[RFC PATCH 0/7] Implement ref namespaces as a ref storage backend

[RFC PATCH 0/7] Implement ref namespaces as a ref storage backend

[Richard Maw]

Forewarning: I don't consider this work complete
and am unlikely to find time to finish it any time soon.
I've mostly sent this because it may include valuable feedback
on how well the ref storage backends works
from trying to use it to change how git namespaces work.

Introduction
============

I work on a git server called Gitano,
and I'd like to add support for git namespaces to:

1.  Allow administrative content to be kept out of the default namespace.

    Gitano keeps some repository configuration in a ref in the repository.
    I'd like to be able to hide it in a namespace
    to make fetching all the content easier, such as for mirroring.

2.  Implement repository forking backed by namespaces in the same repo.

    I'd like to be able to add a logical vs physical repository separation
    so that forking a repository just copies the refs into a namespace.

3.  Any other inventive uses users could think of.


It's possible with some hackery to do all this with the existing namespace code
but we like to integrate with a web frontend, and a web frontend needs to do
more than just let you push and pull the repository.

Unfortunately namespace handling was never implemented for any other part of git
and at least gitolite makes use of namespaces,
and will have to work around it not being implemented fully,
but implementing it more fully will break work-arounds.

Instead of continuing to do work-arounds I tried to add support into libgit,
since as well as making it less code in the web frontend to work around it,
it would become common code that other git servers may make use of.


This is not my first attempt to improve the git namespace handling in git.
I tried last year, but it took me so long that all the ref handling code changed
and I would have had to start from scratch.

Fortunately the pluggable ref backends work provided an easier starting point.

The included patches work for the use-cases I need to support in gitano,
but I don't want it to end up like GIT_NAMESPACE and not be fixable,
so I've tried to make it work such that everything in the git test suite works.

I was not successful with this due to time constraints
but it helped me find many issues and I've listed known issues.

Technical description
=====================

This patch series adds a new refs backend, stacking on top of the files backend,
based on whether `core.namespace` is set in git config.

Since config can be done on the command-line or in config files,
both per-repo or global, it's a reasonable approach.

This allows the default namespace of a repository to be changed
so that operations such as fetch only show refs of that namespace,
or a smarter git server to intercept the repository path
and redirect it to a different repository with a namespace set.

It also mostly works for local git operations,
but I've no real idea what they would be useful for
beyond what's needed for a git server's web frontend.

It may make sense in future to allow remotes to have namespaces
so you can push to a namespace on the server without it being namespace aware,
but that's not the goal of this series,
and may be possible to handle without modification by changing the refspecs.

The majority of what the namespaced refs backend does
is to prepend the namespace to requests before the files backend sees them
and strip namespaces off returned refs before the caller sees them.

Issues
======

Having core.namespace set in a repository namespaces the fetch results.
If the source repository is local then setting -c core.namespace
to fetch the content into a different namespace will break the source namespace
since the upload-pack also obeys the -c core.namespace on the command-line.

Supporting `clone --namespace` instead of `git -c` might resolve this,
but I can't think of an appropriate use-case for wanting to do so
which makes it hard to consider what API would be appropriate.

Bugs
----

Most boil down to how special refs like HEAD are handled.

1.  Logged messages display the namespaced path,
    which a human may deal with but confuses the test suite.

2.  Reflogs for namespaced HEAD are not updated.

    This is because resolving HEAD to split the transaction's updates
    to add a log only update to HEAD works by transaction_prepare resolving HEAD
    using its own ref store rather than the main one,
    so the namespace translation isn't performed.
    See split_head_update.

    The fix for this may be to move the transaction mangling out of the backend,
    unless it should be implied that every backend implementation
    must be responsible for symbolic ref reflog updates implicitly.

3.  git init always says Reinitialized repository.

    This is because create_default_files checks for whether HEAD already exists
    directly via fs access rather than through the refs backend,
    but then creates the symbolic ref using it.

    Without a workaround this causes clones to fail because they don't recognise
    that the repository is initialized because .git/HEAD is missing.
    By working around this and creating .git/HEAD during the init_db callback
    instead create_default_files thinks it's a reinitialisation
    since it expected to create HEAD itself,
    and fails to actually create HEAD.
    The implemented workaround for that is for the namespaced backend's init_db
    to create both .git/HEAD and the namespaced HEAD.

    This could be fixed by:

    1.  Make create_default_files check whether HEAD exists via the refs backend

        This wouldn't fix .git/HEAD being missing in other cases,
        but allows namespaced_init_db to only create .git/HEAD
        and would fix the reinitialisation message.

        I attempted to do this, but running the test suite on the change
        caused it to corrupt my repository,
        so I haven't dared try it again.

    2.  Making backends responsible for creating HEAD in init_db.

        I'm unsure whether creating HEAD is the responsibility of the workspace
        or the responsibility of the refs backend.

4.  delete-refs won't remove namespaced symbolic refs.

    The files backend's delete_refs calls back into refs_delete_ref,
    which normally bypasses the backend to delete pseudorefs,
    whether the NODEREF option has been passed or not.

    (see t1405-main-ref-store for a test that triggers this)

    This could be fixed by changing is_pseudoref_syntax to strip any namespace
    off the front before checking whether it's outside of refs/ and is all caps,
    however this would then mean that anywhere that calls ref_delete
    would delete the pseudoref without namespace translation.

    Fixing this requires one of:

    1.  A work-around in the namespaced ref backend
        so that if it looks like a pseudoref after the namespace is stripped
        then the NODEREF flag is implicitly added to any deletes.
    2.  Ref backends to be given domain over pseudorefs.
    3.  Pseudoref backends.

5.  Per-workspace namespaced refs don't work.

    refs/bisect/ gets moved to refs/namespaces/foo/refs/bisect,
    but those refs can't be found in iteration
    because the files backend walks the refs in the common dir
    rather than the refs in the git dir,
    and the simple workaround in loose_fill_ref_dir doesn't work.

