2019-07-25 01:21:37 -04:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2012-09-12 02:23:16 -04:00
|
|
|
require 'spec_helper'
|
|
|
|
|
2017-07-10 10:24:02 -04:00
|
|
|
describe Gitlab::Auth do
|
2016-04-29 12:58:55 -04:00
|
|
|
let(:gl_auth) { described_class }
|
2012-09-12 02:23:16 -04:00
|
|
|
|
2017-01-31 05:21:29 -05:00
|
|
|
describe 'constants' do
|
|
|
|
it 'API_SCOPES contains all scopes for API access' do
|
2019-04-15 09:05:55 -04:00
|
|
|
expect(subject::API_SCOPES).to eq %i[api read_user]
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'ADMIN_SCOPES contains all scopes for ADMIN access' do
|
|
|
|
expect(subject::ADMIN_SCOPES).to eq %i[sudo]
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'REPOSITORY_SCOPES contains all scopes for REPOSITORY access' do
|
|
|
|
expect(subject::REPOSITORY_SCOPES).to eq %i[read_repository write_repository]
|
2017-01-31 05:21:29 -05:00
|
|
|
end
|
|
|
|
|
|
|
|
it 'OPENID_SCOPES contains all scopes for OpenID Connect' do
|
|
|
|
expect(subject::OPENID_SCOPES).to eq [:openid]
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'DEFAULT_SCOPES contains all default scopes' do
|
|
|
|
expect(subject::DEFAULT_SCOPES).to eq [:api]
|
|
|
|
end
|
|
|
|
|
2017-09-15 11:43:49 -04:00
|
|
|
it 'optional_scopes contains all non-default scopes' do
|
2017-08-04 09:17:20 -04:00
|
|
|
stub_container_registry_config(enabled: true)
|
|
|
|
|
2019-04-15 09:05:55 -04:00
|
|
|
expect(subject.optional_scopes).to eq %i[read_user read_repository write_repository read_registry sudo openid profile email]
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'available_scopes' do
|
|
|
|
it 'contains all non-default scopes' do
|
|
|
|
stub_container_registry_config(enabled: true)
|
|
|
|
|
|
|
|
expect(subject.all_available_scopes).to eq %i[api read_user read_repository write_repository read_registry sudo]
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'contains for non-admin user all non-default scopes without ADMIN access' do
|
|
|
|
stub_container_registry_config(enabled: true)
|
|
|
|
user = create(:user, admin: false)
|
|
|
|
|
|
|
|
expect(subject.available_scopes_for(user)).to eq %i[api read_user read_repository write_repository read_registry]
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'contains for admin user all non-default scopes with ADMIN access' do
|
|
|
|
stub_container_registry_config(enabled: true)
|
|
|
|
user = create(:user, admin: true)
|
|
|
|
|
|
|
|
expect(subject.available_scopes_for(user)).to eq %i[api read_user read_repository write_repository read_registry sudo]
|
2017-06-06 07:18:01 -04:00
|
|
|
end
|
|
|
|
|
2017-09-15 11:43:49 -04:00
|
|
|
context 'registry_scopes' do
|
2017-08-04 09:17:20 -04:00
|
|
|
context 'when registry is disabled' do
|
|
|
|
before do
|
|
|
|
stub_container_registry_config(enabled: false)
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'is empty' do
|
2017-09-15 11:43:49 -04:00
|
|
|
expect(subject.registry_scopes).to eq []
|
2017-08-04 09:17:20 -04:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when registry is enabled' do
|
|
|
|
before do
|
|
|
|
stub_container_registry_config(enabled: true)
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'contains all registry related scopes' do
|
2017-09-15 11:43:49 -04:00
|
|
|
expect(subject.registry_scopes).to eq %i[read_registry]
|
2017-08-04 09:17:20 -04:00
|
|
|
end
|
|
|
|
end
|
2017-01-31 05:21:29 -05:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2016-06-13 09:38:25 -04:00
|
|
|
describe 'find_for_git_client' do
|
2016-09-15 05:57:09 -04:00
|
|
|
context 'build token' do
|
|
|
|
subject { gl_auth.find_for_git_client('gitlab-ci-token', build.token, project: project, ip: 'ip') }
|
|
|
|
|
|
|
|
context 'for running build' do
|
|
|
|
let!(:build) { create(:ci_build, :running) }
|
|
|
|
let(:project) { build.project }
|
|
|
|
|
|
|
|
before do
|
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: true, login: 'gitlab-ci-token')
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'recognises user-less build' do
|
2016-09-16 03:59:10 -04:00
|
|
|
expect(subject).to eq(Gitlab::Auth::Result.new(nil, build.project, :ci, build_authentication_abilities))
|
