Authentication in Controller

GitBucket provides many authenticators to access controlling in the controller.

For example, in the case of RepositoryViwerController, it references three authenticators, ReadableUsersAuthenticator, ReferrerAuthenticator and CollaboratorsAuthenticator:

class RepositoryViewerController extends RepositoryViewerControllerBase
  with RepositoryService with AccountService with ActivityService with IssuesService with WebHookService with CommitsService
  with ReadableUsersAuthenticator with ReferrerAuthenticator with CollaboratorsAuthenticator with PullRequestService with CommitStatusService
  with WebHookPullRequestService with WebHookPullRequestReviewCommentService

trait RepositoryViewerControllerBase extends ControllerBase {
  self: RepositoryService with AccountService with ActivityService with IssuesService with WebHookService with CommitsService
    with ReadableUsersAuthenticator with ReferrerAuthenticator with CollaboratorsAuthenticator with PullRequestService with CommitStatusService
    with WebHookPullRequestService with WebHookPullRequestReviewCommentService =>

  ...

• ReadableUsersAuthenticator provides readableUsersOnly method
• ReferrerAuthenticator provides referrersOnly method
• CollaboratorsAuthenticator provides collaboratorsOnly method

These methods are available in each actions as below:

// Allows only the repository owner (or manager for group repository) and administrators.
get("/:owner/:repository/tree/*")(referrersOnly { repository =>
  ...
})

// Allows only collaborators and administrators.
get("/:owner/:repository/new/*")(collaboratorsOnly { repository =>
  ...
})

// Allows only signed in users which can access the repository.
post("/:owner/:repository/commit/:id/comment/new", commentForm)(readableUsersOnly { (form, repository) =>
  ...
})

Currently, GitBucket provides below authenticators:

Of course, if you make a new plugin, you can define a your own authenticator according to requirement in your plugin.