How to configure multiple user access control setting by acl extension in Mercurial repository

Question

I have main mercurial repository (A) with 2 folders "depot1" and "depot2" in Windows Machine

Following configuration is done in .hg/hgrc file of A repo.

[ui]
username = praveen

[extensions]
hgext.acl=

[hooks]
changegroup.update = hg update
pretxnchangegroup.acl = python:hgext.acl.hook

[acl]
sources = serve push pull commit

Then I created 2 clones of mercurial A repository. X and Y on windows machines

X .hg/hgrc file is:

[ui]
username = clone1

Y .hg/hgrc file is:

[ui]
username = clone2

My Question: 
1- Restrict all push operations from user="clone2".
2- user="clone1" will be able to perform push on only "depot1".

Please suggest me how this configuration is possible.

Thanks,

Praveen

Answer 1

Unfortunately, you're misunderstanding what the username in the [ui] section does. It's strictly a client-side setting that says "If a server asks me for a username for authentication here's what I want to send", so what you have in the ui.username in repos A, X, and Y will have no affect on what remote users can to to/with those repositories.

Instead, you need to use the [acl.allow] and [acl.deny] sections in the Y and X repositories' .hg/hgrc files to specify access controls for them.

The usernames that you use in those section, ('clone1' and 'clone2') in your examples need to be backed by a real authentication system too. The built-in hg-serve doesn't provide one, so you need to be using either ssh or Apache/ISS with a hgweb or hgwebdir. See the publishing repositories wiki page for a great overview.

Answer 2

Is there any option to restrict user to use "hg push -f"? Because it will removed intermediete commits by other users. send reply to my mail id [email protected]