debian-mirror-gitlab/lib/api/helpers.rb

485 lines
13 KiB
Ruby
Raw Normal View History

2014-09-02 18:07:02 +05:30
module API
2015-11-26 14:37:03 +05:30
module Helpers
2016-11-24 13:41:30 +05:30
include Gitlab::Utils
2014-09-02 18:07:02 +05:30
PRIVATE_TOKEN_HEADER = "HTTP_PRIVATE_TOKEN"
PRIVATE_TOKEN_PARAM = :private_token
2016-06-02 11:05:42 +05:30
SUDO_HEADER = "HTTP_SUDO"
2014-09-02 18:07:02 +05:30
SUDO_PARAM = :sudo
2017-01-15 13:20:01 +05:30
def declared_params(options = {})
options = { include_parent_namespaces: false }.merge(options)
declared(params, options).to_h.symbolize_keys
2016-06-22 15:30:34 +05:30
end
2014-09-02 18:07:02 +05:30
def current_user
2017-01-15 13:20:01 +05:30
return @current_user if defined?(@current_user)
2014-09-02 18:07:02 +05:30
2017-01-15 13:20:01 +05:30
@current_user = initial_current_user
2014-09-02 18:07:02 +05:30
2017-01-15 13:20:01 +05:30
sudo!
2014-09-02 18:07:02 +05:30
@current_user
end
2017-01-15 13:20:01 +05:30
def sudo?
initial_current_user != current_user
2014-09-02 18:07:02 +05:30
end
def user_project
@project ||= find_project(params[:id])
end
2016-11-03 12:29:30 +05:30
def available_labels
@available_labels ||= LabelsFinder.new(current_user, project_id: user_project.id).execute
end
2017-01-15 13:20:01 +05:30
def find_user(id)
if id =~ /^\d+$/
User.find_by(id: id)
else
User.find_by(username: id)
end
end
2014-09-02 18:07:02 +05:30
def find_project(id)
project = Project.find_with_namespace(id) || Project.find_by(id: id)
2016-09-13 17:45:13 +05:30
if can?(current_user, :read_project, project)
2014-09-02 18:07:02 +05:30
project
else
2016-09-13 17:45:13 +05:30
not_found!('Project')
2014-09-02 18:07:02 +05:30
end
end
2015-09-25 12:07:36 +05:30
def project_service
@project_service ||= begin
underscored_service = params[:service_slug].underscore
if Service.available_services_names.include?(underscored_service)
user_project.build_missing_services
service_method = "#{underscored_service}_service"
2015-10-24 18:46:33 +05:30
2015-09-25 12:07:36 +05:30
send_service(service_method)
end
end
2015-10-24 18:46:33 +05:30
2015-09-25 12:07:36 +05:30
@project_service || not_found!("Service")
end
def send_service(service_method)
user_project.send(service_method)
end
def service_attributes
@service_attributes ||= project_service.fields.inject([]) do |arr, hash|
arr << hash[:name].to_sym
end
end
2015-04-26 12:48:37 +05:30
def find_group(id)
2016-09-13 17:45:13 +05:30
group = Group.find_by(path: id) || Group.find_by(id: id)
2015-04-26 12:48:37 +05:30
if can?(current_user, :read_group, group)
group
else
2016-06-02 11:05:42 +05:30
not_found!('Group')
2015-04-26 12:48:37 +05:30
end
end
2016-06-02 11:05:42 +05:30
def find_project_label(id)
2016-11-03 12:29:30 +05:30
label = available_labels.find_by_id(id) || available_labels.find_by_title(id)
2016-06-02 11:05:42 +05:30
label || not_found!('Label')
end
def find_project_issue(id)
2017-01-15 13:20:01 +05:30
IssuesFinder.new(current_user, project_id: user_project.id).find(id)
2016-06-02 11:05:42 +05:30
end
2014-09-02 18:07:02 +05:30
def paginate(relation)
relation.page(params[:page]).per(params[:per_page].to_i).tap do |data|
add_pagination_headers(data)
end
2014-09-02 18:07:02 +05:30
end
def authenticate!
