Access control for branch reads
Enable ref level READ +1 access control, so permissions can be
fine-grained down to the branch level within the same project.
There are two parts to this change:
- Filter the branches that the user can see in Upload and
ReceiveCommits using the new RefFilter interface in JGit.
This prevents a user from fetching something they are not
allowed to read.
- Ensure that any object created by the user only points to
objects they can already reach. This prevents the user
from being able to discover objects they can't read by
uploading a change that points at them.
Change-Id: I55a1811694e8f568e3404f625c5f0a8bf7000cac
17 files changed
