2016-06-02 11:05:42 +05:30
|
|
|
require 'spec_helper'
|
|
|
|
|
2017-09-10 17:25:29 +05:30
|
|
|
describe Auth::ContainerRegistryAuthenticationService do
|
2016-06-02 11:05:42 +05:30
|
|
|
let(:current_project) { nil }
|
|
|
|
let(:current_user) { nil }
|
|
|
|
let(:current_params) { {} }
|
|
|
|
let(:rsa_key) { OpenSSL::PKey::RSA.generate(512) }
|
|
|
|
let(:payload) { JWT.decode(subject[:token], rsa_key).first }
|
2017-08-17 22:00:37 +05:30
|
|
|
|
2016-09-29 09:46:39 +05:30
|
|
|
let(:authentication_abilities) do
|
2017-09-10 17:25:29 +05:30
|
|
|
[:read_container_image, :create_container_image, :admin_container_image]
|
2016-09-29 09:46:39 +05:30
|
|
|
end
|
2016-06-02 11:05:42 +05:30
|
|
|
|
2017-08-17 22:00:37 +05:30
|
|
|
subject do
|
|
|
|
described_class.new(current_project, current_user, current_params)
|
|
|
|
.execute(authentication_abilities: authentication_abilities)
|
|
|
|
end
|
2016-06-02 11:05:42 +05:30
|
|
|
|
|
|
|
before do
|
|
|
|
allow(Gitlab.config.registry).to receive_messages(enabled: true, issuer: 'rspec', key: nil)
|
|
|
|
allow_any_instance_of(JSONWebToken::RSAToken).to receive(:key).and_return(rsa_key)
|
|
|
|
end
|
|
|
|
|
2018-11-08 19:23:39 +05:30
|
|
|
shared_examples 'an authenticated' do
|
|
|
|
it { is_expected.to include(:token) }
|
|
|
|
it { expect(payload).to include('access') }
|
|
|
|
end
|
|
|
|
|
2016-06-16 23:09:34 +05:30
|
|
|
shared_examples 'a valid token' do
|
2016-06-02 11:05:42 +05:30
|
|
|
it { is_expected.to include(:token) }
|
|
|
|
it { expect(payload).to include('access') }
|
2016-06-16 23:09:34 +05:30
|
|
|
|
|
|
|
context 'a expirable' do
|
|
|
|
let(:expires_at) { Time.at(payload['exp']) }
|
|
|
|
let(:expire_delay) { 10 }
|
|
|
|
|
|
|
|
context 'for default configuration' do
|
|
|
|
it { expect(expires_at).not_to be_within(2.seconds).of(Time.now + expire_delay.minutes) }
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'for changed configuration' do
|
2017-09-10 17:25:29 +05:30
|
|
|
before do
|
|
|
|
stub_application_setting(container_registry_token_expire_delay: expire_delay)
|
|
|
|
end
|
2016-06-16 23:09:34 +05:30
|
|
|
|
|
|
|
it { expect(expires_at).to be_within(2.seconds).of(Time.now + expire_delay.minutes) }
|
|
|
|
end
|
|
|
|
end
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
|
2018-03-17 18:26:18 +05:30
|
|
|
shared_examples 'a browsable' do
|
|
|
|
let(:access) do
|
|
|
|
[{ 'type' => 'registry',
|
|
|
|
'name' => 'catalog',
|
|
|
|
'actions' => ['*'] }]
|
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'a valid token'
|
|
|
|
it_behaves_like 'not a container repository factory'
|
|
|
|
|
|
|
|
it 'has the correct scope' do
|
|
|
|
expect(payload).to include('access' => access)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2017-08-17 22:00:37 +05:30
|
|
|
shared_examples 'an accessible' do
|
2016-06-02 11:05:42 +05:30
|
|
|
let(:access) do
|
2017-08-17 22:00:37 +05:30
|
|
|
[{ 'type' => 'repository',
|
2017-09-10 17:25:29 +05:30
|
|
|
'name' => project.full_path,
|
2017-08-17 22:00:37 +05:30
|
|
|
'actions' => actions }]
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
|
2016-06-16 23:09:34 +05:30
|
|
|
it_behaves_like 'a valid token'
|
2018-03-17 18:26:18 +05:30
|
|
|
|
|
|
|
it 'has the correct scope' do
|
|
|
|
expect(payload).to include('access' => access)
|
|
|
|
end
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
|
2016-06-16 23:09:34 +05:30
|
|
|
shared_examples 'an inaccessible' do
|
|
|
|
it_behaves_like 'a valid token'
|
|
|
|
it { expect(payload).to include('access' => []) }
|
|
|
|
end
|
|
|
|
|
2017-09-10 17:25:29 +05:30
|
|
|
shared_examples 'a deletable' do
|
|
|
|
it_behaves_like 'an accessible' do
|
|
|
|
let(:actions) { ['*'] }
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2016-06-02 11:05:42 +05:30
|
|
|
shared_examples 'a pullable' do
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'an accessible' do
|
2016-06-02 11:05:42 +05:30
|
|
|
let(:actions) { ['pull'] }
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
shared_examples 'a pushable' do
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'an accessible' do
|
