debian-mirror-gitlab/lib/api/helpers.rb

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

796 lines
23 KiB
Ruby
Raw Normal View History

2018-12-05 23:21:45 +05:30
# frozen_string_literal: true
2014-09-02 18:07:02 +05:30
module API
2015-11-26 14:37:03 +05:30
module Helpers
2016-11-24 13:41:30 +05:30
include Gitlab::Utils
2021-04-29 21:17:54 +05:30
include Helpers::Caching
2017-08-17 22:00:37 +05:30
include Helpers::Pagination
2020-03-13 15:44:24 +05:30
include Helpers::PaginationStrategies
2022-08-27 11:52:29 +05:30
include Gitlab::Ci::Artifacts::Logger
2016-11-24 13:41:30 +05:30
2019-12-04 20:38:33 +05:30
SUDO_HEADER = "HTTP_SUDO"
GITLAB_SHARED_SECRET_HEADER = "Gitlab-Shared-Secret"
2014-09-02 18:07:02 +05:30
SUDO_PARAM = :sudo
2019-12-04 20:38:33 +05:30
API_USER_ENV = 'gitlab.api.user'
2022-08-27 11:52:29 +05:30
API_TOKEN_ENV = 'gitlab.api.token'
2019-12-26 22:10:19 +05:30
API_EXCEPTION_ENV = 'gitlab.api.exception'
2020-05-24 23:13:21 +05:30
API_RESPONSE_STATUS_CODE = 'gitlab.api.response_status_code'
2014-09-02 18:07:02 +05:30
2017-01-15 13:20:01 +05:30
def declared_params(options = {})
options = { include_parent_namespaces: false }.merge(options)
declared(params, options).to_h.symbolize_keys
2016-06-22 15:30:34 +05:30
end
2018-03-17 18:26:18 +05:30
def check_unmodified_since!(last_modified)
2022-08-27 11:52:29 +05:30
if_unmodified_since = begin
Time.parse(headers['If-Unmodified-Since'])
rescue StandardError
nil
end
2018-03-17 18:26:18 +05:30
if if_unmodified_since && last_modified && last_modified > if_unmodified_since
render_api_error!('412 Precondition Failed', 412)
end
end
def destroy_conditionally!(resource, last_updated: nil)
last_updated ||= resource.updated_at
check_unmodified_since!(last_updated)
status 204
2020-03-13 15:44:24 +05:30
body false
2018-03-17 18:26:18 +05:30
if block_given?
yield resource
else
resource.destroy
end
end
2020-07-28 23:09:34 +05:30
def job_token_authentication?
initial_current_user && @current_authenticated_job.present? # rubocop:disable Gitlab/ModuleWithInstanceVariables
end
# Returns the job associated with the token provided for
# authentication, if any
def current_authenticated_job
2021-04-29 21:17:54 +05:30
if try(:namespace_inheritable, :authentication)
ci_build_from_namespace_inheritable
else
@current_authenticated_job # rubocop:disable Gitlab/ModuleWithInstanceVariables
end
2020-07-28 23:09:34 +05:30
end
2018-03-17 18:26:18 +05:30
# rubocop:disable Gitlab/ModuleWithInstanceVariables
# We can't rewrite this with StrongMemoize because `sudo!` would
# actually write to `@current_user`, and `sudo?` would immediately
# call `current_user` again which reads from `@current_user`.
# We should rewrite this in a way that using StrongMemoize is possible
2014-09-02 18:07:02 +05:30
def current_user
2017-01-15 13:20:01 +05:30
return @current_user if defined?(@current_user)
2014-09-02 18:07:02 +05:30
2017-01-15 13:20:01 +05:30
@current_user = initial_current_user
2014-09-02 18:07:02 +05:30
2017-09-10 17:25:29 +05:30
Gitlab::I18n.locale = @current_user&.preferred_language
2017-01-15 13:20:01 +05:30
sudo!
