自动更改安全组的 Azure DevOps 存储库的权限

Question

I want to write a PowerShell code to change permission of a ]Azure DevOps repository for a security group Manual process is documented in this article.]( https://learn.microsoft.com/en-us/azure/devops/repos/git/set-git-repository-permissions?view=azure-devops )

Please help me with above.

Answer 1

I've blogged about the process on how to do this , not on the REST API perse, but using the az devops CLI.

The process is quite complex, since the permission model of Azure DevOps uses GUIDs and tokens for the permissions, users and access control list items.

az devops calls the REST API under the hood, you could use fiddler to have a peek at the REST calls that are made to achieve the same thing.

The general process looks like this:

$subject = az devops security group list `
    --org "https://dev.azure.com/$org/" `
    --scope organization `
    --subject-types vssgp `
    --query "graphGroups[?@.principalName == '[$org]\Project Collection Administrators'].descriptor | [0]"
    
$namespaceId = az devops security permission namespace list `
    --org "https://dev.azure.com/$org/" `
    --query "[?@.name == 'Git Repositories'].namespaceId | [0]"

$bit = az devops security permission namespace show `
    --namespace-id $namespaceId `
    --org "https://dev.azure.com/$org/" `
    --query "[0].actions[?@.name == 'PullRequestBypassPolicy'].bit | [0]"

az devops security permission update `
    --id $namespaceId `
    --subject $subject `
    --token "repoV2/" `
    --allow-bit $bit `
    --merge true `
    --org https://dev.azure.com/$org/

The token is made up of a number of identifiers:

repoV2/daec401a-49b6-4758-adb5-3f65fd3264e3/f59f38e0-e8c4-45d5-8dee-0d20e7ada1b7/refs/heads/6600650061007400750072006500/6d0069006e006500
^      ^                                    ^                                    ^
|      |                                    |                                    |
|      |                                    |                                    -- The branch
|      |                                    -- The Git Repository
|      -- The Team Project Guid
|
-- The root object (Repositories)

This sets the permissions for all git repos, the blog contains the code to generate a --token for a specific branch:

function hexify($string) {
     return ($string | Format-Hex -Encoding Unicode | Select-Object -Expand Bytes | ForEach-Object { '{0:x2}' -f $_ }) -join ''
}

$branch = "feature/mine"
$split = $branch.Split("/")
$hexBranch = ($split | ForEach-Object { hexify -string $_ }) -join "/"
$token = "refs/heads/$hexBranch"

refs/heads/6600650061007400750072006500/6d0069006e006500