2018-09-29 22:34:47 +00:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2016-04-25 03:30:20 +00:00
|
|
|
module API
|
|
|
|
module Helpers
|
2016-10-28 20:56:13 +00:00
|
|
|
include Gitlab::Utils
|
2016-12-07 12:15:01 +00:00
|
|
|
include Helpers::Pagination
|
2020-01-10 15:07:47 +00:00
|
|
|
include Helpers::PaginationStrategies
|
2016-10-28 20:56:13 +00:00
|
|
|
|
2019-09-10 08:11:43 +00:00
|
|
|
SUDO_HEADER = "HTTP_SUDO"
|
|
|
|
GITLAB_SHARED_SECRET_HEADER = "Gitlab-Shared-Secret"
|
2016-04-25 03:30:20 +00:00
|
|
|
SUDO_PARAM = :sudo
|
2019-09-10 08:11:43 +00:00
|
|
|
API_USER_ENV = 'gitlab.api.user'
|
2019-11-11 15:06:42 +00:00
|
|
|
API_EXCEPTION_ENV = 'gitlab.api.exception'
|
2020-04-23 12:09:46 +00:00
|
|
|
API_RESPONSE_STATUS_CODE = 'gitlab.api.response_status_code'
|
2016-04-25 03:30:20 +00:00
|
|
|
|
2016-11-10 15:32:59 +00:00
|
|
|
def declared_params(options = {})
|
|
|
|
options = { include_parent_namespaces: false }.merge(options)
|
|
|
|
declared(params, options).to_h.symbolize_keys
|
|
|
|
end
|
|
|
|
|
2017-03-02 12:14:13 +00:00
|
|
|
def check_unmodified_since!(last_modified)
|
|
|
|
if_unmodified_since = Time.parse(headers['If-Unmodified-Since']) rescue nil
|
2017-03-01 13:35:48 +00:00
|
|
|
|
2017-08-24 08:41:54 +00:00
|
|
|
if if_unmodified_since && last_modified && last_modified > if_unmodified_since
|
2017-03-01 13:35:48 +00:00
|
|
|
render_api_error!('412 Precondition Failed', 412)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2017-08-30 12:33:39 +00:00
|
|
|
def destroy_conditionally!(resource, last_updated: nil)
|
|
|
|
last_updated ||= resource.updated_at
|
|
|
|
|
|
|
|
check_unmodified_since!(last_updated)
|
2017-03-02 12:14:13 +00:00
|
|
|
|
|
|
|
status 204
|
2020-01-16 18:08:46 +00:00
|
|
|
body false
|
2018-01-11 16:34:01 +00:00
|
|
|
|
2017-03-02 12:14:13 +00:00
|
|
|
if block_given?
|
|
|
|
yield resource
|
|
|
|
else
|
|
|
|
resource.destroy
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2020-07-13 09:09:29 +00:00
|
|
|
def job_token_authentication?
|
|
|
|
initial_current_user && @current_authenticated_job.present? # rubocop:disable Gitlab/ModuleWithInstanceVariables
|
|
|
|
end
|
|
|
|
|
|
|
|
# Returns the job associated with the token provided for
|
|
|
|
# authentication, if any
|
|
|
|
def current_authenticated_job
|
|
|
|
@current_authenticated_job
|
|
|
|
end
|
|
|
|
|
2017-11-22 07:50:36 +00:00
|
|
|
# rubocop:disable Gitlab/ModuleWithInstanceVariables
|
2017-11-17 12:27:16 +00:00
|
|
|
# We can't rewrite this with StrongMemoize because `sudo!` would
|
|
|
|
# actually write to `@current_user`, and `sudo?` would immediately
|
|
|
|
# call `current_user` again which reads from `@current_user`.
|
|
|
|
# We should rewrite this in a way that using StrongMemoize is possible
|
2016-04-25 03:30:20 +00:00
|
|
|
def current_user
|
2016-12-09 17:48:20 +00:00
|
|
|
return @current_user if defined?(@current_user)
|
2016-04-25 03:30:20 +00:00
|
|
|
|
2016-12-09 17:48:20 +00:00
|
|
|
@current_user = initial_current_user
|
2016-04-25 03:30:20 +00:00
|
|
|
|
2017-08-02 16:20:31 +00:00
|
|
|
Gitlab::I18n.locale = @current_user&.preferred_language
|
|
|
|
|
2016-12-09 17:48:20 +00:00
|
|
|
sudo!