2014-09-02 18:07:02 +05:30
2018-03-17 18:26:18 +05:30
validate_access_token!(scopes: scopes_registered_for_endpoint) unless sudo?
save_current_user_in_env(@current_user) if @current_user
2022-08-27 11:52:29 +05:30
save_current_token_in_env
2021-09-04 01:27:46 +05:30
if @current_user
2021-11-18 22:05:49 +05:30
::ApplicationRecord
.sticking
.stick_or_unstick_request(env, :user, @current_user.id)
2021-09-04 01:27:46 +05:30
end
2014-09-02 18:07:02 +05:30
@current_user
end
2018-03-17 18:26:18 +05:30
# rubocop:enable Gitlab/ModuleWithInstanceVariables
def save_current_user_in_env(user)
env[API_USER_ENV] = { user_id: user.id, username: user.username }
end
2014-09-02 18:07:02 +05:30
2022-08-27 11:52:29 +05:30
def save_current_token_in_env
token = access_token
env[API_TOKEN_ENV] = { token_id: token.id, token_type: token.class } if token
rescue Gitlab::Auth::UnauthorizedError
end
2017-01-15 13:20:01 +05:30
def sudo?
initial_current_user != current_user
2014-09-02 18:07:02 +05:30
end
2017-09-10 17:25:29 +05:30
def user_group
@group ||= find_group!(params[:id])
end
2014-09-02 18:07:02 +05:30
def user_project
2017-08-17 22:00:37 +05:30
@project ||= find_project!(params[:id])
2014-09-02 18:07:02 +05:30
end
2021-01-29 00:20:46 +05:30
def available_labels_for(label_parent, params = { include_ancestor_groups: true, only_group_labels: true })
2018-05-09 12:01:36 +05:30
if label_parent.is_a?(Project)
2021-01-29 00:20:46 +05:30
params.delete(:only_group_labels)
params[:project_id] = label_parent.id
2018-05-09 12:01:36 +05:30
else
2021-01-29 00:20:46 +05:30
params[:group_id] = label_parent.id
2018-05-09 12:01:36 +05:30
end
2018-03-17 18:26:18 +05:30
2021-01-29 00:20:46 +05:30
LabelsFinder.new(current_user, params).execute
2016-11-03 12:29:30 +05:30
end
2017-01-15 13:20:01 +05:30
def find_user(id)
2018-12-13 13:39:08 +05:30
UserFinder.new(id).find_by_id_or_username
2017-01-15 13:20:01 +05:30
end
2018-12-05 23:21:45 +05:30
# rubocop: disable CodeReuse/ActiveRecord
2014-09-02 18:07:02 +05:30
def find_project(id)
2022-04-04 11:22:00 +05:30
return unless id
2022-05-07 20:08:51 +05:30
projects = Project.without_deleted.not_hidden
2018-12-05 23:21:45 +05:30
2018-05-09 12:01:36 +05:30
if id.is_a?(Integer) || id =~ /^\d+$/
2018-12-05 23:21:45 +05:30
projects.find_by(id: id)
2018-05-09 12:01:36 +05:30
elsif id.include?("/")
2018-12-05 23:21:45 +05:30
projects.find_by_full_path(id)
2014-09-02 18:07:02 +05:30
end
end
2018-12-05 23:21:45 +05:30
# rubocop: enable CodeReuse/ActiveRecord
2014-09-02 18:07:02 +05:30
2017-08-17 22:00:37 +05:30
def find_project!(id)
project = find_project(id)
2015-09-25 12:07:36 +05:30
2021-06-08 01:23:25 +05:30
return forbidden! unless authorized_project_scope?(project)
2021-03-11 19:13:27 +05:30
return project if can?(current_user, :read_project, project)
return unauthorized! if authenticate_non_public?
not_found!('Project')
2015-09-25 12:07:36 +05:30
end
2021-06-08 01:23:25 +05:30
def authorized_project_scope?(project)
return true unless job_token_authentication?
return true unless route_authentication_setting[:job_token_scope] == :project
2022-07-16 23:28:13 +05:30
::Feature.enabled?(:ci_job_token_scope, project) &&
2021-06-08 01:23:25 +05:30
current_authenticated_job.project == project
end
2018-12-05 23:21:45 +05:30
# rubocop: disable CodeReuse/ActiveRecord
2017-08-17 22:00:37 +05:30
def find_group(id)
2018-03-17 18:26:18 +05:30
if id.to_s =~ /^\d+$/
2017-08-17 22:00:37 +05:30
Group.find_by(id: id)
else
Group.find_by_full_path(id)
2015-09-25 12:07:36 +05:30
end
end
2018-12-05 23:21:45 +05:30
# rubocop: enable CodeReuse/ActiveRecord
2015-09-25 12:07:36 +05:30
2017-08-17 22:00:37 +05:30
def find_group!(id)
group = find_group(id)
2022-07-16 23:28:13 +05:30
check_group_access(group)
end
# rubocop: disable CodeReuse/ActiveRecord
def find_group_by_full_path!(full_path)
group = Group.find_by_full_path(full_path)
check_group_access(group)
end
# rubocop: enable CodeReuse/ActiveRecord
2015-04-26 12:48:37 +05:30
2022-07-16 23:28:13 +05:30
def check_group_access(group)
2021-03-11 19:13:27 +05:30
return group if can?(current_user, :read_group, group)
return unauthorized! if authenticate_non_public?