Richard Maw (7):
  Expose expand_namespace API
  Add git_configset_add_standard
  Add helper for skipping namespace prefixes
  Autocreate reflogs for namespaced refs
  Treat namespaced HEAD and refs/bisect as per-worktree
  Add namespaced ref backend
  Plumb in namespaced ref store

 Makefile                  |   1 +
 cache.h                   |   1 +
 config.c                  |   7 +-
 config.h                  |   1 +
 environment.c             |   2 +-
 git-compat-util.h         |  19 ++
 refs.c                    |   7 +-
 refs/namespaced-backend.c | 619 ++++++++++++++++++++++++++++++++++++++++++++++
 refs/refs-internal.h      |   1 +
 9 files changed, 654 insertions(+), 4 deletions(-)
 create mode 100644 refs/namespaced-backend.c

-- 
2.9.0

[PATCH 1/7] Expose expand_namespace API

[Richard Maw]

Namespaces will not only be settable with GIT_NAMESPACE,
so this previously internal helper needs to be made available to other code.
---
 cache.h       | 1 +
 environment.c | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/cache.h b/cache.h
index 71fe092..e01b8a2 100644
--- a/cache.h
+++ b/cache.h
@@ -485,6 +485,7 @@ extern char *get_graft_file(void);
 extern int set_git_dir(const char *path);
 extern int get_common_dir_noenv(struct strbuf *sb, const char *gitdir);
 extern int get_common_dir(struct strbuf *sb, const char *gitdir);
+extern char *expand_namespace(const char *raw_namespace);
 extern const char *get_git_namespace(void);
 extern const char *strip_namespace(const char *namespaced_ref);
 extern const char *get_super_prefix(void);
diff --git a/environment.c b/environment.c
index 3fd4b10..97dfa8c 100644
--- a/environment.c
+++ b/environment.c
@@ -123,7 +123,7 @@ const char * const local_repo_env[] = {
 	NULL
 };
 
-static char *expand_namespace(const char *raw_namespace)
+char *expand_namespace(const char *raw_namespace)
 {
 	struct strbuf buf = STRBUF_INIT;
 	struct strbuf **components, **c;
-- 
2.9.0

[PATCH 2/7] Add git_configset_add_standard

[Richard Maw]

This exposes implementation details of repo_read_config
so a configset can be populated with a repository's standard config,
without needing to create a full repository.

This allows config lookup to use the same codepath
whether the repository is ready or not,
which allows it to be used during git init.
---
 config.c | 7 ++++++-
 config.h | 1 +
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/config.c b/config.c
index 231f9a7..d0af812 100644
--- a/config.c
+++ b/config.c
@@ -1764,6 +1764,11 @@ int git_configset_add_file(struct config_set *cs, const char *filename)
 	return git_config_from_file(config_set_callback, filename, cs);
 }
 
+int git_configset_add_standard(struct config_set *cs, const struct config_options *opts)
+{
+	return config_with_options(config_set_callback, cs, NULL, opts);
+}
+
 int git_configset_get_value(struct config_set *cs, const char *key, const char **value)
 {
 	const struct string_list *values = NULL;
@@ -1879,7 +1884,7 @@ static void repo_read_config(struct repository *repo)
 
 	git_configset_init(repo->config);
 
-	if (config_with_options(config_set_callback, repo->config, NULL, &opts) < 0)
+	if (git_configset_add_standard(repo->config, &opts) < 0)
 		/*
 		 * config_with_options() normally returns only
 		 * zero, as most errors are fatal, and
diff --git a/config.h b/config.h
index 0352da1..0b7b8d2 100644
--- a/config.h
+++ b/config.h
@@ -151,6 +151,7 @@ struct config_set {
 
 extern void git_configset_init(struct config_set *cs);
 extern int git_configset_add_file(struct config_set *cs, const char *filename);
+extern int git_configset_add_standard(struct config_set *cs, const struct config_options *opts);
 extern int git_configset_get_value(struct config_set *cs, const char *key, const char **value);
 extern const struct string_list *git_configset_get_value_multi(struct config_set *cs, const char *key);
 extern void git_configset_clear(struct config_set *cs);
-- 
2.9.0

[PATCH 3/7] Add helper for skipping namespace prefixes

[Richard Maw]

Normally your own namespace is known and you only need to skip that prefix,
but when you need to classify the type of a ref
it helps to be able to consider what type of ref it would be
if it were outside of a namespace.
---
 git-compat-util.h | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/git-compat-util.h b/git-compat-util.h
index db9c22d..c5e0a34 100644
--- a/git-compat-util.h
+++ b/git-compat-util.h
@@ -501,6 +501,25 @@ static inline int skip_prefix_mem(const char *buf, size_t len,
 	return 0;
 }
 
+static inline int skip_namespace(const char *refname, const char **out)
+{
+	const char *c = refname;
+
+	while (skip_prefix(c, "refs/namespaces/", &c)) {
+		c = strchr(c, '/');
+		if (!c)
+			return 0;
+
+		c++;
+	}
+
+	if (c == refname)
+		return 0;
+
+	*out = c;
+	return 1;
+}
+
 /*
  * If buf ends with suffix, return 1 and subtract the length of the suffix
  * from *len. Otherwise, return 0 and leave *len untouched.
-- 
2.9.0

[PATCH 4/7] Autocreate reflogs for namespaced refs

[Richard Maw]

Since refs are classified based on their prefix
but namespaces have their own prefix,
it's necessary to skip that prefix to classify their remaining prefix.
---
 refs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/refs.c b/refs.c
index ba22f4a..2e8bace 100644
--- a/refs.c
+++ b/refs.c
@@ -699,6 +699,7 @@ int should_autocreate_reflog(const char *refname)
 	case LOG_REFS_ALWAYS:
 		return 1;
 	case LOG_REFS_NORMAL:
+		(void) skip_namespace(refname, &refname);
 		return starts_with(refname, "refs/heads/") ||
 			starts_with(refname, "refs/remotes/") ||
 			starts_with(refname, "refs/notes/") ||
-- 
2.9.0

[PATCH 5/7] Treat namespaced HEAD and refs/bisect as per-worktree

[Richard Maw]

---
 refs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/refs.c b/refs.c
index 2e8bace..9a3dcfb 100644
--- a/refs.c
+++ b/refs.c
@@ -536,6 +536,7 @@ int dwim_log(const char *str, int len, unsigned char *sha1, char **log)
 
 static int is_per_worktree_ref(const char *refname)
 {
+	(void) skip_namespace(refname, &refname);
 	return !strcmp(refname, "HEAD") ||
 		starts_with(refname, "refs/bisect/");
 }
-- 
2.9.0

[PATCH 6/7] Add namespaced ref backend

[Richard Maw]

