2018-09-14 01:42:05 -04:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2016-11-21 10:31:51 -05:00
|
|
|
# This concern assumes:
|
|
|
|
# - a `#project` accessor
|
|
|
|
# - a `#user` accessor
|
|
|
|
# - a `#authentication_result` accessor
|
|
|
|
# - a `#can?(object, action, subject)` method
|
|
|
|
# - a `#ci?` method
|
|
|
|
# - a `#download_request?` method
|
|
|
|
# - a `#upload_request?` method
|
|
|
|
# - a `#has_authentication_ability?(ability)` method
|
|
|
|
module LfsRequest
|
|
|
|
extend ActiveSupport::Concern
|
|
|
|
|
2018-02-07 08:00:53 -05:00
|
|
|
CONTENT_TYPE = 'application/vnd.git-lfs+json'.freeze
|
|
|
|
|
2016-11-21 10:31:51 -05:00
|
|
|
included do
|
|
|
|
before_action :require_lfs_enabled!
|
|
|
|
before_action :lfs_check_access!
|
|
|
|
end
|
|
|
|
|
|
|
|
private
|
2016-11-02 17:50:44 -04:00
|
|
|
|
2016-08-10 10:48:21 -04:00
|
|
|
def require_lfs_enabled!
|
2016-07-20 12:41:26 -04:00
|
|
|
return if Gitlab.config.lfs.enabled
|
|
|
|
|
|
|
|
render(
|
|
|
|
json: {
|
|
|
|
message: 'Git LFS is not enabled on this GitLab server, contact your admin.',
|
2017-05-03 07:22:03 -04:00
|
|
|
documentation_url: help_url
|
2016-07-20 12:41:26 -04:00
|
|
|
},
|
2018-07-02 06:43:06 -04:00
|
|
|
status: :not_implemented
|
2016-07-20 12:41:26 -04:00
|
|
|
)
|
|
|
|
end
|
|
|
|
|
|
|
|
def lfs_check_access!
|
|
|
|
return if download_request? && lfs_download_access?
|
|
|
|
return if upload_request? && lfs_upload_access?
|
|
|
|
|
2016-11-21 10:31:51 -05:00
|
|
|
if project.public? || can?(user, :read_project, project)
|
|
|
|
lfs_forbidden!
|
2016-07-20 12:41:26 -04:00
|
|
|
else
|
|
|
|
render_lfs_not_found
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2016-11-21 10:31:51 -05:00
|
|
|
def lfs_forbidden!
|
|
|
|
render_lfs_forbidden
|
2016-07-20 12:41:26 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
def render_lfs_forbidden
|
|
|
|
render(
|
|
|
|
json: {
|
|
|
|
message: 'Access forbidden. Check your access level.',
|
2017-05-03 07:22:03 -04:00
|
|
|
documentation_url: help_url
|
2016-07-20 12:41:26 -04:00
|
|
|
},
|
2018-02-07 08:00:53 -05:00
|
|
|
content_type: CONTENT_TYPE,
|
2016-07-20 12:41:26 -04:00
|
|
|
status: 403
|
|
|
|
)
|
|
|
|
end
|
|
|
|
|
|
|
|
def render_lfs_not_found
|
|
|
|
render(
|
|
|
|
json: {
|
|
|
|
message: 'Not found.',
|
2017-05-03 07:22:03 -04:00
|
|
|
documentation_url: help_url
|
2016-07-20 12:41:26 -04:00
|
|
|
},
|
2018-02-07 08:00:53 -05:00
|
|
|
content_type: CONTENT_TYPE,
|
2016-07-20 12:41:26 -04:00
|
|
|
status: 404
|
|
|
|
)
|
|
|
|
end
|
|
|
|
|
2016-11-21 10:31:51 -05:00
|
|
|
def lfs_download_access?
|
|
|
|
return false unless project.lfs_enabled?
|
|
|
|
|
2018-07-23 05:23:08 -04:00
|
|
|
ci? || lfs_deploy_token? || user_can_download_code? || build_can_download_code? || deploy_token_can_download_code?
|
|
|
|
end
|
|
|
|
|
|
|
|
def deploy_token_can_download_code?
|
|
|
|
deploy_token_present? &&
|
|
|
|
deploy_token.project == project &&
|
|
|
|
deploy_token.active? &&
|
|
|
|
deploy_token.read_repository?
|
|
|
|
end
|
|
|
|
|
|
|
|
def deploy_token_present?
|
|
|
|
user && user.is_a?(DeployToken)
|
|
|
|
end
|
|
|
|
|
|
|
|
def deploy_token
|
|
|
|
user
|
2016-11-21 10:31:51 -05:00
|
|
|
end
|
|
|
|
|
|
|
|
def lfs_upload_access?
|
|
|
|
return false unless project.lfs_enabled?
|
2017-11-08 11:21:39 -05:00
|
|
|
return false unless has_authentication_ability?(:push_code)
|
2016-11-21 10:31:51 -05:00
|
|
|
|
2017-11-08 11:21:39 -05:00
|
|
|
lfs_deploy_token? || can?(user, :push_code, project)
|
2016-11-21 10:31:51 -05:00
|
|
|
end
|
|
|
|
|
|
|
|
def lfs_deploy_token?
|
|
|
|
authentication_result.lfs_deploy_token?(project)
|
|
|
|
end
|
|
|
|
|
|
|
|
def user_can_download_code?
|
2018-07-23 05:23:08 -04:00
|
|
|
has_authentication_ability?(:download_code) && can?(user, :download_code, project) && !deploy_token_present?
|
2016-11-21 10:31:51 -05:00
|
|
|
end
|
|
|
|
|
|
|
|
def build_can_download_code?
|
|
|
|
has_authentication_ability?(:build_download_code) && can?(user, :build_download_code, project)
|
|
|
|
end
|
|
|
|
|
2016-07-20 12:41:26 -04:00
|
|
|
def storage_project
|
2017-11-08 07:59:48 -05:00
|
|
|
@storage_project ||= project.lfs_storage_project
|
2016-07-20 12:41:26 -04:00
|
|
|
end
|
2016-11-21 10:31:51 -05:00
|
|
|
|
|
|
|
def objects
|
|
|
|
@objects ||= (params[:objects] || []).to_a
|
|
|
|
end
|
2017-05-16 15:58:46 -04:00
|
|
|
|
|
|
|
def has_authentication_ability?(capability)
|
|
|
|
(authentication_abilities || []).include?(capability)
|
|
|
|
end
|
2016-07-20 12:41:26 -04:00
|
|
|
end
|