debian-mirror-gitlab/app/services/resource_access_tokens/create_service.rb

117 lines
3.3 KiB
Ruby
Raw Normal View History

2020-04-22 19:07:51 +05:30
# frozen_string_literal: true
2020-05-24 23:13:21 +05:30
module ResourceAccessTokens
class CreateService < BaseService
def initialize(current_user, resource, params = {})
@resource_type = resource.class.name.downcase
2020-04-22 19:07:51 +05:30
@resource = resource
2020-05-24 23:13:21 +05:30
@current_user = current_user
2020-04-22 19:07:51 +05:30
@params = params.dup
end
def execute
return error("User does not have permission to create #{resource_type} Access Token") unless has_permission_to_create?
user = create_user
return error(user.errors.full_messages.to_sentence) unless user.persisted?
2021-01-29 00:20:46 +05:30
member = create_membership(resource, user)
unless member.persisted?
delete_failed_user(user)
return error("Could not provision maintainer access to project access token")
end
2020-04-22 19:07:51 +05:30
token_response = create_personal_access_token(user)
if token_response.success?
success(token_response.payload[:personal_access_token])
else
2021-01-29 00:20:46 +05:30
delete_failed_user(user)
2020-04-22 19:07:51 +05:30
error(token_response.message)
end
end
private
2020-05-24 23:13:21 +05:30
attr_reader :resource_type, :resource
2020-04-22 19:07:51 +05:30
def has_permission_to_create?
2021-01-03 14:25:43 +05:30
%w(project group).include?(resource_type) && can?(current_user, :admin_resource_access_tokens, resource)
2020-04-22 19:07:51 +05:30
end
def create_user
2020-07-28 23:09:34 +05:30
# Even project maintainers can create project access tokens, which in turn
# creates a bot user, and so it becomes necessary to have `skip_authorization: true`
# since someone like a project maintainer does not inherently have the ability
# to create a new user in the system.
2020-04-22 19:07:51 +05:30
Users::CreateService.new(current_user, default_user_params).execute(skip_authorization: true)
end
2021-01-29 00:20:46 +05:30
def delete_failed_user(user)
DeleteUserWorker.perform_async(current_user.id, user.id, hard_delete: true, skip_authorization: true)
end
2020-04-22 19:07:51 +05:30
def default_user_params
{
name: params[:name] || "#{resource.name.to_s.humanize} bot",
email: generate_email,
username: generate_username,
2020-07-28 23:09:34 +05:30
user_type: "#{resource_type}_bot".to_sym,
skip_confirmation: true # Bot users should always have their emails confirmed.
2020-04-22 19:07:51 +05:30
}
end
def generate_username
base_username = "#{resource_type}_#{resource.id}_bot"
uniquify.string(base_username) { |s| User.find_by_username(s) }
end
def generate_email
email_pattern = "#{resource_type}#{resource.id}_bot%s@example.com"
uniquify.string(-> (n) { Kernel.sprintf(email_pattern, n) }) do |s|
User.find_by_email(s)
end
end
def uniquify
Uniquify.new
end
def create_personal_access_token(user)
2021-01-29 00:20:46 +05:30
PersonalAccessTokens::CreateService.new(
current_user: user, target_user: user, params: personal_access_token_params
).execute
2020-04-22 19:07:51 +05:30
end
def personal_access_token_params
{
2020-05-24 23:13:21 +05:30
name: params[:name] || "#{resource_type}_bot",
2020-04-22 19:07:51 +05:30
impersonation: false,
scopes: params[:scopes] || default_scopes,
expires_at: params[:expires_at] || nil
}
end
def default_scopes
2020-05-24 23:13:21 +05:30
Gitlab::Auth.resource_bot_scopes
2020-04-22 19:07:51 +05:30
end
2021-01-29 00:20:46 +05:30
def create_membership(resource, user)
2021-01-03 14:25:43 +05:30
resource.add_user(user, :maintainer, expires_at: params[:expires_at])
2020-04-22 19:07:51 +05:30
end
def error(message)
ServiceResponse.error(message: message)
end
def success(access_token)
ServiceResponse.success(payload: { access_token: access_token })
end
end
end