not_found!('Group')
2015-04-26 12:48:37 +05:30
end
2020-04-08 14:13:33 +05:30
def check_namespace_access(namespace)
return namespace if can?(current_user, :read_namespace, namespace)
not_found!('Namespace')
end
2018-12-05 23:21:45 +05:30
# rubocop: disable CodeReuse/ActiveRecord
2018-03-17 18:26:18 +05:30
def find_namespace(id)
if id.to_s =~ /^\d+$/
2021-12-11 22:18:48 +05:30
Namespace.without_project_namespaces.find_by(id: id)
2018-03-17 18:26:18 +05:30
else
2021-12-11 22:18:48 +05:30
find_namespace_by_path(id)
2018-03-17 18:26:18 +05:30
end
end
2018-12-05 23:21:45 +05:30
# rubocop: enable CodeReuse/ActiveRecord
2018-03-17 18:26:18 +05:30
def find_namespace!(id)
2020-04-08 14:13:33 +05:30
check_namespace_access(find_namespace(id))
end
2018-03-17 18:26:18 +05:30
2020-04-08 14:13:33 +05:30
def find_namespace_by_path(path)
2021-12-11 22:18:48 +05:30
Namespace.without_project_namespaces.find_by_full_path(path)
2020-04-08 14:13:33 +05:30
end
def find_namespace_by_path!(path)
check_namespace_access(find_namespace_by_path(path))
2018-03-17 18:26:18 +05:30
end
2018-11-20 20:47:30 +05:30
def find_branch!(branch_name)
2019-02-15 15:39:39 +05:30
if Gitlab::GitRefValidator.validate(branch_name)
user_project.repository.find_branch(branch_name) || not_found!('Branch')
else
render_api_error!('The branch refname is invalid', 400)
end
2018-11-20 20:47:30 +05:30
end
2020-05-24 23:13:21 +05:30
def find_tag!(tag_name)
if Gitlab::GitRefValidator.validate(tag_name)
user_project.repository.find_tag(tag_name) || not_found!('Tag')
else
render_api_error!('The tag refname is invalid', 400)
end
end
2018-12-05 23:21:45 +05:30
# rubocop: disable CodeReuse/ActiveRecord
2020-04-22 19:07:51 +05:30
def find_project_issue(iid, project_id = nil)
project = project_id ? find_project!(project_id) : user_project
2022-08-13 15:12:31 +05:30
::IssuesFinder.new(
current_user,
project_id: project.id,
issue_types: WorkItems::Type.allowed_types_for_issues
).find_by!(iid: iid)
2016-06-02 11:05:42 +05:30
end
2018-12-05 23:21:45 +05:30
# rubocop: enable CodeReuse/ActiveRecord
2016-06-02 11:05:42 +05:30
2018-12-05 23:21:45 +05:30
# rubocop: disable CodeReuse/ActiveRecord
2017-08-17 22:00:37 +05:30
def find_project_merge_request(iid)
MergeRequestsFinder.new(current_user, project_id: user_project.id).find_by!(iid: iid)
end
2018-12-05 23:21:45 +05:30
# rubocop: enable CodeReuse/ActiveRecord
2017-08-17 22:00:37 +05:30
2018-10-15 14:42:47 +05:30
def find_project_commit(id)
user_project.commit_by(oid: id)
end
2018-12-05 23:21:45 +05:30
# rubocop: disable CodeReuse/ActiveRecord
2017-08-17 22:00:37 +05:30
def find_merge_request_with_access(iid, access_level = :read_merge_request)
merge_request = user_project.merge_requests.find_by!(iid: iid)
authorize! access_level, merge_request
merge_request
2014-09-02 18:07:02 +05:30
end
2018-12-05 23:21:45 +05:30
# rubocop: enable CodeReuse/ActiveRecord
2014-09-02 18:07:02 +05:30
2018-03-17 18:26:18 +05:30
def find_build!(id)
user_project.builds.find(id.to_i)
end
2021-03-08 18:12:59 +05:30
def find_job!(id)
user_project.processables.find(id.to_i)
end
2014-09-02 18:07:02 +05:30
def authenticate!
2018-03-17 18:26:18 +05:30
unauthorized! unless current_user
2017-08-17 22:00:37 +05:30
end
def authenticate_non_get!
authenticate! unless %w[GET HEAD].include?(route.request_method)
2014-09-02 18:07:02 +05:30
end
2015-04-26 12:48:37 +05:30
def authenticate_by_gitlab_shell_token!