2016-09-15 05:57:09 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
it 'recognises user token' do
|
|
|
|
build.update(user: create(:user))
|
|
|
|
|
2016-09-16 03:59:10 -04:00
|
|
|
expect(subject).to eq(Gitlab::Auth::Result.new(build.user, build.project, :build, build_authentication_abilities))
|
2016-09-15 05:57:09 -04:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2016-09-16 07:47:54 -04:00
|
|
|
(HasStatus::AVAILABLE_STATUSES - ['running']).each do |build_status|
|
2016-09-16 05:06:31 -04:00
|
|
|
context "for #{build_status} build" do
|
|
|
|
let!(:build) { create(:ci_build, status: build_status) }
|
|
|
|
let(:project) { build.project }
|
|
|
|
|
|
|
|
before do
|
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: false, login: 'gitlab-ci-token')
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'denies authentication' do
|
2016-09-16 07:47:54 -04:00
|
|
|
expect(subject).to eq(Gitlab::Auth::Result.new)
|
2016-09-16 05:06:31 -04:00
|
|
|
end
|
2016-09-15 05:57:09 -04:00
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'recognizes other ci services' do
|
2017-08-02 15:55:11 -04:00
|
|
|
project = create(:project)
|
2016-09-15 05:57:09 -04:00
|
|
|
project.create_drone_ci_service(active: true)
|
|
|
|
project.drone_ci_service.update(token: 'token')
|
2016-08-01 18:31:21 -04:00
|
|
|
|
2016-12-04 23:19:51 -05:00
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: true, login: 'drone-ci-token')
|
|
|
|
expect(gl_auth.find_for_git_client('drone-ci-token', 'token', project: project, ip: 'ip')).to eq(Gitlab::Auth::Result.new(nil, project, :ci, build_authentication_abilities))
|
2016-04-29 12:58:55 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
it 'recognizes master passwords' do
|
|
|
|
user = create(:user, password: 'password')
|
|
|
|
|
2016-12-04 23:19:51 -05:00
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: true, login: user.username)
|
|
|
|
expect(gl_auth.find_for_git_client(user.username, 'password', project: nil, ip: 'ip')).to eq(Gitlab::Auth::Result.new(user, nil, :gitlab_or_ldap, full_authentication_abilities))
|
2016-04-29 12:58:55 -04:00
|
|
|
end
|
|
|
|
|
2017-02-17 07:24:32 -05:00
|
|
|
include_examples 'user login operation with unique ip limit' do
|
|
|
|
let(:user) { create(:user, password: 'password') }
|
2017-02-17 06:52:27 -05:00
|
|
|
|
2017-02-17 07:24:32 -05:00
|
|
|
def operation
|
2017-02-17 06:52:27 -05:00
|
|
|
expect(gl_auth.find_for_git_client(user.username, 'password', project: nil, ip: 'ip')).to eq(Gitlab::Auth::Result.new(user, nil, :gitlab_or_ldap, full_authentication_abilities))
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2017-01-24 12:12:49 -05:00
|
|
|
context 'while using LFS authenticate' do
|
|
|
|
it 'recognizes user lfs tokens' do
|
|
|
|
user = create(:user)
|
|
|
|
token = Gitlab::LfsToken.new(user).token
|
2016-09-19 10:34:32 -04:00
|
|
|
|
2017-01-24 12:12:49 -05:00
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: true, login: user.username)
|
|
|
|
expect(gl_auth.find_for_git_client(user.username, token, project: nil, ip: 'ip')).to eq(Gitlab::Auth::Result.new(user, nil, :lfs_token, full_authentication_abilities))
|
|
|
|
end
|
2016-09-19 10:34:32 -04:00
|
|
|
|
2017-01-24 12:12:49 -05:00
|
|
|
it 'recognizes deploy key lfs tokens' do
|
|
|
|
key = create(:deploy_key)
|
|
|
|
token = Gitlab::LfsToken.new(key).token
|
2016-09-19 10:34:32 -04:00
|
|
|
|
2017-01-24 12:12:49 -05:00
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: true, login: "lfs+deploy-key-#{key.id}")
|
2019-04-15 09:05:55 -04:00
|
|
|
expect(gl_auth.find_for_git_client("lfs+deploy-key-#{key.id}", token, project: nil, ip: 'ip')).to eq(Gitlab::Auth::Result.new(key, nil, :lfs_deploy_token, read_only_authentication_abilities))
|
2017-01-24 12:12:49 -05:00
|
|
|
end
|
2016-09-19 10:34:32 -04:00
|
|
|
|
2017-01-24 12:12:49 -05:00
|
|
|
it 'does not try password auth before oauth' do
|
2016-11-22 04:13:37 -05:00
|
|
|
user = create(:user)
|
2017-01-24 12:12:49 -05:00
|
|
|
token = Gitlab::LfsToken.new(user).token
|
|
|
|
|
|
|
|
expect(gl_auth).not_to receive(:find_with_user_password)
|
2016-11-22 04:13:37 -05:00
|
|
|
|
2017-01-24 12:12:49 -05:00
|
|
|