---
 Makefile                  |   1 +
 refs/namespaced-backend.c | 619 ++++++++++++++++++++++++++++++++++++++++++++++
 refs/refs-internal.h      |   1 +
 3 files changed, 621 insertions(+)
 create mode 100644 refs/namespaced-backend.c

diff --git a/Makefile b/Makefile
index 461c845..0c417c3 100644
--- a/Makefile
+++ b/Makefile
@@ -842,6 +842,7 @@ LIB_OBJS += reflog-walk.o
 LIB_OBJS += refs.o
 LIB_OBJS += refs/files-backend.o
 LIB_OBJS += refs/iterator.o
+LIB_OBJS += refs/namespaced-backend.o
 LIB_OBJS += refs/ref-cache.o
 LIB_OBJS += ref-filter.o
 LIB_OBJS += remote.o
diff --git a/refs/namespaced-backend.c b/refs/namespaced-backend.c
new file mode 100644
index 0000000..bcea2ca
--- /dev/null
+++ b/refs/namespaced-backend.c
@@ -0,0 +1,619 @@
+
+#include "../cache.h"
+#include "../config.h"
+#include "../refs.h"
+#include "refs-internal.h"
+#include "../repository.h"
+#include "../iterator.h"
+
+/* Namespace backend intended to stack on top of existing ref store */
+
+extern struct ref_storage_be refs_be_namespaced;
+
+struct namespaced_ref_store {
+	struct ref_store base;
+	struct ref_store *lower;
+	char *prefix;
+};
+
+static struct namespaced_ref_store *namespaced_downcast(
+		struct ref_store *ref_store, const char *caller)
+{
+	struct namespaced_ref_store *refs;
+
+	if (ref_store->be != &refs_be_namespaced)
+		die("BUG: ref_store is type \"%s\" not \"namespaced\" in %s",
+		    ref_store->be->name, caller);
+
+	refs = (struct namespaced_ref_store *)ref_store;
+
+	return refs;
+}
+
+int namespaced_ref_store_create(const char *gitdir,
+                                struct ref_store **lower)
+{
+	struct namespaced_ref_store *refs = NULL;
+	struct ref_store *ref_store;
+	char *config = NULL, *prefix = NULL;
+	int ret;
+	struct config_options opts;
+	struct config_set cs;
+	struct strbuf sb = STRBUF_INIT;
+
+	ret = get_common_dir(&sb, gitdir);
+	if (ret < 0) {
+		goto cleanup;
+	}
+
+	opts.respect_includes = 1;
+	opts.commondir =  sb.buf;
+	opts.git_dir = gitdir;
+	memset(&cs, 0, sizeof(cs));
+	git_configset_init(&cs);
+
+	ret = git_configset_add_standard(&cs, &opts);
+	if (ret < 0) {
+		goto cleanup;
+	}
+
+	ret = git_configset_get_string(&cs, "core.namespace", &config);
+	if (ret != 0) {
+		goto cleanup;
+	}
+
+	prefix = expand_namespace(config);
+	assert(prefix);
+
+	refs = xcalloc(1, sizeof(*refs));
+	ref_store = &refs->base;
+	refs->prefix = prefix;
+	prefix = NULL;
+
+	base_ref_store_init(ref_store, &refs_be_namespaced);
+
+	refs->lower = *lower;
+	*lower = ref_store;
+	refs = NULL;
+
+cleanup:
+	free(refs);
+	git_configset_clear(&cs);
+	free(prefix);
+	free(config);
+	strbuf_release(&sb);
+
+	return ret;
+}
+
+static void prepend_prefix(struct ref_transaction *transaction,
+                           const char *prefix)
+{
+	struct strbuf sb = STRBUF_INIT;
+	size_t prefixlen;
+	int i;
+
+	strbuf_addstr(&sb, prefix);
+	prefixlen = sb.len;
+
+	for (i = 0; i < transaction->nr; i++) {
+		struct ref_update *oldupdate, *newupdate;
+
+		oldupdate = transaction->updates[i];
+
+		if (ref_type(oldupdate->refname) == REF_TYPE_PSEUDOREF)
+			continue;
+
+		strbuf_addstr(&sb, oldupdate->refname);
+		FLEX_ALLOC_STR(newupdate, refname, sb.buf);
+		memcpy(newupdate, oldupdate,
+		       ((char*)&newupdate->refname) - (char*)newupdate);
+		transaction->updates[i] = newupdate;
+		free(oldupdate);
+		strbuf_setlen(&sb, prefixlen);
+	}
+	strbuf_release(&sb);
+}
+
+static char *add_namespace(
+		struct strbuf *sb, struct namespaced_ref_store *refs,
+		const char *refname)
+{
+	if (ref_type(refname) != REF_TYPE_PSEUDOREF)
+		strbuf_addstr(sb, refs->prefix);
+	if (refname)
+		strbuf_addstr(sb, refname);
+	return sb->buf;
+}
+
+static int namespaced_init_db(struct ref_store *ref_store, struct strbuf *err)
+{
+	struct namespaced_ref_store *refs = namespaced_downcast(
+			ref_store, "init_db");
+	int ret;
+	
+	ret = refs->lower->be->init_db(refs->lower, err);
+	if (ret != 0)
+		return ret;
+
+	/* TODO: Needs to add an un-namespaced HEAD symlink,
+	         is_git_directory assumes it's not a repo without it.
+	         Can't change is_git_directory to resolve ref via backend
+	         since it would need to make the backend and can't free it. */
+	ret = refs->lower->be->create_symref(
+			refs->lower, "HEAD", "refs/heads/master", NULL);
+	if (ret != 0)
+		return ret;
+
+	ret = refs_create_symref(ref_store, "HEAD", "refs/heads/master", NULL);
+
+	return ret;
+}
+
+static int namespaced_transaction_prepare(struct ref_store *ref_store,
+                                          struct ref_transaction *transaction,
+                                          struct strbuf *err)
+{
+	struct namespaced_ref_store *refs = namespaced_downcast(
+			ref_store, "transaction_prepare");
+	int ret;
+
+	prepend_prefix(transaction, refs->prefix);
+
+	ret = refs->lower->be->transaction_prepare(refs->lower, transaction,
+	                                           err);
+
+	/* TODO: Fix missing ref update for namespaced HEAD */
+
+	return ret;
+}
+static int namespaced_transaction_finish(struct ref_store *ref_store,
+                                         struct ref_transaction *transaction,
+                                         struct strbuf *err)
+{
+	struct namespaced_ref_store *refs = namespaced_downcast(
+			ref_store, "transaction_finish");
+	return refs->lower->be->transaction_finish(refs->lower, transaction,
+	                                           err);
+}
+static int namespaced_transaction_abort(struct ref_store *ref_store,
+                                        struct ref_transaction *transaction,
+                                        struct strbuf *err)
+{
+	struct namespaced_ref_store *refs = namespaced_downcast(
+			ref_store, "transaction_abort");
+	return refs->lower->be->transaction_abort(refs->lower, transaction,
+	                                          err);
+}
+static int namespaced_initial_transaction_commit(
+		struct ref_store *ref_store,
+		struct ref_transaction *transaction, struct strbuf *err)
+{
+	struct namespaced_ref_store *refs = namespaced_downcast(
+			ref_store, "initial_transaction_commit");
+	int ret;
+
+	prepend_prefix(transaction, refs->prefix);
+
+	ret = refs->lower->be->initial_transaction_commit(
+			refs->lower, transaction, err);
+
+	/* TODO: Fix missing ref update for namespaced HEAD */
+
+	return ret;
+}
+static int namespaced_pack_refs(struct ref_store *ref_store, unsigned int flags)