|
2016-04-25 03:30:20 +00:00
|
|
|
|
2017-10-12 12:38:39 +00:00
|
|
|
validate_access_token!(scopes: scopes_registered_for_endpoint) unless sudo?
|
|
|
|
|
2018-01-06 08:41:13 +00:00
|
|
|
save_current_user_in_env(@current_user) if @current_user
|
|
|
|
|
2016-04-25 03:30:20 +00:00
|
|
|
@current_user
|
|
|
|
end
|
2017-11-22 07:50:36 +00:00
|
|
|
# rubocop:enable Gitlab/ModuleWithInstanceVariables
|
2016-04-25 03:30:20 +00:00
|
|
|
|
2018-01-06 08:41:13 +00:00
|
|
|
def save_current_user_in_env(user)
|
|
|
|
env[API_USER_ENV] = { user_id: user.id, username: user.username }
|
|
|
|
end
|
|
|
|
|
2016-12-09 17:48:20 +00:00
|
|
|
def sudo?
|
|
|
|
initial_current_user != current_user
|
2016-04-25 03:30:20 +00:00
|
|
|
end
|
|
|
|
|
2017-07-12 19:58:48 +00:00
|
|
|
def user_group
|
|
|
|
@group ||= find_group!(params[:id])
|
|
|
|
end
|
|
|
|
|
2016-04-25 03:30:20 +00:00
|
|
|
def user_project
|
2016-11-24 13:40:35 +00:00
|
|
|
@project ||= find_project!(params[:id])
|
2016-04-25 03:30:20 +00:00
|
|
|
end
|
|
|
|
|
2019-01-06 17:56:02 +00:00
|
|
|
def available_labels_for(label_parent, include_ancestor_groups: true)
|
2019-01-03 14:07:13 +00:00
|
|
|
search_params = { include_ancestor_groups: include_ancestor_groups }
|
2018-04-04 15:40:29 +00:00
|
|
|
|
|
|
|
if label_parent.is_a?(Project)
|
|
|
|
search_params[:project_id] = label_parent.id
|
|
|
|
else
|
|
|
|
search_params.merge!(group_id: label_parent.id, only_group_labels: true)
|
|
|
|
end
|
2017-12-06 19:07:47 +00:00
|
|
|
|
|
|
|
LabelsFinder.new(current_user, search_params).execute
|
2016-10-13 21:34:44 +00:00
|
|
|
end
|
|
|
|
|
2016-12-13 14:53:00 +00:00
|
|
|
def find_user(id)
|
2018-10-18 09:06:44 +00:00
|
|
|
UserFinder.new(id).find_by_id_or_username
|
2016-12-13 14:53:00 +00:00
|
|
|
end
|
|
|
|
|
2018-08-27 15:31:01 +00:00
|
|
|
# rubocop: disable CodeReuse/ActiveRecord
|
2016-04-25 03:30:20 +00:00
|
|
|
def find_project(id)
|
2018-09-12 20:52:30 +00:00
|
|
|
projects = Project.without_deleted
|
|
|
|
|
2018-04-11 15:45:22 +00:00
|
|
|
if id.is_a?(Integer) || id =~ /^\d+$/
|
2018-09-12 20:52:30 +00:00
|
|
|
projects.find_by(id: id)
|
2018-04-11 15:45:22 +00:00
|
|
|
elsif id.include?("/")
|
2018-09-12 20:52:30 +00:00
|
|
|
projects.find_by_full_path(id)
|
2016-11-24 13:40:35 +00:00
|
|
|
end
|
|
|
|
end
|
2018-08-27 15:31:01 +00:00
|
|
|
# rubocop: enable CodeReuse/ActiveRecord
|
2016-11-24 13:40:35 +00:00
|
|
|
|
|
|
|
def find_project!(id)
|
|
|
|
project = find_project(id)
|
2016-04-25 03:30:20 +00:00
|
|
|
|
2016-06-23 15:14:31 +00:00
|
|
|
if can?(current_user, :read_project, project)
|
2016-04-25 03:30:20 +00:00
|
|
|
project
|
|
|
|
else
|
2016-06-23 15:14:31 +00:00
|
|
|
not_found!('Project')
|
2016-04-25 03:30:20 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2018-08-27 15:31:01 +00:00
|
|
|
# rubocop: disable CodeReuse/ActiveRecord
|
2016-04-25 03:30:20 +00:00
|
|
|
def find_group(id)
|
2017-09-07 18:35:45 +00:00
|
|
|
if id.to_s =~ /^\d+$/
|
2016-11-24 15:58:32 +00:00
|
|
|
Group.find_by(id: id)
|
|
|
|
else
|
2016-10-31 11:00:53 +00:00
|
|
|
Group.find_by_full_path(id)
|
2016-11-24 15:58:32 +00:00
|
|
|
end
|
|
|
|
end
|
2018-08-27 15:31:01 +00:00
|
|
|
# rubocop: enable CodeReuse/ActiveRecord
|
2016-11-24 15:58:32 +00:00
|
|
|
|
|
|
|
def find_group!(id)
|
|
|
|
group = find_group(id)
|
2016-04-25 03:30:20 +00:00
|
|
|
|
|
|
|
if can?(current_user, :read_group, group)
|
|
|
|
group
|
|
