2016-04-24 23:30:20 -04:00
|
|
|
module API
|
|
|
|
module Helpers
|
2016-10-28 16:56:13 -04:00
|
|
|
include Gitlab::Utils
|
2016-12-07 07:15:01 -05:00
|
|
|
include Helpers::Pagination
|
2016-10-28 16:56:13 -04:00
|
|
|
|
2017-02-21 18:32:18 -05:00
|
|
|
SUDO_HEADER = "HTTP_SUDO".freeze
|
2016-04-24 23:30:20 -04:00
|
|
|
SUDO_PARAM = :sudo
|
|
|
|
|
2016-11-10 10:32:59 -05:00
|
|
|
def declared_params(options = {})
|
|
|
|
options = { include_parent_namespaces: false }.merge(options)
|
|
|
|
declared(params, options).to_h.symbolize_keys
|
|
|
|
end
|
|
|
|
|
2016-04-24 23:30:20 -04:00
|
|
|
def current_user
|
2016-12-09 12:48:20 -05:00
|
|
|
return @current_user if defined?(@current_user)
|
2016-04-24 23:30:20 -04:00
|
|
|
|
2016-12-09 12:48:20 -05:00
|
|
|
@current_user = initial_current_user
|
2016-04-24 23:30:20 -04:00
|
|
|
|
2016-12-09 12:48:20 -05:00
|
|
|
sudo!
|
2016-04-24 23:30:20 -04:00
|
|
|
|
|
|
|
@current_user
|
|
|
|
end
|
|
|
|
|
2016-12-09 12:48:20 -05:00
|
|
|
def sudo?
|
|
|
|
initial_current_user != current_user
|
2016-04-24 23:30:20 -04:00
|
|
|
end
|
|
|
|
|
2017-07-12 15:58:48 -04:00
|
|
|
def user_group
|
|
|
|
@group ||= find_group!(params[:id])
|
|
|
|
end
|
|
|
|
|
2016-04-24 23:30:20 -04:00
|
|
|
def user_project
|
2016-11-24 08:40:35 -05:00
|
|
|
@project ||= find_project!(params[:id])
|
2016-04-24 23:30:20 -04:00
|
|
|
end
|
|
|
|
|
2016-10-13 17:34:44 -04:00
|
|
|
def available_labels
|
|
|
|
@available_labels ||= LabelsFinder.new(current_user, project_id: user_project.id).execute
|
|
|
|
end
|
|
|
|
|
2016-12-13 09:53:00 -05:00
|
|
|
def find_user(id)
|
|
|
|
if id =~ /^\d+$/
|
|
|
|
User.find_by(id: id)
|
|
|
|
else
|
|
|
|
User.find_by(username: id)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2016-04-24 23:30:20 -04:00
|
|
|
def find_project(id)
|
2016-11-24 08:40:35 -05:00
|
|
|
if id =~ /^\d+$/
|
|
|
|
Project.find_by(id: id)
|
|
|
|
else
|
2017-02-02 18:43:19 -05:00
|
|
|
Project.find_by_full_path(id)
|
2016-11-24 08:40:35 -05:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def find_project!(id)
|
|
|
|
project = find_project(id)
|
2016-04-24 23:30:20 -04:00
|
|
|
|
2016-06-23 11:14:31 -04:00
|
|
|
if can?(current_user, :read_project, project)
|
2016-04-24 23:30:20 -04:00
|
|
|
project
|
|
|
|
else
|
2016-06-23 11:14:31 -04:00
|
|
|
not_found!('Project')
|
2016-04-24 23:30:20 -04:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def find_group(id)
|
2016-11-24 10:58:32 -05:00
|
|
|
if id =~ /^\d+$/
|
|
|
|
Group.find_by(id: id)
|
|
|
|
else
|
2016-10-31 07:00:53 -04:00
|
|
|
Group.find_by_full_path(id)
|
2016-11-24 10:58:32 -05:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def find_group!(id)
|
|
|
|
group = find_group(id)
|
2016-04-24 23:30:20 -04:00
|
|
|
|
|
|
|
if can?(current_user, :read_group, group)
|
|
|
|
group
|
|
|
|
else
|
|
|
|
not_found!('Group')
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2016-05-12 16:48:09 -04:00
|
|
|
def find_project_label(id)
|
2016-10-13 17:34:44 -04:00
|
|
|
label = available_labels.find_by_id(id) || available_labels.find_by_title(id)
|
2016-05-12 16:48:09 -04:00
|
|
|