+{
+	struct namespaced_ref_store *refs = namespaced_downcast(
+			ref_store, "pack_refs");
+	return refs->lower->be->pack_refs(refs->lower, flags);
+}
+static int namespaced_peel_ref(struct ref_store *ref_store, const char *refname,
+                               unsigned char *sha1)
+{
+	struct namespaced_ref_store *refs = namespaced_downcast(
+			ref_store, "peel_ref");
+	struct strbuf sb = STRBUF_INIT;
+	int ret;
+
+	ret = refs->lower->be->peel_ref(
+			refs->lower, add_namespace(&sb, refs, refname), sha1);
+	
+	strbuf_release(&sb);
+
+	return ret;
+}
+static int namespaced_create_symref(struct ref_store *ref_store,
+                                    const char *refname,
+                                    const char *target,
+                                    const char *logmsg)
+{
+	struct namespaced_ref_store *refs = namespaced_downcast(
+			ref_store, "create_symref");
+	struct strbuf rsb = STRBUF_INIT, tsb = STRBUF_INIT;
+	int ret;
+
+	ret = refs->lower->be->create_symref(
+			refs->lower, add_namespace(&rsb, refs, refname),
+			add_namespace(&tsb, refs, target), logmsg);
+	
+	strbuf_release(&rsb);
+	strbuf_release(&tsb);
+
+	return ret;
+}
+static int namespaced_delete_refs(struct ref_store *ref_store, const char *msg,
+                                  struct string_list *refnames,
+                                  unsigned int flags)
+{
+	struct namespaced_ref_store *refs = namespaced_downcast(
+			ref_store, "delete_refs");
+	struct string_list prefixed = STRING_LIST_INIT_DUP;
+	struct string_list_item *it;
+	int ret;
+
+	for_each_string_list_item(it, refnames) {
+		struct strbuf sb = STRBUF_INIT;
+
+		/* TODO: Pseudorefs aren't namespaced,
+		         so add_namespace may do nothing but strdup */
+		add_namespace(&sb, refs, it->string);
+		string_list_append_nodup(&prefixed, strbuf_detach(&sb, NULL));
+
+		strbuf_release(&sb);
+	}
+	
+	ret = refs->lower->be->delete_refs(refs->lower, msg, &prefixed, flags);
+
+	string_list_clear(&prefixed, 1);
+
+	return ret;
+}
+static int namespaced_rename_ref(struct ref_store *ref_store,
+                                 const char *oldref, const char *newref,
+                                 const char *logmsg)
+{
+	struct namespaced_ref_store *refs = namespaced_downcast(
+			ref_store, "rename_ref");
+	struct strbuf osb = STRBUF_INIT, nsb = STRBUF_INIT;
+	int ret;
+
+	ret = refs->lower->be->rename_ref(
+			refs->lower, add_namespace(&osb, refs, oldref),
+			add_namespace(&nsb, refs, newref), logmsg);
+	
+	strbuf_release(&osb);
+	strbuf_release(&nsb);
+
+	return ret;
+}
+
+extern struct ref_iterator_vtable namespaced_ref_iterator_vtable;
+
+struct namespaced_ref_iterator {
+	struct ref_iterator base;
+	struct ref_iterator *lower;
+	const char *prefix;
+};
+
+static struct namespaced_ref_iterator *nsiter_downcast(
+		struct ref_iterator *ref_iterator, const char *caller)
+{
+	struct namespaced_ref_iterator *iter;
+
+	if (ref_iterator->vtable != &namespaced_ref_iterator_vtable)
+		die("BUG: ref_iterator is not \"namespaced\" in %s",
+		    caller);
+
+	iter = (struct namespaced_ref_iterator *)ref_iterator;
+
+	return iter;
+}
+static int namespaced_ref_iterator_advance(struct ref_iterator *ref_iterator)
+{
+	struct namespaced_ref_iterator *iter = nsiter_downcast(ref_iterator,
+	                                                       "advance");
+	int ret;
+
+	while ((ret = iter->lower->vtable->advance(iter->lower)) == ITER_OK) {
+		/* Pseudorefs are not namespaced */
+		if (ref_type(iter->lower->refname) == REF_TYPE_PSEUDOREF) {
+			iter->base.oid = iter->lower->oid;
+			iter->base.flags = iter->lower->flags;
+			iter->base.refname = iter->lower->refname;
+			return ITER_OK;
+		}
+		    
+		/* Standard ref iterator is pre-filtered,
+		   but the same function is used for reflogs
+		   which has no pre-filtering. */
+		if (!starts_with(iter->lower->refname, iter->prefix))
+			continue;
+
+		iter->base.oid = iter->lower->oid;
+		iter->base.flags = iter->lower->flags;
+		assert(skip_prefix(iter->lower->refname, iter->prefix,
+		                   &iter->base.refname));
+		return ITER_OK;
+	}
+
+	iter->lower = NULL;
+	if (ref_iterator_abort(ref_iterator) != ITER_DONE)
+		ret = ITER_ERROR;
+
+	return ret;
+}
+static int namespaced_ref_iterator_peel(struct ref_iterator *ref_iterator,
+                                        struct object_id *peeled)
+{
+	struct namespaced_ref_iterator *iter = nsiter_downcast(ref_iterator,
+	                                                       "peel");
+	return iter->lower->vtable->peel(iter->lower, peeled);
+}
+static int namespaced_ref_iterator_abort(struct ref_iterator *ref_iterator)
+{
+	struct namespaced_ref_iterator *iter = nsiter_downcast(ref_iterator,
+	                                                       "abort");
+	int ret = ITER_DONE;
+	if (iter->lower)
+		ret = iter->lower->vtable->abort(iter->lower);
+
+	base_ref_iterator_free(ref_iterator);
+	return ret;
+}
+struct ref_iterator_vtable namespaced_ref_iterator_vtable = {
+	namespaced_ref_iterator_advance,
+	namespaced_ref_iterator_peel,
+	namespaced_ref_iterator_abort,
+};
+
+static struct ref_iterator *make_namespaced_iterator(
+		struct ref_iterator *lower,
+		const char *prefix)
+{
+	struct ref_iterator *ref_iterator;
+	struct namespaced_ref_iterator *iter;
+
+	iter = xcalloc(1, sizeof(*iter));
+	ref_iterator = &iter->base;
+	base_ref_iterator_init(ref_iterator, &namespaced_ref_iterator_vtable);
+
+	iter->lower = lower;
+	iter->prefix = prefix;
+
+	return ref_iterator;
+}
+static struct ref_iterator *namespaced_iterator_begin(
+		struct ref_store *ref_store, const char *prefix,
+		unsigned int flags)
+{
+	struct namespaced_ref_store *refs = namespaced_downcast(
+			ref_store, "iterator_begin");
+	struct ref_iterator *lower, *ret;
+	struct strbuf sb = STRBUF_INIT;
+
+	/* TODO: Pseudorefs aren't namespaced, but appear in the namespace.
+	         Pseudorefs can only appear if there's no prefix or it's ""
+	         at which point stripping the namespace off and filtering works,
+	         so if we've got a prefix we prepend the namespace,
+	         and if we don't we filter post-hoc.
+	*/
+	if (prefix && *prefix)
+		prefix = add_namespace(&sb, refs, prefix);
+
+	lower = refs->lower->be->iterator_begin(
+			refs->lower, prefix, flags);
+
+	ret = make_namespaced_iterator(lower, refs->prefix);
+
+	strbuf_release(&sb);
+
