Re: [p4] Anyone have a way to preview p4 protect updates outside of the P4V admin tool?

Posted on behalf of forum user 'mcru'.

That's actually not the worlds most terrible idea. What I'm even doing
in the first place is somewhat nuts. To give you guys a little background...

I'm placing a new ACL model on top of p4 protect. We need to ACL our code
down to the file level, with multiple delegated and sub-delegated paths. We also
need to let the 'project' owners apply and delegate their own ACLs,
without having any access to any other projects. I also need to migrate a
non-trivial number of SVN repositories (which aren't even actual
repositories, they are individual directories under a single repo) to p4, while
maintaining the existing ACLs from SVN. The only real way to do this is to port
the ACL model from our existing SVN setup over to p4.

What I'm doing is creating an acl repo that is a big tree of all p4 paths to
protect, with each 'repo' owner having write access on the path to the
files that will maintain the acl for their project(s). Any sub-delegated paths
will write a file under this same path that is writable to the repo owner, and
the users selected for sub-delegation. The sub-delegated path owners can further
sub-delegate if necessary. 

Each repo that is delegated to an owner or group of owners is given the owner
permission in the base protects table, owned by a service user, to keep all acl
lines for that path outside of the base protect table.

The new ACL model is much more simple than the p4 protects model, and much more
flexible. It allows the depot or sub-delegate owners to define their own groups
of users or groups of files to protect, and apply permissions in a way that are
additive, but automatically get restrictive as finer grained paths are defined.
These rules are written following a specified format that, when checked back
into perforce, is automatically parsed/verified via pre-submit trigger. If all
checks pass the file is submitted, and a post submit trigger expands the rules
across all acl files related to the path to acl, plus any delegate or sub
delegate files, and generates p4 protect lines. The server user that was given
ownership on the path to this repo then takes the generated protect lines and
updates the delegated p4 protects table file. 

So far, this is working great. And it actually wasn't that bad to write with
p4 python. What I need to do now is to give users a way to preview what their
changes will do before they submit them. For example, a repo owner or a
delegate/sub-delegate should be able to run a script against the new ACL model
file they own that will combine all related files, generate the protect lines
that would be applied, and then display all paths a specified user can
read/write to under that path using the generated protect lines. It would be a
breeze if I had access to the same algorithm that p4 uses to apply protections
based on the protect table, but I can guarantee I will F this up if rolling my
own check, miss some edge case, and lead someone to apply incorrect permissions.
This is a huge no-no for us. 

Matt - you've got me thinking now... what if I applied the protects to a
local DVCS clone of the path to protect and ran the check against that? I think
it would work, but I'm not a fan of writing the clone to users's disk
and cleaning that up. Also, not even sure if I can apply protections to a local
DVCS instance or not. 

So far, I'm thinking my best bet is to test a few specific scenarios of p4
protect and force my generated protect lines to match those scenarios and those
scenarios only. That way, I can write reliable tests and generate reliable
previews using those tests. The only downside is this might be really limiting
in what I can support protections wise.



--
Please click here to see the post in its original format:
  http://forums.perforce.com/index.php?/topic/5674-anyone-have-a-way-to-preview-p4-protect-updates-outside-of-the-p4v-admin-tool
_______________________________________________
perforce-user mailing list  -  [email protected]
http://maillist.perforce.com/mailman/listinfo/perforce-user