Grant anonymous uses READ +1, registered users READ +1..+2

The READ +2 permission implies being able to read a project and
uploading a new change into it for review.  Only a registered user
can actually do an upload, as Gerrit requires the user to have an
account that is associated with the change review.

Therefore in our initial configuration of "-- All Projects --"
access rights we should grant read access to anonymous users but
read + create change for review access for registered users.

Change-Id: I57ecd17cfabc093b1dfd068a4f040dd067e5f5c0
Signed-off-by: Shawn O. Pearce <sop@google.com>

1 files changed, 8 insertions, 0 deletions

diff --git a/src/main/java/com/google/gerrit/server/config/SystemConfigProvider.java b/src/main/java/com/google/gerrit/server/config/SystemConfigProvider.java
index 2307b9bb1e..f4045a0fec 100644
--- a/src/main/java/com/google/gerrit/server/config/SystemConfigProvider.java
+++ b/src/main/java/com/google/gerrit/server/config/SystemConfigProvider.java
@@ -256,6 +256,14 @@ class SystemConfigProvider implements Provider<SystemConfig> {
       final ProjectRight read =
           new ProjectRight(new ProjectRight.Key(DEFAULT_WILD_NAME, cat.getId(),
               sConfig.anonymousGroupId));
+      read.setMaxValue((short) 1);
+      read.setMinValue((short) 1);
+      c.projectRights().insert(Collections.singleton(read));
+    }
+    {
+      final ProjectRight read =
+          new ProjectRight(new ProjectRight.Key(DEFAULT_WILD_NAME, cat.getId(),
+              sConfig.registeredGroupId));
       read.setMaxValue((short) 2);
       read.setMinValue((short) 1);
       c.projectRights().insert(Collections.singleton(read));