debian-mirror-gitlab/lib/api/api_guard.rb

174 lines
5.4 KiB
Ruby
Raw Normal View History

2018-12-05 23:21:45 +05:30
# frozen_string_literal: true
2015-04-26 12:48:37 +05:30
# Guard API with OAuth 2.0 Access Token
require 'rack/oauth2'
2016-06-02 11:05:42 +05:30
module API
module APIGuard
extend ActiveSupport::Concern
2015-04-26 12:48:37 +05:30
2016-06-02 11:05:42 +05:30
included do |base|
# OAuth2 Resource Server Authentication
use Rack::OAuth2::Server::Resource::Bearer, 'The API' do |request|
# The authenticator only fetches the raw token string
2015-04-26 12:48:37 +05:30
2016-06-02 11:05:42 +05:30
# Must yield access token to store it in the env
request.access_token
end
2015-04-26 12:48:37 +05:30
2019-12-21 20:55:43 +05:30
use AdminModeMiddleware
2016-06-02 11:05:42 +05:30
helpers HelperMethods
2015-04-26 12:48:37 +05:30
2016-06-02 11:05:42 +05:30
install_error_responders(base)
end
2015-04-26 12:48:37 +05:30
2017-09-10 17:25:29 +05:30
class_methods do
# Set the authorization scope(s) allowed for an API endpoint.
#
# A call to this method maps the given scope(s) to the current API
# endpoint class. If this method is called multiple times on the same class,
# the scopes are all aggregated.
def allow_access_with_scope(scopes, options = {})
Array(scopes).each do |scope|
allowed_scopes << Scope.new(scope, options)
end
end
def allowed_scopes
@scopes ||= []
end
end
2016-06-02 11:05:42 +05:30
# Helper Methods for Grape Endpoint
module HelperMethods
2019-12-04 20:38:33 +05:30
prepend_if_ee('EE::API::APIGuard::HelperMethods') # rubocop: disable Cop/InjectEnterpriseEditionModule
2020-01-01 13:55:28 +05:30
include Gitlab::Auth::AuthFinders
2015-04-26 12:48:37 +05:30
2018-03-17 18:26:18 +05:30
def find_current_user!
user = find_user_from_sources
return unless user
2017-08-17 22:00:37 +05:30
2018-10-15 14:42:47 +05:30
unless api_access_allowed?(user)
forbidden!(api_access_denied_message(user))
end
2017-08-17 22:00:37 +05:30
2019-12-21 20:55:43 +05:30
# Set admin mode for API requests (if admin)
if Feature.enabled?(:user_mode_in_session)
2020-01-01 13:55:28 +05:30
current_user_mode = Gitlab::Auth::CurrentUserMode.new(user)
current_user_mode.enable_sessionless_admin_mode!