gl_auth.find_for_git_client(user.username, token, project: nil, ip: 'ip')
|
|
|
|
end
|
2017-11-08 11:21:39 -05:00
|
|
|
|
|
|
|
it 'grants deploy key write permissions' do
|
|
|
|
project = create(:project)
|
2018-01-05 10:23:44 -05:00
|
|
|
key = create(:deploy_key)
|
|
|
|
create(:deploy_keys_project, :write_access, deploy_key: key, project: project)
|
2017-11-08 11:21:39 -05:00
|
|
|
token = Gitlab::LfsToken.new(key).token
|
|
|
|
|
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: true, login: "lfs+deploy-key-#{key.id}")
|
|
|
|
expect(gl_auth.find_for_git_client("lfs+deploy-key-#{key.id}", token, project: project, ip: 'ip')).to eq(Gitlab::Auth::Result.new(key, nil, :lfs_deploy_token, read_write_authentication_abilities))
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'does not grant deploy key write permissions' do
|
|
|
|
project = create(:project)
|
2018-01-05 10:23:44 -05:00
|
|
|
key = create(:deploy_key)
|
2017-11-08 11:21:39 -05:00
|
|
|
token = Gitlab::LfsToken.new(key).token
|
|
|
|
|
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: true, login: "lfs+deploy-key-#{key.id}")
|
2019-04-15 09:05:55 -04:00
|
|
|
expect(gl_auth.find_for_git_client("lfs+deploy-key-#{key.id}", token, project: project, ip: 'ip')).to eq(Gitlab::Auth::Result.new(key, nil, :lfs_deploy_token, read_only_authentication_abilities))
|
2017-11-08 11:21:39 -05:00
|
|
|
end
|
2017-01-24 12:12:49 -05:00
|
|
|
end
|
|
|
|
|
|
|
|
context 'while using OAuth tokens as passwords' do
|
|
|
|
let(:user) { create(:user) }
|
|
|
|
let(:token_w_api_scope) { Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id, scopes: 'api') }
|
|
|
|
let(:application) { Doorkeeper::Application.create!(name: 'MyApp', redirect_uri: 'https://app.com', owner: user) }
|
|
|
|
|
|
|
|
it 'succeeds for OAuth tokens with the `api` scope' do
|
2016-12-04 23:19:51 -05:00
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: true, login: 'oauth2')
|
2017-04-13 07:34:16 -04:00
|
|
|
expect(gl_auth.find_for_git_client("oauth2", token_w_api_scope.token, project: nil, ip: 'ip')).to eq(Gitlab::Auth::Result.new(user, nil, :oauth, full_authentication_abilities))
|
2016-11-22 04:13:37 -05:00
|
|
|
end
|
|
|
|
|
|
|
|
it 'fails for OAuth tokens with other scopes' do
|
2017-01-24 12:12:49 -05:00
|
|
|
token = Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id, scopes: 'read_user')
|
2016-11-22 04:13:37 -05:00
|
|
|
|
2016-12-04 23:19:51 -05:00
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: false, login: 'oauth2')
|
|
|
|
expect(gl_auth.find_for_git_client("oauth2", token.token, project: nil, ip: 'ip')).to eq(Gitlab::Auth::Result.new(nil, nil))
|
2016-11-22 04:13:37 -05:00
|
|
|
end
|
2017-01-24 12:12:49 -05:00
|
|
|
|
|
|
|
it 'does not try password auth before oauth' do
|
|
|
|
expect(gl_auth).not_to receive(:find_with_user_password)
|
|
|
|
|
|
|
|
gl_auth.find_for_git_client("oauth2", token_w_api_scope.token, project: nil, ip: 'ip')
|
|
|
|
end
|
2016-11-22 04:13:37 -05:00
|
|
|
end
|
|
|
|
|
2017-01-24 12:12:49 -05:00
|
|
|
context 'while using personal access tokens as passwords' do
|
|
|
|
it 'succeeds for personal access tokens with the `api` scope' do
|
2016-12-28 11:19:08 -05:00
|
|
|
personal_access_token = create(:personal_access_token, scopes: ['api'])
|
|
|
|
|
2019-04-15 09:05:55 -04:00
|
|
|
expect_results_with_abilities(personal_access_token, full_authentication_abilities)
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'succeeds for personal access tokens with the `read_repository` scope' do
|
|
|
|
personal_access_token = create(:personal_access_token, scopes: ['read_repository'])
|
|
|
|
|
|
|
|
expect_results_with_abilities(personal_access_token, [:download_code])
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'succeeds for personal access tokens with the `write_repository` scope' do
|
|
|
|
personal_access_token = create(:personal_access_token, scopes: ['write_repository'])
|
|
|
|
|
|
|
|
expect_results_with_abilities(personal_access_token, [:download_code, :push_code])
|
2016-11-22 04:13:37 -05:00
|
|
|
end
|
|
|
|
|
2017-08-04 09:17:20 -04:00
|
|
|
context 'when registry is enabled' do
|
|
|
|
before do
|
|
|
|
