GitBucket/doc/authenticator.md

Authentication in Controller

GitBucket provides many authenticators to access controlling in the controller.

For example, in the case of RepositoryViwerController, it references three authenticators: ReadableUsersAuthenticator, ReferrerAuthenticator and CollaboratorsAuthenticator.

class RepositoryViewerController extends RepositoryViewerControllerBase
  with RepositoryService with AccountService with ActivityService with IssuesService with WebHookService with CommitsService
  with ReadableUsersAuthenticator with ReferrerAuthenticator with CollaboratorsAuthenticator with PullRequestService with CommitStatusService
  with WebHookPullRequestService with WebHookPullRequestReviewCommentService

trait RepositoryViewerControllerBase extends ControllerBase {
  self: RepositoryService with AccountService with ActivityService with IssuesService with WebHookService with CommitsService
    with ReadableUsersAuthenticator with ReferrerAuthenticator with CollaboratorsAuthenticator with PullRequestService with CommitStatusService
    with WebHookPullRequestService with WebHookPullRequestReviewCommentService =>

  ...

Authenticators provides a method to add guard to actions in the controller:

• ReadableUsersAuthenticator provides readableUsersOnly method
• ReferrerAuthenticator provides referrersOnly method
• CollaboratorsAuthenticator provides collaboratorsOnly method

These methods are available in each actions as below:

// Allows only the repository owner (or manager for group repository) and administrators.
get("/:owner/:repository/tree/*")(referrersOnly { repository =>
  ...
})

// Allows only collaborators and administrators.
get("/:owner/:repository/new/*")(collaboratorsOnly { repository =>
  ...
})

// Allows only signed in users which can access the repository.
post("/:owner/:repository/commit/:id/comment/new", commentForm)(readableUsersOnly { (form, repository) =>
  ...
})

Currently, GitBucket provides below authenticators:

Trait	Method	Description
OneselfAuthenticator	oneselfOnly	Allows only oneself and administrators.
OwnerAuthenticator	ownerOnly	Allows only the repository owner and administrators.
UsersAuthenticator	usersOnly	Allows only signed in users.
AdminAuthenticator	adminOnly	Allows only administrators.
CollaboratorsAuthenticator	collaboratorsOnly	Allows only collaborators and administrators.
ReferrerAuthenticator	referrersOnly	Allows only the repository owner (or manager for group repository) and administrators.
ReadableUsersAuthenticator	readableUsersOnly	Allows only signed in users which can access the repository.
GroupManagerAuthenticator	managersOnly	Allows only the group managers.

Of course, if you make a new plugin, you can define a your own authenticator according to requirement in your plugin.