[HUDSON-3677] First pass at providing read-only access to project configuration.

Defined a new permission, ExtendedRead, which can be enabled by specifying true
for the system property hudson.security.ExtendedReadPermission. Granting job
configuration permissions implies this permission.

	main/core/src/main/java/model/Item.java

Added plumbing for dynamic enabling and disabling of permissions at runtime.
This will be the basis for future UI based toggling of the availability of a
permission.

	main/core/src/main/java/hudson/security/Permission.java

Add the enabled state of a permission to the decision about whether a principal
has it or not. Only show a permission when it's enabled.

	main/core/src/main/java/hudson/security/GlobalMatrixAuthorizationStrategy.java

Allow access to config.xml when ExtendedRead is granted.

	main/core/src/main/java/hudson/model/Job.java

Don't show the save button if the user only has ExtendedRead.

	main/core/src/main/resources/hudson/model/Job/configure.jelly

Change the text of the Configure link in the side panel based on whether a user
has Configure or ExtendedRead permissions.

	main/core/src/main/resources/hudson/model/AbstractProject/sidepanel.jelly



git-svn-id: https://hudson.dev.java.net/svn/hudson/trunk/hudson/main@21626 71c3de6d-444a-0410-be80-ed276b4c234a

core/src/main/java/hudson/model/Item.java

@@ -1,7 +1,7 @@
 /*
  * The MIT License
  * 
- * Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi
+ * Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi, Yahoo! Inc.
  * 
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -196,6 +196,7 @@ public interface Item extends PersistenceRoot, SearchableModelObject, AccessCont
     public static final Permission DELETE = new Permission(PERMISSIONS,"Delete", Permission.DELETE);
     public static final Permission CONFIGURE = new Permission(PERMISSIONS,"Configure", Permission.CONFIGURE);
     public static final Permission READ = new Permission(PERMISSIONS,"Read", Permission.READ);
+    public static final Permission EXTENDED_READ = new Permission(PERMISSIONS,"ExtendedRead", Messages._AbstractProject_ExtendedReadPermission_Description(), CONFIGURE, Boolean.getBoolean("hudson.security.ExtendedReadPermission"));
     public static final Permission BUILD = new Permission(PERMISSIONS, "Build", Messages._AbstractProject_BuildPermission_Description(),  Permission.UPDATE);
     public static final Permission WORKSPACE = new Permission(PERMISSIONS, "Workspace", Messages._AbstractProject_WorkspacePermission_Description(), Permission.READ);
 }

core/src/main/java/hudson/model/Job.java

@@ -977,7 +977,7 @@ public abstract class Job<JobT extends Job<JobT, RunT>, RunT extends Run<JobT, R
     @WebMethod(name = "config.xml")
     public void doConfigDotXml(StaplerRequest req, StaplerResponse rsp)
             throws IOException {
-        checkPermission(CONFIGURE);
+        checkPermission(EXTENDED_READ);
 
         if (req.getMethod().equals("GET")) {
             // read

core/src/main/java/hudson/security/GlobalMatrixAuthorizationStrategy.java

@@ -1,7 +1,7 @@
 /*
  * The MIT License
  * 
- * Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi
+ * Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi, Yahoo! Inc.
  * 
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -144,7 +144,7 @@ public class GlobalMatrixAuthorizationStrategy extends AuthorizationStrategy {
     public boolean hasPermission(String sid, Permission p) {
         for(; p!=null; p=p.impliedBy) {
             Set<String> set = grantedPermissions.get(p);
-            if(set!=null && set.contains(sid))
+            if(set!=null && set.contains(sid) && p.getEnabled())
                 return true;
         }
         return false;
@@ -155,7 +155,7 @@ public class GlobalMatrixAuthorizationStrategy extends AuthorizationStrategy {
      */
     public boolean hasExplicitPermission(String sid, Permission p) {
         Set<String> set = grantedPermissions.get(p);
-        return set != null && set.contains(sid);
+        return set != null && set.contains(sid) && p.getEnabled();
     }
 
     /**
@@ -266,7 +266,7 @@ public class GlobalMatrixAuthorizationStrategy extends AuthorizationStrategy {
         }
 
         public boolean showPermission(Permission p) {
-            return true;
+            return p.getEnabled();
         }
 
         public FormValidation doCheckName(@QueryParameter String value ) throws IOException, ServletException {

core/src/main/java/hudson/security/Permission.java

@@ -1,7 +1,7 @@
 /*
  * The MIT License
  * 
- * Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi
+ * Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi, Yahoo! Inc.
  * 
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -82,6 +82,18 @@ public final class Permission {
      */
     public final Permission impliedBy;
 
+    /**
+     * Whether this permission is available for use.
+     *
+     * <p>
+     * This allows us to dynamically enable or disable the visibility of
+     * permissions, so administrators can control the complexitity of their
+     * permission matrix.
+     *
+     * @since 1.325
+     */
+    public boolean enabled;
+    
     /**
      * Defines a new permission.
      *
@@ -106,7 +118,7 @@ public final class Permission {
      * @param impliedBy
      *      See {@link #impliedBy}.
      */
-    public Permission(PermissionGroup group, String name, Localizable description, Permission impliedBy) {
+    public Permission(PermissionGroup group, String name, Localizable description, Permission impliedBy, boolean enable) {
         if(!JSONUtils.isJavaIdentifier(name))
             throw new IllegalArgumentException(name+" is not a Java identifier");
         this.owner = group.owner;
@@ -114,11 +126,16 @@ public final class Permission {
         this.name = name;
         this.description = description;
         this.impliedBy = impliedBy;
+        this.enabled = enable;
 
         group.add(this);
         ALL.add(this);
     }
 
+    public Permission(PermissionGroup group, String name, Localizable description, Permission impliedBy) {
+        this(group, name, description, impliedBy, true);
+    }
+    
     /**
      * @deprecated since 1.257.
      *      Use {@link #Permission(PermissionGroup, String, Localizable, Permission)} 
@@ -171,6 +188,14 @@ public final class Permission {
         return "Permission["+owner+','+name+']';
     }
 
+    public void setEnabled(boolean enable) {
+        enabled = enable;
+    }
+
+    public boolean getEnabled() {
+        return enabled;
+    }
+    
     /**
      * Returns all the {@link Permission}s available in the system.
      * @return