2016-06-02 11:05:42 +05:30
|
|
|
let(:actions) { ['push'] }
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
shared_examples 'a pullable and pushable' do
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'an accessible' do
|
|
|
|
let(:actions) { %w(pull push) }
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
shared_examples 'a forbidden' do
|
|
|
|
it { is_expected.to include(http_status: 403) }
|
2016-06-16 23:09:34 +05:30
|
|
|
it { is_expected.not_to include(:token) }
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
|
2017-08-17 22:00:37 +05:30
|
|
|
shared_examples 'container repository factory' do
|
|
|
|
it 'creates a new container repository resource' do
|
|
|
|
expect { subject }
|
|
|
|
.to change { project.container_repositories.count }.by(1)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
shared_examples 'not a container repository factory' do
|
|
|
|
it 'does not create a new container repository resource' do
|
|
|
|
expect { subject }.not_to change { ContainerRepository.count }
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2016-06-02 11:05:42 +05:30
|
|
|
describe '#full_access_token' do
|
2017-09-10 17:25:29 +05:30
|
|
|
let(:project) { create(:project) }
|
|
|
|
let(:token) { described_class.full_access_token(project.full_path) }
|
2016-06-02 11:05:42 +05:30
|
|
|
|
|
|
|
subject { { token: token } }
|
|
|
|
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'an accessible' do
|
2016-06-02 11:05:42 +05:30
|
|
|
let(:actions) { ['*'] }
|
|
|
|
end
|
2017-08-17 22:00:37 +05:30
|
|
|
|
|
|
|
it_behaves_like 'not a container repository factory'
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
context 'user authorization' do
|
|
|
|
let(:current_user) { create(:user) }
|
|
|
|
|
2018-03-17 18:26:18 +05:30
|
|
|
context 'for registry catalog' do
|
|
|
|
let(:current_params) do
|
|
|
|
{ scope: "registry:catalog:*" }
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'disallow browsing for users without Gitlab admin rights' do
|
|
|
|
it_behaves_like 'an inaccessible'
|
|
|
|
it_behaves_like 'not a container repository factory'
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2016-08-24 12:49:21 +05:30
|
|
|
context 'for private project' do
|
2017-09-10 17:25:29 +05:30
|
|
|
let(:project) { create(:project) }
|
2016-06-02 11:05:42 +05:30
|
|
|
|
2016-08-24 12:49:21 +05:30
|
|
|
context 'allow to use scope-less authentication' do
|
|
|
|
it_behaves_like 'a valid token'
|
|
|
|
end
|
2016-06-02 11:05:42 +05:30
|
|
|
|
2016-08-24 12:49:21 +05:30
|
|
|
context 'allow developer to push images' do
|
2017-09-10 17:25:29 +05:30
|
|
|
before do
|
|
|
|
project.add_developer(current_user)
|
|
|
|
end
|
2016-08-24 12:49:21 +05:30
|
|
|
|
|
|
|
let(:current_params) do
|
2017-09-10 17:25:29 +05:30
|
|
|
{ scope: "repository:#{project.full_path}:push" }
|
2016-08-24 12:49:21 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'a pushable'
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'container repository factory'
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
|
2017-09-10 17:25:29 +05:30
|
|
|
context 'disallow developer to delete images' do
|
|
|
|
before do
|
|
|
|
project.add_developer(current_user)
|
|
|
|
end
|
|
|
|
|
|
|
|
let(:current_params) do
|
2018-03-27 19:54:05 +05:30
|
|
|
{ scope: "repository:#{project.full_path}:*" }
|
2017-09-10 17:25:29 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'an inaccessible'
|
|
|
|
it_behaves_like 'not a container repository factory'
|
|
|
|
end
|
|
|
|
|
2016-08-24 12:49:21 +05:30
|
|
|
context 'allow reporter to pull images' do
|
2017-09-10 17:25:29 +05:30
|
|
|
before do
|
|
|
|
project.add_reporter(current_user)
|
|
|
|
end
|
2016-08-24 12:49:21 +05:30
|
|
|
|
2017-08-17 22:00:37 +05:30
|
|
|
context 'when pulling from root level repository' do
|
|
|
|
let(:current_params) do
|
2017-09-10 17:25:29 +05:30
|
|
|
{ scope: "repository:#{project.full_path}:pull" }
|
2017-08-17 22:00:37 +05:30
|
|
|
end
|
2016-06-02 11:05:42 +05:30
|
|
|
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'a pullable'
|
|
|
|
it_behaves_like 'not a container repository factory'
