2018-09-29 22:34:47 +00:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2014-12-19 14:15:29 +00:00
|
|
|
# Guard API with OAuth 2.0 Access Token
|
|
|
|
|
|
|
|
require 'rack/oauth2'
|
|
|
|
|
2016-04-15 15:35:40 +00:00
|
|
|
module API
|
|
|
|
module APIGuard
|
|
|
|
extend ActiveSupport::Concern
|
2014-12-19 14:15:29 +00:00
|
|
|
|
2016-04-15 15:35:40 +00:00
|
|
|
included do |base|
|
|
|
|
# OAuth2 Resource Server Authentication
|
|
|
|
use Rack::OAuth2::Server::Resource::Bearer, 'The API' do |request|
|
|
|
|
# The authenticator only fetches the raw token string
|
2014-12-19 14:15:29 +00:00
|
|
|
|
2016-04-15 15:35:40 +00:00
|
|
|
# Must yield access token to store it in the env
|
|
|
|
request.access_token
|
|
|
|
end
|
2014-12-19 14:15:29 +00:00
|
|
|
|
2019-09-26 12:06:00 +00:00
|
|
|
use AdminModeMiddleware
|
|
|
|
|
2016-04-15 15:35:40 +00:00
|
|
|
helpers HelperMethods
|
2014-12-19 14:15:29 +00:00
|
|
|
|
2016-04-15 15:35:40 +00:00
|
|
|
install_error_responders(base)
|
|
|
|
end
|
2014-12-19 14:15:29 +00:00
|
|
|
|
2017-06-20 07:40:24 +00:00
|
|
|
class_methods do
|
2017-06-20 12:00:57 +00:00
|
|
|
# Set the authorization scope(s) allowed for an API endpoint.
|
2017-06-20 07:40:24 +00:00
|
|
|
#
|
2017-06-20 12:00:57 +00:00
|
|
|
# A call to this method maps the given scope(s) to the current API
|
|
|
|
# endpoint class. If this method is called multiple times on the same class,
|
|
|
|
# the scopes are all aggregated.
|
2017-06-20 07:40:24 +00:00
|
|
|
def allow_access_with_scope(scopes, options = {})
|
2017-06-23 11:18:44 +00:00
|
|
|
Array(scopes).each do |scope|
|
2017-06-28 07:12:23 +00:00
|
|
|
allowed_scopes << Scope.new(scope, options)
|
2017-06-23 11:18:44 +00:00
|
|
|
end
|
2017-06-20 07:40:24 +00:00
|
|
|
end
|
|
|
|
|
2017-06-23 11:18:44 +00:00
|
|
|
def allowed_scopes
|
|
|
|
@scopes ||= []
|
2017-06-20 07:40:24 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2016-04-15 15:35:40 +00:00
|
|
|
# Helper Methods for Grape Endpoint
|
|
|
|
module HelperMethods
|
2019-09-13 13:26:31 +00:00
|
|
|
prepend_if_ee('EE::API::APIGuard::HelperMethods') # rubocop: disable Cop/InjectEnterpriseEditionModule
|
2019-12-11 12:08:10 +00:00
|
|
|
include Gitlab::Auth::AuthFinders
|
2017-11-13 15:27:30 +00:00
|
|
|
|
2020-04-01 12:08:00 +00:00
|
|
|
def access_token
|
|
|
|
super || find_personal_access_token_from_http_basic_auth
|
|
|
|
end
|
|
|
|
|
2017-10-12 12:38:39 +00:00
|
|
|
def find_current_user!
|
2018-02-05 09:44:23 +00:00
|
|
|
user = find_user_from_sources
|
2017-10-12 12:38:39 +00:00
|
|
|
return unless user
|
2017-09-27 13:56:48 +00:00
|
|
|
|
2020-03-02 12:07:57 +00:00
|
|
|
# Sessions are enforced to be unavailable for API calls, so ignore them for admin mode
|
|
|
|
Gitlab::Auth::CurrentUserMode.bypass_session!(user.id) if Feature.enabled?(:user_mode_in_session)
|
|
|
|
|
2018-05-08 13:07:55 +00:00
|
|
|
unless api_access_allowed?(user)
|
|
|
|
forbidden!(api_access_denied_message(user))
