add optional usage of hubot-auth

lib/phabricator.coffee

@@ -208,6 +208,18 @@ class Phabricator
       cb { name: 'nobody' }
 
 
+  withPermission: (msg, user, group, cb) ->
+    if group is 'phuser' and process.env.PHABRICATOR_TRUSTED_USERS is 'y'
+      isAuthorized = true
+    else
+      isAuthorized = msg.robot.auth?.hasRole(user, [group, 'phadmin']) or
+                     msg.robot.auth?.isAdmin(user)
+    if msg.robot.auth? and not isAuthorized
+      msg.reply "You don't have permission to do that."
+    else
+      cb()
+
+
   taskInfo: (msg, id, cb) ->
     if @ready(msg) is true
       query = { 'task_id': id }

scripts/phabs_admin.coffee

@@ -38,12 +38,13 @@ module.exports = (robot) ->
 
   #   hubot phad <project> delete
   robot.respond (/phad (.+) del(?:ete)?$/), (msg) ->
-    project = msg.match[1]
-    if data.projects[project]?
-      delete data.projects[project]
-      msg.send "#{project} erased from memory."
-    else
-      msg.send "#{project} not found in memory."
+    phab.withPermission msg, msg.envelope.user, 'phadmin', ->
+      project = msg.match[1]
+      if data.projects[project]?
+        delete data.projects[project]
+        msg.send "#{project} erased from memory."
+      else
+        msg.send "#{project} not found in memory."
 
   #   hubot phad <project> info
   robot.respond (/phad (.+) info$/), (msg) ->
@@ -62,46 +63,50 @@ module.exports = (robot) ->
 
   #   hubot phad <project> alias <alias>
   robot.respond (/phad (.+) a(?:lia)?s (.+)$/), (msg) ->
-    project = msg.match[1]
-    alias = msg.match[2]
-    phab.withProject msg, project, (projectData) ->
-      if data.aliases[alias]?
-        msg.send "The alias '#{alias}' already exists for project '#{data.aliases[alias]}'."
-      else
-        data.aliases[alias] = projectData.data.name
-        msg.send "Ok, '#{projectData.data.name}' will be known as '#{alias}'."
+    phab.withPermission msg, msg.envelope.user, 'phadmin', ->
+      project = msg.match[1]
+      alias = msg.match[2]
+      phab.withProject msg, project, (projectData) ->
+        if data.aliases[alias]?
+          msg.send "The alias '#{alias}' already exists for project '#{data.aliases[alias]}'."
+        else
+          data.aliases[alias] = projectData.data.name
+          msg.send "Ok, '#{projectData.data.name}' will be known as '#{alias}'."
 
   #   hubot phad forget <alias>
   robot.respond (/phad forget (.+)$/), (msg) ->
-    alias = msg.match[1]
-    if data.aliases[alias]
-      delete data.aliases[alias]
-      msg.send "Ok, the alias '#{alias}' is forgotten."
-    else
-      msg.send "Sorry, I don't know the alias '#{alias}'."
+    phab.withPermission msg, msg.envelope.user, 'phadmin', ->
+      alias = msg.match[1]
+      if data.aliases[alias]
+        delete data.aliases[alias]
+        msg.send "Ok, the alias '#{alias}' is forgotten."
+      else
+        msg.send "Sorry, I don't know the alias '#{alias}'."
 
