auth: add basic authentication filter framework

[ps-cgit] / cgitrc.5.txt

diff --git a/cgitrc.5.txt b/cgitrc.5.txt
index 8b0ad21270d992fdebcc3469188df7b64a875a2f..c45dbd3681de8f7a258d8f84669d1bc08ca7d6d5 100644 (file)
--- a/cgitrc.5.txt
+++ b/cgitrc.5.txt
@@ -42,6 +42,13 @@ agefile::
        hh:mm:ss". You may want to generate this file from a post-receive
        hook. Default value: "info/web/last-modified".
 
        hh:mm:ss". You may want to generate this file from a post-receive
        hook. Default value: "info/web/last-modified".
 

+auth-filter::
+       Specifies a command that will be invoked for authenticating repository
+       access. Receives quite a few arguments, and data on both stdin and
+       stdout for authentication processing. Details follow later in this
+       document. If no auth-filter is specified, no authentication is
+       performed. Default value: none. See also: "FILTER API".
+

 branch-sort::
        Flag which, when set to "age", enables date ordering in the branch ref
        list, and when set to "name" enables ordering by branch name. Default
 branch-sort::
        Flag which, when set to "age", enables date ordering in the branch ref
        list, and when set to "name" enables ordering by branch name. Default


@@ -117,6 +124,14 @@ css::
        Url which specifies the css document to include in all cgit pages.
        Default value: "/cgit.css".
 
        Url which specifies the css document to include in all cgit pages.
        Default value: "/cgit.css".
 

+email-filter::
+       Specifies a command which will be invoked to format names and email
+       address of committers, authors, and taggers, as represented in various
+       places throughout the cgit interface. This command will receive an
+       email address and an origin page string as its command line arguments,
+       and the text to format on STDIN. It is to write the formatted text back
+       out onto STDOUT. Default value: none. See also: "FILTER API".
+

 embedded::
        Flag which, when set to "1", will make cgit generate a html fragment
        suitable for embedding in other html pages. Default value: none. See
 embedded::
        Flag which, when set to "1", will make cgit generate a html fragment
        suitable for embedding in other html pages. Default value: none. See


@@ -133,8 +148,9 @@ enable-filter-overrides::
 
 enable-http-clone::
        If set to "1", cgit will act as an dumb HTTP endpoint for git clones.
 
 enable-http-clone::
        If set to "1", cgit will act as an dumb HTTP endpoint for git clones.

-       If you use an alternate way of serving git repositories, you may wish
-       to disable this. Default value: "1".
+       You can add "http://$HTTP_HOST$SCRIPT_NAME/$CGIT_REPO_URL" to clone-url
+       to expose this feature. If you use an alternate way of serving git
+       repositories, you may wish to disable this. Default value: "1".

 
 enable-index-links::
        Flag which, when set to "1", will make cgit generate extra links for
 
 enable-index-links::
        Flag which, when set to "1", will make cgit generate extra links for


@@ -176,7 +192,7 @@ enable-git-config::
        "scan-path", and must be defined prior, to augment repo-specific
        settings. The keys gitweb.owner, gitweb.category, and gitweb.description
        will map to the cgit keys repo.owner, repo.section, and repo.desc,
        "scan-path", and must be defined prior, to augment repo-specific
        settings. The keys gitweb.owner, gitweb.category, and gitweb.description
        will map to the cgit keys repo.owner, repo.section, and repo.desc,

-       respectivly. All git config keys that begin with "cgit." will be mapped
+       respectively. All git config keys that begin with "cgit." will be mapped

        to the corresponding "repo." key in cgit. Default value: "0". See also:
        scan-path, section-from-path.
 
        to the corresponding "repo." key in cgit. Default value: "0". See also:
        scan-path, section-from-path.
 


@@ -284,7 +300,7 @@ nocache::
        value: "0".
 
 noplainemail::
        value: "0".
 
 noplainemail::

-       If set to "1" showing full author email adresses will be disabled.
+       If set to "1" showing full author email addresses will be disabled.