+	return ret;
+}
+static int namespaced_read_raw_ref(struct ref_store *ref_store,
+                                   const char *refname, unsigned char *sha1,
+                                   struct strbuf *referent, unsigned int *type)
+{
+	struct namespaced_ref_store *refs = namespaced_downcast(
+			ref_store, "read_raw_ref");
+	struct strbuf sb = STRBUF_INIT;
+	int ret;
+
+	ret = refs->lower->be->read_raw_ref(
+			refs->lower, add_namespace(&sb, refs, refname), sha1,
+			referent, type);
+
+	if (ret == 0 && (*type & REF_ISSYMREF) == REF_ISSYMREF) {
+		const char *stripped_ref;
+		if (skip_prefix(referent->buf, refs->prefix, &stripped_ref)) {
+			struct strbuf stripped = STRBUF_INIT;
+			strbuf_addstr(&stripped, stripped_ref);
+			strbuf_swap(referent, &stripped);
+			strbuf_release(&stripped);
+		}
+	}
+
+	strbuf_release(&sb);
+
+	return ret;
+}
+static struct ref_iterator *namespaced_reflog_iterator_begin(
+		struct ref_store *ref_store)
+{
+	struct namespaced_ref_store *refs = namespaced_downcast(
+			ref_store, "reflog_iterator_begin");
+	struct ref_iterator *lower;
+
+	lower = refs->lower->be->reflog_iterator_begin(
+			refs->lower);
+
+	return make_namespaced_iterator(lower, refs->prefix);
+}
+
+static int namespaced_for_each_reflog_ent(struct ref_store *ref_store,
+                                          const char *refname,
+                                          each_reflog_ent_fn fn,
+                                          void *cb_data)
+{
+	struct namespaced_ref_store *refs = namespaced_downcast(
+			ref_store, "for_each_reflog_ent");
+	struct strbuf sb = STRBUF_INIT;
+	int ret;
+
+	ret = refs->lower->be->for_each_reflog_ent(
+			refs->lower, add_namespace(&sb, refs, refname),
+			fn, cb_data);
+
+	strbuf_release(&sb);
+
+	return ret;
+}
+static int namespaced_for_each_reflog_ent_reverse(struct ref_store *ref_store,
+                                                  const char *refname,
+                                                  each_reflog_ent_fn fn,
+                                                  void *cb_data)
+{
+	struct namespaced_ref_store *refs = namespaced_downcast(
+			ref_store, "for_each_reflog_ent_reverse");
+	struct strbuf sb = STRBUF_INIT;
+	int ret;
+
+	ret = refs->lower->be->for_each_reflog_ent_reverse(
+			refs->lower, add_namespace(&sb, refs, refname),
+			fn, cb_data);
+
+	strbuf_release(&sb);
+
+	return ret;
+}
+static int namespaced_reflog_exists(struct ref_store *ref_store,
+                                    const char *refname)
+{
+	struct namespaced_ref_store *refs = namespaced_downcast(
+			ref_store, "reflog_exists");
+	struct strbuf sb = STRBUF_INIT;
+	int ret;
+
+	ret = refs->lower->be->reflog_exists(
+			refs->lower, add_namespace(&sb, refs, refname));
+
+	strbuf_release(&sb);
+
+	return ret;
+}
+static int namespaced_create_reflog(struct ref_store *ref_store,
+                                    const char *refname, int force_create,
+                                    struct strbuf *err)
+{
+	struct namespaced_ref_store *refs = namespaced_downcast(
+			ref_store, "create_reflog");
+	struct strbuf sb = STRBUF_INIT;
+	int ret;
+
+	ret = refs->lower->be->create_reflog(
+			refs->lower, add_namespace(&sb, refs, refname),
+			force_create, err);
+
+	strbuf_release(&sb);
+
+	return ret;
+}
+static int namespaced_delete_reflog(struct ref_store *ref_store,
+                                    const char *refname)
+{
+	struct namespaced_ref_store *refs = namespaced_downcast(
+			ref_store, "delete_reflog");
+	struct strbuf sb = STRBUF_INIT;
+	int ret;
+
+	ret = refs->lower->be->delete_reflog(
+			refs->lower, add_namespace(&sb, refs, refname));
+
+	strbuf_release(&sb);
+
+	return ret;
+}
+
+struct wrap_expiry_cb_data {
+	char *prefix;
+	reflog_expiry_prepare_fn *prepare_fn;
+	reflog_expiry_should_prune_fn *should_prune_fn;
+	reflog_expiry_cleanup_fn *cleanup_fn;
+	void *cb_data;
+};
+void wrap_expiry_prepare(const char *refname, const struct object_id *oid,
+                         void *cb_data)
+{
+	struct wrap_expiry_cb_data *cbd = cb_data;
+	skip_prefix(refname, cbd->prefix, &refname);
+	cbd->prepare_fn(refname, oid, cbd->cb_data);
+}
+int wrap_expiry_should_prune(struct object_id *ooid, struct object_id *noid,
+                             const char *email, timestamp_t timestamp, int tz,
+                             const char *message, void *cb_data)
+{
+	struct wrap_expiry_cb_data *cbd = cb_data;
+	return cbd->should_prune_fn(ooid, noid, email, timestamp, tz,
+	                            message, cbd->cb_data);
+}
+void wrap_expiry_cleanup(void *cb_data)
+{
+	struct wrap_expiry_cb_data *cbd = cb_data;
+	cbd->cleanup_fn(cbd->cb_data);
+}
+static int namespaced_reflog_expire(
+		struct ref_store *ref_store, const char *refname,
+		const unsigned char *sha1, unsigned int flags,
+		reflog_expiry_prepare_fn prepare_fn,
+		reflog_expiry_should_prune_fn should_prune_fn,
+		reflog_expiry_cleanup_fn cleanup_fn,
+		void *policy_cb_data)
+{
+	struct namespaced_ref_store *refs = namespaced_downcast(
+			ref_store, "reflog_expire");
+	struct strbuf sb = STRBUF_INIT;
+	struct wrap_expiry_cb_data cbd = {
+		refs->prefix,
+		prepare_fn,
+		should_prune_fn,
+		cleanup_fn,
+		policy_cb_data,
+	};
+	int ret;
+
+	ret = refs->lower->be->reflog_expire(
+			refs->lower, add_namespace(&sb, refs, refname), sha1,
+			flags, wrap_expiry_prepare, wrap_expiry_should_prune,
+			wrap_expiry_cleanup, &cbd);
+
+	strbuf_release(&sb);
+
+	return ret;
+}
+
+struct ref_storage_be refs_be_namespaced = {
+	NULL,
+	"namespaced",
+	NULL, /* Initialised by namespaced_ref_store_create with different API */
+	namespaced_init_db,
+	namespaced_transaction_prepare,
+	namespaced_transaction_finish,
+	namespaced_transaction_abort,
+	namespaced_initial_transaction_commit,
+	namespaced_pack_refs,
+	namespaced_peel_ref,
+	namespaced_create_symref,
+	namespaced_delete_refs,
+	namespaced_rename_ref,
+	namespaced_iterator_begin,
+	namespaced_read_raw_ref,
+	namespaced_reflog_iterator_begin,
+	namespaced_for_each_reflog_ent,
+	namespaced_for_each_reflog_ent_reverse,
+	namespaced_reflog_exists,
+	namespaced_create_reflog,
+	namespaced_delete_reflog,
+	namespaced_reflog_expire,
+};
+
+
diff --git a/refs/refs-internal.h b/refs/refs-internal.h
index 192f9f8..8391eda 100644
--- a/refs/refs-internal.h
+++ b/refs/refs-internal.h
@@ -655,6 +655,7 @@ struct ref_storage_be {
 };
 
