Add capability to control access to the metrics
diff --git a/BUILD b/BUILD
index 325c6ab..89cb6c3 100644
--- a/BUILD
+++ b/BUILD
@@ -5,6 +5,8 @@
srcs = glob(["src/main/java/**/*.java"]),
manifest_entries = [
"Gerrit-PluginName: metrics-reporter-prometheus",
+ "Gerrit-Module: com.googlesource.gerrit.plugins.metricsreporters.GerritPrometheusModule",
+ "Gerrit-HttpModule: com.googlesource.gerrit.plugins.metricsreporters.GerritPrometheusHttpModule",
],
resources = glob(["src/main/resources/**/*"]),
deps = [
diff --git a/pom.xml b/pom.xml
index 17da0a2..15a4f17 100644
--- a/pom.xml
+++ b/pom.xml
@@ -40,6 +40,8 @@
<archive>
<manifestEntries>
<Gerrit-PluginName>metrics-reporter-prometheus</Gerrit-PluginName>
+ <Gerrit-Module>com.googlesource.gerrit.plugins.metricsreporters.GerritPrometheusModule</Gerrit-Module>
+ <Gerrit-HttpModule>com.googlesource.gerrit.plugins.metricsreporters.GerritPrometheusHttpModule</Gerrit-HttpModule>
<Implementation-Vendor>Gerrit Code Review</Implementation-Vendor>
<Implementation-URL>https://gerrit-review.googlesource.com/#/admin/projects/plugins/metrics-reporter-prometheus</Implementation-URL>
<Implementation-Title>Prometheus metrics plugin</Implementation-Title>
diff --git a/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/CapabilityChecker.java b/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/CapabilityChecker.java
new file mode 100644
index 0000000..32ca8f6
--- /dev/null
+++ b/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/CapabilityChecker.java
@@ -0,0 +1,38 @@
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package com.googlesource.gerrit.plugins.metricsreporters;
+
+import com.google.gerrit.extensions.annotations.PluginName;
+import com.google.gerrit.server.CurrentUser;
+import com.google.gerrit.server.account.CapabilityControl;
+import com.google.inject.Inject;
+import com.google.inject.Provider;
+
+public class CapabilityChecker {
+ private final Provider<CurrentUser> userProvider;
+ private final String capabilityName;
+
+ @Inject
+ CapabilityChecker(Provider<CurrentUser> userProvider,
+ @PluginName String pluginName) {
+ this.userProvider = userProvider;
+ this.capabilityName = String.format("%s-%s", pluginName,
+ ViewMetricsCapability.ID);
+ }
+
+ public boolean canViewMetrics() {
+ CapabilityControl ctl = userProvider.get().getCapabilities();
+ return ctl.canAdministrateServer() || ctl.canPerform(capabilityName);
+ }
+}
\ No newline at end of file
diff --git a/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/GerritPrometheusExporter.java b/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/GerritPrometheusExporter.java
index b561c5e..54827be 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/GerritPrometheusExporter.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/GerritPrometheusExporter.java
@@ -14,20 +14,40 @@
package com.googlesource.gerrit.plugins.metricsreporters;
import com.codahale.metrics.MetricRegistry;
-import com.google.gerrit.extensions.annotations.Export;
import com.google.inject.Inject;
import com.google.inject.Singleton;
import io.prometheus.client.CollectorRegistry;
import io.prometheus.client.dropwizard.DropwizardExports;
import io.prometheus.client.exporter.MetricsServlet;
+import java.io.IOException;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletResponse;
-@Export("/metrics")
@Singleton
public class GerritPrometheusExporter extends MetricsServlet {
+ CapabilityChecker capabilityChecker;
+
@Inject
- public GerritPrometheusExporter(MetricRegistry registry) {
+ public GerritPrometheusExporter(MetricRegistry registry,
+ CapabilityChecker capabilityChecker) {
+ this.capabilityChecker = capabilityChecker;
+
// Hook the Dropwizard registry into the Prometheus registry
// via the DropwizardExports collector.
