2018-07-25 09:30:33 +00:00
# frozen_string_literal: true
2019-03-28 13:17:42 +00:00
class PersonalAccessToken < ApplicationRecord
2016-12-27 16:26:57 +00:00
include Expirable
2016-04-25 09:00:59 +00:00
include TokenAuthenticatable
2019-12-17 09:07:48 +00:00
include Sortable
2019-02-20 11:39:37 +00:00
add_authentication_token_field :token , digest : true
2016-04-25 09:00:59 +00:00
2017-12-04 04:01:18 +00:00
REDIS_EXPIRY_TIME = 3 . minutes
2019-07-22 08:50:25 +00:00
TOKEN_LENGTH = 20
2017-12-04 04:01:18 +00:00
2017-07-03 14:01:41 +00:00
serialize :scopes , Array # rubocop:disable Cop/ActiveRecordSerialize
2016-11-22 08:53:53 +00:00
2016-04-15 07:36:44 +00:00
belongs_to :user
2017-02-23 17:47:06 +00:00
before_save :ensure_token
2017-02-27 18:56:54 +00:00
scope :active , - > { where ( " revoked = false AND (expires_at >= NOW() OR expires_at IS NULL) " ) }
2019-12-10 07:53:40 +00:00
scope :expiring_and_not_notified , - > ( date ) { where ( [ " revoked = false AND expire_notification_delivered = false AND expires_at >= NOW() AND expires_at <= ? " , date ] ) }
2016-04-22 08:33:11 +00:00
scope :inactive , - > { where ( " revoked = true OR expires_at < NOW() " ) }
2017-02-27 18:56:54 +00:00
scope :with_impersonation , - > { where ( impersonation : true ) }
scope :without_impersonation , - > { where ( impersonation : false ) }
2019-12-17 09:07:48 +00:00
scope :for_user , - > ( user ) { where ( user : user ) }
scope :preload_users , - > { preload ( :user ) }
2016-04-15 15:24:20 +00:00
2017-02-06 15:39:35 +00:00
validates :scopes , presence : true
2017-05-31 13:55:12 +00:00
validate :validate_scopes
2017-01-31 10:21:29 +00:00
2017-10-03 14:57:31 +00:00
after_initialize :set_default_scopes , if : :persisted?
2016-04-15 15:24:20 +00:00
def revoke!
2017-05-31 13:55:12 +00:00
update! ( revoked : true )
2016-04-15 15:24:20 +00:00
end
2016-12-27 16:26:57 +00:00
def active?
! revoked? && ! expired?
end
2017-03-07 16:16:08 +00:00
2017-12-04 04:01:18 +00:00
def self . redis_getdel ( user_id )
Gitlab :: Redis :: SharedState . with do | redis |
2018-10-29 16:06:45 +00:00
encrypted_token = redis . get ( redis_shared_state_key ( user_id ) )
2017-12-04 04:01:18 +00:00
redis . del ( redis_shared_state_key ( user_id ) )
2018-10-29 16:06:45 +00:00
begin
Gitlab :: CryptoHelper . aes256_gcm_decrypt ( encrypted_token )
rescue = > ex
logger . warn " Failed to decrypt PersonalAccessToken value stored in Redis for User # #{ user_id } : #{ ex . class } "
encrypted_token
end
2017-12-04 04:01:18 +00:00
end
end
def self . redis_store! ( user_id , token )
2018-10-29 16:06:45 +00:00
encrypted_token = Gitlab :: CryptoHelper . aes256_gcm_encrypt ( token )
2017-12-04 04:01:18 +00:00
Gitlab :: Redis :: SharedState . with do | redis |
2018-10-29 16:06:45 +00:00
redis . set ( redis_shared_state_key ( user_id ) , encrypted_token , ex : REDIS_EXPIRY_TIME )
2017-12-04 04:01:18 +00:00
end
end
2017-01-31 10:21:29 +00:00
protected
2017-05-31 13:55:12 +00:00
def validate_scopes
2019-04-15 13:05:55 +00:00
unless revoked || scopes . all? { | scope | Gitlab :: Auth . all_available_scopes . include? ( scope . to_sym ) }
2017-05-31 13:55:12 +00:00
errors . add :scopes , " can only contain available scopes "
2017-01-31 10:21:29 +00:00
end
end
2017-10-03 14:57:31 +00:00
def set_default_scopes
self . scopes = Gitlab :: Auth :: DEFAULT_SCOPES if self . scopes . empty?
end
2017-12-04 04:01:18 +00:00
def self . redis_shared_state_key ( user_id )
" gitlab:personal_access_token: #{ user_id } "
end
2016-04-15 07:36:44 +00:00
end
2019-12-06 00:07:48 +00:00
PersonalAccessToken . prepend_if_ee ( 'EE::PersonalAccessToken' )