From 55cb5156520ae6b66782c19564463e77989f539c Mon Sep 17 00:00:00 2001
From: Julen Landa Alustiza <jlanda@fedoraproject.org>
Date: Nov 29 2019 09:34:23 +0000
Subject: [PATCH 1/2] dist_git_auth: fix pr_only check logic


---

diff --git a/dist_git_auth.py b/dist_git_auth.py
index 71ea0cc..c30b4dd 100644
--- a/dist_git_auth.py
+++ b/dist_git_auth.py
@@ -254,8 +254,8 @@ class DistGitAuth(GitAuthHelper):
             # this is not a fork, only allow pushing if this is a PR merge.
             pr_only = project.settings.get("pull_request_access_only", False)
             if (
-                pr_only
-                or (self.global_pr_only and not project.is_fork)
+                (pr_only
+                or (self.global_pr_only and not project.is_fork))
                 and pull_request is None
             ):
                 self.info("A pull request is required for this branch")

From 7304c5c998dbe997415ccbcbefb86ea23e5544e9 Mon Sep 17 00:00:00 2001
From: Julen Landa Alustiza <jlanda@fedoraproject.org>
Date: Nov 29 2019 10:52:21 +0000
Subject: [PATCH 2/2] tests: test project level pull requests only


---

diff --git a/dist_git_auth_tests.py b/dist_git_auth_tests.py
index 355f381..7092a34 100644
--- a/dist_git_auth_tests.py
+++ b/dist_git_auth_tests.py
@@ -117,7 +117,7 @@ class DistGitAuthTests(tests.Modeltests):
         self.dga = None
         super(DistGitAuthTests, self).tearDown()
 
-    def create_namespaced_project(self, namespace, name, is_fork=False):
+    def create_namespaced_project(self, namespace, name, is_fork=False, settings={}):
         item = pagure.lib.model.Project(
             user_id=1,  # pingou
             name=name,
@@ -126,6 +126,7 @@ class DistGitAuthTests(tests.Modeltests):
             description='namespaced test project',
             hook_token='aaabbbeee',
             namespace=namespace,
+            settings=settings
         )
         item.close_status = [
             'Invalid', 'Insufficient data', 'Fixed', 'Duplicate']
@@ -371,7 +372,51 @@ class DistGitAuthTestsGeneric(DistGitAuthTests):
         )
 
         self.expect_info_msg("Committer push to unprotected")
+    
+    def test_unprotected_pr_required_repo_pr_only_no_pr(self):
+        settings = {"pull_request_access_only": True}
+        project = self.create_namespaced_project('unprotected', 'test', settings=settings)
 
+        self.assertFalse(
+            self.dga.check_acl(
+                self.session,
+                project=project,
+                username="pingou",
+                refname="refs/heads/mywip",
+                pull_request=None,
+                repodir=None,
+                repotype='main',
+                revfrom=None,
+                revto=None,
+                is_internal=False,
+            )
+        )
+
+        self.expect_info_msg("A pull request is required for this branch")
+    
+    def test_unprotected_pr_required_repo_pr_only(self):
+        settings = {"pull_request_access_only": True}
+        project = self.create_namespaced_project(
+            'unprotected',
+            'test',
+            settings=settings
+        )
+        self.assertTrue(
+            self.dga.check_acl(
+                self.session,
+                project=project,
+                username="pingou",
+                refname="refs/heads/mywip",
+                pull_request="pull_request",
+                repodir=None,
+                repotype='main',
+                revfrom=None,
+                revto=None,
+                is_internal=False,
+            )
+        )
+
+        self.expect_info_msg("Committer push to unprotected")
 
 class DistGitAuthTestsFedora(DistGitAuthTests):
     dga_config = {