|
|
|
|
end
|
2016-08-24 12:49:21 +05:30
|
|
|
end
|
2016-06-02 11:05:42 +05:30
|
|
|
|
2017-09-10 17:25:29 +05:30
|
|
|
context 'disallow reporter to delete images' do
|
|
|
|
before do
|
|
|
|
project.add_reporter(current_user)
|
|
|
|
end
|
|
|
|
|
|
|
|
let(:current_params) do
|
2018-03-27 19:54:05 +05:30
|
|
|
{ scope: "repository:#{project.full_path}:*" }
|
2017-09-10 17:25:29 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'an inaccessible'
|
|
|
|
it_behaves_like 'not a container repository factory'
|
|
|
|
end
|
|
|
|
|
2016-08-24 12:49:21 +05:30
|
|
|
context 'return a least of privileges' do
|
2017-09-10 17:25:29 +05:30
|
|
|
before do
|
|
|
|
project.add_reporter(current_user)
|
|
|
|
end
|
2016-08-24 12:49:21 +05:30
|
|
|
|
|
|
|
let(:current_params) do
|
2017-09-10 17:25:29 +05:30
|
|
|
{ scope: "repository:#{project.full_path}:push,pull" }
|
2016-08-24 12:49:21 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'a pullable'
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'not a container repository factory'
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
|
2016-08-24 12:49:21 +05:30
|
|
|
context 'disallow guest to pull or push images' do
|
2017-09-10 17:25:29 +05:30
|
|
|
before do
|
|
|
|
project.add_guest(current_user)
|
|
|
|
end
|
2016-08-24 12:49:21 +05:30
|
|
|
|
|
|
|
let(:current_params) do
|
2017-09-10 17:25:29 +05:30
|
|
|
{ scope: "repository:#{project.full_path}:pull,push" }
|
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'an inaccessible'
|
|
|
|
it_behaves_like 'not a container repository factory'
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'disallow guest to delete images' do
|
|
|
|
before do
|
|
|
|
project.add_guest(current_user)
|
|
|
|
end
|
|
|
|
|
|
|
|
let(:current_params) do
|
2018-03-27 19:54:05 +05:30
|
|
|
{ scope: "repository:#{project.full_path}:*" }
|
2016-08-24 12:49:21 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'an inaccessible'
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'not a container repository factory'
|
2016-08-24 12:49:21 +05:30
|
|
|
end
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
|
2016-08-24 12:49:21 +05:30
|
|
|
context 'for public project' do
|
2017-09-10 17:25:29 +05:30
|
|
|
let(:project) { create(:project, :public) }
|
2016-06-02 11:05:42 +05:30
|
|
|
|
2016-08-24 12:49:21 +05:30
|
|
|
context 'allow anyone to pull images' do
|
|
|
|
let(:current_params) do
|
2017-09-10 17:25:29 +05:30
|
|
|
{ scope: "repository:#{project.full_path}:pull" }
|
2016-08-24 12:49:21 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'a pullable'
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'not a container repository factory'
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
|
2016-08-24 12:49:21 +05:30
|
|
|
context 'disallow anyone to push images' do
|
|
|
|
let(:current_params) do
|
2017-09-10 17:25:29 +05:30
|
|
|
{ scope: "repository:#{project.full_path}:push" }
|
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'an inaccessible'
|
|
|
|
it_behaves_like 'not a container repository factory'
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'disallow anyone to delete images' do
|
|
|
|
let(:current_params) do
|
2018-03-27 19:54:05 +05:30
|
|
|
{ scope: "repository:#{project.full_path}:*" }
|
2016-08-24 12:49:21 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'an inaccessible'
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'not a container repository factory'
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when repository name is invalid' do
|
|
|
|
let(:current_params) do
|
|
|
|
{ scope: 'repository:invalid:push' }
|
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'an inaccessible'
|
|
|
|
it_behaves_like 'not a container repository factory'
|
2016-08-24 12:49:21 +05:30
|
|
|
end
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
|
2016-08-24 12:49:21 +05:30
|
|
|
context 'for internal project' do
|
2017-09-10 17:25:29 +05:30
|
|
|
let(:project) { create(:project, :internal) }
|
2016-06-02 11:05:42 +05:30
|
|
|
|
2016-08-24 12:49:21 +05:30
|
|
|
context 'for internal user' do
|
|
|
|