|
|
else
|
|
|
|
not_found!('Group')
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2020-03-09 12:07:45 +00:00
|
|
|
def check_namespace_access(namespace)
|
|
|
|
return namespace if can?(current_user, :read_namespace, namespace)
|
|
|
|
|
|
|
|
not_found!('Namespace')
|
|
|
|
end
|
|
|
|
|
2018-08-27 15:31:01 +00:00
|
|
|
# rubocop: disable CodeReuse/ActiveRecord
|
2017-11-23 13:32:16 +00:00
|
|
|
def find_namespace(id)
|
|
|
|
if id.to_s =~ /^\d+$/
|
|
|
|
Namespace.find_by(id: id)
|
|
|
|
else
|
|
|
|
Namespace.find_by_full_path(id)
|
|
|
|
end
|
|
|
|
end
|
2018-08-27 15:31:01 +00:00
|
|
|
# rubocop: enable CodeReuse/ActiveRecord
|
2017-11-23 13:32:16 +00:00
|
|
|
|
|
|
|
def find_namespace!(id)
|
2020-03-09 12:07:45 +00:00
|
|
|
check_namespace_access(find_namespace(id))
|
|
|
|
end
|
2017-11-23 13:32:16 +00:00
|
|
|
|
2020-03-09 12:07:45 +00:00
|
|
|
def find_namespace_by_path(path)
|
|
|
|
Namespace.find_by_full_path(path)
|
|
|
|
end
|
|
|
|
|
|
|
|
def find_namespace_by_path!(path)
|
|
|
|
check_namespace_access(find_namespace_by_path(path))
|
2017-11-23 13:32:16 +00:00
|
|
|
end
|
|
|
|
|
2018-09-08 08:55:17 +00:00
|
|
|
def find_branch!(branch_name)
|
2018-12-21 23:41:37 +00:00
|
|
|
if Gitlab::GitRefValidator.validate(branch_name)
|
|
|
|
user_project.repository.find_branch(branch_name) || not_found!('Branch')
|
|
|
|
else
|
|
|
|
render_api_error!('The branch refname is invalid', 400)
|
|
|
|
end
|
2018-09-08 08:55:17 +00:00
|
|
|
end
|
|
|
|
|
2020-05-11 09:09:45 +00:00
|
|
|
def find_tag!(tag_name)
|
|
|
|
if Gitlab::GitRefValidator.validate(tag_name)
|
|
|
|
user_project.repository.find_tag(tag_name) || not_found!('Tag')
|
|
|
|
else
|
|
|
|
render_api_error!('The tag refname is invalid', 400)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2018-08-27 15:31:01 +00:00
|
|
|
# rubocop: disable CodeReuse/ActiveRecord
|
2020-04-02 12:08:18 +00:00
|
|
|
def find_project_issue(iid, project_id = nil)
|
|
|
|
project = project_id ? find_project!(project_id) : user_project
|
|
|
|
|
|
|
|
::IssuesFinder.new(current_user, project_id: project.id).find_by!(iid: iid)
|
2016-05-12 20:48:09 +00:00
|
|
|
end
|
2018-08-27 15:31:01 +00:00
|
|
|
# rubocop: enable CodeReuse/ActiveRecord
|
2016-05-12 20:48:09 +00:00
|
|
|
|
2018-08-27 15:31:01 +00:00
|
|
|
# rubocop: disable CodeReuse/ActiveRecord
|
2017-02-25 12:25:32 +00:00
|
|
|
def find_project_merge_request(iid)
|
|
|
|
MergeRequestsFinder.new(current_user, project_id: user_project.id).find_by!(iid: iid)
|
2016-04-25 03:30:20 +00:00
|
|
|
end
|
2018-08-27 15:31:01 +00:00
|
|
|
# rubocop: enable CodeReuse/ActiveRecord
|
2016-04-25 03:30:20 +00:00
|
|
|
|
2018-05-01 12:39:44 +00:00
|
|
|
def find_project_commit(id)
|
|
|
|
user_project.commit_by(oid: id)
|
|
|
|
end
|
|
|
|
|
2018-08-27 15:31:01 +00:00
|
|
|
# rubocop: disable CodeReuse/ActiveRecord
|
2017-02-25 12:25:32 +00:00
|
|
|
def find_merge_request_with_access(iid, access_level = :read_merge_request)
|
|
|
|
merge_request = user_project.merge_requests.find_by!(iid: iid)
|
2017-01-03 18:03:13 +00:00
|
|
|
authorize! access_level, merge_request
|
|
|
|
merge_request
|
|
|
|
end
|
2018-08-27 15:31:01 +00:00
|
|
|
# rubocop: enable CodeReuse/ActiveRecord
|
2017-01-03 18:03:13 +00:00
|
|
|
|
2017-09-06 09:20:12 +00:00
|
|
|
def find_build!(id)
|
|
|
|
user_project.builds.find(id.to_i)
|
|
|
|
end
|
|
|
|
|
2016-04-25 03:30:20 +00:00
|
|
|
def authenticate!
