Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for specifying multiple superusers #37

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion README.md
Original file line number Diff line number Diff line change
@@ -76,7 +76,13 @@ user by defining `$DOKKU_SUPER_USER` env in `~dokku/.dokkurc/acl`:
export DOKKU_SUPER_USER=puck
```

If defined, this user is always allowed to push, and no other users are allowed to push to apps with empty ACLs.
If defined, this user (or users) is always allowed to push, and no other users are allowed to push to apps with empty ACLs.

You can also specify multiple users:

```shell
export DOKKU_SUPER_USER="dokku puck"
```

### command restrictions

8 changes: 5 additions & 3 deletions internal-functions
Original file line number Diff line number Diff line change
@@ -126,9 +126,11 @@ fn-acl-is-super-user() {
declare desc="check if the specified user is a super user"
declare USERNAME="$1"

if [[ "$USERNAME" == "$DOKKU_SUPER_USER" ]]; then
return
fi
for super_user in $DOKKU_SUPER_USER; do
if [[ "$USERNAME" == "$super_user" ]]; then
return
fi
done

return 1
}
5 changes: 3 additions & 2 deletions pre-build
Original file line number Diff line number Diff line change
@@ -2,6 +2,7 @@
set -eo pipefail
[[ $DOKKU_TRACE ]] && set -x
source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
source "$(dirname "${BASH_SOURCE[0]}")/internal-functions"

APP="$1"
ACL="$DOKKU_ROOT/$APP/acl"
@@ -26,7 +27,7 @@ if [[ -z "$NAME" ]]; then
fi

if [[ ! -d "$ACL" ]]; then
if [[ -n "$DOKKU_SUPER_USER" ]] && [[ "$NAME" != "$DOKKU_SUPER_USER" ]]; then
if [[ -n "$DOKKU_SUPER_USER" ]] && ! fn-acl-is-super-user "$NAME"; then
dokku_log_fail "Only $DOKKU_SUPER_USER can modify a repository if the ACL is empty"
fi

@@ -35,7 +36,7 @@ fi

ACL_FILE="$ACL/$NAME"

if [[ ! -f "$ACL_FILE" ]] && [[ "$NAME" != "$DOKKU_SUPER_USER" ]]; then
if [[ ! -f "$ACL_FILE" ]] && ! fn-acl-is-super-user "$NAME"; then
echo "User $NAME does not have permissions to modify this repository" >&2
exit 2
fi
2 changes: 1 addition & 1 deletion user-auth
Original file line number Diff line number Diff line change
@@ -20,7 +20,7 @@ shift 2

[[ -z "$DOKKU_ACL_USER_COMMANDS" && -z "$DOKKU_ACL_PER_APP_COMMANDS" && -z "$DOKKU_ACL_PER_SERVICE_COMMANDS" && -z "$DOKKU_ACL_LINK_COMMANDS" ]] && exit 0
[[ "$SSH_USER" == "root" ]] && exit 0
[[ -n "$DOKKU_SUPER_USER" ]] && [[ "$SSH_NAME" == "$DOKKU_SUPER_USER" ]] && exit 0
[[ -n "$DOKKU_SUPER_USER" ]] && fn-acl-is-super-user "$SSH_NAME" && exit 0

CMD=$1