perforce: controlling permissions without involving super user access

Question

We are using perforce in my company and heavily rely on it. I need some suggestion for the following scenario:

Our Depot structure is something like this:

//depot
    /product1
        /component1
        /component2
        .
        .
        /componentN
            /*.java
            /*.xml
    /product2
        /component1
        /component2
        .
        .
        /componentN
            /*.java
            /*.xml

Every product has multiple components and every component consist of java or xml or some other program file. Every component has a manager/owner associated with it.

Right now, we have blocked the write permissions for every user and only when it is approved by the manager/owner after code review, we open the write permission for that user for any file/folder to check in. This process becomes a little untidy because the manager/developer have to wait for perforce admin to allow permissions (update protections table of perforce). Also, we give them a window of only 24 hrs to check in (due to agile, which i dont understand much :)), after which we are supposed to block the write access again for that user.

What I am looking for is a mechanism where perforce admins can delegate this responsibility to respective managers/owners without giving them super user or admin access and which automatically disables the write permission after 24 hrs.

Any suggestions ?

Thanks in advance.

Answer 1

There's nothing to do this out of the box, per se.

The closest thing I can think of is if the mainline version of these components were permissioned by a group with an owner. The owner of the group is allowed to add and remove members from the group, thus delegating the permissioning to the "gatekeeper" rather than the admins, themselves.

Let me know if you require further clarification about this.

Answer 2

One common solution is to build a simple tool which reads and writes the protections table, the group memberships, etc., to implement the policies that you desire.

The protections and groups data are not complex in format, and you can easily write a little bit of text-processing code that writes and re-writes these specs according to your needs.

Then install your tool on the server machine in a secure fashion, granting the tool the rights to update the protections table, and have your component administrators use the tool to manage the permissions.

For example, I've seen this done by writing a small web application, in Java or Perl for example, installing that on a web server on a secure machine, and letting the component admins operate that tool through a web interface.

All your tool has to provide is (a) a simple login/logout mechanism for your component admins (the web server may already do this for you), (b) a command that takes a user name and a folder name and grants permission, and (c) a command (or a timer) that removes that permissions subsequently.