From 25686b8675e8a4d888eef5d53c6e61845c88eaba Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Dec 03 2019 11:39:11 +0000
Subject: Allow RCM/releng to by-pass a PR-only workflow


The RCM_GROUP and the EXTERNAL_COMMITTER configuration keys will need to
be in synced though.

Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/dist_git_auth.py b/dist_git_auth.py
index 168cfb2..591b2f4 100644
--- a/dist_git_auth.py
+++ b/dist_git_auth.py
@@ -266,9 +266,10 @@ class DistGitAuth(GitAuthHelper):
 
         # This is applicable to all namespace, protected or not
 
-        if repotype == "main":
+        if repotype == "main" and not is_rcm:
             # If this project has PRs only on, or PRs are globally enforced and
             # this is not a fork, only allow pushing if this is a PR merge.
+            # However, RCM/releng is allowed to by-pass the PR only model
             pr_only = project.settings.get("pull_request_access_only", False)
             if (
                 pr_only or (self.global_pr_only and not project.is_fork)
diff --git a/dist_git_auth_tests.py b/dist_git_auth_tests.py
index fee227d..e52b99a 100644
--- a/dist_git_auth_tests.py
+++ b/dist_git_auth_tests.py
@@ -85,6 +85,7 @@ class DistGitAuthTests(tests.Modeltests):
         super(DistGitAuthTests, self).setUp()
 
         pagure.config.config['ACL_DEBUG'] = True
+        pagure.config.config['EXTERNAL_COMMITTER'] = {"relenggroup": {}}
         pagure.config.config.update(self.dga_config)
 
         self.dga = dist_git_auth.DistGitAuth()
@@ -352,6 +353,27 @@ class DistGitAuthTestsGeneric(DistGitAuthTests):
 
         self.expect_info_msg("A pull request is required for this branch")
 
+    def test_unprotected_pr_required_no_pr_cvsadmin(self):
+        project = self.create_namespaced_project('unprotected', 'test')
+        self.dga.global_pr_only = True
+
+        self.assertTrue(
+            self.dga.check_acl(
+                self.session,
+                project=project,
+                username="releng",
+                refname="refs/heads/mywip",
+                pull_request=None,
+                repodir=None,
+                repotype='main',
+                revfrom=None,
+                revto=None,
+                is_internal=False,
+            )
+        )
+
+        self.expect_info_msg("Committer push")
+
     def test_unprotected_pr_required_requests(self):
         project = self.create_namespaced_project('unprotected', 'test')
         self.dga.global_pr_only = True