2019-07-07 11:18:12 +05:30
input = params['secret_token']
input ||= Base64.decode64(headers[GITLAB_SHARED_SECRET_HEADER]) if headers.key?(GITLAB_SHARED_SECRET_HEADER)
input&.chomp!
unauthorized! unless Devise.secure_compare(secret_token, input)
2015-04-26 12:48:37 +05:30
end
2020-01-01 13:55:28 +05:30
def authenticated_with_can_read_all_resources!
2018-03-17 18:26:18 +05:30
authenticate!
2020-01-01 13:55:28 +05:30
forbidden! unless current_user.can_read_all_resources?
2018-03-17 18:26:18 +05:30
end
2014-09-02 18:07:02 +05:30
def authenticated_as_admin!
2017-08-17 22:00:37 +05:30
authenticate!
forbidden! unless current_user.admin?
2014-09-02 18:07:02 +05:30
end
2019-03-02 22:35:43 +05:30
def authorize!(action, subject = :global, reason = nil)
forbidden!(reason) unless can?(current_user, action, subject)
2014-09-02 18:07:02 +05:30
end
def authorize_push_project
authorize! :push_code, user_project
end
2019-09-30 21:07:59 +05:30
def authorize_admin_tag
authorize! :admin_tag, user_project
end
2014-09-02 18:07:02 +05:30
def authorize_admin_project
authorize! :admin_project, user_project
end
2020-04-22 19:07:51 +05:30
def authorize_admin_group
authorize! :admin_group, user_group
end
2018-03-17 18:26:18 +05:30
def authorize_read_builds!
authorize! :read_build, user_project
end
2021-02-22 17:27:13 +05:30
def authorize_read_build_trace!(build)
authorize! :read_build_trace, build
end
2021-03-08 18:12:59 +05:30
def authorize_read_job_artifacts!(build)
authorize! :read_job_artifacts, build
end
2019-07-07 11:18:12 +05:30
def authorize_destroy_artifacts!
authorize! :destroy_artifacts, user_project
end
2018-03-17 18:26:18 +05:30
def authorize_update_builds!
authorize! :update_build, user_project
end
2019-09-30 21:07:59 +05:30
def require_repository_enabled!(subject = :global)
not_found!("Repository") unless user_project.feature_available?(:repository, current_user)
end
2015-11-26 14:37:03 +05:30
def require_gitlab_workhorse!
2020-02-01 01:16:34 +05:30
verify_workhorse_api!
2015-11-26 14:37:03 +05:30
unless env['HTTP_GITLAB_WORKHORSE'].present?
forbidden!('Request should be executed via GitLab Workhorse')
end
end
2020-02-01 01:16:34 +05:30
def verify_workhorse_api!
Gitlab::Workhorse.verify_api_request!(request.headers)
2021-06-08 01:23:25 +05:30
rescue StandardError => e
2020-02-01 01:16:34 +05:30
Gitlab::ErrorTracking.track_exception(e)
forbidden!
end
2018-03-17 18:26:18 +05:30
def require_pages_enabled!
not_found! unless user_project.pages_available?
end
def require_pages_config_enabled!
not_found! unless Gitlab.config.pages.enabled
end
2017-08-17 22:00:37 +05:30
def can?(object, action, subject = :global)
2016-09-29 09:46:39 +05:30
Ability.allowed?(object, action, subject)
2014-09-02 18:07:02 +05:30
end
# Checks the occurrences of required attributes, each attribute must be present in the params hash
# or a Bad Request error is invoked.
#
# Parameters:
# keys (required) - A hash consisting of keys that must be present
def required_attributes!(keys)
keys.each do |key|
2021-02-22 17:27:13 +05:30
bad_request_missing_attribute!(key) unless params[key].present?
2014-09-02 18:07:02 +05:30
end
end
2015-09-25 12:07:36 +05:30
def attributes_for_keys(keys, custom_params = nil)
2016-02-05 20:25:01 +05:30
params_hash = custom_params || params
2014-09-02 18:07:02 +05:30
attrs = {}
keys.each do |key|
2017-09-10 17:25:29 +05:30
if params_hash[key].present? || (params_hash.key?(key) && params_hash[key] == false)
2016-02-05 20:25:01 +05:30
attrs[key] = params_hash[key]
2014-09-02 18:07:02 +05:30
end
end
2018-11-08 19:23:39 +05:30
permitted_attrs = ActionController::Parameters.new(attrs).permit!