   #   hubot phad <project> feed to <room>
   robot.respond (/phad (.+) feeds?(?: to)? (.+)$/), (msg) ->
-    project = msg.match[1]
-    room = msg.match[2]
-    phab.withProject msg, project, (projectData) ->
-      projectData.data.feeds ?= [ ]
-      if room in projectData.data.feeds
-        msg.send "The feed from '#{projectData.data.name}' to '#{room}' already exist."
-      else
-        data.projects[projectData.data.name].feeds ?= [ ]
-        data.projects[projectData.data.name].feeds.push room
-        msg.send "Ok, '#{projectData.data.name}' is now feeding '#{room}'."
+    phab.withPermission msg, msg.envelope.user, 'phadmin', ->
+      project = msg.match[1]
+      room = msg.match[2]
+      phab.withProject msg, project, (projectData) ->
+        projectData.data.feeds ?= [ ]
+        if room in projectData.data.feeds
+          msg.send "The feed from '#{projectData.data.name}' to '#{room}' already exist."
+        else
+          data.projects[projectData.data.name].feeds ?= [ ]
+          data.projects[projectData.data.name].feeds.push room
+          msg.send "Ok, '#{projectData.data.name}' is now feeding '#{room}'."
 
   #   hubot phad <project> remove from <room>
   robot.respond (/phad (.+) remove (?:from )?(.+)$/), (msg) ->
-    project = msg.match[1]
-    room = msg.match[2]
-    phab.withProject msg, project, (projectData) ->
-      projectData.data.feeds ?= [ ]
-      if room in projectData.data.feeds
-        idx = data.projects[projectData.data.name].feeds.indexOf room
-        data.projects[projectData.data.name].feeds.splice(idx, 1)
-        msg.send "Ok, The feed from '#{projectData.data.name}' to '#{room}' was removed."
-      else
-        msg.send "Sorry, '#{projectData.data.name}' is not feeding '#{room}'."
+    phab.withPermission msg, msg.envelope.user, 'phadmin', ->
+      project = msg.match[1]
+      room = msg.match[2]
+      phab.withProject msg, project, (projectData) ->
+        projectData.data.feeds ?= [ ]
+        if room in projectData.data.feeds
+          idx = data.projects[projectData.data.name].feeds.indexOf room
+          data.projects[projectData.data.name].feeds.splice(idx, 1)
+          msg.send "Ok, The feed from '#{projectData.data.name}' to '#{room}' was removed."
+        else
+          msg.send "Sorry, '#{projectData.data.name}' is not feeding '#{room}'."

scripts/phabs_commands.coffee

@@ -39,32 +39,34 @@ module.exports = (robot) ->
 
   #   hubot phab new <project> <name of the task> - creates a new task
   robot.respond (/ph(?:ab)? new ([-_a-zA-Z0-9]+) ([^=]+)(?: = (.*))?$/), (msg) ->
-    project = msg.match[1]
-    name = msg.match[2]
-    description = msg.match[3]
-    phab.withProject msg, project, (projectData) ->
-      phab.createTask msg, projectData.data.phid, name, description, (body) ->
-        # console.log body
+    phab.withPermission msg, msg.envelope.user, 'phuser', ->
+      project = msg.match[1]
+      name = msg.match[2]
+      description = msg.match[3]
+      phab.withProject msg, project, (projectData) ->
+        phab.createTask msg, projectData.data.phid, name, description, (body) ->
+          # console.log body
+          if body['error_info']?
+            msg.send "#{body['error_info']}"
+          else
+            id = body['result']['object']['id']
+            url = process.env.PHABRICATOR_URL + "/T#{id}"
+            phab.recordPhid msg, id
+            msg.send "Task T#{id} created = #{url}"
+    msg.finish()
+
+  #   hubot phab paste <name of the paste> - creates a new paste
+  robot.respond /ph(?:ab)? paste (.*)$/, (msg) ->
+    phab.withPermission msg, msg.envelope.user, 'phuser', ->
+      title = msg.match[1]
+      phab.createPaste msg, title, (body) ->
         if body['error_info']?
           msg.send "#{body['error_info']}"
         else
           id = body['result']['object']['id']
-          url = process.env.PHABRICATOR_URL + "/T#{id}"
+          url = process.env.PHABRICATOR_URL + "/paste/edit/#{id}"
           phab.recordPhid msg, id
-          msg.send "Task T#{id} created = #{url}"
-    msg.finish()
-
-  #   hubot phab paste <name of the paste> - creates a new paste
-  robot.respond /ph(?:ab)? paste (.*)$/, (msg) ->
-    title = msg.match[1]
-    phab.createPaste msg, title, (body) ->
-      if body['error_info']?
-        msg.send "#{body['error_info']}"
-      else
-        id = body['result']['object']['id']
-        url = process.env.PHABRICATOR_URL + "/paste/edit/#{id}"
-        phab.recordPhid msg, id
-        msg.send "Paste P#{id} created = edit on #{url}"
+          msg.send "Paste P#{id} created = edit on #{url}"
     msg.finish()
 