context 'allow anyone to pull images' do
|
|
|
|
let(:current_params) do
|
2017-09-10 17:25:29 +05:30
|
|
|
{ scope: "repository:#{project.full_path}:pull" }
|
2016-08-24 12:49:21 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'a pullable'
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'not a container repository factory'
|
2016-08-24 12:49:21 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
context 'disallow anyone to push images' do
|
|
|
|
let(:current_params) do
|
2017-09-10 17:25:29 +05:30
|
|
|
{ scope: "repository:#{project.full_path}:push" }
|
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'an inaccessible'
|
|
|
|
it_behaves_like 'not a container repository factory'
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'disallow anyone to delete images' do
|
|
|
|
let(:current_params) do
|
2018-03-27 19:54:05 +05:30
|
|
|
{ scope: "repository:#{project.full_path}:*" }
|
2016-08-24 12:49:21 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'an inaccessible'
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'not a container repository factory'
|
2016-08-24 12:49:21 +05:30
|
|
|
end
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
|
2016-08-24 12:49:21 +05:30
|
|
|
context 'for external user' do
|
2017-09-10 17:25:29 +05:30
|
|
|
context 'disallow anyone to pull or push images' do
|
|
|
|
let(:current_user) { create(:user, external: true) }
|
|
|
|
let(:current_params) do
|
2018-03-27 19:54:05 +05:30
|
|
|
{ scope: "repository:#{project.full_path}:pull,push" }
|
2017-09-10 17:25:29 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'an inaccessible'
|
|
|
|
it_behaves_like 'not a container repository factory'
|
2016-08-24 12:49:21 +05:30
|
|
|
end
|
|
|
|
|
2017-09-10 17:25:29 +05:30
|
|
|
context 'disallow anyone to delete images' do
|
|
|
|
let(:current_user) { create(:user, external: true) }
|
|
|
|
let(:current_params) do
|
2018-03-27 19:54:05 +05:30
|
|
|
{ scope: "repository:#{project.full_path}:*" }
|
2017-09-10 17:25:29 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'an inaccessible'
|
|
|
|
it_behaves_like 'not a container repository factory'
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'delete authorized as master' do
|
|
|
|
let(:current_project) { create(:project) }
|
|
|
|
let(:current_user) { create(:user) }
|
|
|
|
|
|
|
|
let(:authentication_abilities) do
|
|
|
|
[:admin_container_image]
|
|
|
|
end
|
|
|
|
|
|
|
|
before do
|
|
|
|
current_project.add_master(current_user)
|
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'a valid token'
|
|
|
|
|
|
|
|
context 'allow to delete images' do
|
|
|
|
let(:current_params) do
|
2018-03-27 19:54:05 +05:30
|
|
|
{ scope: "repository:#{current_project.full_path}:*" }
|
2017-09-10 17:25:29 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'a deletable' do
|
|
|
|
let(:project) { current_project }
|
2016-08-24 12:49:21 +05:30
|
|
|
end
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2016-09-29 09:46:39 +05:30
|
|
|
context 'build authorized as user' do
|
2017-09-10 17:25:29 +05:30
|
|
|
let(:current_project) { create(:project) }
|
2016-09-29 09:46:39 +05:30
|
|
|
let(:current_user) { create(:user) }
|
2017-08-17 22:00:37 +05:30
|
|
|
|
2016-09-29 09:46:39 +05:30
|
|
|
let(:authentication_abilities) do
|
2017-08-17 22:00:37 +05:30
|
|
|
[:build_read_container_image, :build_create_container_image]
|
2016-09-29 09:46:39 +05:30
|
|
|
end
|
2016-06-02 11:05:42 +05:30
|
|
|
|
2016-09-29 09:46:39 +05:30
|
|
|
before do
|
2017-09-10 17:25:29 +05:30
|
|
|
current_project.add_developer(current_user)
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
|
2018-11-08 19:23:39 +05:30
|
|
|
context 'allow to use offline_token' do
|
|
|
|
let(:current_params) do
|
|
|
|
{ offline_token: true }
|
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'an authenticated'
|
|
|
|
end
|
|
|
|
|
2016-09-29 09:46:39 +05:30
|
|
|
it_behaves_like 'a valid token'
|
|
|
|
|
2016-06-02 11:05:42 +05:30
|
|
|
context 'allow to pull and push images' do
|
|
|
|
let(:current_params) do
|
2017-09-10 17:25:29 +05:30
|
|
|
{ scope: "repository:#{current_project.full_path}:pull,push" }