label || not_found!('Label')
|
|
|
|
end
|
|
|
|
|
2017-02-25 03:44:09 -05:00
|
|
|
def find_project_issue(iid)
|
|
|
|
IssuesFinder.new(current_user, project_id: user_project.id).find_by!(iid: iid)
|
2016-05-12 16:48:09 -04:00
|
|
|
end
|
|
|
|
|
2017-02-25 07:25:32 -05:00
|
|
|
def find_project_merge_request(iid)
|
|
|
|
MergeRequestsFinder.new(current_user, project_id: user_project.id).find_by!(iid: iid)
|
2016-04-24 23:30:20 -04:00
|
|
|
end
|
|
|
|
|
2017-03-27 09:01:45 -04:00
|
|
|
def find_project_snippet(id)
|
2017-05-10 06:03:29 -04:00
|
|
|
finder_params = { project: user_project }
|
|
|
|
SnippetsFinder.new(current_user, finder_params).execute.find(id)
|
2017-03-27 09:01:45 -04:00
|
|
|
end
|
|
|
|
|
2017-02-25 07:25:32 -05:00
|
|
|
def find_merge_request_with_access(iid, access_level = :read_merge_request)
|
|
|
|
merge_request = user_project.merge_requests.find_by!(iid: iid)
|
2017-01-03 13:03:13 -05:00
|
|
|
authorize! access_level, merge_request
|
|
|
|
merge_request
|
|
|
|
end
|
|
|
|
|
2016-04-24 23:30:20 -04:00
|
|
|
def authenticate!
|
2017-04-21 02:44:47 -04:00
|
|
|
unauthorized! unless current_user && can?(initial_current_user, :access_api)
|
2016-04-24 23:30:20 -04:00
|
|
|
end
|
|
|
|
|
2016-11-30 09:48:19 -05:00
|
|
|
def authenticate_non_get!
|
2016-12-23 11:03:25 -05:00
|
|
|
authenticate! unless %w[GET HEAD].include?(route.request_method)
|
2016-11-30 09:48:19 -05:00
|
|
|
end
|
|
|
|
|
2016-04-24 23:30:20 -04:00
|
|
|
def authenticate_by_gitlab_shell_token!
|
|
|
|
input = params['secret_token'].try(:chomp)
|
|
|
|
unless Devise.secure_compare(secret_token, input)
|
|
|
|
unauthorized!
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def authenticated_as_admin!
|
2016-11-30 09:48:19 -05:00
|
|
|
authenticate!
|
2017-04-08 22:20:57 -04:00
|
|
|
forbidden! unless current_user.admin?
|
2016-04-24 23:30:20 -04:00
|
|
|
end
|
|
|
|
|
2017-02-28 16:08:07 -05:00
|
|
|
def authorize!(action, subject = :global)
|
2016-06-23 11:14:31 -04:00
|
|
|
forbidden! unless can?(current_user, action, subject)
|
2016-04-24 23:30:20 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
def authorize_push_project
|
|
|
|
authorize! :push_code, user_project
|
|
|
|
end
|
|
|
|
|
|
|
|
def authorize_admin_project
|
|
|
|
authorize! :admin_project, user_project
|
|
|
|
end
|
|
|
|
|
|
|
|
def require_gitlab_workhorse!
|
|
|
|
unless env['HTTP_GITLAB_WORKHORSE'].present?
|
|
|
|
forbidden!('Request should be executed via GitLab Workhorse')
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2017-02-28 16:08:07 -05:00
|
|
|
def can?(object, action, subject = :global)
|
2016-08-08 14:55:13 -04:00
|
|
|
Ability.allowed?(object, action, subject)
|
2016-04-24 23:30:20 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
# Checks the occurrences of required attributes, each attribute must be present in the params hash
|
|
|
|
# or a Bad Request error is invoked.
|
|
|
|
#
|
|
|
|
# Parameters:
|
|
|
|
# keys (required) - A hash consisting of keys that must be present
|
|
|
|
def required_attributes!(keys)
|
|
|
|
keys.each do |key|
|
|
|
|
bad_request!(key) unless params[key].present?