   #   hubot phab count <project> - counts how many tasks a project has
@@ -100,94 +102,100 @@ module.exports = (robot) ->
   robot.respond new RegExp(
     "ph(?:ab)?(?: T([0-9]+))? (?:is )?(#{Object.keys(phab.statuses).join('|')})$"
   ), (msg) ->
-    id = msg.match[1] ? phab.retrievePhid(msg)
-    unless id?
-      msg.send "Sorry, you don't have any task active right now."
-      msg.finish()
-      return
-    status = msg.match[2]
-    phab.updateStatus msg, id, status, (body) ->
-      if body['error_info']?
-        msg.send "oops T#{id} #{body['error_info']}"
-      else
-        msg.send "Ok, T#{id} now has status #{body['result']['statusName']}."
+    phab.withPermission msg, msg.envelope.user, 'phuser', ->
+      id = msg.match[1] ? phab.retrievePhid(msg)
+      unless id?
+        msg.send "Sorry, you don't have any task active right now."
+        msg.finish()
+        return
+      status = msg.match[2]
+      phab.updateStatus msg, id, status, (body) ->
+        if body['error_info']?
+          msg.send "oops T#{id} #{body['error_info']}"
+        else
+          msg.send "Ok, T#{id} now has status #{body['result']['statusName']}."
     msg.finish()
 
   #   hubot phab Txx is <priority> - modifies task Txxx priority
   robot.respond new RegExp(
     "ph(?:ab)?(?: T([0-9]+))? (?:is )?(#{Object.keys(phab.priorities).join('|')})$"
   ), (msg) ->
-    id = msg.match[1] ? phab.retrievePhid(msg)
-    unless id?
-      msg.send "Sorry, you don't have any task active right now."
-      msg.finish()
-      return
-    priority = msg.match[2]
-    phab.updatePriority msg, id, priority, (body) ->
-      if body['error_info']?
-        msg.send "oops T#{id} #{body['error_info']}"
-      else
-        msg.send "Ok, T#{id} now has priority #{body['result']['priority']}"
+    phab.withPermission msg, msg.envelope.user, 'phuser', ->
+      id = msg.match[1] ? phab.retrievePhid(msg)
+      unless id?
+        msg.send "Sorry, you don't have any task active right now."
+        msg.finish()
+        return
+      priority = msg.match[2]
+      phab.updatePriority msg, id, priority, (body) ->
+        if body['error_info']?
+          msg.send "oops T#{id} #{body['error_info']}"
+        else
+          msg.send "Ok, T#{id} now has priority #{body['result']['priority']}"
     msg.finish()
 
   #   hubot phab <user> - checks if user is known or not
   robot.respond /ph(?:ab)? ([^ ]*)$/, (msg) ->
-    name = msg.match[1]
-    assignee = robot.brain.userForName(name)
-    unless assignee
-      msg.send "Sorry, I have no idea who #{name} is. Did you mistype it?"
-      msg.finish()
-      return
-    phab.withUser msg, assignee, (userPhid) ->
-      msg.send "Hey I know #{name}, he's #{userPhid}"
+    phab.withPermission msg, msg.envelope.user, 'phuser', ->
+      name = msg.match[1]
+      assignee = robot.brain.userForName(name)
+      unless assignee
+        msg.send "Sorry, I have no idea who #{name} is. Did you mistype it?"
+        msg.finish()
+        return
+      phab.withUser msg, assignee, (userPhid) ->
+        msg.send "Hey I know #{name}, he's #{userPhid}"
     msg.finish()
 