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'a pullable and pushable' do
|
|
|
|
let(:project) { current_project }
|
|
|
|
end
|
2017-08-17 22:00:37 +05:30
|
|
|
|
|
|
|
it_behaves_like 'container repository factory' do
|
|
|
|
let(:project) { current_project }
|
|
|
|
end
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
|
2017-09-10 17:25:29 +05:30
|
|
|
context 'disallow to delete images' do
|
|
|
|
let(:current_params) do
|
2018-03-27 19:54:05 +05:30
|
|
|
{ scope: "repository:#{current_project.full_path}:*" }
|
2017-09-10 17:25:29 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'an inaccessible' do
|
|
|
|
let(:project) { current_project }
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2016-06-02 11:05:42 +05:30
|
|
|
context 'for other projects' do
|
|
|
|
context 'when pulling' do
|
|
|
|
let(:current_params) do
|
2017-09-10 17:25:29 +05:30
|
|
|
{ scope: "repository:#{project.full_path}:pull" }
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
context 'allow for public' do
|
2017-09-10 17:25:29 +05:30
|
|
|
let(:project) { create(:project, :public) }
|
2016-09-29 09:46:39 +05:30
|
|
|
|
2016-06-02 11:05:42 +05:30
|
|
|
it_behaves_like 'a pullable'
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'not a container repository factory'
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
|
2016-09-29 09:46:39 +05:30
|
|
|
shared_examples 'pullable for being team member' do
|
|
|
|
context 'when you are not member' do
|
|
|
|
it_behaves_like 'an inaccessible'
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'not a container repository factory'
|
2016-09-29 09:46:39 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
context 'when you are member' do
|
|
|
|
before do
|
2017-09-10 17:25:29 +05:30
|
|
|
project.add_developer(current_user)
|
2016-09-29 09:46:39 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'a pullable'
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'not a container repository factory'
|
2016-09-29 09:46:39 +05:30
|
|
|
end
|
2016-11-24 13:41:30 +05:30
|
|
|
|
|
|
|
context 'when you are owner' do
|
2017-09-10 17:25:29 +05:30
|
|
|
let(:project) { create(:project, namespace: current_user.namespace) }
|
2016-11-24 13:41:30 +05:30
|
|
|
|
|
|
|
it_behaves_like 'a pullable'
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'not a container repository factory'
|
2016-11-24 13:41:30 +05:30
|
|
|
end
|
2016-09-29 09:46:39 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
context 'for private' do
|
2017-09-10 17:25:29 +05:30
|
|
|
let(:project) { create(:project, :private) }
|
2016-09-29 09:46:39 +05:30
|
|
|
|
|
|
|
it_behaves_like 'pullable for being team member'
|
|
|
|
|
|
|
|
context 'when you are admin' do
|
|
|
|
let(:current_user) { create(:admin) }
|
|
|
|
|
|
|
|
context 'when you are not member' do
|
|
|
|
it_behaves_like 'an inaccessible'
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'not a container repository factory'
|
2016-09-29 09:46:39 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
context 'when you are member' do
|
|
|
|
before do
|
2017-09-10 17:25:29 +05:30
|
|
|
project.add_developer(current_user)
|
2016-09-29 09:46:39 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'a pullable'
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'not a container repository factory'
|
2016-09-29 09:46:39 +05:30
|
|
|
end
|
2016-11-24 13:41:30 +05:30
|
|
|
|
|
|
|
context 'when you are owner' do
|
2017-09-10 17:25:29 +05:30
|
|
|
let(:project) { create(:project, namespace: current_user.namespace) }
|
2016-11-24 13:41:30 +05:30
|
|
|
|
|
|
|
it_behaves_like 'a pullable'
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'not a container repository factory'
|
2016-11-24 13:41:30 +05:30
|
|
|
end
|
2016-09-29 09:46:39 +05:30
|
|
|
end
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when pushing' do
|
|
|
|
let(:current_params) do
|
2017-09-10 17:25:29 +05:30
|
|
|
{ scope: "repository:#{project.full_path}:push" }
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
context 'disallow for all' do
|
2016-11-24 13:41:30 +05:30
|
|
|
context 'when you are member' do