stub_container_registry_config(enabled: true)
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'succeeds for personal access tokens with the `read_registry` scope' do
|
|
|
|
personal_access_token = create(:personal_access_token, scopes: ['read_registry'])
|
2017-05-31 09:55:12 -04:00
|
|
|
|
2019-04-15 09:05:55 -04:00
|
|
|
expect_results_with_abilities(personal_access_token, [:read_container_image])
|
2017-08-04 09:17:20 -04:00
|
|
|
end
|
2017-05-31 09:55:12 -04:00
|
|
|
end
|
|
|
|
|
2016-12-28 11:19:08 -05:00
|
|
|
it 'succeeds if it is an impersonation token' do
|
2017-03-01 11:59:03 -05:00
|
|
|
impersonation_token = create(:personal_access_token, :impersonation, scopes: ['api'])
|
2016-04-29 12:58:55 -04:00
|
|
|
|
2019-04-15 09:05:55 -04:00
|
|
|
expect_results_with_abilities(impersonation_token, full_authentication_abilities)
|
2016-11-22 04:13:37 -05:00
|
|
|
end
|
|
|
|
|
2017-06-06 07:18:01 -04:00
|
|
|
it 'limits abilities based on scope' do
|
2017-11-23 06:41:29 -05:00
|
|
|
personal_access_token = create(:personal_access_token, scopes: %w[read_user sudo])
|
2016-04-29 12:58:55 -04:00
|
|
|
|
2019-04-15 09:05:55 -04:00
|
|
|
expect_results_with_abilities(personal_access_token, [])
|
2017-02-27 13:56:54 -05:00
|
|
|
end
|
2017-01-24 12:12:49 -05:00
|
|
|
|
2016-12-28 11:19:08 -05:00
|
|
|
it 'fails if password is nil' do
|
2019-04-15 09:05:55 -04:00
|
|
|
expect_results_with_abilities(nil, nil, false)
|
2017-01-24 12:12:49 -05:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'while using regular user and password' do
|
|
|
|
it 'falls through lfs authentication' do
|
|
|
|
user = create(
|
|
|
|
:user,
|
|
|
|
username: 'normal_user',
|
2017-05-03 07:27:17 -04:00
|
|
|
password: 'my-secret'
|
2017-01-24 12:12:49 -05:00
|
|
|
)
|
|
|
|
|
|
|
|
expect(gl_auth.find_for_git_client(user.username, user.password, project: nil, ip: 'ip'))
|
|
|
|
.to eq(Gitlab::Auth::Result.new(user, nil, :gitlab_or_ldap, full_authentication_abilities))
|
|
|
|
end
|
|
|
|
|
2018-03-29 18:56:35 -04:00
|
|
|
it 'fails through oauth authentication when the username is oauth2' do
|
2017-01-24 12:12:49 -05:00
|
|
|
user = create(
|
|
|
|
:user,
|
|
|
|
username: 'oauth2',
|
2017-05-03 07:27:17 -04:00
|
|
|
password: 'my-secret'
|
2017-01-24 12:12:49 -05:00
|
|
|
)
|
|
|
|
|
|
|
|
expect(gl_auth.find_for_git_client(user.username, user.password, project: nil, ip: 'ip'))
|
|
|
|
.to eq(Gitlab::Auth::Result.new(user, nil, :gitlab_or_ldap, full_authentication_abilities))
|
|
|
|
end
|
2016-04-29 12:58:55 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns double nil for invalid credentials' do
|
|
|
|
login = 'foo'
|
|
|
|
|
2016-12-04 23:19:51 -05:00
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: false, login: login)
|
|
|
|
expect(gl_auth.find_for_git_client(login, 'bar', project: nil, ip: 'ip')).to eq(Gitlab::Auth::Result.new)
|
2016-04-29 12:58:55 -04:00
|
|
|
end
|
2017-06-07 15:49:45 -04:00
|
|
|
|
|
|
|
it 'throws an error suggesting user create a PAT when internal auth is disabled' do
|
2017-11-23 08:16:14 -05:00
|
|
|
allow_any_instance_of(ApplicationSetting).to receive(:password_authentication_enabled_for_git?) { false }
|
2017-06-07 15:49:45 -04:00
|
|
|
|
2017-10-12 05:27:16 -04:00
|
|
|
expect { gl_auth.find_for_git_client('foo', 'bar', project: nil, ip: 'ip') }.to raise_error(Gitlab::Auth::MissingPersonalAccessTokenError)
|
2017-06-07 15:49:45 -04:00
|
|
|
end
|
2018-03-29 18:56:35 -04:00
|
|
|
|
|
|
|
context 'while using deploy tokens' do
|
|
|
|
let(:project) { create(:project) }
|
|
|
|
let(:auth_failure) { Gitlab::Auth::Result.new(nil, nil) }
|
|
|
|
|
2019-07-17 16:08:58 -04:00
|
|
|
context 'when deploy token and user have the same username' do
|
|
|
|
let(:username) { 'normal_user' }
|
|
|
|
let(:user) { create(:user, username: username, password: 'my-secret') }
|
|
|
|
let(:deploy_token) { create(:deploy_token, username: username, read_registry: false, projects: [project]) }
|
|
|
|
|
|
|
|
before do
|
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: true, login: username)
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'succeeds for the token' do
|
|
|
|