|
2017-09-27 13:31:52 +00:00
|
|
|
unauthorized! unless current_user
|
2016-04-25 03:30:20 +00:00
|
|
|
end
|
|
|
|
|
2016-11-30 14:48:19 +00:00
|
|
|
def authenticate_non_get!
|
2016-12-23 16:03:25 +00:00
|
|
|
authenticate! unless %w[GET HEAD].include?(route.request_method)
|
2016-11-30 14:48:19 +00:00
|
|
|
end
|
|
|
|
|
2016-04-25 03:30:20 +00:00
|
|
|
def authenticate_by_gitlab_shell_token!
|
2019-03-08 13:57:01 +00:00
|
|
|
input = params['secret_token']
|
|
|
|
input ||= Base64.decode64(headers[GITLAB_SHARED_SECRET_HEADER]) if headers.key?(GITLAB_SHARED_SECRET_HEADER)
|
|
|
|
|
|
|
|
input&.chomp!
|
|
|
|
|
|
|
|
unauthorized! unless Devise.secure_compare(secret_token, input)
|
2016-04-25 03:30:20 +00:00
|
|
|
end
|
|
|
|
|
2019-12-17 09:07:48 +00:00
|
|
|
def authenticated_with_can_read_all_resources!
|
2017-11-13 16:05:44 +00:00
|
|
|
authenticate!
|
2019-12-17 09:07:48 +00:00
|
|
|
forbidden! unless current_user.can_read_all_resources?
|
2017-11-13 16:05:44 +00:00
|
|
|
end
|
|
|
|
|
2016-04-25 03:30:20 +00:00
|
|
|
def authenticated_as_admin!
|
2016-11-30 14:48:19 +00:00
|
|
|
authenticate!
|
2017-04-09 02:20:57 +00:00
|
|
|
forbidden! unless current_user.admin?
|
2016-04-25 03:30:20 +00:00
|
|
|
end
|
|
|
|
|
2019-01-08 23:35:54 +00:00
|
|
|
def authorize!(action, subject = :global, reason = nil)
|
|
|
|
forbidden!(reason) unless can?(current_user, action, subject)
|
2016-04-25 03:30:20 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def authorize_push_project
|
|
|
|
authorize! :push_code, user_project
|
|
|
|
end
|
|
|
|
|
2019-06-19 07:08:56 +00:00
|
|
|
def authorize_admin_tag
|
|
|
|
authorize! :admin_tag, user_project
|
|
|
|
end
|
|
|
|
|
2016-04-25 03:30:20 +00:00
|
|
|
def authorize_admin_project
|
|
|
|
authorize! :admin_project, user_project
|
|
|
|
end
|
|
|
|
|
2020-03-30 18:08:07 +00:00
|
|
|
def authorize_admin_group
|
|
|
|
authorize! :admin_group, user_group
|
|
|
|
end
|
|
|
|
|
2017-09-06 09:20:12 +00:00
|
|
|
def authorize_read_builds!
|
|
|
|
authorize! :read_build, user_project
|
|
|
|
end
|
|
|
|
|
2019-03-06 11:06:21 +00:00
|
|
|
def authorize_destroy_artifacts!