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def attributes_for_keys(keys, custom_params = nil)
|
|
|
|
params_hash = custom_params || params
|
|
|
|
attrs = {}
|
|
|
|
keys.each do |key|
|
2017-06-02 13:11:26 -04:00
|
|
|
if params_hash[key].present? || (params_hash.key?(key) && params_hash[key] == false)
|
2016-04-24 23:30:20 -04:00
|
|
|
attrs[key] = params_hash[key]
|
|
|
|
end
|
|
|
|
end
|
|
|
|
ActionController::Parameters.new(attrs).permit!
|
|
|
|
end
|
|
|
|
|
|
|
|
def filter_by_iid(items, iid)
|
|
|
|
items.where(iid: iid)
|
|
|
|
end
|
|
|
|
|
2017-02-28 07:23:40 -05:00
|
|
|
def filter_by_search(items, text)
|
|
|
|
items.search(text)
|
|
|
|
end
|
|
|
|
|
2016-04-24 23:30:20 -04:00
|
|
|
# error helpers
|
|
|
|
|
|
|
|
def forbidden!(reason = nil)
|
|
|
|
message = ['403 Forbidden']
|
|
|
|
message << " - #{reason}" if reason
|
|
|
|
render_api_error!(message.join(' '), 403)
|
|
|
|
end
|
|
|
|
|
|
|
|
def bad_request!(attribute)
|
|
|
|
message = ["400 (Bad request)"]
|
|
|
|
message << "\"" + attribute.to_s + "\" not given"
|
|
|
|
render_api_error!(message.join(' '), 400)
|
|
|
|
end
|
|
|
|
|
|
|
|
def not_found!(resource = nil)
|
|
|
|
message = ["404"]
|
|
|
|
message << resource if resource
|
|
|
|
message << "Not Found"
|
|
|
|
render_api_error!(message.join(' '), 404)
|
|
|
|
end
|
|
|
|
|
|
|
|
def unauthorized!
|
|
|
|
render_api_error!('401 Unauthorized', 401)
|
|
|
|
end
|
|
|
|
|
|
|
|
def not_allowed!
|
|
|
|
render_api_error!('405 Method Not Allowed', 405)
|
|
|
|
end
|
|
|
|
|
|
|
|
def conflict!(message = nil)
|
|
|
|
render_api_error!(message || '409 Conflict', 409)
|
|
|
|
end
|
|
|
|
|
|
|
|
def file_to_large!
|
|
|
|
render_api_error!('413 Request Entity Too Large', 413)
|
|
|
|
end
|
|
|
|
|
|
|
|
def not_modified!
|
|
|
|
render_api_error!('304 Not Modified', 304)
|
|
|
|
end
|
|
|
|
|
2016-09-06 08:30:54 -04:00
|
|
|
def no_content!
|
|
|
|
render_api_error!('204 No Content', 204)
|
|
|
|
end
|
|
|
|
|
2017-02-22 12:37:13 -05:00
|
|
|
def accepted!
|
|
|
|
render_api_error!('202 Accepted', 202)
|
|
|
|
end
|
|
|
|
|
2016-04-24 23:30:20 -04:00
|
|
|
def render_validation_error!(model)
|
|
|
|
if model.errors.any?
|
|
|
|
render_api_error!(model.errors.messages || '400 Bad Request', 400)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2017-02-14 14:07:11 -05:00
|
|
|
def render_spam_error!