auth_success = Gitlab::Auth::Result.new(deploy_token, project, :deploy_token, [:download_code])
|
|
|
|
|
|
|
|
expect(gl_auth.find_for_git_client(username, deploy_token.token, project: project, ip: 'ip'))
|
|
|
|
.to eq(auth_success)
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'succeeds for the user' do
|
|
|
|
auth_success = Gitlab::Auth::Result.new(user, nil, :gitlab_or_ldap, full_authentication_abilities)
|
|
|
|
|
|
|
|
expect(gl_auth.find_for_git_client(username, 'my-secret', project: project, ip: 'ip'))
|
|
|
|
.to eq(auth_success)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when deploy tokens have the same username' do
|
|
|
|
context 'and belong to the same project' do
|
|
|
|
let!(:read_registry) { create(:deploy_token, username: 'deployer', read_repository: false, projects: [project]) }
|
|
|
|
let!(:read_repository) { create(:deploy_token, username: read_registry.username, read_registry: false, projects: [project]) }
|
|
|
|
|
|
|
|
it 'succeeds for the right token' do
|
|
|
|
auth_success = Gitlab::Auth::Result.new(read_repository, project, :deploy_token, [:download_code])
|
|
|
|
|
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: true, login: 'deployer')
|
|
|
|
expect(gl_auth.find_for_git_client('deployer', read_repository.token, project: project, ip: 'ip'))
|
|
|
|
.to eq(auth_success)
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'fails for the wrong token' do
|
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: false, login: 'deployer')
|
|
|
|
expect(gl_auth.find_for_git_client('deployer', read_registry.token, project: project, ip: 'ip'))
|
|
|
|
.to eq(auth_failure)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'and belong to different projects' do
|
|
|
|
let!(:read_registry) { create(:deploy_token, username: 'deployer', read_repository: false, projects: [create(:project)]) }
|
|
|
|
let!(:read_repository) { create(:deploy_token, username: read_registry.username, read_registry: false, projects: [project]) }
|
|
|
|
|
|
|
|
it 'succeeds for the right token' do
|
|
|
|
auth_success = Gitlab::Auth::Result.new(read_repository, project, :deploy_token, [:download_code])
|
|
|
|
|
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: true, login: 'deployer')
|
|
|
|
expect(gl_auth.find_for_git_client('deployer', read_repository.token, project: project, ip: 'ip'))
|
|
|
|
.to eq(auth_success)
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'fails for the wrong token' do
|
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: false, login: 'deployer')
|
|
|
|
expect(gl_auth.find_for_git_client('deployer', read_registry.token, project: project, ip: 'ip'))
|
|
|
|
.to eq(auth_failure)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2018-04-04 19:43:41 -04:00
|
|
|
context 'when the deploy token has read_repository as scope' do
|
2018-04-05 13:22:34 -04:00
|
|
|
let(:deploy_token) { create(:deploy_token, read_registry: false, projects: [project]) }
|
2018-04-05 23:02:13 -04:00
|
|
|
let(:login) { deploy_token.username }
|
2018-03-29 18:56:35 -04:00
|
|
|
|
2018-04-05 23:02:13 -04:00
|
|
|
it 'succeeds when login and token are valid' do
|
|
|
|
auth_success = Gitlab::Auth::Result.new(deploy_token, project, :deploy_token, [:download_code])
|
2018-03-29 18:56:35 -04:00
|
|
|
|
2018-04-05 23:02:13 -04:00
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: true, login: login)
|
|
|
|
expect(gl_auth.find_for_git_client(login, deploy_token.token, project: project, ip: 'ip'))
|
2018-04-03 17:34:56 -04:00
|
|
|
.to eq(auth_success)
|
|
|
|
end
|
2018-03-29 18:56:35 -04:00
|
|
|
|
2019-07-02 14:56:48 -04:00
|
|
|
it 'succeeds when custom login and token are valid' do
|
|
|
|
deploy_token = create(:deploy_token, username: 'deployer', read_registry: false, projects: [project])
|
|
|
|
auth_success = Gitlab::Auth::Result.new(deploy_token, project, :deploy_token, [:download_code])
|
|
|
|
|
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: true, login: 'deployer')
|
|
|
|
expect(gl_auth.find_for_git_client('deployer', deploy_token.token, project: project, ip: 'ip'))
|
|
|
|
.to eq(auth_success)
|
|
|
|
end
|
|
|
|
|
2018-04-05 23:02:13 -04:00
|
|
|
it 'fails when login is not valid' do
|