|
|
|
|
authorize! :destroy_artifacts, user_project
|
|
|
|
end
|
|
|
|
|
2017-09-06 09:20:12 +00:00
|
|
|
def authorize_update_builds!
|
|
|
|
authorize! :update_build, user_project
|
|
|
|
end
|
|
|
|
|
2019-06-24 22:12:42 +00:00
|
|
|
def require_repository_enabled!(subject = :global)
|
|
|
|
not_found!("Repository") unless user_project.feature_available?(:repository, current_user)
|
|
|
|
end
|
|
|
|
|
2016-04-25 03:30:20 +00:00
|
|
|
def require_gitlab_workhorse!
|
2020-01-30 21:08:47 +00:00
|
|
|
verify_workhorse_api!
|
|
|
|
|
2016-04-25 03:30:20 +00:00
|
|
|
unless env['HTTP_GITLAB_WORKHORSE'].present?
|
|
|
|
forbidden!('Request should be executed via GitLab Workhorse')
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2020-01-30 21:08:47 +00:00
|
|
|
def verify_workhorse_api!
|
|
|
|
Gitlab::Workhorse.verify_api_request!(request.headers)
|
|
|
|
rescue => e
|
|
|
|
Gitlab::ErrorTracking.track_exception(e)
|
|
|
|
|
|
|
|
forbidden!
|
|
|
|
end
|
|
|
|
|
2017-08-21 23:59:54 +00:00
|
|
|
def require_pages_enabled!
|
|
|
|
not_found! unless user_project.pages_available?
|
|
|
|
end
|
|
|
|
|
2017-11-13 16:05:44 +00:00
|
|
|
def require_pages_config_enabled!
|
|
|
|
not_found! unless Gitlab.config.pages.enabled
|
|
|
|
end
|
|
|
|
|
2017-02-28 21:08:07 +00:00
|
|
|
def can?(object, action, subject = :global)
|
2016-08-08 18:55:13 +00:00
|
|
|
Ability.allowed?(object, action, subject)
|
2016-04-25 03:30:20 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
# Checks the occurrences of required attributes, each attribute must be present in the params hash
|
|
|
|
# or a Bad Request error is invoked.
|
|
|
|
#
|
|
|
|
# Parameters:
|
|
|
|
# keys (required) - A hash consisting of keys that must be present
|
|
|
|
def required_attributes!(keys)
|
|
|
|
keys.each do |key|
|
|
|
|
bad_request!(key) unless params[key].present?
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def attributes_for_keys(keys, custom_params = nil)
|
|
|
|
params_hash = custom_params || params
|
|
|
|
attrs = {}
|
|
|
|
keys.each do |key|
|
2017-06-02 17:11:26 +00:00
|
|
|
if params_hash[key].present? || (params_hash.key?(key) && params_hash[key] == false)
|
2016-04-25 03:30:20 +00:00
|
|
|
attrs[key] = params_hash[key]
|
|
|
|
end
|
|
|
|
end
|
2018-06-13 20:37:41 +00:00
|
|
|
permitted_attrs = ActionController::Parameters.new(attrs).permit!
|
2018-12-15 09:06:56 +00:00
|
|
|
permitted_attrs.to_h
|
2016-04-25 03:30:20 +00:00
|
|
|
end
|
|
|
|
|
2018-08-27 15:31:01 +00:00
|
|
|
# rubocop: disable CodeReuse/ActiveRecord
|
2016-04-25 03:30:20 +00:00
|
|
|
def filter_by_iid(items, iid)
|
|
|
|
items.where(iid: iid)
|
|
|
|
end
|
2018-08-27 15:31:01 +00:00
|
|
|
# rubocop: enable CodeReuse/ActiveRecord
|
2016-04-25 03:30:20 +00:00
|
|
|
|
2019-03-27 09:01:07 +00:00
|
|
|
# rubocop: disable CodeReuse/ActiveRecord
|
|
|
|
def filter_by_title(items, title)
|
|
|
|
items.where(title: title)
|
|
|
|
end
|
|
|
|
# rubocop: enable CodeReuse/ActiveRecord
|
|
|
|
|
2017-02-28 12:23:40 +00:00
|
|
|
def filter_by_search(items, text)
|
|
|
|
items.search(text)
|
|
|
|
end
|
|
|
|
|
2019-02-16 15:11:31 +00:00
|
|
|