2019-02-15 15:39:39 +05:30
permitted_attrs.to_h
2014-09-02 18:07:02 +05:30
end
2018-12-05 23:21:45 +05:30
# rubocop: disable CodeReuse/ActiveRecord
2015-09-11 14:41:01 +05:30
def filter_by_iid(items, iid)
items.where(iid: iid)
end
2018-12-05 23:21:45 +05:30
# rubocop: enable CodeReuse/ActiveRecord
2015-09-11 14:41:01 +05:30
2019-07-07 11:18:12 +05:30
# rubocop: disable CodeReuse/ActiveRecord
def filter_by_title(items, title)
items.where(title: title)
end
# rubocop: enable CodeReuse/ActiveRecord
2017-08-17 22:00:37 +05:30
def filter_by_search(items, text)
items.search(text)
end
2019-07-07 11:18:12 +05:30
def order_options_with_tie_breaker
2022-07-23 23:45:48 +05:30
order_by = if params[:order_by] == 'created_at'
2022-07-16 23:28:13 +05:30
'id'
else
params[:order_by]
end
order_options = { order_by => params[:sort] }
2020-03-13 15:44:24 +05:30
order_options['id'] ||= params[:sort] || 'asc'
2019-07-07 11:18:12 +05:30
order_options
end
2014-09-02 18:07:02 +05:30
# error helpers
2015-04-26 12:48:37 +05:30
def forbidden!(reason = nil)
2022-07-23 23:45:48 +05:30
render_api_error_with_reason!(403, '403 Forbidden', reason)
2014-09-02 18:07:02 +05:30
end
2021-02-22 17:27:13 +05:30
def bad_request!(reason = nil)
2022-07-23 23:45:48 +05:30
render_api_error_with_reason!(400, '400 Bad request', reason)
2014-09-02 18:07:02 +05:30
end
2021-02-22 17:27:13 +05:30
def bad_request_missing_attribute!(attribute)
bad_request!("\"#{attribute}\" not given")
end
2014-09-02 18:07:02 +05:30
def not_found!(resource = nil)
message = ["404"]
message << resource if resource
message << "Not Found"
render_api_error!(message.join(' '), 404)
end
2020-07-28 23:09:34 +05:30
def check_sha_param!(params, merge_request)
if params[:sha] && merge_request.diff_head_sha != params[:sha]
render_api_error!("SHA does not match HEAD of source branch: #{merge_request.diff_head_sha}", 409)
end
end
2022-07-23 23:45:48 +05:30
def unauthorized!(reason = nil)
render_api_error_with_reason!(401, '401 Unauthorized', reason)
2014-09-02 18:07:02 +05:30
end
2021-01-29 00:20:46 +05:30
def not_allowed!(message = nil)
render_api_error!(message || '405 Method Not Allowed', :method_not_allowed)
2015-04-26 12:48:37 +05:30
end
2020-03-28 13:19:24 +05:30
def not_acceptable!
render_api_error!('406 Not Acceptable', 406)
end
2021-11-18 22:05:49 +05:30
def service_unavailable!(message = nil)
render_api_error!(message || '503 Service Unavailable', 503)
2020-04-08 14:13:33 +05:30
end
2015-04-26 12:48:37 +05:30
def conflict!(message = nil)
render_api_error!(message || '409 Conflict', 409)
end
2020-10-24 23:57:45 +05:30
def unprocessable_entity!(message = nil)
render_api_error!(message || '422 Unprocessable Entity', :unprocessable_entity)
end
2019-12-21 20:55:43 +05:30
def file_too_large!
2015-11-26 14:37:03 +05:30
render_api_error!('413 Request Entity Too Large', 413)
end
2016-06-02 11:05:42 +05:30
def not_modified!
render_api_error!('304 Not Modified', 304)
end
2016-09-29 09:46:39 +05:30
def no_content!
render_api_error!('204 No Content', 204)
end
2020-03-13 15:44:24 +05:30
def created!
render_api_error!('201 Created', 201)
end
2017-08-17 22:00:37 +05:30
def accepted!
render_api_error!('202 Accepted', 202)
end
2022-08-13 15:12:31 +05:30
def render_validation_error!(model, status = 400)
2015-04-26 12:48:37 +05:30
if model.errors.any?
