How to reject Mercurial user if userid not matched with Apache authentication?

Question

Presently we are serving Mercurial Repository (hgweb) behind the Apache server, when user pushes changes to Apache it is authenticated by userid/password (pwauth). How to restrict the push to user commits by user@myorg.com and must be authenticate as user (pwauth) instead of otheruser2?

Answer 1

The best way to do such a thing would be with a pretxnchangegroup hook in Mercurial itself. You'd have to inspect each commit in the set to ensure that the username matches. The reason for this being that just because someone is pushing some changesets to a server, it doesn't mean they've created all those changesets themselves.

For example, someone could have pulled changes from someone else, merged them in to their own branch, and then be pushing the result up to the server.