def order_options_with_tie_breaker
|
|
|
|
order_options = { params[:order_by] => params[:sort] }
|
2020-01-22 18:08:47 +00:00
|
|
|
order_options['id'] ||= params[:sort] || 'asc'
|
2019-02-16 15:11:31 +00:00
|
|
|
order_options
|
|
|
|
end
|
|
|
|
|
2016-04-25 03:30:20 +00:00
|
|
|
# error helpers
|
|
|
|
|
|
|
|
def forbidden!(reason = nil)
|
|
|
|
message = ['403 Forbidden']
|
|
|
|
message << " - #{reason}" if reason
|
|
|
|
render_api_error!(message.join(' '), 403)
|
|
|
|
end
|
|
|
|
|
|
|
|
def bad_request!(attribute)
|
|
|
|
message = ["400 (Bad request)"]
|
2017-09-06 09:31:08 +00:00
|
|
|
message << "\"" + attribute.to_s + "\" not given" if attribute
|
2016-04-25 03:30:20 +00:00
|
|
|
render_api_error!(message.join(' '), 400)
|
|
|
|
end
|
|
|
|
|
|
|
|
def not_found!(resource = nil)
|
|
|
|
message = ["404"]
|
|
|
|
message << resource if resource
|
|
|
|
message << "Not Found"
|
|
|
|
render_api_error!(message.join(' '), 404)
|
|
|
|
end
|
|
|
|
|
2020-07-10 21:09:29 +00:00
|
|
|
def check_sha_param!(params, merge_request)
|
|
|
|
if params[:sha] && merge_request.diff_head_sha != params[:sha]
|
|
|
|
render_api_error!("SHA does not match HEAD of source branch: #{merge_request.diff_head_sha}", 409)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2016-04-25 03:30:20 +00:00
|
|
|
def unauthorized!
|
|
|
|
render_api_error!('401 Unauthorized', 401)
|
|
|
|
end
|
|
|
|
|
|
|
|
def not_allowed!
|
|
|
|
render_api_error!('405 Method Not Allowed', 405)
|
|
|
|
end
|
|
|
|
|
2020-03-26 18:08:03 +00:00
|
|
|
def not_acceptable!
|
|
|
|
render_api_error!('406 Not Acceptable', 406)
|
|
|
|
end
|
|
|
|
|
2020-02-20 18:08:51 +00:00
|
|
|
def service_unavailable!
|
|
|
|
render_api_error!('503 Service Unavailable', 503)
|
|
|
|
end
|
|
|
|
|
2016-04-25 03:30:20 +00:00
|
|
|
def conflict!(message = nil)
|
|
|
|
render_api_error!(message || '409 Conflict', 409)
|
|
|
|
end
|
|
|
|
|
2020-07-18 00:09:34 +00:00
|
|
|
def unprocessable_entity!(message = nil)
|
|
|
|
render_api_error!(message || '422 Unprocessable Entity', :unprocessable_entity)
|
|
|
|
end
|
|
|
|
|
2019-10-08 12:06:01 +00:00
|
|
|
def file_too_large!
|
2016-04-25 03:30:20 +00:00
|
|
|
render_api_error!('413 Request Entity Too Large', 413)
|
|
|
|
end
|
|
|
|
|
|
|
|
def not_modified!
|
|
|
|
render_api_error!('304 Not Modified', 304)
|
|
|
|
end
|
|
|
|
|
2016-09-06 12:30:54 +00:00
|
|
|
def no_content!
|
|
|
|
render_api_error!('204 No Content', 204)
|
|
|
|
end
|
|
|
|
|
2019-12-20 12:07:40 +00:00
|
|
|
def created!
|
|
|
|
render_api_error!('201 Created', 201)
|
|
|
|
end
|
|
|
|
|
2017-02-22 17:37:13 +00:00
|
|
|
def accepted!
|
|
|
|
render_api_error!('202 Accepted', 202)
|
|
|
|
end
|
|
|
|
|
2016-04-25 03:30:20 +00:00
|
|
|
def render_validation_error!(model)
|
|
|
|
if model.errors.any?
|
2020-07-10 00:09:13 +00:00
|
|
|
render_api_error!(model_error_messages(model) || '400 Bad Request', 400)
|
2016-04-25 03:30:20 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2020-07-10 00:09:13 +00:00
|
|
|
def model_error_messages(model)
|
|
|
|
model.errors.messages
|
|
|
|
end
|
|
|
|
|
2017-02-14 19:07:11 +00:00
|
|
|
def render_spam_error!