2022-08-13 15:12:31 +05:30
render_api_error!(model_error_messages(model) || '400 Bad Request', status)
2015-04-26 12:48:37 +05:30
end
2014-09-02 18:07:02 +05:30
end
2020-07-28 23:09:34 +05:30
def model_error_messages(model)
model.errors.messages
end
2022-07-23 23:45:48 +05:30
def render_api_error_with_reason!(status, message, reason)
message = [message]
message << "- #{reason}" if reason
render_api_error!(message.join(' '), status)
end
2022-05-07 20:08:51 +05:30
def render_api_error!(message, status)
render_structured_api_error!({ 'message' => message }, status)
2017-08-17 22:00:37 +05:30
end
2022-05-07 20:08:51 +05:30
def render_structured_api_error!(hash, status)
# Use this method instead of `render_api_error!` when you have additional top-level
# hash entries in addition to 'message' which need to be passed to `#error!`
set_status_code_in_env(status)
error!(hash, status, header)
end
def set_status_code_in_env(status)
2020-05-24 23:13:21 +05:30
# grape-logging doesn't pass the status code, so this is a
# workaround for getting that information in the loggers:
# https://github.com/aserafin/grape_logging/issues/71
env[API_RESPONSE_STATUS_CODE] = Rack::Utils.status_code(status)
2014-09-02 18:07:02 +05:30
end
2016-09-29 09:46:39 +05:30
def handle_api_exception(exception)
2019-02-15 15:39:39 +05:30
if report_exception?(exception)
2016-09-29 09:46:39 +05:30
define_params_for_grape_middleware
2021-12-11 22:18:48 +05:30
Gitlab::ApplicationContext.push(user: current_user, remote_ip: request.ip)
2021-09-04 01:27:46 +05:30
Gitlab::ErrorTracking.track_exception(exception)
2016-09-29 09:46:39 +05:30
end
2019-12-26 22:10:19 +05:30
# This is used with GrapeLogging::Loggers::ExceptionLogger
env[API_EXCEPTION_ENV] = exception
2016-09-29 09:46:39 +05:30
# lifted from https://github.com/rails/rails/blob/master/actionpack/lib/action_dispatch/middleware/debug_exceptions.rb#L60
trace = exception.backtrace
2018-12-05 23:21:45 +05:30
message = ["\n#{exception.class} (#{exception.message}):\n"]
2016-09-29 09:46:39 +05:30
message << exception.annoted_source_code.to_s if exception.respond_to?(:annoted_source_code)
message << " " << trace.join("\n ")
2018-12-05 23:21:45 +05:30
message = message.join
2016-09-29 09:46:39 +05:30
API.logger.add Logger::FATAL, message
2018-03-17 18:26:18 +05:30
response_message =
if Rails.env.test?
message
else
'500 Internal Server Error'
end
rack_response({ 'message' => response_message }.to_json, 500)
2016-09-29 09:46:39 +05:30
end
2017-08-17 22:00:37 +05:30
# project helpers
2015-09-25 12:07:36 +05:30
2018-12-05 23:21:45 +05:30
# rubocop: disable CodeReuse/ActiveRecord
2017-09-10 17:25:29 +05:30
def reorder_projects(projects)
2019-07-07 11:18:12 +05:30
projects.reorder(order_options_with_tie_breaker)
2015-09-25 12:07:36 +05:30
end
2018-12-05 23:21:45 +05:30
# rubocop: enable CodeReuse/ActiveRecord
2015-09-25 12:07:36 +05:30
2017-09-10 17:25:29 +05:30
def project_finder_params
2019-12-04 20:38:33 +05:30
project_finder_params_ce.merge(project_finder_params_ee)
2017-09-10 17:25:29 +05:30
end
2015-11-26 14:37:03 +05:30
# file helpers
2018-05-09 12:01:36 +05:30
def present_disk_file!(path, filename, content_type = 'application/octet-stream')
2015-11-26 14:37:03 +05:30
filename ||= File.basename(path)
2020-03-13 15:44:24 +05:30
header['Content-Disposition'] = ActionDispatch::Http::ContentDisposition.format(disposition: 'attachment', filename: filename)
2015-11-26 14:37:03 +05:30
header['Content-Transfer-Encoding'] = 'binary'
content_type content_type
# Support download acceleration
case headers['X-Sendfile-Type']
when 'X-Sendfile'
header['X-Sendfile'] = path
2021-03-08 18:12:59 +05:30
body '' # to avoid an error from API::APIGuard::ResponseCoercerMiddleware
2015-11-26 14:37:03 +05:30
else
2020-07-28 23:09:34 +05:30
sendfile path
2015-11-26 14:37:03 +05:30
end
end
2022-07-23 23:45:48 +05:30
def present_artifacts_file!(file, **args)
2022-08-27 11:52:29 +05:30
log_artifacts_filesize(file&.model)
2022-07-23 23:45:48 +05:30
present_carrierwave_file!(file, **args)
end
2018-05-09 12:01:36 +05:30
def present_carrierwave_file!(file, supports_direct_download: true)
2019-09-04 21:01:54 +05:30
return not_found! unless file&.exists?