        Default value: "0".
 
 noheader::
        Default value: "0".
 
 noheader::


@@ -381,10 +397,10 @@ side-by-side-diffs::
        default. Default value: "0".
 
 snapshots::
        default. Default value: "0".
 
 snapshots::

-       Text which specifies the default set of snapshot formats generated by
-       cgit. The value is a space-separated list of zero or more of the
-       values "tar", "tar.gz", "tar.bz2", "tar.xz" and "zip". Default value:
-       none.
+       Text which specifies the default set of snapshot formats that cgit
+       generates links for. The value is a space-separated list of zero or
+       more of the values "tar", "tar.gz", "tar.bz2", "tar.xz" and "zip".
+       Default value: none.

 
 source-filter::
        Specifies a command which will be invoked to format plaintext blobs
 
 source-filter::
        Specifies a command which will be invoked to format plaintext blobs


@@ -456,6 +472,10 @@ repo.defbranch::
 repo.desc::
        The value to show as repository description. Default value: none.
 
 repo.desc::
        The value to show as repository description. Default value: none.
 

+repo.email-filter::
+       Override the default email-filter. Default value: none. See also:
+       "enable-filter-overrides". See also: "FILTER API".
+

 repo.enable-commit-graph::
        A flag which can be used to disable the global setting
        `enable-commit-graph'. Default value: none.
 repo.enable-commit-graph::
        A flag which can be used to disable the global setting
        `enable-commit-graph'. Default value: none.


@@ -525,8 +545,9 @@ repo.readme::
        file. Default value: <readme>.
 
 repo.snapshots::
        file. Default value: <readme>.
 
 repo.snapshots::

-       A mask of allowed snapshot-formats for this repo, restricted by the
-       "snapshots" global setting. Default value: <snapshots>.
+       A mask of snapshot formats for this repo that cgit generates links for,
+       restricted by the global "snapshots" setting. Default value:
+       <snapshots>.

 
 repo.section::
        Override the current section name for this repository. Default value:
 
 repo.section::
        Override the current section name for this repository. Default value:


@@ -556,6 +577,47 @@ config files, e.g. "repo.desc" becomes "desc".
 
 FILTER API
 ----------
 
 FILTER API
 ----------

+By default, filters are separate processes that are executed each time they
+are needed.  Alternative technologies may be used by prefixing the filter
+specification with the relevant string; available values are:
+
+'exec:'::
+       The default "one process per filter" mode.
+
+'lua:'::
+       Executes the script using a built-in Lua interpreter. The script is
+       loaded once per execution of cgit, and may be called multiple times
+       during cgit's lifetime, making it a good choice for repeated filters
+       such as the 'email filter'. It responds to three functions:
+
+       'filter_open(argument1, argument2, argument3, ...)'::
+               This is called upon activation of the filter for a particular
+               set of data.
+       'filter_write(buffer)'::
+               This is called whenever cgit writes data to the webpage.
+       'filter_close()'::
+               This is called when the current filtering operation is
+               completed. It must return an integer value. Usually 0
+               indicates success.
+       
+       Additionally, cgit exposes to the Lua the following built-in functions:
+
+       'html(str)'::
+               Writes 'str' to the webpage.
+       'html_txt(str)'::
+               HTML escapes and writes 'str' to the webpage.
+       'html_attr(str)'::
+               HTML escapes for an attribute and writes "str' to the webpage.
+       'html_url_path(str)'::
+               URL escapes for a path and writes 'str' to the webpage.
+       'html_url_arg(str)'::
+               URL escapes for an argument and writes 'str' to the webpage.
+       'html_include(file)'::
+               Includes 'file' in webpage.
+
+
+Parameters are provided to filters as follows.
+

 about filter::
        This filter is given a single parameter: the filename of the source
        file to filter. The filter can use the filename to determine (for
 about filter::
        This filter is given a single parameter: the filename of the source
        file to filter. The filter can use the filename to determine (for


@@ -568,6 +630,13 @@ commit filter::
        be filtered is available on standard input and the filtered text is
        expected on standard output.
 
        be filtered is available on standard input and the filtered text is
        expected on standard output.
 