|
|
|
|
render_api_error!({ error: 'Spam detected' }, 400)
|
|
|
|
end
|
|
|
|
|
2016-04-25 03:30:20 +00:00
|
|
|
def render_api_error!(message, status)
|
2020-04-23 12:09:46 +00:00
|
|
|
# grape-logging doesn't pass the status code, so this is a
|
|
|
|
# workaround for getting that information in the loggers:
|
|
|
|
# https://github.com/aserafin/grape_logging/issues/71
|
|
|
|
env[API_RESPONSE_STATUS_CODE] = Rack::Utils.status_code(status)
|
|
|
|
|
2017-01-19 22:41:12 +00:00
|
|
|
error!({ 'message' => message }, status, header)
|
2016-04-25 03:30:20 +00:00
|
|
|
end
|
|
|
|
|
2016-08-19 00:06:33 +00:00
|
|
|
def handle_api_exception(exception)
|
2018-12-05 20:54:40 +00:00
|
|
|
if report_exception?(exception)
|
2016-08-19 00:06:33 +00:00
|
|
|
define_params_for_grape_middleware
|
2019-12-16 12:07:43 +00:00
|
|
|
Gitlab::ErrorTracking.with_context(current_user) do
|
2020-05-20 12:07:52 +00:00
|
|
|
Gitlab::ErrorTracking.track_exception(exception)
|
2019-12-13 12:07:41 +00:00
|
|
|
end
|
2016-08-19 00:06:33 +00:00
|
|
|
end
|
|
|
|
|
2019-11-11 15:06:42 +00:00
|
|
|
# This is used with GrapeLogging::Loggers::ExceptionLogger
|
|
|
|
env[API_EXCEPTION_ENV] = exception
|
|
|
|
|
2016-08-19 00:06:33 +00:00
|
|
|
# lifted from https://github.com/rails/rails/blob/master/actionpack/lib/action_dispatch/middleware/debug_exceptions.rb#L60
|
|
|
|
trace = exception.backtrace
|
|
|
|
|
2018-09-29 22:34:47 +00:00
|
|
|
message = ["\n#{exception.class} (#{exception.message}):\n"]
|
2016-08-19 00:06:33 +00:00
|
|
|
message << exception.annoted_source_code.to_s if exception.respond_to?(:annoted_source_code)
|
|
|
|
message << " " << trace.join("\n ")
|
2018-09-29 22:34:47 +00:00
|
|
|
message = message.join
|
2016-08-19 00:06:33 +00:00
|
|
|
|
|
|
|
API.logger.add Logger::FATAL, message
|
2017-08-11 12:50:35 +00:00
|
|
|
|
|
|
|
response_message =
|
|
|
|
if Rails.env.test?
|
|
|
|
message
|
|
|
|
else
|
|
|
|
'500 Internal Server Error'
|
|
|
|
end
|
|
|
|
|
|
|
|
rack_response({ 'message' => response_message }.to_json, 500)
|
2016-08-19 00:06:33 +00:00
|
|
|
end
|
|
|
|
|
2016-11-22 16:58:10 +00:00
|
|
|
# project helpers
|
2016-04-25 03:30:20 +00:00
|
|
|
|
2018-08-27 15:31:01 +00:00
|
|
|
# rubocop: disable CodeReuse/ActiveRecord
|
2017-05-26 14:31:37 +00:00
|
|
|
def reorder_projects(projects)
|
2019-02-16 10:03:42 +00:00
|
|
|
projects.reorder(order_options_with_tie_breaker)
|
|
|
|
end
|
|
|
|
# rubocop: enable CodeReuse/ActiveRecord
|
|
|
|
|
2017-05-24 20:12:40 +00:00
|
|
|
def project_finder_params
|
2019-08-28 14:26:42 +00:00
|
|
|
project_finder_params_ce.merge(project_finder_params_ee)
|
2017-05-24 20:12:40 +00:00
|
|
|
end
|
|
|
|
|
2016-04-25 03:30:20 +00:00
|
|
|
# file helpers
|
|
|
|
|
2018-03-09 14:16:06 +00:00
|
|
|
def present_disk_file!(path, filename, content_type = 'application/octet-stream')
|
2016-04-25 03:30:20 +00:00
|
|
|
filename ||= File.basename(path)
|
2020-01-29 18:08:47 +00:00
|
|
|
header['Content-Disposition'] = ActionDispatch::Http::ContentDisposition.format(disposition: 'attachment', filename: filename)
|
2016-04-25 03:30:20 +00:00
|
|
|
header['Content-Transfer-Encoding'] = 'binary'
|
|
|
|
content_type content_type
|
|
|
|
|
|
|
|
# Support download acceleration
|
|
|
|
case headers['X-Sendfile-Type']
|
|
|
|
when 'X-Sendfile'
|
|
|
|
header['X-Sendfile'] = path
|
|
|
|
body
|
|
|
|
else
|
2020-07-15 09:09:34 +00:00
|
|
|
sendfile path
|
2016-04-25 03:30:20 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2018-03-09 14:16:06 +00:00
|
|
|
def present_carrierwave_file!(file, supports_direct_download: true)
|
2019-03-22 12:38:45 +00:00
|
|
|
return not_found! unless file&.exists?
