Stash - Is there a way to make permissions stricter for particular branches or repositories?

[Todd Ellner]

We have a Development project. Inside the project we have repositories for a number of development projects. For the most part engineers should be able to create repositories and merge code, the sort of thing that WRITE access grants. But for certain ones such as the master branch or main-line development branches within repositories we need to lock down access. The documentation on Using Branch Permissions, Controlling Access and Branch Control Patterns shows how to add additional access. Is there a way to, for instance, set branch or repository permissions to be more restrictive than what is inherited rather than less?

[Tim Crall · Accepted solution]

You can't set a repo's projects to be more restrictive than it's project's.  If you need a particular repo to be more secure than the others, put it in its own project (or, more obnoxiously, set the project permissions only to those that are shared by all repos, and add individual permissions to repos as needed).

You can further restrict a branch.  In fact, that's the only thing you can do to a branch, permissions-wise.  Any addition of permissions to a branch will grant write access to that branch ONLY to the people listed. They will still require write access on the repo (set either at the project or repo level).

[Todd Ellner]

So if the default for people in the engineering group was "WRITE" and I added branch permissions on master for User1 and User2 only they could merge or accept accept pull requests, but engineers would still have READ privileges?

[Todd Ellner]

And it works! Thank you very much

[Tim Crall]

Exactly. :-) No problem!