FreeBSD/contrib/subversion/subversion/svnserve/serve.c
/* Check that the client has the REQUIRED access by consulting the
 * authentication and authorization states stored in BATON.  If the
 * client does not have the required access credentials, attempt to
 * authenticate the client to get that access, using CONN for
 * communication.
 *
 * This function is supposed to be called to handle the authentication
 * half of a standard svn protocol reply.  If an error is returned, it
 * probably means that the server can terminate the client connection
 * with an apologetic error, as it implies an authentication failure.
 *
 * PATH and NEEDS_USERNAME are passed along to lookup_access, their
 * behaviour is documented there.
 */
Check that the client has the REQUIRED access by consulting the
authentication and authorization states stored in BATON.  If the
client does not have the required access credentials, attempt to
authenticate the client to get that access, using CONN for
communication.

This function is supposed to be called to handle the authentication
half of a standard svn protocol reply.  If an error is returned, it
probably means that the server can terminate the client connection
with an apologetic error, as it implies an authentication failure.

PATH and NEEDS_USERNAME are passed along to lookup_access, their
behaviour is documented there.
Check that the client has the REQUIRED access by consulting the authentication and authorization states stored in BATON . If the client does not have the required access credentials attempt to authenticate the client to get that access using CONN for communication . This function is supposed to be called to handle the authentication half of a standard svn protocol reply . If an error is returned it probably means that the server can terminate the client connection with an apologetic error as it implies an authentication failure . PATH and NEEDS_USERNAME are passed along to lookup_access their behaviour is documented there .
static svn_error_t *must_have_access(svn_ra_svn_conn_t *conn,
                                     apr_pool_t *pool,
                                     server_baton_t *b,
                                     svn_repos_authz_access_t required,
                                     const char *path,
                                     svn_boolean_t needs_username)
{
  enum access_type req = (required & svn_authz_write) ?
    WRITE_ACCESS : READ_ACCESS;
  if (lookup_access(pool, b, required, path, needs_username))
    {
      SVN_ERR(create_fs_access(b, pool));
      return trivial_auth_request(conn, pool, b);
    }
  if (b->client_info->user == NULL
      && b->repository->auth_access >= req
      && (b->client_info->tunnel_user || b->repository->pwdb
          || b->repository->use_sasl))
    SVN_ERR(auth_request(conn, pool, b, req, TRUE));
  if (! lookup_access(pool, b, required, path, needs_username))
    return svn_error_create(SVN_ERR_RA_SVN_CMD_ERR,
                            error_create_and_log(SVN_ERR_RA_NOT_AUTHORIZED,
                                                 NULL, NULL, b),
                            NULL);
  SVN_ERR(create_fs_access(b, pool));
  return SVN_NO_ERROR;
}
static svn_error_t * must_have_access ( svn_ra_svn_conn_t * conn , apr_pool_t * pool , server_baton_t * b , svn_repos_authz_access_t required , const char * path , svn_boolean_t needs_username ) { enum access_type req = ( required & svn_authz_write ) ? WRITE_ACCESS : READ_ACCESS ; if ( lookup_access ( pool , b , required , path , needs_username ) ) { SVN_ERR ( create_fs_access ( b , pool ) ) ; return trivial_auth_request ( conn , pool , b ) ; } if ( b -> client_info -> user == NULL && b -> repository -> auth_access >= req && ( b -> client_info -> tunnel_user || b -> repository -> pwdb || b -> repository -> use_sasl ) ) SVN_ERR ( auth_request ( conn , pool , b , req , TRUE ) ) ; if ( ! lookup_access ( pool , b , required , path , needs_username ) ) return svn_error_create ( SVN_ERR_RA_SVN_CMD_ERR , error_create_and_log ( SVN_ERR_RA_NOT_AUTHORIZED , NULL , NULL , b ) , NULL ) ; SVN_ERR ( create_fs_access ( b , pool ) ) ; return SVN_NO_ERROR ; }
Check that the client has the REQUIRED access by consulting the
 authentication and authorization states stored in BATON.
Check that the client has the REQUIRED access by consulting the authentication and authorization states stored in BATON .
/* See whether the user already has the required access.  If so,
     nothing needs to be done.  Create the FS access and send a
     trivial auth request. */ /* If the required blanket access can be obtained by authenticating,
     try that.  Unfortunately, we can't tell until after
     authentication whether authz will work or not.  We force
     requiring a username because we need one to be able to check
     authz configuration again with a different user credentials than
     the first time round. */ /* Now that an authentication has been done get the new take of
     authz on the request. */ /* Else, access is granted, and there is much rejoicing. */