2017-09-10 17:25:29 +05:30
2018-05-09 12:01:36 +05:30
if file.file_storage?
present_disk_file!(file.path, file.filename)
elsif supports_direct_download && file.class.direct_download_enabled?
redirect(file.url)
2017-09-10 17:25:29 +05:30
else
2018-05-09 12:01:36 +05:30
header(*Gitlab::Workhorse.send_url(file.url))
status :ok
2021-03-08 18:12:59 +05:30
body '' # to avoid an error from API::APIGuard::ResponseCoercerMiddleware
2017-09-10 17:25:29 +05:30
end
end
2021-02-22 17:27:13 +05:30
def increment_counter(event_name)
Gitlab::UsageDataCounters.count(event_name)
2021-06-08 01:23:25 +05:30
rescue StandardError => error
2021-02-22 17:27:13 +05:30
Gitlab::AppLogger.warn("Redis tracking event failed for event: #{event_name}, message: #{error.message}")
end
2020-11-24 15:15:51 +05:30
# @param event_name [String] the event name
# @param values [Array|String] the values counted
def increment_unique_values(event_name, values)
return unless values.present?
2021-03-08 18:12:59 +05:30
Gitlab::UsageDataCounters::HLLRedisCounter.track_event(event_name, values: values)
2021-06-08 01:23:25 +05:30
rescue StandardError => error
2020-11-24 15:15:51 +05:30
Gitlab::AppLogger.warn("Redis tracking event failed for event: #{event_name}, message: #{error.message}")
end
2021-10-27 15:23:28 +05:30
def order_by_similarity?(allow_unauthorized: true)
params[:order_by] == 'similarity' && params[:search].present? && (allow_unauthorized || current_user.present?)
end
2019-12-04 20:38:33 +05:30
protected
2020-04-22 19:07:51 +05:30
def project_finder_params_visibility_ce
finder_params = {}
finder_params[:min_access_level] = params[:min_access_level] if params[:min_access_level]
finder_params[:visibility_level] = Gitlab::VisibilityLevel.level_value(params[:visibility]) if params[:visibility]
2019-12-04 20:38:33 +05:30
finder_params[:owned] = true if params[:owned].present?
finder_params[:non_public] = true if params[:membership].present?
finder_params[:starred] = true if params[:starred].present?
finder_params[:archived] = archived_param unless params[:archived].nil?
2020-04-22 19:07:51 +05:30
finder_params
end
def project_finder_params_ce
finder_params = project_finder_params_visibility_ce
2021-06-08 01:23:25 +05:30
finder_params.merge!(
params
.slice(:search,
:custom_attributes,
:last_activity_after,
:last_activity_before,
2021-09-04 01:27:46 +05:30
:topic,
2022-08-13 15:12:31 +05:30
:topic_id,
2021-06-08 01:23:25 +05:30
:repository_storage)
.symbolize_keys
.compact
)
2020-07-28 23:09:34 +05:30
finder_params[:with_issues_enabled] = true if params[:with_issues_enabled].present?
finder_params[:with_merge_requests_enabled] = true if params[:with_merge_requests_enabled].present?
2020-04-22 19:07:51 +05:30
finder_params[:without_deleted] = true
finder_params[:search_namespaces] = true if params[:search_namespaces].present?
2019-12-04 20:38:33 +05:30
finder_params[:user] = params.delete(:user) if params[:user]
2020-10-24 23:57:45 +05:30
finder_params[:id_after] = sanitize_id_param(params[:id_after]) if params[:id_after]
finder_params[:id_before] = sanitize_id_param(params[:id_before]) if params[:id_before]
2019-12-04 20:38:33 +05:30
finder_params
end
# Overridden in EE
def project_finder_params_ee
{}
end
2021-11-18 22:05:49 +05:30
def validate_anonymous_search_access!
return if current_user.present? || Feature.disabled?(:disable_anonymous_search, type: :ops)
unprocessable_entity!('User must be authenticated to use search')
end
2014-09-02 18:07:02 +05:30
private
2018-03-17 18:26:18 +05:30
# rubocop:disable Gitlab/ModuleWithInstanceVariables
2017-01-15 13:20:01 +05:30
def initial_current_user
return @initial_current_user if defined?(@initial_current_user)
2018-03-17 18:26:18 +05:30
begin
@initial_current_user = Gitlab::Auth::UniqueIpsLimiter.limit_user! { find_current_user! }
rescue Gitlab::Auth::UnauthorizedError
unauthorized!
