func revokeAccessFromTeam(appName, teamName string, u *auth.User) error {
t := new(auth.Team)
app, err := getAppOrError(appName, u)
if err != nil {
return err
}
err = db.Session.Teams().Find(bson.M{"_id": teamName}).One(t)
if err != nil {
return &errors.Http{Code: http.StatusNotFound, Message: "Team not found"}
}
if len(app.Teams) == 1 {
msg := "You can not revoke the access from this team, because it is the unique team with access to the app, and an app can not be orphaned"
return &errors.Http{Code: http.StatusForbidden, Message: msg}
}
err = app.Revoke(t)
if err != nil {
return &errors.Http{Code: http.StatusNotFound, Message: err.Error()}
}
err = db.Session.Apps().Update(bson.M{"name": app.Name}, app)
if err != nil {
return err
}
users := getEmailsForRevoking(&app, t)
if len(users) > 0 {
gUrl := repository.GitServerUri()
if err := (&gandalf.Client{Endpoint: gUrl}).RevokeAccess([]string{app.Name}, users); err != nil {
return &errors.Http{Code: http.StatusInternalServerError, Message: err.Error()}
}
}
return nil
}
func revokeAppAccess(w http.ResponseWriter, r *http.Request, t *auth.Token) error {
u, err := t.User()
if err != nil {
return err
}
appName := r.URL.Query().Get(":app")
teamName := r.URL.Query().Get(":team")
rec.Log(u.Email, "revoke-app-access", "app="+appName, "team="+teamName)
team := new(auth.Team)
app, err := getApp(appName, u)
if err != nil {
return err
}
conn, err := db.Conn()
if err != nil {
return err
}
defer conn.Close()
err = conn.Teams().Find(bson.M{"_id": teamName}).One(team)
if err != nil {
return &errors.HTTP{Code: http.StatusNotFound, Message: "Team not found"}
}
if len(app.Teams) == 1 {
msg := "You can not revoke the access from this team, because it is the unique team with access to the app, and an app can not be orphaned"
return &errors.HTTP{Code: http.StatusForbidden, Message: msg}
}
err = app.Revoke(team)
if err != nil {
return &errors.HTTP{Code: http.StatusNotFound, Message: err.Error()}
}
err = conn.Apps().Update(bson.M{"name": app.Name}, app)
if err != nil {
return err
}
users := getEmailsForRevoking(&app, team)
if len(users) > 0 {
gURL := repository.ServerURL()
if err := (&gandalf.Client{Endpoint: gURL}).RevokeAccess([]string{app.Name}, users); err != nil {
return fmt.Errorf("Failed to revoke access in the git server: %s", err)
}
}
return nil
}