// Copyright (C) 2009 The Android Open Source Project
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package com.google.gerrit.server;

import com.google.gerrit.reviewdb.AccountGroup;
import com.google.gerrit.reviewdb.Change;
import com.google.gerrit.server.config.AuthConfig;
import com.google.inject.Inject;
import com.google.inject.assistedinject.Assisted;

import java.util.Collections;
import java.util.HashSet;
import java.util.Set;

public class ReplicationUser extends CurrentUser {
  public interface Factory {
    ReplicationUser create(@Assisted Set<AccountGroup.Id> authGroups);
  }

  private Set<AccountGroup.Id> effectiveGroups;

  @Inject
  protected ReplicationUser(AuthConfig authConfig,
      @Assisted Set<AccountGroup.Id> authGroups) {
    super(AccessPath.REPLICATION, authConfig);
    effectiveGroups = new HashSet<AccountGroup.Id>(authGroups);

    if (effectiveGroups.isEmpty()) {
      effectiveGroups.addAll(authConfig.getRegisteredGroups());
    }

    effectiveGroups = Collections.unmodifiableSet(effectiveGroups);
  }

  @Override
  public Set<AccountGroup.Id> getEffectiveGroups() {
    return Collections.unmodifiableSet(effectiveGroups);
  }

  @Override
  public Set<Change.Id> getStarredChanges() {
    return Collections.emptySet();
  }
}

@@ -1107,16 +1107,22 @@
 private 
+final 
 Set%3CAcco
@@ -1315,109 +1315,384 @@
 g);%0A
+%0A
     
-effectiveGroups = new HashSet%3CAccountGroup.Id%3E(authGroups);%0A%0A    if (effectiveGroups.isEmpty()) %7B
+if (authGroups.isEmpty()) %7B%0A      // Only include the registered groups if no specific groups%0A      // were provided. This allows an administrator to configure%0A      // a replication user with a narrower view of the system than%0A      // all other users, such as when replicating from an internal%0A      // company server to a public open source distribution site.%0A      //
 %0A   
@@ -1713,16 +1713,11 @@
 oups
-.addAll(
+ = 
 auth
@@ -1748,18 +1748,26 @@
 ps()
-)
 ;
+%0A
 %0A    %7D
-%0A%0A
+ else %7B%0A  
     
@@ -1788,51 +1788,186 @@
 s = 
-Collections.unmodifiableSet(effectiveGroups
+copy(authGroups);%0A    %7D%0A  %7D%0A%0A  private static Set%3CAccountGroup.Id%3E copy(Set%3CAccountGroup.Id%3E groups) %7B%0A    return Collections.unmodifiableSet(new HashSet%3CAccountGroup.Id%3E(groups)
 );%0A 
@@ -2050,36 +2050,8 @@
 urn 
-Collections.unmodifiableSet(
 effe
@@ -2057,25 +2057,24 @@
 ectiveGroups
-)
 ;%0A  %7D%0A%0A  @Ov

Document why ReplicationUser doesn't use registered groups