CollectorRegistry.defaultRegistry.register(new DropwizardExports(registry));
}
+
+ @Override
+ public void service(ServletRequest req, ServletResponse res)
+ throws ServletException, IOException {
+ if (capabilityChecker.canViewMetrics()) {
+ super.service(req, res);
+ } else {
+ HttpServletResponse httpResponse = (HttpServletResponse) res;
+ httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN,
+ "Forbidden access");
+ }
+ }
};
diff --git a/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/GerritPrometheusHttpModule.java b/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/GerritPrometheusHttpModule.java
new file mode 100644
index 0000000..1cd11db
--- /dev/null
+++ b/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/GerritPrometheusHttpModule.java
@@ -0,0 +1,23 @@
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package com.googlesource.gerrit.plugins.metricsreporters;
+
+import com.google.inject.servlet.ServletModule;
+
+public class GerritPrometheusHttpModule extends ServletModule {
+ @Override
+ protected void configureServlets() {
+ serve("/metrics").with(GerritPrometheusExporter.class);
+ }
+}
\ No newline at end of file
diff --git a/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/GerritPrometheusModule.java b/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/GerritPrometheusModule.java
new file mode 100644
index 0000000..c49d691
--- /dev/null
+++ b/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/GerritPrometheusModule.java
@@ -0,0 +1,27 @@
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package com.googlesource.gerrit.plugins.metricsreporters;
+
+import com.google.gerrit.extensions.annotations.Exports;
+import com.google.gerrit.extensions.config.CapabilityDefinition;
+import com.google.inject.AbstractModule;
+
+public class GerritPrometheusModule extends AbstractModule {
+ @Override
+ protected void configure() {
+ bind(CapabilityDefinition.class)
+ .annotatedWith(Exports.named(ViewMetricsCapability.ID))
+ .to(ViewMetricsCapability.class);
+ }
+}
\ No newline at end of file
diff --git a/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/ViewMetricsCapability.java b/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/ViewMetricsCapability.java
new file mode 100644
index 0000000..e3f7412
--- /dev/null
+++ b/src/main/java/com/googlesource/gerrit/plugins/metricsreporters/ViewMetricsCapability.java
@@ -0,0 +1,25 @@
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package com.googlesource.gerrit.plugins.metricsreporters;
+
+import com.google.gerrit.extensions.config.CapabilityDefinition;
+
+public class ViewMetricsCapability extends CapabilityDefinition {
+ static final String ID = "viewMetrics";
+
+ @Override
+ public String getDescription() {
+ return "View Metrics";
+ }
+}
\ No newline at end of file
diff --git a/src/main/resources/Documentation/about.md b/src/main/resources/Documentation/about.md
index 4bc7e2f..0092de0 100644
--- a/src/main/resources/Documentation/about.md
+++ b/src/main/resources/Documentation/about.md
@@ -1,3 +1,7 @@
This plugin exposes Gerrit metrics to Prometheus.
-The metrics can be accessed at the @URL@plugins/@PLUGIN@/metrics URL.
\ No newline at end of file
+The metrics can be accessed at the @URL@plugins/@PLUGIN@/metrics URL.
+
+To access the monitoring URL, a user must be a member of a group that is granted
+the ‘View Metrics’ capability (provided by this plugin) or the ‘Administrate
+Server’ capability.
\ No newline at end of file
diff --git a/src/main/resources/Documentation/config.md b/src/main/resources/Documentation/config.md
new file mode 100644
index 0000000..fa180cf
--- /dev/null
+++ b/src/main/resources/Documentation/config.md
@@ -0,0 +1,16 @@
+Configuration
+=============
+
+To access the monitoring URL, a user must be a member of a group that is granted
+the ‘View Metrics’ capability (provided by this plugin) or the ‘Administrate
+Server’ capability.This plugin requires no configuration.
+
+This capability can be configured in the 'Global Capabilities' section of the
+['All-Projects'](@URL@#/admin/projects/All-Projects,access) access right.
+
+It is possible to allow anonymous access to the metrics by giving the capability
+to the 'Anonymous Users' group.
+
+[Back to @PLUGIN@ documentation index][index]
+
+[index]: index.html
\ No newline at end of file
