From 902fa86e2d56d8b737b9f9632a45ac30e8f14f85 Mon Sep 17 00:00:00 2001
From: Moshe Weitzman <weitzman@tejasa.com>
Date: Fri, 9 Feb 2018 15:50:56 -0500
Subject: [PATCH] Update /drush dir for Drush9

Shows how the benefits of a policyfile and also illustrates where to store site aliases and druh config.
---
 drush/Commands/PolicyCommands.php | 55 +++++++++++++++++++++++++++++++
 drush/Sites/self.site.yml         | 14 ++++++++
 drush/drush.yml                   |  2 ++
 drush/policy.drush.inc            | 38 ---------------------
 4 files changed, 71 insertions(+), 38 deletions(-)
 create mode 100644 drush/Commands/PolicyCommands.php
 create mode 100644 drush/Sites/self.site.yml
 create mode 100644 drush/drush.yml
 delete mode 100644 drush/policy.drush.inc

diff --git a/drush/Commands/PolicyCommands.php b/drush/Commands/PolicyCommands.php
new file mode 100644
index 0000000000..00c8e5346c
--- /dev/null
+++ b/drush/Commands/PolicyCommands.php
@@ -0,0 +1,55 @@
+<?php
+namespace Drush\Commands;
+
+use Consolidation\AnnotatedCommand\CommandData;
+use Drush\Commands\DrushCommands;
+use Symfony\Component\Console\Input\InputOption;
+
+/**
+ * Edit this file to reflect your organization's needs.
+ */
+
+class PolicyCommands extends DrushCommands {
+
+  /**
+   * Prevent catastrophic braino. Note that this file has to be local to the
+   * machine that initiates the sql:sync command.
+   *
+   * hook validate sql:sync
+   *
+   * @throws \Exception
+   */
+  public function sqlSyncValidate(CommandData $commandData) {
+    if ($commandData->input()->getArgument('destination') == '@prod') {
+      throw new \Exception(dt('Per !file, you may never overwrite the production database.', ['!file' => __FILE__]));
+    }
+  }
+
+  /**
+   * Limit rsync operations to production site.
+   *
+   * hook validate core:rsync
+   */
+  public function rsyncValidate(CommandData $commandData) {
+    if (preg_match("/^@prod/", $commandData->input()->getArgument('destination'))) {
+      throw new \Exception(dt('Per !file, you may never rsync to the production site.', ['!file' => __FILE__]));
+    }
+  }
+
+  /**
+   * Unauthorized may not execute updates.
+   *
+   * @hook validate updatedb
+   */
+  public function validateUpdateDb(CommandData $commandData) {
+    if (!$commandData->input()->getOption('secret') == 'mysecret') {
+      throw new \Exception(dt('UpdateDb command requires a secret token per site policy.'));
+    }
+  }
+
+  /**
+   * @hook option updatedb
+   * @option secret A required token else user may not run updatedb command.
+   */
+  public function optionsetUpdateDb($options = ['secret' => self::REQ]) {}
+}
diff --git a/drush/Sites/self.site.yml b/drush/Sites/self.site.yml
new file mode 100644
index 0000000000..8742ea4695
--- /dev/null
+++ b/drush/Sites/self.site.yml
@@ -0,0 +1,14 @@
+# Edit or remove this file as needed.
+# Docs at https://github.com/drush-ops/drush/blob/master/examples/example.site.yml
+
+#live:
+#  host: live.domain.com
+#  user: www-admin
+#  root: /path/to/drupal
+#  uri: http://www.example.com
+#
+#stage:
+#  host: stage.domain.com
+#  user: www-admin
+#  root: /path/to/drupal
+#  uri: http://stage.example.com
\ No newline at end of file
diff --git a/drush/drush.yml b/drush/drush.yml
new file mode 100644
index 0000000000..38342bf576
--- /dev/null
+++ b/drush/drush.yml
@@ -0,0 +1,2 @@
+# A Drush configuration file.
+# Details at https://github.com/drush-ops/drush/blob/master/examples/example.drush.yml
\ No newline at end of file
diff --git a/drush/policy.drush.inc b/drush/policy.drush.inc
deleted file mode 100644
index 64cd62d0f6..0000000000
--- a/drush/policy.drush.inc
+++ /dev/null
@@ -1,38 +0,0 @@
-<?php
-
-/*
- * Customize this file as desired. See https://github.com/drush-ops/drush/blob/8.x/examples/policy.drush.inc for documentation.
- */
-
-/**
- * Implements drush_hook_COMMAND_validate().
- *
- * Encourage folks to use `composer` instead of Drush pm commands
- */
-function drush_policy_pm_updatecode_validate() {
-  return _deny_message();
-}
-
-function drush_policy_pm_update_validate() {
-  return _deny_message();
-}
-
-function drush_policy_pm_download_validate() {
-  return _deny_message();
-}
-
-function _deny_message() {
-  if (!drush_get_option('pm-force')) {
-    $msg = 'This codebase is assembled with Composer instead of Drush. Use `composer update` and `composer require` instead of `drush pm-updatecode` and `drush pm-download`. You may override this error by using the --pm-force option.';
-    return drush_set_error('POLICY_PM_DENY', dt($msg));
-  }
-}
-
-/**
- * Implements hook_drush_help_alter().
- */
-function policy_drush_help_alter(&$command) {
-  if (in_array($command['command'], array('pm-updatecode', 'pm-update', 'pm-download'))) {
-    $command['options']['pm-force'] = 'Override site policy and allow Drush codebase management (pm-* commands)';
-  }
-}