|
2017-09-10 17:25:29 +05:30
|
|
|
let(:project) { create(:project, :public) }
|
2016-09-29 09:46:39 +05:30
|
|
|
|
2016-11-24 13:41:30 +05:30
|
|
|
before do
|
2017-09-10 17:25:29 +05:30
|
|
|
project.add_developer(current_user)
|
2016-11-24 13:41:30 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'an inaccessible'
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'not a container repository factory'
|
2016-09-29 09:46:39 +05:30
|
|
|
end
|
|
|
|
|
2016-11-24 13:41:30 +05:30
|
|
|
context 'when you are owner' do
|
2017-09-10 17:25:29 +05:30
|
|
|
let(:project) { create(:project, :public, namespace: current_user.namespace) }
|
2016-11-24 13:41:30 +05:30
|
|
|
|
|
|
|
it_behaves_like 'an inaccessible'
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'not a container repository factory'
|
2016-11-24 13:41:30 +05:30
|
|
|
end
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'for project without container registry' do
|
2017-09-10 17:25:29 +05:30
|
|
|
let(:project) { create(:project, :public, container_registry_enabled: false) }
|
2016-06-02 11:05:42 +05:30
|
|
|
|
2017-09-10 17:25:29 +05:30
|
|
|
before do
|
|
|
|
project.update(container_registry_enabled: false)
|
|
|
|
end
|
2016-06-02 11:05:42 +05:30
|
|
|
|
|
|
|
context 'disallow when pulling' do
|
|
|
|
let(:current_params) do
|
2017-09-10 17:25:29 +05:30
|
|
|
{ scope: "repository:#{project.full_path}:pull" }
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
|
2016-06-16 23:09:34 +05:30
|
|
|
it_behaves_like 'an inaccessible'
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'not a container repository factory'
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2018-03-17 18:26:18 +05:30
|
|
|
context 'registry catalog browsing authorized as admin' do
|
|
|
|
let(:current_user) { create(:user, :admin) }
|
|
|
|
|
|
|
|
let(:current_params) do
|
|
|
|
{ scope: "registry:catalog:*" }
|
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'a browsable'
|
|
|
|
end
|
|
|
|
|
2016-06-02 11:05:42 +05:30
|
|
|
context 'unauthorized' do
|
2016-06-16 23:09:34 +05:30
|
|
|
context 'disallow to use scope-less authentication' do
|
|
|
|
it_behaves_like 'a forbidden'
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'not a container repository factory'
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
context 'for invalid scope' do
|
|
|
|
let(:current_params) do
|
|
|
|
{ scope: 'invalid:aa:bb' }
|
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'a forbidden'
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'not a container repository factory'
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
context 'for private project' do
|
2017-09-10 17:25:29 +05:30
|
|
|
let(:project) { create(:project, :private) }
|
2016-06-02 11:05:42 +05:30
|
|
|
|
|
|
|
let(:current_params) do
|
2017-09-10 17:25:29 +05:30
|
|
|
{ scope: "repository:#{project.full_path}:pull" }
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'a forbidden'
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'for public project' do
|
2017-09-10 17:25:29 +05:30
|
|
|
let(:project) { create(:project, :public) }
|
2016-06-02 11:05:42 +05:30
|
|
|
|
|
|
|
context 'when pulling and pushing' do
|
|
|
|
let(:current_params) do
|
2017-09-10 17:25:29 +05:30
|
|
|
{ scope: "repository:#{project.full_path}:pull,push" }
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'a pullable'
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'not a container repository factory'
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
context 'when pushing' do
|
|
|
|
let(:current_params) do
|
2017-09-10 17:25:29 +05:30
|
|
|
{ scope: "repository:#{project.full_path}:push" }
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'a forbidden'
|
2017-08-17 22:00:37 +05:30
|
|
|
it_behaves_like 'not a container repository factory'
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
|
|
|
end
|
2018-03-17 18:26:18 +05:30
|
|
|
|
|
|
|
context 'for registry catalog' do
|
|
|
|
let(:current_params) do
|
|
|
|
{ scope: "registry:catalog:*" }
|
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'a forbidden'
|
|
|
|