unauthorized! unless current_user
end
2015-04-26 12:48:37 +05:30
def authenticate_by_gitlab_shell_token!
input = params['secret_token'].try(:chomp)
unless Devise.secure_compare(secret_token, input)
unauthorized!
end
end
2014-09-02 18:07:02 +05:30
def authenticated_as_admin!
forbidden! unless current_user.is_admin?
end
2016-09-29 09:46:39 +05:30
def authorize!(action, subject = nil)
2016-09-13 17:45:13 +05:30
forbidden! unless can?(current_user, action, subject)
2014-09-02 18:07:02 +05:30
end
def authorize_push_project
authorize! :push_code, user_project
end
def authorize_admin_project
authorize! :admin_project, user_project
end
2015-11-26 14:37:03 +05:30
def require_gitlab_workhorse!
unless env['HTTP_GITLAB_WORKHORSE'].present?
forbidden!('Request should be executed via GitLab Workhorse')
end
end
2014-09-02 18:07:02 +05:30
def can?(object, action, subject)
2016-09-29 09:46:39 +05:30
Ability.allowed?(object, action, subject)
2014-09-02 18:07:02 +05:30
end
# Checks the occurrences of required attributes, each attribute must be present in the params hash
# or a Bad Request error is invoked.
#
# Parameters:
# keys (required) - A hash consisting of keys that must be present
def required_attributes!(keys)
keys.each do |key|
bad_request!(key) unless params[key].present?
end
end
2015-09-25 12:07:36 +05:30
def attributes_for_keys(keys, custom_params = nil)
2016-02-05 20:25:01 +05:30
params_hash = custom_params || params
2014-09-02 18:07:02 +05:30
attrs = {}
keys.each do |key|
2016-02-05 20:25:01 +05:30
if params_hash[key].present? or (params_hash.has_key?(key) and params_hash[key] == false)
attrs[key] = params_hash[key]
2014-09-02 18:07:02 +05:30
end
end
ActionController::Parameters.new(attrs).permit!
end
2016-06-02 11:05:42 +05:30
# Checks the occurrences of datetime attributes, each attribute if present in the params hash must be in ISO 8601
# format (YYYY-MM-DDTHH:MM:SSZ) or a Bad Request error is invoked.
#
# Parameters:
# keys (required) - An array consisting of elements that must be parseable as dates from the params hash
def datetime_attributes!(*keys)
keys.each do |key|
begin
params[key] = Time.xmlschema(params[key]) if params[key].present?
rescue ArgumentError
message = "\"" + key.to_s + "\" must be a timestamp in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ"
render_api_error!(message, 400)
end
end
end
2015-04-26 12:48:37 +05:30
def issuable_order_by
if params["order_by"] == 'updated_at'
'updated_at'
else
'created_at'
end
end
def issuable_sort
if params["sort"] == 'asc'
:asc
else
:desc
end
end
2015-09-11 14:41:01 +05:30
def filter_by_iid(items, iid)
items.where(iid: iid)
end
2014-09-02 18:07:02 +05:30
# error helpers
2015-04-26 12:48:37 +05:30
def forbidden!(reason = nil)
message = ['403 Forbidden']
message << " - #{reason}" if reason
render_api_error!(message.join(' '), 403)
2014-09-02 18:07:02 +05:30
end
def bad_request!(attribute)
message = ["400 (Bad request)"]
message << "\"" + attribute.to_s + "\" not given"
render_api_error!(message.join(' '), 400)
end
def not_found!(resource = nil)
message = ["404"]
message << resource if resource
message << "Not Found"
render_api_error!(message.join(' '), 404)
end
def unauthorized!
render_api_error!('401 Unauthorized', 401)
end
def not_allowed!