 extern struct ref_storage_be refs_be_files;
+int namespaced_ref_store_create(const char *gitdir, struct ref_store **lower);
 
 /*
  * A representation of the reference store for the main repository or
-- 
2.9.0

[PATCH 7/7] Plumb in namespaced ref store

[Richard Maw]

---
 refs.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/refs.c b/refs.c
index 9a3dcfb..e80244f 100644
--- a/refs.c
+++ b/refs.c
@@ -647,7 +647,6 @@ int refs_delete_ref(struct ref_store *refs, const char *msg,
 	struct strbuf err = STRBUF_INIT;
 
 	if (ref_type(refname) == REF_TYPE_PSEUDOREF) {
-		assert(refs == get_main_ref_store());
 		return delete_pseudoref(refname, old_sha1);
 	}
 
@@ -986,7 +985,6 @@ int refs_update_ref(struct ref_store *refs, const char *msg,
 	int ret = 0;
 
 	if (ref_type(refname) == REF_TYPE_PSEUDOREF) {
-		assert(refs == get_main_ref_store());
 		ret = write_pseudoref(refname, new_sha1, old_sha1, &err);
 	} else {
 		t = ref_store_transaction_begin(refs, &err);
@@ -1589,6 +1587,9 @@ static struct ref_store *ref_store_init(const char *gitdir,
 		die("BUG: reference backend %s is unknown", be_name);
 
 	refs = be->init(gitdir, flags);
+
+	namespaced_ref_store_create(gitdir, &refs);
+
 	return refs;
 }
 
-- 
2.9.0

Re: [RFC PATCH 0/7] Implement ref namespaces as a ref storage backend

[Stefan Beller]

> Technical description
> =====================
>
> This patch series adds a new refs backend, stacking on top of the files backend,
> based on whether `core.namespace` is set in git config.

Currently there is another Big Thing getting started in in the refs backend.
https://public-inbox.org/git/CAJo=hJtg0PAVHT1phbArdra8+4LfnEEuaj3fBid==BXkZghi8g@mail.gmail.com/
Maybe it is worth looking into that as well? Reftables solve
the problem of scaling (i.e. a repo containing a million refs works
just fine, and fast(!) for reading/writing refs, which is not the case
for packed refs)

Re: [RFC PATCH 0/7] Implement ref namespaces as a ref storage backend

[Junio C Hamano]

Richard Maw <richard.maw@gmail.com> writes:

> This is not my first attempt to improve the git namespace handling in git.
> I tried last year, but it took me so long that all the ref handling code changed
> and I would have had to start from scratch.
>
> Fortunately the pluggable ref backends work provided an easier starting point.

Yeah, I also made an ultra-brief foray into ref backends a few weeks
ago, and found that Michael did an excellent job identifying the
building blocks backends may want to implement differently and
abstracting out major parts of the ref processing.  I also hit some
of the same issues you mention, e.g. "HEAD" and other funny refs.

