  911600dab2ae7a9baff75958b84fe606851ce955
+  e8fc755d4d8217ee5b0c2bb41558c40d43b92c01
+  adding changesets
+  bundling: 1/4 changesets (25.00%)
+  bundling: 2/4 changesets (50.00%)
+  bundling: 3/4 changesets (75.00%)
+  bundling: 4/4 changesets (100.00%)
+  bundling: 1/4 manifests (25.00%)
+  bundling: 2/4 manifests (50.00%)
+  bundling: 3/4 manifests (75.00%)
+  bundling: 4/4 manifests (100.00%)
+  bundling: abc.txt 1/4 files (25.00%)
+  bundling: foo/Bar/file.txt 2/4 files (50.00%)
+  bundling: foo/file.txt 3/4 files (75.00%)
+  bundling: quux/file.py 4/4 files (100.00%)
+  changesets: 1 chunks
+  add changeset ef1ea85a6374
+  changesets: 2 chunks
+  add changeset f9cafe1212c8
+  changesets: 3 chunks
+  add changeset 911600dab2ae
+  changesets: 4 chunks
+  add changeset e8fc755d4d82
+  adding manifests
+  manifests: 1/4 chunks (25.00%)
+  manifests: 2/4 chunks (50.00%)
+  manifests: 3/4 chunks (75.00%)
+  manifests: 4/4 chunks (100.00%)
+  adding file changes
+  adding abc.txt revisions
+  files: 1/4 chunks (25.00%)
+  adding foo/Bar/file.txt revisions
+  files: 2/4 chunks (50.00%)
+  adding foo/file.txt revisions
+  files: 3/4 chunks (75.00%)
+  adding quux/file.py revisions
+  files: 4/4 chunks (100.00%)
+  added 4 changesets with 4 changes to 4 files (+1 heads)
+  calling hook pretxnchangegroup.acl: hgext.acl.hook
+  acl: checking access for user "george"
+  acl: acl.allow.branches not enabled
+  acl: acl.deny.branches enabled, 1 entries for user george
+  acl: acl.allow not enabled
+  acl: acl.deny not enabled
+  error: pretxnchangegroup.acl hook failed: acl: user "george" denied on branch "default" (changeset "ef1ea85a6374")
+  transaction abort!
+  rollback completed
+  abort: acl: user "george" denied on branch "default" (changeset "ef1ea85a6374")
+  no rollback information available
+  2:fb35475503ef
+  
+