2015-04-26 12:48:37 +05:30
render_api_error!('405 Method Not Allowed', 405)
end
def conflict!(message = nil)
render_api_error!(message || '409 Conflict', 409)
end
2015-11-26 14:37:03 +05:30
def file_to_large!
render_api_error!('413 Request Entity Too Large', 413)
end
2016-06-02 11:05:42 +05:30
def not_modified!
render_api_error!('304 Not Modified', 304)
end
2016-09-29 09:46:39 +05:30
def no_content!
render_api_error!('204 No Content', 204)
end
2015-04-26 12:48:37 +05:30
def render_validation_error!(model)
if model.errors.any?
render_api_error!(model.errors.messages || '400 Bad Request', 400)
end
2014-09-02 18:07:02 +05:30
end
def render_api_error!(message, status)
2015-04-26 12:48:37 +05:30
error!({ 'message' => message }, status)
2014-09-02 18:07:02 +05:30
end
2016-09-29 09:46:39 +05:30
def handle_api_exception(exception)
if sentry_enabled? && report_exception?(exception)
define_params_for_grape_middleware
sentry_context
Raven.capture_exception(exception)
end
# lifted from https://github.com/rails/rails/blob/master/actionpack/lib/action_dispatch/middleware/debug_exceptions.rb#L60
trace = exception.backtrace
message = "\n#{exception.class} (#{exception.message}):\n"
message << exception.annoted_source_code.to_s if exception.respond_to?(:annoted_source_code)
message << " " << trace.join("\n ")
API.logger.add Logger::FATAL, message
rack_response({ 'message' => '500 Internal Server Error' }.to_json, 500)
end
2015-09-25 12:07:36 +05:30
# Projects helpers
def filter_projects(projects)
# If the archived parameter is passed, limit results accordingly
if params[:archived].present?
2016-09-13 17:45:13 +05:30
projects = projects.where(archived: to_boolean(params[:archived]))
2015-09-25 12:07:36 +05:30
end
if params[:search].present?
projects = projects.search(params[:search])
end
2016-04-02 18:10:28 +05:30
if params[:visibility].present?
projects = projects.search_by_visibility(params[:visibility])
end
2015-12-23 02:04:40 +05:30
projects.reorder(project_order_by => project_sort)
2015-09-25 12:07:36 +05:30
end
def project_order_by
order_fields = %w(id name path created_at updated_at last_activity_at)
if order_fields.include?(params['order_by'])
params['order_by']
else
'created_at'
end
end
def project_sort
if params["sort"] == 'asc'
:asc
else
:desc
end
end
2015-11-26 14:37:03 +05:30
# file helpers
def uploaded_file(field, uploads_path)
2015-11-26 14:37:03 +05:30
if params[field]
bad_request!("#{field} is not a file") unless params[field].respond_to?(:filename)
return params[field]
end
return nil unless params["#{field}.path"] && params["#{field}.name"]
2015-11-26 14:37:03 +05:30
# sanitize file paths
# this requires all paths to exist
required_attributes! %W(#{field}.path)
uploads_path = File.realpath(uploads_path)
file_path = File.realpath(params["#{field}.path"])
bad_request!('Bad file path') unless file_path.start_with?(uploads_path)
UploadedFile.new(
file_path,
params["#{field}.name"],
params["#{field}.type"] || 'application/octet-stream',
)
end
def present_file!(path, filename, content_type = 'application/octet-stream')
filename ||= File.basename(path)
header['Content-Disposition'] = "attachment; filename=#{filename}"
header['Content-Transfer-Encoding'] = 'binary'
content_type content_type
# Support download acceleration
case headers['X-Sendfile-Type']
when 'X-Sendfile'
header['X-Sendfile'] = path
body
else
file FileStreamer.new(path)
end
end
2014-09-02 18:07:02 +05:30
private
2017-01-15 13:20:01 +05:30
def private_token
params[PRIVATE_TOKEN_PARAM] || env[PRIVATE_TOKEN_HEADER]
end
def warden
env['warden']
end
# Check the Rails session for valid authentication details
#
# Until CSRF protection is added to the API, disallow this method for
# state-changing endpoints
def find_user_from_warden
warden.try(:authenticate) if %w[GET HEAD].include?(env['REQUEST_METHOD'])
end
def find_user_by_private_token
token = private_token
return nil unless token.present?