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: false, login: 'random_login')
|
|
|
|
expect(gl_auth.find_for_git_client('random_login', deploy_token.token, project: project, ip: 'ip'))
|
|
|
|
.to eq(auth_failure)
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'fails when token is not valid' do
|
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: false, login: login)
|
|
|
|
expect(gl_auth.find_for_git_client(login, '123123', project: project, ip: 'ip'))
|
|
|
|
.to eq(auth_failure)
|
|
|
|
end
|
|
|
|
|
2018-04-03 17:34:56 -04:00
|
|
|
it 'fails if token is nil' do
|
2018-04-05 23:02:13 -04:00
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: false, login: login)
|
|
|
|
expect(gl_auth.find_for_git_client(login, nil, project: project, ip: 'ip'))
|
2018-04-03 17:34:56 -04:00
|
|
|
.to eq(auth_failure)
|
|
|
|
end
|
2018-03-29 18:56:35 -04:00
|
|
|
|
2018-04-03 17:34:56 -04:00
|
|
|
it 'fails if token is not related to project' do
|
2018-04-05 23:02:13 -04:00
|
|
|
another_deploy_token = create(:deploy_token)
|
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: false, login: login)
|
|
|
|
expect(gl_auth.find_for_git_client(login, another_deploy_token.token, project: project, ip: 'ip'))
|
2018-04-03 17:34:56 -04:00
|
|
|
.to eq(auth_failure)
|
|
|
|
end
|
2018-03-31 18:45:02 -04:00
|
|
|
|
2018-04-03 17:34:56 -04:00
|
|
|
it 'fails if token has been revoked' do
|
|
|
|
deploy_token.revoke!
|
2018-03-31 18:45:02 -04:00
|
|
|
|
2018-04-03 17:34:56 -04:00
|
|
|
expect(deploy_token.revoked?).to be_truthy
|
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: false, login: 'deploy-token')
|
|
|
|
expect(gl_auth.find_for_git_client('deploy-token', deploy_token.token, project: project, ip: 'ip'))
|
|
|
|
.to eq(auth_failure)
|
2018-03-31 18:45:02 -04:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2018-04-03 17:34:56 -04:00
|
|
|
context 'when the deploy token has read_registry as a scope' do
|
2018-04-05 13:22:34 -04:00
|
|
|
let(:deploy_token) { create(:deploy_token, read_repository: false, projects: [project]) }
|
2018-04-05 23:02:13 -04:00
|
|
|
let(:login) { deploy_token.username }
|
2018-04-03 17:34:56 -04:00
|
|
|
|
|
|
|
context 'when registry enabled' do
|
|
|
|
before do
|
|
|
|
stub_container_registry_config(enabled: true)
|
|
|
|
end
|
|
|
|
|
2018-04-05 23:02:13 -04:00
|
|
|
it 'succeeds when login and token are valid' do
|
2018-04-07 04:35:00 -04:00
|
|
|
auth_success = Gitlab::Auth::Result.new(deploy_token, project, :deploy_token, [:read_container_image])
|
2018-04-03 17:34:56 -04:00
|
|
|
|
2018-04-05 23:02:13 -04:00
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: true, login: login)
|
|
|
|
expect(gl_auth.find_for_git_client(login, deploy_token.token, project: nil, ip: 'ip'))
|
2018-04-03 17:34:56 -04:00
|
|
|
.to eq(auth_success)
|
|
|
|
end
|
|
|
|
|
2018-04-05 23:02:13 -04:00
|
|
|
it 'fails when login is not valid' do
|
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: false, login: 'random_login')
|
|
|
|
expect(gl_auth.find_for_git_client('random_login', deploy_token.token, project: project, ip: 'ip'))
|
|
|
|
.to eq(auth_failure)
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'fails when token is not valid' do
|
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: false, login: login)
|
|
|
|
expect(gl_auth.find_for_git_client(login, '123123', project: project, ip: 'ip'))
|
|
|
|
.to eq(auth_failure)
|
|
|
|
end
|
|
|
|
|
2018-04-03 17:34:56 -04:00
|
|
|
it 'fails if token is nil' do
|
2018-04-05 23:02:13 -04:00
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: false, login: login)
|
|
|
|
expect(gl_auth.find_for_git_client(login, nil, project: nil, ip: 'ip'))
|
2018-04-03 17:34:56 -04:00
|
|
|
.to eq(auth_failure)
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'fails if token is not related to project' do
|
2018-04-05 23:02:13 -04:00
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: false, login: login)
|
|
|
|
expect(gl_auth.find_for_git_client(login, 'abcdef', project: nil, ip: 'ip'))
|
2018-04-03 17:34:56 -04:00
|
|
|
.to eq(auth_failure)
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'fails if token has been revoked' do
|
|
|
|
deploy_token.revoke!