2019-12-21 20:55:43 +05:30
end
2018-03-17 18:26:18 +05:30
user
2017-08-17 22:00:37 +05:30
end
2018-03-17 18:26:18 +05:30
def find_user_from_sources
2020-01-01 13:55:28 +05:30
find_user_from_access_token ||
find_user_from_job_token ||
find_user_from_warden
2016-06-02 11:05:42 +05:30
end
2015-04-26 12:48:37 +05:30
2016-06-02 11:05:42 +05:30
private
2015-04-26 12:48:37 +05:30
2018-03-17 18:26:18 +05:30
# An array of scopes that were registered (using `allow_access_with_scope`)
# for the current endpoint class. It also returns scopes registered on
# `API::API`, since these are meant to apply to all API routes.
def scopes_registered_for_endpoint
@scopes_registered_for_endpoint ||=
begin
endpoint_classes = [options[:for].presence, ::API::API].compact
endpoint_classes.reduce([]) do |memo, endpoint|
if endpoint.respond_to?(:allowed_scopes)
memo.concat(endpoint.allowed_scopes)
else
memo
end
end
end
2016-06-02 11:05:42 +05:30
end
2018-10-15 14:42:47 +05:30
def api_access_allowed?(user)
Gitlab::UserAccess.new(user).allowed? && user.can?(:access_api)
end
def api_access_denied_message(user)
Gitlab::Auth::UserAccessDeniedReason.new(user).rejection_message
end
2015-04-26 12:48:37 +05:30
end
2018-11-20 20:47:30 +05:30
class_methods do
2016-06-02 11:05:42 +05:30
private
2015-04-26 12:48:37 +05:30
2016-06-02 11:05:42 +05:30
def install_error_responders(base)
2018-03-17 18:26:18 +05:30
error_classes = [Gitlab::Auth::MissingTokenError,
Gitlab::Auth::TokenNotFoundError,
Gitlab::Auth::ExpiredError,
Gitlab::Auth::RevokedError,
2019-02-15 15:39:39 +05:30
Gitlab::Auth::ImpersonationDisabled,
2018-03-17 18:26:18 +05:30
Gitlab::Auth::InsufficientScopeError]
2015-04-26 12:48:37 +05:30
2018-03-17 18:26:18 +05:30
base.__send__(:rescue_from, *error_classes, oauth2_bearer_token_error_handler) # rubocop:disable GitlabSecurity/PublicSend
2016-06-02 11:05:42 +05:30
end
def oauth2_bearer_token_error_handler
2017-08-17 22:00:37 +05:30
proc do |e|
2016-06-02 11:05:42 +05:30
response =
case e
2018-03-17 18:26:18 +05:30
when Gitlab::Auth::MissingTokenError
2016-06-02 11:05:42 +05:30
Rack::OAuth2::Server::Resource::Bearer::Unauthorized.new
2018-03-17 18:26:18 +05:30
when Gitlab::Auth::TokenNotFoundError
2016-06-02 11:05:42 +05:30
Rack::OAuth2::Server::Resource::Bearer::Unauthorized.new(
:invalid_token,
"Bad Access Token.")
2018-03-17 18:26:18 +05:30
when Gitlab::Auth::ExpiredError
2016-06-02 11:05:42 +05:30
Rack::OAuth2::Server::Resource::Bearer::Unauthorized.new(
:invalid_token,
"Token is expired. You can either do re-authorization or token refresh.")
2018-03-17 18:26:18 +05:30
when Gitlab::Auth::RevokedError
2016-06-02 11:05:42 +05:30
Rack::OAuth2::Server::Resource::Bearer::Unauthorized.new(
:invalid_token,
"Token was revoked. You have to re-authorize from the user.")
2019-02-15 15:39:39 +05:30
when Gitlab::Auth::ImpersonationDisabled
Rack::OAuth2::Server::Resource::Bearer::Unauthorized.new(
:invalid_token,
"Token is an impersonation token but impersonation was disabled.")
2018-03-17 18:26:18 +05:30
when Gitlab::Auth::InsufficientScopeError
2016-06-02 11:05:42 +05:30
# FIXME: ForbiddenError (inherited from Bearer::Forbidden of Rack::Oauth2)
# does not include WWW-Authenticate header, which breaks the standard.
Rack::OAuth2::Server::Resource::Bearer::Forbidden.new(
:insufficient_scope,
Rack::OAuth2::Server::Resource::ErrorMethods::DEFAULT_DESCRIPTION[:insufficient_scope],
{ scope: e.scopes })
end
response.finish
end
2015-04-26 12:48:37 +05:30
end
end
2019-12-21 20:55:43 +05:30
class AdminModeMiddleware < ::Grape::Middleware::Base
def initialize(app, **options)
super
end
def call(env)
if Feature.enabled?(:user_mode_in_session)
session = {}
Gitlab::Session.with_session(session) do
app.call(env)
end
else
app.call(env)
end
end
end
2015-04-26 12:48:37 +05:30
end
end