User.find_by_authentication_token(token) || User.find_by_personal_access_token(token)
end
def initial_current_user
return @initial_current_user if defined?(@initial_current_user)
@initial_current_user ||= find_user_by_private_token
@initial_current_user ||= doorkeeper_guard
@initial_current_user ||= find_user_from_warden
unless @initial_current_user && Gitlab::UserAccess.new(@initial_current_user).allowed?
@initial_current_user = nil
end
@initial_current_user
end
def sudo!
return unless sudo_identifier
return unless initial_current_user
unless initial_current_user.is_admin?
forbidden!('Must be admin to use sudo')
end
# Only private tokens should be used for the SUDO feature
unless private_token == initial_current_user.private_token
forbidden!('Private token must be specified in order to use sudo')
end
sudoed_user = find_user(sudo_identifier)
if sudoed_user
@current_user = sudoed_user
else
not_found!("No user id or username for: #{sudo_identifier}")
end
end
def sudo_identifier
@sudo_identifier ||= params[SUDO_PARAM] || env[SUDO_HEADER]
end
def add_pagination_headers(paginated_data)
header 'X-Total', paginated_data.total_count.to_s
header 'X-Total-Pages', paginated_data.total_pages.to_s
header 'X-Per-Page', paginated_data.limit_value.to_s
header 'X-Page', paginated_data.current_page.to_s
header 'X-Next-Page', paginated_data.next_page.to_s
header 'X-Prev-Page', paginated_data.prev_page.to_s
header 'Link', pagination_links(paginated_data)
end
def pagination_links(paginated_data)
2014-09-02 18:07:02 +05:30
request_url = request.url.split('?').first
2016-04-02 18:10:28 +05:30
request_params = params.clone
request_params[:per_page] = paginated_data.limit_value
2014-09-02 18:07:02 +05:30
links = []
2016-04-02 18:10:28 +05:30
request_params[:page] = paginated_data.current_page - 1
links << %(<#{request_url}?#{request_params.to_query}>; rel="prev") unless paginated_data.first_page?
request_params[:page] = paginated_data.current_page + 1
links << %(<#{request_url}?#{request_params.to_query}>; rel="next") unless paginated_data.last_page?
request_params[:page] = 1
links << %(<#{request_url}?#{request_params.to_query}>; rel="first")
request_params[:page] = paginated_data.total_pages
links << %(<#{request_url}?#{request_params.to_query}>; rel="last")
2014-09-02 18:07:02 +05:30
links.join(', ')
2014-09-02 18:07:02 +05:30
end
2015-04-26 12:48:37 +05:30
def secret_token
2016-11-03 12:29:30 +05:30
Gitlab::Shell.secret_token
2015-04-26 12:48:37 +05:30
end
def send_git_blob(repository, blob)
env['api.format'] = :txt
content_type 'text/plain'
header(*Gitlab::Workhorse.send_git_blob(repository, blob))
end
def send_git_archive(repository, ref:, format:)
header(*Gitlab::Workhorse.send_git_archive(repository, ref: ref, format: format))
end
def issue_entity(project)
if project.has_external_issue_tracker?
Entities::ExternalIssue
else
Entities::Issue
end
end
2016-09-29 09:46:39 +05:30
# The Grape Error Middleware only has access to env but no params. We workaround this by
# defining a method that returns the right value.
def define_params_for_grape_middleware
self.define_singleton_method(:params) { Rack::Request.new(env).params.symbolize_keys }
end
# We could get a Grape or a standard Ruby exception. We should only report anything that
# is clearly an error.
def report_exception?(exception)
return true unless exception.respond_to?(:status)
exception.status == 500
end
2014-09-02 18:07:02 +05:30
end
end