|
|
|
|
end
|
2017-09-27 13:56:48 +00:00
|
|
|
|
|
|
|
user
|
|
|
|
end
|
|
|
|
|
2018-02-05 09:44:23 +00:00
|
|
|
def find_user_from_sources
|
2019-12-10 18:08:04 +00:00
|
|
|
find_user_from_access_token ||
|
|
|
|
find_user_from_job_token ||
|
|
|
|
find_user_from_warden
|
2018-02-05 09:44:23 +00:00
|
|
|
end
|
|
|
|
|
2017-11-07 18:17:41 +00:00
|
|
|
private
|
2016-11-22 09:04:23 +00:00
|
|
|
|
2017-09-27 13:56:48 +00:00
|
|
|
# An array of scopes that were registered (using `allow_access_with_scope`)
|
|
|
|
# for the current endpoint class. It also returns scopes registered on
|
|
|
|
# `API::API`, since these are meant to apply to all API routes.
|
|
|
|
def scopes_registered_for_endpoint
|
|
|
|
@scopes_registered_for_endpoint ||=
|
|
|
|
begin
|
|
|
|
endpoint_classes = [options[:for].presence, ::API::API].compact
|
|
|
|
endpoint_classes.reduce([]) do |memo, endpoint|
|
|
|
|
if endpoint.respond_to?(:allowed_scopes)
|
|
|
|
memo.concat(endpoint.allowed_scopes)
|
|
|
|
else
|
|
|
|
memo
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
2018-05-08 13:07:55 +00:00
|
|
|
|
|
|
|
def api_access_allowed?(user)
|
|
|
|
Gitlab::UserAccess.new(user).allowed? && user.can?(:access_api)
|
|
|
|
end
|
|
|
|
|
|
|
|
def api_access_denied_message(user)
|
|
|
|
Gitlab::Auth::UserAccessDeniedReason.new(user).rejection_message
|
|
|
|
end
|
2014-12-19 14:15:29 +00:00
|
|
|
end
|
|
|
|
|
2018-08-27 12:35:31 +00:00
|
|
|
class_methods do
|
2016-04-15 15:35:40 +00:00
|
|
|
private
|
2014-12-19 14:15:29 +00:00
|
|
|
|
2016-04-15 15:35:40 +00:00
|
|
|
def install_error_responders(base)
|
2017-11-16 16:03:19 +00:00
|
|
|
error_classes = [Gitlab::Auth::MissingTokenError,
|
|
|
|
Gitlab::Auth::TokenNotFoundError,
|
|
|
|
Gitlab::Auth::ExpiredError,
|
|
|
|
Gitlab::Auth::RevokedError,
|
2018-11-24 12:39:16 +00:00
|
|
|
Gitlab::Auth::ImpersonationDisabled,
|
2017-11-16 16:03:19 +00:00
|
|
|
Gitlab::Auth::InsufficientScopeError]
|
2014-12-19 14:15:29 +00:00
|
|
|
|
2017-08-10 16:39:26 +00:00
|
|
|
base.__send__(:rescue_from, *error_classes, oauth2_bearer_token_error_handler) # rubocop:disable GitlabSecurity/PublicSend
|
2016-04-15 15:35:40 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def oauth2_bearer_token_error_handler
|
2017-03-31 15:11:28 +00:00
|
|
|
proc do |e|
|
2016-04-15 15:35:40 +00:00
|
|
|
response =
|
|
|
|
case e
|
2017-11-16 16:03:19 +00:00
|
|
|
when Gitlab::Auth::MissingTokenError
|
2016-04-15 15:35:40 +00:00
|
|
|
Rack::OAuth2::Server::Resource::Bearer::Unauthorized.new
|
|
|
|
|
2017-11-16 16:03:19 +00:00
|
|
|
when Gitlab::Auth::TokenNotFoundError
|
2016-04-15 15:35:40 +00:00
|
|
|
Rack::OAuth2::Server::Resource::Bearer::Unauthorized.new(
|
|
|
|
:invalid_token,
|
|
|
|
"Bad Access Token.")
|
|
|
|
|
2017-11-16 16:03:19 +00:00
|
|
|
when Gitlab::Auth::ExpiredError
|
2016-04-15 15:35:40 +00:00
|
|
|
Rack::OAuth2::Server::Resource::Bearer::Unauthorized.new(
|
|
|
|
:invalid_token,
|
|
|
|
"Token is expired. You can either do re-authorization or token refresh.")
|
|
|
|
|
2017-11-16 16:03:19 +00:00
|
|
|
when Gitlab::Auth::RevokedError
|
2016-04-15 15:35:40 +00:00
|
|
|
Rack::OAuth2::Server::Resource::Bearer::Unauthorized.new(
|
|
|
|
:invalid_token,
|
|
|
|
"Token was revoked. You have to re-authorize from the user.")
|
|
|
|
|
2018-11-24 12:39:16 +00:00
|
|
|
when Gitlab::Auth::ImpersonationDisabled
|
|
|
|
Rack::OAuth2::Server::Resource::Bearer::Unauthorized.new(
|
|
|
|
:invalid_token,
|
|
|
|
"Token is an impersonation token but impersonation was disabled.")
|
|
|
|
|
2017-11-16 16:03:19 +00:00
|
|
|
when Gitlab::Auth::InsufficientScopeError
|
2016-04-15 15:35:40 +00:00
|
|
|
# FIXME: ForbiddenError (inherited from Bearer::Forbidden of Rack::Oauth2)
|
|
|
|
# does not include WWW-Authenticate header, which breaks the standard.
|
|
|
|
Rack::OAuth2::Server::Resource::Bearer::Forbidden.new(
|
|
|
|
:insufficient_scope,
|
|
|
|
Rack::OAuth2::Server::Resource::ErrorMethods::DEFAULT_DESCRIPTION[:insufficient_scope],
|
|
|
|
{ scope: e.scopes })
|
|
|
|
end
|
|
|
|
|
2020-04-28 03:09:53 +00:00
|
|
|
response.finish
|
2016-04-15 15:35:40 +00:00
|
|
|
end
|
2015-02-03 05:22:57 +00:00
|
|
|
end
|
2014-12-19 14:15:29 +00:00
|
|
|
end
|
2019-09-26 12:06:00 +00:00
|
|
|
|
|
|
|
class AdminModeMiddleware < ::Grape::Middleware::Base
|
2020-03-02 12:07:57 +00:00
|
|
|
def after
|
|
|
|
# Use a Grape middleware since the Grape `after` blocks might run
|
|
|
|
# before we are finished rendering the `Grape::Entity` classes
|
|
|
|
Gitlab::Auth::CurrentUserMode.reset_bypass_session! if Feature.enabled?(:user_mode_in_session)
|
2019-09-26 12:06:00 +00:00
|
|
|
|
2020-03-02 12:07:57 +00:00
|
|
|
# Explicit nil is needed or the api call return value will be overwritten
|
|
|
|
nil
|
2019-09-26 12:06:00 +00:00
|
|
|
end
|
|
|
|
end
|
2014-12-19 14:15:29 +00:00
|
|
|
end
|
2015-02-03 03:30:09 +00:00
|
|
|
end
|