Concepts

How wkdoadogit works: what a mount is, what a repository's visibility depends on, and where the package's limits run. What you want to do is on ADO-Git; what you want to look up is in the Technical reference.

Purpose

Brings git repositories hosted in Azure DevOps into the wiki: browse repositories, render source, edit and commit, and run git clone, pull and push through a proxy — all through a single ADO service account, so readers and editors need no licence of their own. The authorisation boundary is DokuWiki's own access control, not an ADO licence.

Audience: administrators and editors who want to make code from Azure DevOps visible or editable in the wiki.

Three acts the plugin does not perform for you

A repository becomes visible only once three separate acts have happened. None of them triggers the next.

Act	Where	What it creates
connection	`do=wkdoado` on a page of the DWDO project	a description of the ADO server with a key and a secret reference
mount	Admin > ADO-Git Repo Mounts	the binding repository ↔ namespace and the permissions for it
markup on a page	any page inside the DWDO project	the only rendering of the repository; the mount creates no page

The complete sequence with a worked example is in Show an ADO repository in the wiki for the first time.

Repository mounts

A mount binds an ADO repository to a DokuWiki namespace of the form code:{project}:{repo}, for example code:dokuwiki-plugins:wkdoadogit. Only a registered mount makes a repository reachable; every access path — the browser, source rendering, the git proxy and the ZIP download — checks DokuWiki's permissions against that namespace.

The mount namespace is virtual: no wiki page exists there. If the template carries the {lang} placeholder, the mount stays one record while the rules are written for every language in the mount_languages setting (default de,en,hr,it,sl).

A mount makes a repository reachable, not visible. It is rendered only where an author places the markup {{wk:adogit>connection:project:repo}} on a page inside a DWDO project (here below {lang}:projects:). Registering a mount and then seeing nothing means the second step is still ahead of you, not that something failed.

Visibility tier and the DokuWiki ACL

The tier of a mount is the single control for visibility. Permissions are read afresh on every request, so a change of tier takes effect immediately. Rules are written for the namespace and for namespace:*; administrators may always act as superuser.

Tier	@ALL (anonymous)	@user (signed in)	@wvds (developers)	@wvdse (editors)	project role groups
`private`	0	–	–	8	–
`readonly`	0	2	2	8	–
`showcase`	1	–	–	8	–
`library`	1	2	–	8	–
`public`	2	–	–	8	–
`team`	0	–	–	8	`readers` 1, `contributors` 2, `maintainers` 8

The role groups of the team tier carry the roleprefix from wkdocore and the project key, for example @dwdo_dwplugins_maintainers.

The tiers showcase and library separate two rights that public grants together: viewing in the browser and taking a copy. Under showcase anyone may read and nobody may clone; under library anyone may read and any signed-in account may clone. The dividing line is the sign-in, not the audience — whoever takes a copy is an account that can be named later.

One number, two readings

The number that gets written is a DokuWiki permission and a capability of this package at the same time.

Level	In this plugin	In DokuWiki
1	browsing and rendering in the wiki	read a page
2	`clone`, `fetch` and ZIP download	edit an existing page
4	`push` to `refs/heads/users/<login>/`	create a page
8	`push` without restriction, plus editing and committing from the wiki	upload a file

The second column is why a mount on a namespace holding real wiki pages is not harmless: public opens the page editor there to anonymous visitors. That is why the wizard's preview counts the pages a namespace already holds.

The rules live in a managed block in conf/acl.auth.php, between the lines # BEGIN wkdoadogit-managed and # END wkdoadogit-managed. Do not edit that block by hand — set the tier of the mount instead. The writer replaces that block and nothing else (atomically, with a temporary file, a rename and a lock) and leaves every other rule untouched, including those maintained by hand or through the core acl admin. A removed mount loses its rules, and the namespace falls back to the site default.

Second factor: two categories, two grades

When Identity is installed, the do=wkdoadogit_stepup bridge demands proof.

Category	Requirement	Applies to
`mount-admin`	`MFA_ANY`	creating, changing and removing mounts, and registering Subversion connections
`token-issue`	`AUTHENTICATED`, raisable by the installation	issuing a personal token

The two grades differ because the acts differ: a mount decides who sees which repository, while a personal token concerns only one's own account and is needed several times a day.

The check is additional to DokuWiki's access control, never a replacement for it. Without wkidentity the package behaves exactly as before. The git proxy is not subject to it: it runs without a session and cannot conduct an interactive challenge, so the requirement attaches to issuing the token rather than to every request it later carries.

Limits and cautions

Mount registration and permission writing are reserved for administrators; personal tokens are self-service.
No finer-grained permissions per subfolder — the tier applies to the whole mount.
The Branches and Tags tabs in the browser header are visible but inactive. The branch on display is chosen in the markup; creating a branch or tag is implemented, switching to one in the interface is not.
The {{wk:adogit>…}} markup does not work outside the project root, because the connection is resolved through the page's DWDO project. {{source>ado:…}} additionally has the route through the mount namespace.
Every embed is a network call, bounded by the timeouts and the byte ceiling in wkdoado.
The git proxy always authenticates to Azure DevOps with one service PAT; pushedBy there is the service account, while the commit author remains the wiki user.
max_execution_time is 30 seconds in server/php/php.ini: harmless for the repository sizes tested, the next limit for very large ones.
A refusal is deliberately uninformative: an unmounted repository, an unknown connection and a missing permission are barely distinguishable from outside.
The binding source of the level mapping is Domain/MountAclWriter::TIERS. When it changes, update this page and the plugin README with it.