   #   hubot phab me as <email> - makes caller known with <email>
   robot.respond /ph(?:ab)? me as (.*@.*)$/, (msg) ->
-    email = msg.match[1]
-    msg.message.user.email_address = email
-    robot.brain.save()
-    msg.send "Okay, I'll remember your email is #{email}"
+    phab.withPermission msg, msg.envelope.user, 'phuser', ->
+      email = msg.match[1]
+      msg.message.user.email_address = email
+      robot.brain.save()
+      msg.send "Okay, I'll remember your email is #{email}"
     msg.finish()
 
   #   hubot phab <user> = <email> - associates user to email
   robot.respond /ph(?:ab)? ([^ ]*) *?= *?([^ ]*@.*)$/, (msg) ->
-    who = msg.match[1]
-    email = msg.match[2]
-    assignee = robot.brain.userForName(who)
-    unless assignee
-      msg.send "Sorry I have no idea who #{who} is. Did you mistype it?"
-      msg.finish()
-      return
-    assignee.email_address = email
-    msg.send "Okay, I'll remember #{who} email as #{email}"
+    phab.withPermission msg, msg.envelope.user, 'phadmin', ->
+      who = msg.match[1]
+      email = msg.match[2]
+      assignee = robot.brain.userForName(who)
+      unless assignee
+        msg.send "Sorry I have no idea who #{who} is. Did you mistype it?"
+        msg.finish()
+        return
+      assignee.email_address = email
+      msg.send "Okay, I'll remember #{who} email as #{email}"
     msg.finish()
 
   #   hubot phab assign Txx to <user> - assigns task Txxx to comeone
   robot.respond new RegExp(
     'ph(?:ab)?(?: assign)? (?:([^ ]+)(?: (?:to|on) (T)([0-9]+))?|(?:T([0-9]+) )?(?:to|on) ([^ ]+))$'
   ), (msg) ->
-    if msg.match[2] is 'T'
-      who = msg.match[1]
-      what = msg.match[3]
-    else
-      who = msg.match[5]
-      what = msg.match[4]
-    id = what ? phab.retrievePhid(msg)
-    unless id?
-      msg.send "Sorry, you don't have any task active right now."
-      msg.finish()
-      return
-    assignee = robot.brain.userForName(who)
-    if assignee?
-      phab.withUser msg, assignee, (userPhid) ->
-        phab.assignTask msg, id, userPhid, (body) ->
-          if body['error_info']?
-            msg.send "#{body['error_info']}"
-          else
-            msg.send "Ok. T#{id} is now assigned to #{assignee.name}"
-    else
-      msg.send "Sorry I don't know who is #{who}, can you .phab #{who} = <email>"
+    phab.withPermission msg, msg.envelope.user, 'phuser', ->
+      if msg.match[2] is 'T'
+        who = msg.match[1]
+        what = msg.match[3]
+      else
+        who = msg.match[5]
+        what = msg.match[4]
+      id = what ? phab.retrievePhid(msg)
+      unless id?
+        msg.send "Sorry, you don't have any task active right now."
+        msg.finish()
+        return
+      assignee = robot.brain.userForName(who)
+      if assignee?
+        phab.withUser msg, assignee, (userPhid) ->
+          phab.assignTask msg, id, userPhid, (body) ->
+            if body['error_info']?
+              msg.send "#{body['error_info']}"
+            else
+              msg.send "Ok. T#{id} is now assigned to #{assignee.name}"
+      else
+        msg.send "Sorry I don't know who is #{who}, can you .phab #{who} = <email>"
     msg.finish()
 
   #   hubot phab <project> search terms - searches for terms in project