2017-01-15 13:20:01 +05:30
end
end
2018-03-17 18:26:18 +05:30
# rubocop:enable Gitlab/ModuleWithInstanceVariables
2017-01-15 13:20:01 +05:30
def sudo!
return unless sudo_identifier
2018-03-17 18:26:18 +05:30
unauthorized! unless initial_current_user
2017-01-15 13:20:01 +05:30
2017-08-17 22:00:37 +05:30
unless initial_current_user.admin?
2017-01-15 13:20:01 +05:30
forbidden!('Must be admin to use sudo')
end
2018-03-17 18:26:18 +05:30
unless access_token
forbidden!('Must be authenticated using an OAuth or Personal Access Token to use sudo')
2017-01-15 13:20:01 +05:30
end
2018-03-17 18:26:18 +05:30
validate_access_token!(scopes: [:sudo])
2017-01-15 13:20:01 +05:30
sudoed_user = find_user(sudo_identifier)
2018-03-17 18:26:18 +05:30
not_found!("User with ID or username '#{sudo_identifier}'") unless sudoed_user
2017-01-15 13:20:01 +05:30
2018-03-17 18:26:18 +05:30
@current_user = sudoed_user # rubocop:disable Gitlab/ModuleWithInstanceVariables
2017-01-15 13:20:01 +05:30
end
def sudo_identifier
@sudo_identifier ||= params[SUDO_PARAM] || env[SUDO_HEADER]
end
2015-04-26 12:48:37 +05:30
def secret_token
2016-11-03 12:29:30 +05:30
Gitlab::Shell.secret_token
2015-04-26 12:48:37 +05:30
end
2021-03-11 19:13:27 +05:30
def authenticate_non_public?
route_authentication_setting[:authenticate_non_public] && !current_user
end
def send_git_blob(repository, blob)
env['api.format'] = :txt
content_type 'text/plain'
2021-12-11 22:18:48 +05:30
2020-03-13 15:44:24 +05:30
header['Content-Disposition'] = ActionDispatch::Http::ContentDisposition.format(disposition: 'inline', filename: blob.name)
2019-03-02 22:35:43 +05:30
# Let Workhorse examine the content and determine the better content disposition
header[Gitlab::Workhorse::DETECT_HEADER] = "true"
header(*Gitlab::Workhorse.send_git_blob(repository, blob))
2021-12-11 22:18:48 +05:30
body ''
end
2018-05-09 12:01:36 +05:30
def send_git_archive(repository, **kwargs)
header(*Gitlab::Workhorse.send_git_archive(repository, **kwargs))
2021-12-11 22:18:48 +05:30
body ''
end
2022-06-21 17:19:12 +05:30
# Deprecated. Use `send_artifacts_entry` instead.
def legacy_send_artifacts_entry(file, entry)
header(*Gitlab::Workhorse.send_artifacts_entry(file, entry))
body ''
end
2020-05-24 23:13:21 +05:30
def send_artifacts_entry(file, entry)
header(*Gitlab::Workhorse.send_artifacts_entry(file, entry))
2022-07-16 23:28:13 +05:30
header(*Gitlab::Workhorse.detect_content_type)
2021-12-11 22:18:48 +05:30
body ''
2018-03-17 18:26:18 +05:30
end
# The Grape Error Middleware only has access to `env` but not `params` nor
# `request`. We workaround this by defining methods that returns the right
# values.
2016-09-29 09:46:39 +05:30
def define_params_for_grape_middleware
2019-03-02 22:35:43 +05:30
self.define_singleton_method(:request) { ActionDispatch::Request.new(env) }
2018-03-17 18:26:18 +05:30
self.define_singleton_method(:params) { request.params.symbolize_keys }
2016-09-29 09:46:39 +05:30
end
# We could get a Grape or a standard Ruby exception. We should only report anything that
# is clearly an error.
def report_exception?(exception)
return true unless exception.respond_to?(:status)
exception.status == 500
end
2018-11-18 11:00:15 +05:30
def archived_param
return 'only' if params[:archived]
params[:archived]
end
2019-10-12 21:52:04 +05:30
def ip_address
env["action_dispatch.remote_ip"].to_s || request.ip
end
2020-10-24 23:57:45 +05:30
def sanitize_id_param(id)
id.present? ? id.to_i : nil
end
2014-09-02 18:07:02 +05:30
end
end
2019-12-04 20:38:33 +05:30
2021-06-08 01:23:25 +05:30
API::Helpers.prepend_mod_with('API::Helpers')