I do suspect that the current GIT_NAMESPACE thing may have outlived
its usefulness and with the pluggable ref backend thing in place, we
may want to redesign how support for multiple views into the same
repository is done.  I do not have a need for such a thing myself,
but I am glad somebody is looking into it ;-)

Re: [RFC PATCH 0/7] Implement ref namespaces as a ref storage backend

[Richard Maw]

On Tue, Aug 15, 2017 at 10:13:22AM -0700, Junio C Hamano wrote:
> Richard Maw <richard.maw@gmail.com> writes:
> 
> > This is not my first attempt to improve the git namespace handling in git.
> > I tried last year, but it took me so long that all the ref handling code changed
> > and I would have had to start from scratch.
> >
> > Fortunately the pluggable ref backends work provided an easier starting point.
> 
> Yeah, I also made an ultra-brief foray into ref backends a few weeks
> ago, and found that Michael did an excellent job identifying the
> building blocks backends may want to implement differently and
> abstracting out major parts of the ref processing.  I also hit some
> of the same issues you mention, e.g. "HEAD" and other funny refs.
> 
> I do suspect that the current GIT_NAMESPACE thing may have outlived
> its usefulness and with the pluggable ref backend thing in place, we
> may want to redesign how support for multiple views into the same
> repository is done.  I do not have a need for such a thing myself,
> but I am glad somebody is looking into it ;-)

It was great to be able to get something mostly working this time around,
which would not have been possible without the pluggable ref backends.

I've no intention of giving up just yet,
though it'll be a while before I can devote significant time to it.

I'll be keeping an eye on the refdb backend.
If it in the process fixes the issues I'd been having that'd be so much better
since I've not got the time or community standing to champion big changes.

Re: [RFC PATCH 0/7] Implement ref namespaces as a ref storage backend

[Michael Haggerty]

On Sun, Aug 13, 2017 at 9:36 PM, Richard Maw <richard.maw@gmail.com> wrote:
> Forewarning: I don't consider this work complete
> and am unlikely to find time to finish it any time soon.
> I've mostly sent this because it may include valuable feedback
> on how well the ref storage backends works
> from trying to use it to change how git namespaces work.
>
> Introduction
> ============
>
> I work on a git server called Gitano,
> and I'd like to add support for git namespaces to: [...]

Thanks so much for your efforts and your description of the problems
that you faced. That will be really valuable for whomever might follow
up on your work (even if it is you :-) ).

> Unfortunately namespace handling was never implemented for any other part of git
> and at least gitolite makes use of namespaces,
> and will have to work around it not being implemented fully,
> but implementing it more fully will break work-arounds.

I agree that the current namespace feature is not a great foundation
for future work.

> [...]
> Fortunately the pluggable ref backends work provided an easier starting point.

:-) I'm glad my years-long obsession is finally yielding fruit.

First a general comment about the approach...

I've always thought that a workable "Git with namespaces" would
probably look more like git worktrees:

* One main repository holding all of the objects and all of the
non-pseudo references.

* One lightweight directory per namespace-view, holding the
"core.namespace" config and the pseudorefs. HEAD should probably be
stored in the main repository (?). Both the main repository and the
namespace-view directories would probably be bare, though perhaps
somebody can think of an application for allowing non-bare
repositories.

Even though this scheme implies the need for extra directories, I
think that it would make it easier to fix a lot of your problems:

* Each namespace-view could define its own namespace,
quasi-permanently. You wouldn't have to pass it via the environment.
(You might even want to *forbid* changing the namespace via the
environment or command line!) So fetches and pushes from one namespace
to another would work correctly.

* There would be one place for each namespace-view's pseudorefs. You
wouldn't have to squeeze them into a single reference tree.

* The main repository would know all of the references of all of the
namespace views, so maintenance tools like `git gc` would work without
changes.

* The namespace-view directories wouldn't be mistakable for full
repositories, so tools like `git gc` would refuse to run in them. I
think this would also make it a little bit harder for reference values
to "leak" from one namespace-view to another.

* Remote access could use different paths for different
namespace-views. The externally-visible path need not, of course, be
the same as the path of the namespace-view's directory.

By the way, there are certainly still places in the code that don't go
through the refs API (e.g., the one that Junio found). That's because
the refs API has still not been used for anything very interesting, so
the bugs haven't been flushed out. I see you've found some more.
That's because you're doing something interesting :-)

> [...]
> Bugs
> ----
>
> Most boil down to how special refs like HEAD are handled.
>
> 1.  Logged messages display the namespaced path,
>     which a human may deal with but confuses the test suite.

I think it's clear that the logged messages should reflect the shorter
reference names, and it is the test suite that needs to be fixed.

> 2.  Reflogs for namespaced HEAD are not updated.
>
>     This is because resolving HEAD to split the transaction's updates
>     to add a log only update to HEAD works by transaction_prepare resolving HEAD
>     using its own ref store rather than the main one,
>     so the namespace translation isn't performed.
>     See split_head_update.
>
>     The fix for this may be to move the transaction mangling out of the backend,
>     unless it should be implied that every backend implementation
>     must be responsible for symbolic ref reflog updates implicitly.

It probably makes sense for the namespace layer to do this step.

I think there is a similar problem with `split_symref_update()`. Here
the problem is trickier, because you don't know how to split the
update until you have locked the symref, but the locking necessarily
has to happen in the main-repo backend. So I think there will be
places where the main-repo backend needs to call back to the namespace
layer for some things, like deciding what reference names to use in
error messages and things.

You'd also want to prevent actions in a namespace-view from affecting
references outside of that namespace. For example, you shouldn't be
able to follow a symref from a namespace-view ref to another reference
in a different namespace. This also implies some cooperation between
the file-level backend and the namespace layer.

I guess it is also clear that symrefs on disk have to contain the full
reference names of their targets, but when they are read via a
namespace-view, the caller should see the short name as the target.

[...]

Michael

Re: [RFC PATCH 0/7] Implement ref namespaces as a ref storage backend

[Richard Maw]

On Thu, Aug 24, 2017 at 06:17:07PM +0200, Michael Haggerty wrote:
> On Sun, Aug 13, 2017 at 9:36 PM, Richard Maw <richard.maw@gmail.com> wrote:
> > [...]
> > Fortunately the pluggable ref backends work provided an easier starting point.
> 
> :-) I'm glad my years-long obsession is finally yielding fruit.
> 
> First a general comment about the approach...
> 
> I've always thought that a workable "Git with namespaces" would
> probably look more like git worktrees:
> 
> * One main repository holding all of the objects and all of the
> non-pseudo references.
> 
> * One lightweight directory per namespace-view, holding the
> "core.namespace" config and the pseudorefs. HEAD should probably be
> stored in the main repository (?).

