project-based-sec-add.mangle: Script to enable default proj-based security.

2 files changed, 34 insertions, 0 deletions

diff --git a/utils/mangle-jobs/mangle_helper.py b/utils/mangle-jobs/mangle_helper.py
index 93735a9..363d2c2 100644
--- a/utils/mangle-jobs/mangle_helper.py
+++ b/utils/mangle-jobs/mangle_helper.py
@@ -29,3 +29,20 @@ def add_or_replace_node(tree, node_xpath, node_text):
         parent_xpath, _ = node_xpath.rsplit("/", 1)
         parent = tree.xpath(parent_xpath)[0]
         parent.append(new_node)
+
+
+def add_child(tree, node_xpath, node_text):
+    "Add new node (node_text) as last child of node_xpath."
+    nodes = tree.xpath(node_xpath)
+    assert len(nodes) == 1, "Found %d nodes with XPath %s, expected 1" % (len(nodes), node_xpath)
+    new_node = lxml.etree.fromstring(node_text)
+    nodes[0].append(new_node)
+
+
+def add_sibling(tree, node_xpath, node_text):
+    "Add new node (node_text) as next sibling after node_xpath."
+    new_node = lxml.etree.fromstring(node_text)
+    nodes = tree.xpath(node_xpath)
+    assert len(nodes) > 0, "Node not found: %s" % node_xpath
+    assert len(nodes) < 2, "Please use more selective XPath expression than %s" % node_xpath
+    nodes[0].addnext(new_node)
diff --git a/utils/mangle-jobs/project-based-sec-add.mangle b/utils/mangle-jobs/project-based-sec-add.mangle
new file mode 100644
index 0000000..d59faaf
--- /dev/null
+++ b/utils/mangle-jobs/project-based-sec-add.mangle
@@ -0,0 +1,17 @@
+# Add default project-based security setting for project (anon read access)
+
+from lxml.etree import fromstring
+from mangle_helper import *
+
+new_node = """\
+    <hudson.security.AuthorizationMatrixProperty>
+      <permission>hudson.model.Item.Read:anonymous</permission>
+    </hudson.security.AuthorizationMatrixProperty>
+"""
+
+def mangle(tree):
+    if tree.xpath("//properties/hudson.security.AuthorizationMatrixProperty"):
+        # Needed config already there - don't change
+        return False
+
+    add_child(tree, "/project/properties", new_node)