Clone a mounted repository

Situation

The repository is visible in the wiki, but the work has to happen locally — clone, pull and push from an ordinary git client, without an Azure DevOps licence of your own.

Solution overview

The plugin brings a git proxy at its own address, separate from doku.php. The git client talks to the wiki, and the wiki talks to Azure DevOps through the service account. Authentication uses HTTP Basic with a personal token, never the wiki password. Access is decided by the same tier of the mount as in the browser.

Act	Level required	Note
`clone`, `fetch` and `pull`	2	at tier `public` an anonymous client suffices; at `library` and `readonly` only a signed-in one; at `showcase` nobody
`push`	4	never anonymous; at levels 4 to 7 only into one's own branch prefix
`push` into any branch	8	among the shipped tiers `@wvdse` reaches this, at tier `team` the project's `maintainers` group
ZIP download	2	button on the Get this repository panel

showcase deliberately grants no acquire right: the source is readable in the browser and nobody takes a copy. Anyone who needs one asks for library or higher.

Implementation

The clone address

The address is formed from the mount namespace by turning colons into slashes:

https://www.wvds.it/wiki/lib/plugins/wkdoadogit/git.php/code/dokuwiki-plugins/wkdoadogit

That address addresses the mount code:dokuwiki-plugins:wkdoadogit. You need not assemble it by hand, because two places show it:

The Get this repository panel above the tree on the page with the browser. Anyone with level 2 or more sees it. Besides the address it offers the ZIP download and links to open the repository in Visual Studio Code and JetBrains.
The mount list in the admin area, in the mount's row menu. Only administrators see it.

A mount registered with the {lang} placeholder has one address per language. The pattern itself is not an address and would be refused.

Personal token

Open /doku.php?do=wkdoadogit_tokens. The link at the foot of the Get this repository panel, the mount's row menu and the Manage git access tokens entry in the command palette lead there too.
Enter a label, for example laptop or CI, and choose Create.
Copy the token shown immediately. It appears exactly once, because only its hash is stored; afterwards it cannot be retrieved, not even by an administrator.
Remove tokens you no longer need with Revoke in the same table.

Every issued token begins with the prefix wkg_, so that a secret scanner or a log filter recognises one on sight.

When wkidentity is installed, issuing a token requires a session proven at least by an ordinary sign-in; the installation may raise that to a second factor. Tokens already issued stay valid when the rule is tightened, so reissue them after such a change.

Calling the client

git clone https://www.wvds.it/wiki/lib/plugins/wkdoadogit/git.php/code/dokuwiki-plugins/wkdoadogit

At the authentication prompt enter your wiki username and, as the password, the personal token. The client also accepts the token as the username with an empty password.

For permanent storage use your client's credential helper. Do not write the token into the address in .git/config.

Pushing into your own prefix

Anyone at levels 4 to 7 may move only branches below their own prefix refs/heads/users/<login>/.

git push origin HEAD:refs/heads/users/jsmith/fix

A command that touches anything outside that prefix is refused in full. At level 8 the restriction does not apply.

ZIP download

The Download as ZIP button on the Get this repository panel downloads a snapshot of the branch on display. The address is /doku.php?do=wkdoadogit_archive&ns=<namespace>&ref=<branch> and requires the same level 2 as clone.

Remarks

The service account faces Azure DevOps. pushedBy there is therefore the service account, while the commit author remains the person who made it.
Revoking a permission takes effect from the next request. Permissions are not cached. If access persists, look for the page cache or a granted group, not the proxy.
The proxy knows no step-up. It runs without a session and authenticates per request with the token, which is why a second factor is required when the token is issued rather than on every request.
The server must allow PATH_INFO. On Apache the shipped .htaccess handles this with the line AcceptPathInfo On for git.php. The shipped web.config applies to IIS only. Without it the server answers 404 before PHP even starts.
Compression on the way corrupts the packfile. Do not enable gzip for the proxy's path.