+email filter::
+       This filter is given two parameters: the email address of the relevent
+       author and a string indicating the originating page. The filter will
+       then receive the text string to format on standard input and is
+       expected to write to standard output the formatted text to be included
+       in the page.
+

 source filter::
        This filter is given a single parameter: the filename of the source
        file to filter. The filter can use the filename to determine (for
 source filter::
        This filter is given a single parameter: the filename of the source
        file to filter. The filter can use the filename to determine (for


@@ -575,7 +644,32 @@ source filter::
        file that is to be filtered is available on standard input and the
        filtered contents is expected on standard output.
 
        file that is to be filtered is available on standard input and the
        filtered contents is expected on standard output.
 

-Also, all filters are handed the following environment variables:
+auth filter::
+       The authentication filter receives 11 parameters:
+         - filter action, explained below, which specifies which action the
+           filter is called for
+         - http cookie
+         - http method
+         - http referer
+         - http path
+         - http https flag
+         - cgit repo
+         - cgit page
+         - cgit url
+       When the filter action is "body", this filter must write to output the
+       HTML for displaying the login form, which POSTs to "/?p=login". When
+       the filter action is "authenticate-cookie", this filter must validate
+       the http cookie and return a 0 if it is invalid or 1 if it is invalid,
+       in the exit code / close function. If the filter action is
+       "authenticate-post", this filter receives POST'd parameters on
+       standard input, and should write to output one or more "Set-Cookie"
+       HTTP headers, each followed by a newline.
+
+       Please see `filters/simple-authentication.lua` for a clear example
+       script that may be modified.
+
+
+All filters are handed the following environment variables:

 
 - CGIT_REPO_URL (from repo.url)
 - CGIT_REPO_NAME (from repo.name)
 
 - CGIT_REPO_URL (from repo.url)
 - CGIT_REPO_NAME (from repo.name)


@@ -592,8 +686,8 @@ environment variable will be unset.
 
 MACRO EXPANSION
 ---------------
 
 MACRO EXPANSION
 ---------------

-The following cgitrc options supports a simple macro expansion feature,
-where tokens prefixed with "$" are replaced with the value of a similary
+The following cgitrc options support a simple macro expansion feature,
+where tokens prefixed with "$" are replaced with the value of a similarly

 named environment variable:
 
 - cache-root
 named environment variable:
 
 - cache-root


@@ -620,7 +714,7 @@ EXAMPLE CGITRC FILE
 -------------------
 
 ....
 -------------------
 
 ....

-# Enable caching of up to 1000 output entriess
+# Enable caching of up to 1000 output entries

 cache-size=1000
 
 
 cache-size=1000
 
 


@@ -636,7 +730,7 @@ enable-index-owner=1
 
 
 # Allow http transport git clone
 
 
 # Allow http transport git clone

-enable-git-clone=1
+enable-http-clone=1

 
 
 # Show extra links for each repository on the index page
 
 
 # Show extra links for each repository on the index page


@@ -700,7 +794,7 @@ mimetype.png=image/png
 mimetype.svg=image/svg+xml
 
 
 mimetype.svg=image/svg+xml
 
 

-# Highlight source code with python pygments-based highligher
+# Highlight source code with python pygments-based highlighter

 source-filter=/var/www/cgit/filters/syntax-highlighting.py
 
 # Format markdown, restructuredtext, manpages, text files, and html files
 source-filter=/var/www/cgit/filters/syntax-highlighting.py
 
 # Format markdown, restructuredtext, manpages, text files, and html files