2018-07-25 05:30:33 -04:00
# frozen_string_literal: true
2019-03-28 09:17:42 -04:00
class PersonalAccessToken < ApplicationRecord
2016-12-27 11:26:57 -05:00
include Expirable
2016-04-25 05:00:59 -04:00
include TokenAuthenticatable
2019-12-17 04:07:48 -05:00
include Sortable
2021-02-25 07:11:01 -05:00
include EachBatch
2020-05-05 17:09:42 -04:00
extend :: Gitlab :: Utils :: Override
2019-02-20 06:39:37 -05:00
add_authentication_token_field :token , digest : true
2016-04-25 05:00:59 -04:00
2017-12-03 23:01:18 -05:00
REDIS_EXPIRY_TIME = 3 . minutes
2020-12-15 10:09:59 -05:00
# PATs are 20 characters + optional configurable settings prefix (0..20)
TOKEN_LENGTH_RANGE = ( 20 .. 40 ) . freeze
2017-12-03 23:01:18 -05:00
2017-07-03 10:01:41 -04:00
serialize :scopes , Array # rubocop:disable Cop/ActiveRecordSerialize
2016-11-22 03:53:53 -05:00
2016-04-15 03:36:44 -04:00
belongs_to :user
2017-02-23 12:47:06 -05:00
before_save :ensure_token
2020-07-13 11:09:08 -04:00
scope :active , - > { where ( " revoked = false AND (expires_at >= CURRENT_DATE OR expires_at IS NULL) " ) }
scope :expiring_and_not_notified , - > ( date ) { where ( [ " revoked = false AND expire_notification_delivered = false AND expires_at >= CURRENT_DATE AND expires_at <= ? " , date ] ) }
2020-08-05 20:09:53 -04:00
scope :expired_today_and_not_notified , - > { where ( [ " revoked = false AND expires_at = CURRENT_DATE AND after_expiry_notification_delivered = false " ] ) }
2020-07-13 11:09:08 -04:00
scope :inactive , - > { where ( " revoked = true OR expires_at < CURRENT_DATE " ) }
2017-02-27 13:56:54 -05:00
scope :with_impersonation , - > { where ( impersonation : true ) }
scope :without_impersonation , - > { where ( impersonation : false ) }
2020-06-18 08:09:25 -04:00
scope :revoked , - > { where ( revoked : true ) }
scope :not_revoked , - > { where ( revoked : [ false , nil ] ) }
2019-12-17 04:07:48 -05:00
scope :for_user , - > ( user ) { where ( user : user ) }
2020-11-16 16:09:02 -05:00
scope :for_users , - > ( users ) { where ( user : users ) }
2019-12-17 04:07:48 -05:00
scope :preload_users , - > { preload ( :user ) }
2020-05-05 17:09:42 -04:00
scope :order_expires_at_asc , - > { reorder ( expires_at : :asc ) }
scope :order_expires_at_desc , - > { reorder ( expires_at : :desc ) }
2016-04-15 11:24:20 -04:00
2017-02-06 10:39:35 -05:00
validates :scopes , presence : true
2017-05-31 09:55:12 -04:00
validate :validate_scopes
2017-01-31 05:21:29 -05:00
2017-10-03 10:57:31 -04:00
after_initialize :set_default_scopes , if : :persisted?
2016-04-15 11:24:20 -04:00
def revoke!
2017-05-31 09:55:12 -04:00
update! ( revoked : true )
2016-04-15 11:24:20 -04:00
end
2016-12-27 11:26:57 -05:00
def active?
! revoked? && ! expired?
end
2017-03-07 11:16:08 -05:00
2021-08-11 05:10:00 -04:00
def expired_but_not_enforced?
false
end
2017-12-03 23:01:18 -05:00
def self . redis_getdel ( user_id )
Gitlab :: Redis :: SharedState . with do | redis |
2020-05-05 17:09:42 -04:00
redis_key = redis_shared_state_key ( user_id )
encrypted_token = redis . get ( redis_key )
redis . del ( redis_key )
2018-10-29 12:06:45 -04:00
begin
Gitlab :: CryptoHelper . aes256_gcm_decrypt ( encrypted_token )
2021-04-26 08:09:44 -04:00
rescue StandardError = > ex
2020-05-05 17:09:42 -04:00
logger . warn " Failed to decrypt #{ self . name } value stored in Redis for key # #{ redis_key } : #{ ex . class } "
2018-10-29 12:06:45 -04:00
encrypted_token
end
2017-12-03 23:01:18 -05:00
end
end
def self . redis_store! ( user_id , token )
2018-10-29 12:06:45 -04:00
encrypted_token = Gitlab :: CryptoHelper . aes256_gcm_encrypt ( token )
2017-12-03 23:01:18 -05:00
Gitlab :: Redis :: SharedState . with do | redis |
2018-10-29 12:06:45 -04:00
redis . set ( redis_shared_state_key ( user_id ) , encrypted_token , ex : REDIS_EXPIRY_TIME )
2017-12-03 23:01:18 -05:00
end
end
2020-05-05 17:09:42 -04:00
override :simple_sorts
def self . simple_sorts
super . merge (
{
'expires_at_asc' = > - > { order_expires_at_asc } ,
'expires_at_desc' = > - > { order_expires_at_desc }
}
)
end
2020-12-15 10:09:59 -05:00
def self . token_prefix
Gitlab :: CurrentSettings . current_application_settings . personal_access_token_prefix
end
override :format_token
def format_token ( token )
" #{ self . class . token_prefix } #{ token } "
end
2017-01-31 05:21:29 -05:00
protected
2017-05-31 09:55:12 -04:00
def validate_scopes
2019-04-15 09:05:55 -04:00
unless revoked || scopes . all? { | scope | Gitlab :: Auth . all_available_scopes . include? ( scope . to_sym ) }
2017-05-31 09:55:12 -04:00
errors . add :scopes , " can only contain available scopes "
2017-01-31 05:21:29 -05:00
end
end
2017-10-03 10:57:31 -04:00
def set_default_scopes
2021-02-25 07:11:01 -05:00
# When only loading a select set of attributes, for example using `EachBatch`,
# the `scopes` attribute is not present, so we can't initialize it.
return unless has_attribute? ( :scopes )
2017-10-03 10:57:31 -04:00
self . scopes = Gitlab :: Auth :: DEFAULT_SCOPES if self . scopes . empty?
end
2017-12-03 23:01:18 -05:00
def self . redis_shared_state_key ( user_id )
" gitlab:personal_access_token: #{ user_id } "
end
2016-04-15 03:36:44 -04:00
end
2019-12-05 19:07:48 -05:00
2021-05-11 17:10:21 -04:00
PersonalAccessToken . prepend_mod_with ( 'PersonalAccessToken' )