it_behaves_like 'not a container repository factory'
|
|
|
|
end
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|
2018-05-09 12:01:36 +05:30
|
|
|
|
|
|
|
context 'for deploy tokens' do
|
|
|
|
let(:current_params) do
|
|
|
|
{ scope: "repository:#{project.full_path}:pull" }
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when deploy token has read_registry as a scope' do
|
|
|
|
let(:current_user) { create(:deploy_token, projects: [project]) }
|
|
|
|
|
|
|
|
context 'for public project' do
|
|
|
|
let(:project) { create(:project, :public) }
|
|
|
|
|
|
|
|
context 'when pulling' do
|
|
|
|
it_behaves_like 'a pullable'
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when pushing' do
|
|
|
|
let(:current_params) do
|
|
|
|
{ scope: "repository:#{project.full_path}:push" }
|
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'an inaccessible'
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'for internal project' do
|
|
|
|
let(:project) { create(:project, :internal) }
|
|
|
|
|
|
|
|
context 'when pulling' do
|
|
|
|
it_behaves_like 'a pullable'
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when pushing' do
|
|
|
|
let(:current_params) do
|
|
|
|
{ scope: "repository:#{project.full_path}:push" }
|
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'an inaccessible'
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'for private project' do
|
|
|
|
let(:project) { create(:project, :private) }
|
|
|
|
|
|
|
|
context 'when pulling' do
|
|
|
|
it_behaves_like 'a pullable'
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when pushing' do
|
|
|
|
let(:current_params) do
|
|
|
|
{ scope: "repository:#{project.full_path}:push" }
|
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'an inaccessible'
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when deploy token does not have read_registry scope' do
|
|
|
|
let(:current_user) { create(:deploy_token, projects: [project], read_registry: false) }
|
|
|
|
|
|
|
|
context 'for public project' do
|
|
|
|
let(:project) { create(:project, :public) }
|
|
|
|
|
|
|
|
context 'when pulling' do
|
|
|
|
it_behaves_like 'a pullable'
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'for internal project' do
|
|
|
|
let(:project) { create(:project, :internal) }
|
|
|
|
|
|
|
|
context 'when pulling' do
|
|
|
|
it_behaves_like 'an inaccessible'
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'for private project' do
|
|
|
|
let(:project) { create(:project, :internal) }
|
|
|
|
|
|
|
|
context 'when pulling' do
|
|
|
|
it_behaves_like 'an inaccessible'
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when deploy token is not related to the project' do
|
|
|
|
let(:current_user) { create(:deploy_token, read_registry: false) }
|
|
|
|
|
|
|
|
context 'for public project' do
|
|
|
|
let(:project) { create(:project, :public) }
|
|
|
|
|
|
|
|
context 'when pulling' do
|
|
|
|
it_behaves_like 'a pullable'
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'for internal project' do
|
|
|
|
let(:project) { create(:project, :internal) }
|
|
|
|
|
|
|
|
context 'when pulling' do
|
|
|
|
it_behaves_like 'an inaccessible'
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'for private project' do
|
|
|
|
let(:project) { create(:project, :internal) }
|
|
|
|
|
|
|
|
context 'when pulling' do
|
|
|
|
it_behaves_like 'an inaccessible'
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when deploy token has been revoked' do
|
|
|
|
let(:current_user) { create(:deploy_token, :revoked, projects: [project]) }
|
|
|
|
|
|
|
|
context 'for public project' do
|
|
|
|
let(:project) { create(:project, :public) }
|
|
|
|
|
|
|
|
it_behaves_like 'a pullable'
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'for internal project' do
|
|
|
|
let(:project) { create(:project, :internal) }
|
|
|
|
|
|
|
|
it_behaves_like 'an inaccessible'
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'for private project' do
|
|
|
|
let(:project) { create(:project, :internal) }
|
|
|
|
|
|
|
|
it_behaves_like 'an inaccessible'
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
2016-06-02 11:05:42 +05:30
|
|
|
end
|