2018-07-25 09:30:33 +00:00
# frozen_string_literal: true
2019-03-28 13:17:42 +00:00
class PersonalAccessToken < ApplicationRecord
2016-12-27 16:26:57 +00:00
include Expirable
2016-04-25 09:00:59 +00:00
include TokenAuthenticatable
2019-12-17 09:07:48 +00:00
include Sortable
2021-02-25 12:11:01 +00:00
include EachBatch
2020-05-05 21:09:42 +00:00
extend :: Gitlab :: Utils :: Override
2019-02-20 11:39:37 +00:00
add_authentication_token_field :token , digest : true
2016-04-25 09:00:59 +00:00
2017-12-04 04:01:18 +00:00
REDIS_EXPIRY_TIME = 3 . minutes
2020-12-15 15:09:59 +00:00
# PATs are 20 characters + optional configurable settings prefix (0..20)
TOKEN_LENGTH_RANGE = ( 20 .. 40 ) . freeze
2017-12-04 04:01:18 +00:00
2017-07-03 14:01:41 +00:00
serialize :scopes , Array # rubocop:disable Cop/ActiveRecordSerialize
2016-11-22 08:53:53 +00:00
2016-04-15 07:36:44 +00:00
belongs_to :user
2017-02-23 17:47:06 +00:00
before_save :ensure_token
2020-07-13 15:09:08 +00:00
scope :active , - > { where ( " revoked = false AND (expires_at >= CURRENT_DATE OR expires_at IS NULL) " ) }
scope :expiring_and_not_notified , - > ( date ) { where ( [ " revoked = false AND expire_notification_delivered = false AND expires_at >= CURRENT_DATE AND expires_at <= ? " , date ] ) }
2020-08-06 00:09:53 +00:00
scope :expired_today_and_not_notified , - > { where ( [ " revoked = false AND expires_at = CURRENT_DATE AND after_expiry_notification_delivered = false " ] ) }
2020-07-13 15:09:08 +00:00
scope :inactive , - > { where ( " revoked = true OR expires_at < CURRENT_DATE " ) }
2017-02-27 18:56:54 +00:00
scope :with_impersonation , - > { where ( impersonation : true ) }
scope :without_impersonation , - > { where ( impersonation : false ) }
2020-06-18 12:09:25 +00:00
scope :revoked , - > { where ( revoked : true ) }
scope :not_revoked , - > { where ( revoked : [ false , nil ] ) }
2019-12-17 09:07:48 +00:00
scope :for_user , - > ( user ) { where ( user : user ) }
2020-11-16 21:09:02 +00:00
scope :for_users , - > ( users ) { where ( user : users ) }
2019-12-17 09:07:48 +00:00
scope :preload_users , - > { preload ( :user ) }
2020-05-05 21:09:42 +00:00
scope :order_expires_at_asc , - > { reorder ( expires_at : :asc ) }
scope :order_expires_at_desc , - > { reorder ( expires_at : :desc ) }
2022-02-08 15:12:33 +00:00
scope :project_access_token , - > { includes ( :user ) . where ( user : { user_type : :project_bot } ) }
2022-03-07 06:15:33 +00:00
scope :owner_is_human , - > { includes ( :user ) . where ( user : { user_type : :human } ) }
2016-04-15 15:24:20 +00:00
2017-02-06 15:39:35 +00:00
validates :scopes , presence : true
2017-05-31 13:55:12 +00:00
validate :validate_scopes
2017-01-31 10:21:29 +00:00
2017-10-03 14:57:31 +00:00
after_initialize :set_default_scopes , if : :persisted?
2016-04-15 15:24:20 +00:00
def revoke!
2017-05-31 13:55:12 +00:00
update! ( revoked : true )
2016-04-15 15:24:20 +00:00
end
2016-12-27 16:26:57 +00:00
def active?
! revoked? && ! expired?
end
2017-03-07 16:16:08 +00:00
2017-12-04 04:01:18 +00:00
def self . redis_getdel ( user_id )
Gitlab :: Redis :: SharedState . with do | redis |
2020-05-05 21:09:42 +00:00
redis_key = redis_shared_state_key ( user_id )
encrypted_token = redis . get ( redis_key )
redis . del ( redis_key )
2018-10-29 16:06:45 +00:00
begin
Gitlab :: CryptoHelper . aes256_gcm_decrypt ( encrypted_token )
2021-04-26 12:09:44 +00:00
rescue StandardError = > ex
2020-05-05 21:09:42 +00:00
logger . warn " Failed to decrypt #{ self . name } value stored in Redis for key # #{ redis_key } : #{ ex . class } "
2018-10-29 16:06:45 +00:00
encrypted_token
end
2017-12-04 04:01:18 +00:00
end
end
def self . redis_store! ( user_id , token )
2018-10-29 16:06:45 +00:00
encrypted_token = Gitlab :: CryptoHelper . aes256_gcm_encrypt ( token )
2017-12-04 04:01:18 +00:00
Gitlab :: Redis :: SharedState . with do | redis |
2018-10-29 16:06:45 +00:00
redis . set ( redis_shared_state_key ( user_id ) , encrypted_token , ex : REDIS_EXPIRY_TIME )
2017-12-04 04:01:18 +00:00
end
end
2020-05-05 21:09:42 +00:00
override :simple_sorts
def self . simple_sorts
super . merge (
{
'expires_at_asc' = > - > { order_expires_at_asc } ,
'expires_at_desc' = > - > { order_expires_at_desc }
}
)
end
2020-12-15 15:09:59 +00:00
def self . token_prefix
Gitlab :: CurrentSettings . current_application_settings . personal_access_token_prefix
end
override :format_token
def format_token ( token )
" #{ self . class . token_prefix } #{ token } "
end
2022-02-08 15:12:33 +00:00
def project_access_token?
user & . project_bot?
end
2017-01-31 10:21:29 +00:00
protected
2017-05-31 13:55:12 +00:00
def validate_scopes
2019-04-15 13:05:55 +00:00
unless revoked || scopes . all? { | scope | Gitlab :: Auth . all_available_scopes . include? ( scope . to_sym ) }
2017-05-31 13:55:12 +00:00
errors . add :scopes , " can only contain available scopes "
2017-01-31 10:21:29 +00:00
end
end
2017-10-03 14:57:31 +00:00
def set_default_scopes
2021-02-25 12:11:01 +00:00
# When only loading a select set of attributes, for example using `EachBatch`,
# the `scopes` attribute is not present, so we can't initialize it.
return unless has_attribute? ( :scopes )
2017-10-03 14:57:31 +00:00
self . scopes = Gitlab :: Auth :: DEFAULT_SCOPES if self . scopes . empty?
end
2017-12-04 04:01:18 +00:00
def self . redis_shared_state_key ( user_id )
" gitlab:personal_access_token: #{ user_id } "
end
2016-04-15 07:36:44 +00:00
end
2019-12-06 00:07:48 +00:00
2021-05-11 21:10:21 +00:00
PersonalAccessToken . prepend_mod_with ( 'PersonalAccessToken' )