Add versioncontrol authentication drush command

Looks good, would you like me to go head and commit this so that you can start patching against this?

Also, versioncontrol_project_get_project_repository_from_nid() looks like a duplicate of versioncontrol_project_repository_load().

I'm also attaching a filterdiffed version of the patch.

$repository = versioncontrol_project_get_project_repository_from_uri($project_uri);
$project = node_load(project_get_nid_from_uri($project_uri));

$project->versioncontrol_project['repo'] already has the repo, so I don't think we need versioncontrol_project_get_project_repository_from_uri() at all. And yeah, let's remove versioncontrol_project_get_project_repository_from_nid() while we're at it, since it's duplicate.

Otherwise, this seems good. Didn't look *that* closely, and certainly didn't test.

Sorry, I didn't review closely enough earlier. I didn't realize we're publishing md5 hashed passwords in here. ;) Yes, definitely want a submodule for this. However, we need some more painful warnings about only turning it on if you've taken steps to lock it down. Probably that should just be in the description in the .info file. If it needs a lot of text, perhaps we should add a README.txt and have the .info file description just say something like:

<strong>This module is insecure</strong> unless you read the README.txt and take steps to restrict access to this service.

Oh, and while you're rerolling, s/$user/$account/. There have been a number of security bugs cause by people using $user as a local variable name and then adding global $user. So, it's always safer to call your local variables $account.

Yay, thanks! In the interest of sprint 8 progress, I just addressed a few code style and legibility cleanups and committed to HEAD of vc_project: http://drupal.org/cvs?commit=480564

My only lingering concerns are:

A) At #1023856-3: Determine best way to provide private webservice to twisted daemon pwolanin asked (and I agree) why does this have to be your d.o login password? Couldn't we have another password field on the user account page for this feature if you want to enable password-only Git access?

B) This adds a drupal_alter(). It'd be nice if it therefore adds a versioncontrol_project.api.php file. ;) To facilitate this, I already added a stub of the file and docs, it just needs to actually be documented now. ;)

Both of these could happen in sprint 9 if needed. Maybe they should be split to separate issues so this one can be fixed.

#12 visually looks fine. Can't test it, but I assume it's good. Committed to vc_project HEAD, and deployed to git-dev.

Reviewed and committed the fix for the json output to HEAD: http://drupal.org/cvs?commit=482154 -- I must admit I don't really understand why we need the empty field like that, but I believe you.

C) It'd be nice to add a code comment about this json object stuff, but I didn't feel qualified to write it. ;)

I made a few tweaks to the new drush command and committed that separately to HEAD: http://drupal.org/cvs?commit=482156

D) Pretty sure the way the code was written would throw PHP notices if you gave it an unknown username, since user_load() would return FALSE but you were directly trying to access ->pass off the return value from user_load().

E) Added an @todo that we don't really need a full bootstrap and user_load() to do this.

Anyway, back to needs work for 11.B, 15.C, and perhaps 15.E. 15.D is already fixed in HEAD.

Cheers,
-Derek

This is in, fixed, and in fact has undergone some changes since this issue was last touched. Marking fixed.