|
|
|
|
render_api_error!({ error: 'Spam detected' }, 400)
|
|
|
|
end
|
|
|
|
|
2016-04-24 23:30:20 -04:00
|
|
|
def render_api_error!(message, status)
|
2017-01-19 17:41:12 -05:00
|
|
|
error!({ 'message' => message }, status, header)
|
2016-04-24 23:30:20 -04:00
|
|
|
end
|
|
|
|
|
2016-08-18 20:06:33 -04:00
|
|
|
def handle_api_exception(exception)
|
|
|
|
if sentry_enabled? && report_exception?(exception)
|
|
|
|
define_params_for_grape_middleware
|
|
|
|
sentry_context
|
|
|
|
Raven.capture_exception(exception)
|
|
|
|
end
|
|
|
|
|
|
|
|
# lifted from https://github.com/rails/rails/blob/master/actionpack/lib/action_dispatch/middleware/debug_exceptions.rb#L60
|
|
|
|
trace = exception.backtrace
|
|
|
|
|
|
|
|
message = "\n#{exception.class} (#{exception.message}):\n"
|
|
|
|
message << exception.annoted_source_code.to_s if exception.respond_to?(:annoted_source_code)
|
|
|
|
message << " " << trace.join("\n ")
|
|
|
|
|
|
|
|
API.logger.add Logger::FATAL, message
|
|
|
|
rack_response({ 'message' => '500 Internal Server Error' }.to_json, 500)
|
|
|
|
end
|
|
|
|
|
2016-11-22 11:58:10 -05:00
|
|
|
# project helpers
|
2016-04-24 23:30:20 -04:00
|
|
|
|
2017-05-26 10:31:37 -04:00
|
|
|
def reorder_projects(projects)
|
2016-11-09 09:51:27 -05:00
|
|
|
projects.reorder(params[:order_by] => params[:sort])
|
2016-04-24 23:30:20 -04:00
|
|
|
end
|
|
|
|
|
2017-05-24 16:12:40 -04:00
|
|
|
def project_finder_params
|
|
|
|
finder_params = {}
|
2017-05-26 10:31:37 -04:00
|
|
|
finder_params[:owned] = true if params[:owned].present?
|
2017-05-24 16:12:40 -04:00
|
|
|
finder_params[:non_public] = true if params[:membership].present?
|
|
|
|
finder_params[:starred] = true if params[:starred].present?
|
|
|
|
finder_params[:visibility_level] = Gitlab::VisibilityLevel.level_value(params[:visibility]) if params[:visibility]
|
|
|
|
finder_params[:archived] = params[:archived]
|
|
|
|
finder_params[:search] = params[:search] if params[:search]
|
2017-06-29 13:20:59 -04:00
|
|
|
finder_params[:user] = params.delete(:user) if params[:user]
|
2017-05-24 16:12:40 -04:00
|
|
|
finder_params
|
|
|
|
end
|
|
|
|
|
2016-04-24 23:30:20 -04:00
|
|
|
# file helpers
|
|
|
|
|
|
|
|
def uploaded_file(field, uploads_path)
|
|
|
|
if params[field]
|
|
|
|
bad_request!("#{field} is not a file") unless params[field].respond_to?(:filename)
|
|
|
|
return params[field]
|
|
|
|
end
|
|
|
|
|
|
|
|
return nil unless params["#{field}.path"] && params["#{field}.name"]
|
|
|
|
|
|
|
|
# sanitize file paths
|
|
|
|
# this requires all paths to exist
|
|
|
|
required_attributes! %W(#{field}.path)
|
|
|
|
uploads_path = File.realpath(uploads_path)
|
|
|
|
file_path = File.realpath(params["#{field}.path"])
|
|
|
|
bad_request!('Bad file path') unless file_path.start_with?(uploads_path)
|
|
|
|
|
|
|
|
UploadedFile.new(
|
|
|
|
file_path,
|
|
|
|
params["#{field}.name"],
|
2017-05-03 07:27:17 -04:00
|
|
|
params["#{field}.type"] || 'application/octet-stream'
|
2016-04-24 23:30:20 -04:00
|
|
|
)
|
|
|
|
end
|
|
|
|
|
|
|
|
def present_file!(path, filename, content_type = 'application/octet-stream')
|
|
|
|
filename ||= File.basename(path)
|
|
|
|
header['Content-Disposition'] = "attachment; filename=#{filename}"
|
|
|
|
header['Content-Transfer-Encoding'] = 'binary'
|
|
|
|
content_type content_type
|
|
|
|
|
|
|
|
# Support download acceleration
|
|
|
|
case headers['X-Sendfile-Type']
|
|
|
|
when 'X-Sendfile'
|
|
|
|
header['X-Sendfile'] = path
|
|
|
|
body
|
|
|
|
else
|
2017-02-03 06:42:11 -05:00
|
|
|
file path
|
2016-04-24 23:30:20 -04:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2017-06-01 03:52:19 -04:00
|
|
|
def present_artifacts!(artifacts_file)
|
|
|
|
return not_found! unless artifacts_file.exists?