I had pondered something like this as a later extension,
since it's an iterable way of finding out which namespaces exist in a repository
and allows you to explicitly say which namespaces are meant to exist
since looking for all (refs/namespaces/[^/]+/).*HEAD
will also return HEADs that were created by requesting a symbolic ref creation.

Given how many of my problems have been because
namespaced head isn't located at ${GITDIR}/HEAD
I'm not sure how this helps.

> Both the main repository and the namespace-view directories would probably be
> bare, though perhaps somebody can think of an application for allowing
> non-bare repositories.

The only application I've come up with so far is:

1.  Your git server stores configuration in git repositories (gitano does).
2.  The configuration is stored in a git namespace (gitano wants to do this).
3.  Instead of making a clone of the namespace, making changes and pushing that
    it would be nicer to create a workspace to make the changes in instead.

It's not a particularly strong application,
since normally you'd be administering by doing a clone remotely,
and even if that doesn't work you can do a clone locally and push that.

Similarly you should be able to create a workspace
and check out the namespace's head yourself.

> Even though this scheme implies the need for extra directories, I
> think that it would make it easier to fix a lot of your problems:
> 
> * Each namespace-view could define its own namespace,
> quasi-permanently. You wouldn't have to pass it via the environment.
> (You might even want to *forbid* changing the namespace via the
> environment or command line!) So fetches and pushes from one namespace
> to another would work correctly.
> 
> * There would be one place for each namespace-view's pseudorefs. You
> wouldn't have to squeeze them into a single reference tree.

I'm not sure that un-namespaced pseudorefs are a problem.
At least for the git server use-case you wouldn't typically have them.
It would be nice for it to just work of course.

> * The main repository would know all of the references of all of the
> namespace views, so maintenance tools like `git gc` would work without
> changes.

The same is/will be true for worktrees from walking the gitdirs
stored in the commondir.

> * The namespace-view directories wouldn't be mistakable for full
> repositories, so tools like `git gc` would refuse to run in them. I
> think this would also make it a little bit harder for reference values
> to "leak" from one namespace-view to another.
> 
> * Remote access could use different paths for different
> namespace-views. The externally-visible path need not, of course, be
> the same as the path of the namespace-view's directory.

This talk of worktrees got me thinking about an alternative implementation
where instead of mangling refs to add and remove prefixes
a separate git directory is maintained, like worktrees,
and the namespace handling in the refs backend would be
to create a files (or reftable) backend for the namespace's git directory.

Having a separate namespave-view would be like having a bare worktree,
which would presumably be just the gitfile.

This would require extra tooling to create namespaces
since you can't just create a sub-namespace by copying some refs
and adding a symbolic ref for HEAD.

However since you can't (or couldn't last time I tried to find a way to)
push a symbolic ref, so the git server needs extra tooling anyway.
You would lose the ability to trivially see sub-namespaces by fetching refs,
but the only use I can think of for that is mirroring for backup.

> By the way, there are certainly still places in the code that don't go
> through the refs API (e.g., the one that Junio found). That's because
> the refs API has still not been used for anything very interesting, so
> the bugs haven't been flushed out. I see you've found some more.
> That's because you're doing something interesting :-)

> > [...]
> > Bugs
> > ----
> >
> > Most boil down to how special refs like HEAD are handled.
> >
> > 1.  Logged messages display the namespaced path,
> >     which a human may deal with but confuses the test suite.
> 
> I think it's clear that the logged messages should reflect the shorter
> reference names, and it is the test suite that needs to be fixed.

It's error messages from inside the files backend.

The namespaced backend gets passed refs with the namespace prepended
and when it produces a message including the ref name the prefix is added.

I'd not put too much thought into ways of fixing this
since if something goes really wrong it's probably more useful
to know the real ref name.

> > 2.  Reflogs for namespaced HEAD are not updated.
> >
> >     This is because resolving HEAD to split the transaction's updates
> >     to add a log only update to HEAD works by transaction_prepare resolving HEAD
> >     using its own ref store rather than the main one,
> >     so the namespace translation isn't performed.
> >     See split_head_update.
> >
> >     The fix for this may be to move the transaction mangling out of the backend,
> >     unless it should be implied that every backend implementation
> >     must be responsible for symbolic ref reflog updates implicitly.
> 
> It probably makes sense for the namespace layer to do this step.
> 
> I think there is a similar problem with `split_symref_update()`. Here
> the problem is trickier, because you don't know how to split the
> update until you have locked the symref, but the locking necessarily
> has to happen in the main-repo backend. So I think there will be
> places where the main-repo backend needs to call back to the namespace
> layer for some things, like deciding what reference names to use in
> error messages and things.

It sounds like perhaps struct ref_store needs a pointer to the "top" backend
for things like refs_resolve_refdup,
but also to store a "parent" and add a render_ref_fn:

    typedef const char *render_ref_fn(struct ref_store *ref_store,
                                      const char *refname,
                                      struct strbuf *result);

This would return the rendered ref.
Passive backends are just:

    const char *backend_render_ref(struct ref_store *ref_store,
                                   const char *refname, struct strbuf *result)
    {
        if (ref_store->parent == NULL)
            return refname;
        return render_ref(ref_store->parent, refname, result)
    }

The namespaced backend would be:

    const char *namespaced_render_ref(struct ref_store *ref_store,
                                      const char *refname,
                                      struct strbuf *result)
    {
        struct namespaced_ref_store *refs = namespaced_downcast(
                        ref_store, "render_ref");

        if (skip_prefix(refname, refs->prefix, &refname) == 0)
            return NULL;

        if (ref_store->parent == NULL)
            return refname;

        return render_ref(ref_store->parent, refname, result)
    }

If a backend did anything more weird it could put the result in *result
and return a pointer into that.

> You'd also want to prevent actions in a namespace-view from affecting
> references outside of that namespace. For example, you shouldn't be
> able to follow a symref from a namespace-view ref to another reference
> in a different namespace. This also implies some cooperation between
> the file-level backend and the namespace layer.

If it's created via the namespaced ref backend it can only point within.
If it's created from a parent namespace then it may be sufficient
to catch it at resolve time and treat it as a broken.

The files backend using REF_ISBROKEN for if a ref resolves to the null OID
seems like sufficient precedent for using it this way.

> I guess it is also clear that symrefs on disk have to contain the full
> reference names of their targets, but when they are read via a
> namespace-view, the caller should see the short name as the target.
> 
> [...]
> 
> Michael