|
|
|
|
|
|
|
|
expect(deploy_token.revoked?).to be_truthy
|
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: false, login: 'deploy-token')
|
|
|
|
expect(gl_auth.find_for_git_client('deploy-token', deploy_token.token, project: nil, ip: 'ip'))
|
|
|
|
.to eq(auth_failure)
|
|
|
|
end
|
2018-03-31 18:45:02 -04:00
|
|
|
end
|
|
|
|
|
2018-04-03 17:34:56 -04:00
|
|
|
context 'when registry disabled' do
|
|
|
|
before do
|
|
|
|
stub_container_registry_config(enabled: false)
|
|
|
|
end
|
2018-03-31 18:45:02 -04:00
|
|
|
|
2018-04-05 23:02:13 -04:00
|
|
|
it 'fails when login and token are valid' do
|
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: false, login: login)
|
|
|
|
expect(gl_auth.find_for_git_client(login, deploy_token.token, project: nil, ip: 'ip'))
|
2018-04-03 17:34:56 -04:00
|
|
|
.to eq(auth_failure)
|
|
|
|
end
|
2018-03-31 18:45:02 -04:00
|
|
|
end
|
|
|
|
end
|
2018-03-29 18:56:35 -04:00
|
|
|
end
|
2016-04-29 12:58:55 -04:00
|
|
|
end
|
|
|
|
|
2016-06-10 08:51:16 -04:00
|
|
|
describe 'find_with_user_password' do
|
2014-09-08 07:11:39 -04:00
|
|
|
let!(:user) do
|
|
|
|
create(:user,
|
|
|
|
username: username,
|
|
|
|
password: password,
|
|
|
|
password_confirmation: password)
|
2012-09-12 02:23:16 -04:00
|
|
|
end
|
2019-01-16 07:09:29 -05:00
|
|
|
let(:username) { 'John' } # username isn't lowercase, test this
|
2014-09-08 07:11:39 -04:00
|
|
|
let(:password) { 'my-secret' }
|
2012-09-12 02:23:16 -04:00
|
|
|
|
2016-08-01 11:00:44 -04:00
|
|
|
it "finds user by valid login/password" do
|
2016-06-10 08:51:16 -04:00
|
|
|
expect( gl_auth.find_with_user_password(username, password) ).to eql user
|
2012-09-12 02:23:16 -04:00
|
|
|
end
|
|
|
|
|
2016-08-01 11:00:44 -04:00
|
|
|
it 'finds user by valid email/password with case-insensitive email' do
|
2016-06-10 08:51:16 -04:00
|
|
|
expect(gl_auth.find_with_user_password(user.email.upcase, password)).to eql user
|
2014-10-22 11:29:26 -04:00
|
|
|
end
|
|
|
|
|
2016-08-01 11:00:44 -04:00
|
|
|
it 'finds user by valid username/password with case-insensitive username' do
|
2016-06-10 08:51:16 -04:00
|
|
|
expect(gl_auth.find_with_user_password(username.upcase, password)).to eql user
|
2014-10-22 11:29:26 -04:00
|
|
|
end
|
|
|
|
|
2016-08-01 11:00:44 -04:00
|
|
|
it "does not find user with invalid password" do
|
2014-09-08 07:11:39 -04:00
|
|
|
password = 'wrong'
|
2016-06-10 08:51:16 -04:00
|
|
|
expect( gl_auth.find_with_user_password(username, password) ).not_to eql user
|
2012-09-12 02:23:16 -04:00
|
|
|
end
|
|
|
|
|
2016-08-01 11:00:44 -04:00
|
|
|
it "does not find user with invalid login" do
|
2014-09-08 07:11:39 -04:00
|
|
|
user = 'wrong'
|
2016-06-10 08:51:16 -04:00
|
|
|
expect( gl_auth.find_with_user_password(username, password) ).not_to eql user
|
2013-03-11 02:44:45 -04:00
|
|
|
end
|
2014-09-08 07:26:25 -04:00
|
|
|
|
2017-02-17 07:24:32 -05:00
|
|
|
include_examples 'user login operation with unique ip limit' do
|
|
|
|
def operation
|
2017-02-20 09:09:05 -05:00
|
|
|
expect(gl_auth.find_with_user_password(username, password)).to eq(user)
|
2017-02-17 07:24:32 -05:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2017-01-18 05:23:25 -05:00
|
|
|
it "does not find user in blocked state" do
|
|
|
|
user.block
|
|
|
|
|
|
|
|
expect( gl_auth.find_with_user_password(username, password) ).not_to eql user
|
|
|
|
end
|
|
|
|
|
|
|
|
it "does not find user in ldap_blocked state" do
|
|
|
|
user.ldap_block
|
|
|
|
|
|
|
|
expect( gl_auth.find_with_user_password(username, password) ).not_to eql user
|
|
|
|
end
|
|
|
|
|
2014-09-08 07:26:25 -04:00
|
|
|
context "with ldap enabled" do
|