|
2017-06-29 13:20:59 -04:00
|
|
|
|
2017-06-01 03:52:19 -04:00
|
|
|
if artifacts_file.file_storage?
|
|
|
|
present_file!(artifacts_file.path, artifacts_file.filename)
|
|
|
|
else
|
|
|
|
redirect_to(artifacts_file.url)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2016-04-24 23:30:20 -04:00
|
|
|
private
|
|
|
|
|
2016-12-09 12:48:20 -05:00
|
|
|
def private_token
|
2016-11-22 04:04:23 -05:00
|
|
|
params[APIGuard::PRIVATE_TOKEN_PARAM] || env[APIGuard::PRIVATE_TOKEN_HEADER]
|
2016-12-09 12:48:20 -05:00
|
|
|
end
|
|
|
|
|
|
|
|
def warden
|
|
|
|
env['warden']
|
|
|
|
end
|
|
|
|
|
2017-07-26 05:25:10 -04:00
|
|
|
# Check if the request is GET/HEAD, or if CSRF token is valid.
|
2017-06-15 20:04:24 -04:00
|
|
|
def verified_request?
|
2017-07-26 05:25:10 -04:00
|
|
|
Gitlab::RequestForgeryProtection.verified?(env)
|
2017-06-15 20:04:24 -04:00
|
|
|
end
|
|
|
|
|
2016-12-09 12:48:20 -05:00
|
|
|
# Check the Rails session for valid authentication details
|
|
|
|
def find_user_from_warden
|
2017-06-15 20:04:24 -04:00
|
|
|
warden.try(:authenticate) if verified_request?
|
2016-12-09 12:48:20 -05:00
|
|
|
end
|
|
|
|
|
|
|
|
def initial_current_user
|
|
|
|
return @initial_current_user if defined?(@initial_current_user)
|
2017-02-17 06:52:27 -05:00
|
|
|
Gitlab::Auth::UniqueIpsLimiter.limit_user! do
|
2017-06-20 08:00:57 -04:00
|
|
|
@initial_current_user ||= find_user_by_private_token(scopes: scopes_registered_for_endpoint)
|
|
|
|
@initial_current_user ||= doorkeeper_guard(scopes: scopes_registered_for_endpoint)
|
2017-02-17 06:52:27 -05:00
|
|
|
@initial_current_user ||= find_user_from_warden
|
2016-12-09 12:48:20 -05:00
|
|
|
|
2017-02-17 06:52:27 -05:00
|
|
|
unless @initial_current_user && Gitlab::UserAccess.new(@initial_current_user).allowed?
|
|
|
|
@initial_current_user = nil
|
|
|
|
end
|
2016-12-09 12:48:20 -05:00
|
|
|
|
2017-02-17 06:52:27 -05:00
|
|
|
@initial_current_user
|
2016-12-09 12:48:20 -05:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def sudo!