2015-05-21 17:49:06 -04:00
|
|
|
before do
|
2018-02-23 07:10:39 -05:00
|
|
|
allow(Gitlab::Auth::LDAP::Config).to receive(:enabled?).and_return(true)
|
2015-05-21 17:49:06 -04:00
|
|
|
end
|
2014-09-08 07:26:25 -04:00
|
|
|
|
|
|
|
it "tries to autheticate with db before ldap" do
|
2018-02-23 07:10:39 -05:00
|
|
|
expect(Gitlab::Auth::LDAP::Authentication).not_to receive(:login)
|
2014-09-08 07:26:25 -04:00
|
|
|
|
2018-03-26 05:23:54 -04:00
|
|
|
expect(gl_auth.find_with_user_password(username, password)).to eq(user)
|
|
|
|
end
|
|
|
|
|
|
|
|
it "does not find user by using ldap as fallback to for authentication" do
|
|
|
|
expect(Gitlab::Auth::LDAP::Authentication).to receive(:login).and_return(nil)
|
|
|
|
|
|
|
|
expect(gl_auth.find_with_user_password('ldap_user', 'password')).to be_nil
|
2014-09-08 07:26:25 -04:00
|
|
|
end
|
|
|
|
|
2018-03-26 05:23:54 -04:00
|
|
|
it "find new user by using ldap as fallback to for authentication" do
|
|
|
|
expect(Gitlab::Auth::LDAP::Authentication).to receive(:login).and_return(user)
|
2014-09-08 07:26:25 -04:00
|
|
|
|
2018-03-26 05:23:54 -04:00
|
|
|
expect(gl_auth.find_with_user_password('ldap_user', 'password')).to eq(user)
|
2014-09-08 07:26:25 -04:00
|
|
|
end
|
|
|
|
end
|
2017-11-23 08:16:14 -05:00
|
|
|
|
|
|
|
context "with password authentication disabled for Git" do
|
|
|
|
before do
|
|
|
|
stub_application_setting(password_authentication_enabled_for_git: false)
|
|
|
|
end
|
|
|
|
|
|
|
|
it "does not find user by valid login/password" do
|
|
|
|
expect(gl_auth.find_with_user_password(username, password)).to be_nil
|
|
|
|
end
|
|
|
|
|
|
|
|
context "with ldap enabled" do
|
|
|
|
before do
|
2018-02-23 07:10:39 -05:00
|
|
|
allow(Gitlab::Auth::LDAP::Config).to receive(:enabled?).and_return(true)
|
2017-11-23 08:16:14 -05:00
|
|
|
end
|
|
|
|
|
|
|
|
it "does not find non-ldap user by valid login/password" do
|
|
|
|
expect(gl_auth.find_with_user_password(username, password)).to be_nil
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
2012-09-12 02:23:16 -04:00
|
|
|
end
|
2016-09-15 05:57:09 -04:00
|
|
|
|
|
|
|
private
|
|
|
|
|
2016-09-16 03:59:10 -04:00
|
|
|
def build_authentication_abilities
|
2016-09-15 05:57:09 -04:00
|
|
|
[
|
|
|
|
:read_project,
|
|
|
|
:build_download_code,
|
2018-04-05 09:49:18 -04:00
|
|
|
:build_read_container_image,
|
2016-09-15 05:57:09 -04:00
|
|
|
:build_create_container_image
|
|
|
|
]
|
|
|
|
end
|
|
|
|
|
2019-04-15 09:05:55 -04:00
|
|
|
def read_only_authentication_abilities
|
2016-09-15 05:57:09 -04:00
|
|
|
[
|
|
|
|
:read_project,
|
|
|
|
:download_code,
|
|
|
|
:read_container_image
|
|
|
|
]
|
|
|
|
end
|
|
|
|
|
2017-11-08 11:21:39 -05:00
|
|
|
def read_write_authentication_abilities
|
2019-04-15 09:05:55 -04:00
|
|
|
read_only_authentication_abilities + [
|
2016-09-15 05:57:09 -04:00
|
|
|
:push_code,
|
2017-11-08 11:21:39 -05:00
|
|
|
:create_container_image
|
|
|
|
]
|
|
|
|
end
|
|
|
|
|
|
|
|
def full_authentication_abilities
|
|
|
|
read_write_authentication_abilities + [
|
2017-08-02 05:27:21 -04:00
|
|
|
:admin_container_image
|
2016-09-15 05:57:09 -04:00
|
|
|
]
|
|
|
|
end
|
2019-04-15 09:05:55 -04:00
|
|
|
|
|
|
|
def expect_results_with_abilities(personal_access_token, abilities, success = true)
|
|
|
|
expect(gl_auth).to receive(:rate_limit!).with('ip', success: success, login: '')
|
|
|
|
expect(gl_auth.find_for_git_client('', personal_access_token&.token, project: nil, ip: 'ip'))
|
|
|
|
.to eq(Gitlab::Auth::Result.new(personal_access_token&.user, nil, personal_access_token.nil? ? nil : :personal_access_token, abilities))
|
|
|
|
end
|
2012-09-12 02:23:16 -04:00
|
|
|
end
|