|
|
|
|
return unless sudo_identifier
|
2016-12-13 09:53:00 -05:00
|
|
|
return unless initial_current_user
|
2016-12-09 12:48:20 -05:00
|
|
|
|
2017-04-08 22:20:57 -04:00
|
|
|
unless initial_current_user.admin?
|
2016-12-09 12:48:20 -05:00
|
|
|
forbidden!('Must be admin to use sudo')
|
|
|
|
end
|
|
|
|
|
|
|
|
# Only private tokens should be used for the SUDO feature
|
|
|
|
unless private_token == initial_current_user.private_token
|
|
|
|
forbidden!('Private token must be specified in order to use sudo')
|
|
|
|
end
|
|
|
|
|
2016-12-13 09:53:00 -05:00
|
|
|
sudoed_user = find_user(sudo_identifier)
|
2016-12-09 12:48:20 -05:00
|
|
|
|
|
|
|
if sudoed_user
|
|
|
|
@current_user = sudoed_user
|
|
|
|
else
|
|
|
|
not_found!("No user id or username for: #{sudo_identifier}")
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def sudo_identifier
|
2016-12-13 09:53:00 -05:00
|
|
|
@sudo_identifier ||= params[SUDO_PARAM] || env[SUDO_HEADER]
|
2016-12-09 12:48:20 -05:00
|
|
|
end
|
|
|
|
|
2016-04-24 23:30:20 -04:00
|
|
|
def secret_token
|
2016-09-29 12:46:54 -04:00
|
|
|
Gitlab::Shell.secret_token
|
2016-04-24 23:30:20 -04:00
|
|
|
end
|
|
|
|
|
2016-06-06 07:16:30 -04:00
|
|
|
def send_git_blob(repository, blob)
|
|
|
|
env['api.format'] = :txt
|
|
|
|
content_type 'text/plain'
|
2016-06-10 06:29:15 -04:00
|
|
|
header(*Gitlab::Workhorse.send_git_blob(repository, blob))
|
2016-06-06 07:16:30 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
def send_git_archive(repository, ref:, format:)
|
2016-06-10 06:29:15 -04:00
|
|
|
header(*Gitlab::Workhorse.send_git_archive(repository, ref: ref, format: format))
|
2016-06-06 07:16:30 -04:00
|
|
|
end
|
2016-06-11 10:16:32 -04:00
|
|
|
|
2016-08-18 20:06:33 -04:00
|
|
|
# The Grape Error Middleware only has access to env but no params. We workaround this by
|
|
|
|
# defining a method that returns the right value.
|
|
|
|
def define_params_for_grape_middleware
|
|
|
|
self.define_singleton_method(:params) { Rack::Request.new(env).params.symbolize_keys }
|
|
|
|
end
|
|
|
|
|
|
|
|
# We could get a Grape or a standard Ruby exception. We should only report anything that
|
|
|
|
# is clearly an error.
|
|
|
|
def report_exception?(exception)
|
|
|
|
return true unless exception.respond_to?(:status)
|
|
|
|
|
|
|
|
exception.status == 500
|
|
|
|
end
|
2017-06-20 08:00:57 -04:00
|
|
|
|
|
|
|
# An array of scopes that were registered (using `allow_access_with_scope`)
|
|
|
|
# for the current endpoint class. It also returns scopes registered on
|
|
|
|
# `API::API`, since these are meant to apply to all API routes.
|
|
|
|
def scopes_registered_for_endpoint
|
|
|
|
@scopes_registered_for_endpoint ||=
|
|
|
|
begin
|
|
|
|
endpoint_classes = [options[:for].presence, ::API::API].compact
|
|
|
|
endpoint_classes.reduce([]) do |memo, endpoint|
|
2017-06-23 07:18:44 -04:00
|
|
|
if endpoint.respond_to?(:allowed_scopes)
|
|
|
|
memo.concat(endpoint.allowed_scopes)
|
2017-06-20 08:00:57 -04:00
|
|
|
else
|
|
|
|
memo
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
2016-04-24 23:30:20 -04:00
|
|
|
end
|
|
|
|
end
|