|
2017-06-29 17:20:59 +00:00
|
|
|
|
2018-03-09 14:16:06 +00:00
|
|
|
if file.file_storage?
|
|
|
|
present_disk_file!(file.path, file.filename)
|
|
|
|
elsif supports_direct_download && file.class.direct_download_enabled?
|
|
|
|
redirect(file.url)
|
2018-02-06 15:39:20 +00:00
|
|
|
else
|
2018-03-09 14:16:06 +00:00
|
|
|
header(*Gitlab::Workhorse.send_url(file.url))
|
2018-02-06 15:39:20 +00:00
|
|
|
status :ok
|
|
|
|
body
|
2017-06-01 07:52:19 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2019-11-12 09:06:14 +00:00
|
|
|
def track_event(action = action_name, **args)
|
|
|
|
category = args.delete(:category) || self.options[:for].name
|
|
|
|
raise "invalid category" unless category
|
|
|
|
|
|
|
|
::Gitlab::Tracking.event(category, action.to_s, **args)
|
|
|
|
rescue => error
|
2020-09-09 15:08:47 +00:00
|
|
|
Gitlab::AppLogger.warn(
|
2019-11-12 09:06:14 +00:00
|
|
|
"Tracking event failed for action: #{action}, category: #{category}, message: #{error.message}"
|
|
|
|
)
|
|
|
|
end
|
|
|
|
|
2020-09-07 12:08:27 +00:00
|
|
|
# @param event_name [String] the event name
|
|
|
|
# @param values [Array|String] the values counted
|
|
|
|
def increment_unique_values(event_name, values)
|
|
|
|
return unless values.present?
|
|
|
|
|
|
|
|
feature_name = "usage_data_#{event_name}"
|
|
|
|
return unless Feature.enabled?(feature_name)
|
|
|
|
|
|
|
|
Gitlab::UsageDataCounters::HLLRedisCounter.track_event(values, event_name)
|
|
|
|
rescue => error
|
|
|
|
Gitlab::AppLogger.warn("Redis tracking event failed for event: #{event_name}, message: #{error.message}")
|
|
|
|
end
|
|
|
|
|
2020-09-02 09:10:23 +00:00
|
|
|
def with_api_params(&block)
|
|
|
|
yield({ api: true, request: request })
|
|
|
|
end
|
|
|
|
|
2019-08-28 14:26:42 +00:00
|
|
|
protected
|
|
|
|
|
2020-04-01 09:07:45 +00:00
|
|
|
def project_finder_params_visibility_ce
|
|
|
|
finder_params = {}
|
|
|
|
finder_params[:min_access_level] = params[:min_access_level] if params[:min_access_level]
|
|
|
|
finder_params[:visibility_level] = Gitlab::VisibilityLevel.level_value(params[:visibility]) if params[:visibility]
|
2019-08-28 14:26:42 +00:00
|
|
|
finder_params[:owned] = true if params[:owned].present?
|
|
|
|
finder_params[:non_public] = true if params[:membership].present?
|
|
|
|
finder_params[:starred] = true if params[:starred].present?
|
|
|
|
finder_params[:archived] = archived_param unless params[:archived].nil?
|
2020-04-01 09:07:45 +00:00
|
|
|
finder_params
|
|
|
|
end
|
|
|
|
|
|
|
|
def project_finder_params_ce
|
|
|
|
finder_params = project_finder_params_visibility_ce
|
2020-06-30 21:09:47 +00:00
|
|
|
finder_params[:with_issues_enabled] = true if params[:with_issues_enabled].present?
|
|
|
|
finder_params[:with_merge_requests_enabled] = true if params[:with_merge_requests_enabled].present?
|
2020-04-01 09:07:45 +00:00
|
|
|
finder_params[:without_deleted] = true
|
2019-08-28 14:26:42 +00:00
|
|
|
finder_params[:search] = params[:search] if params[:search]
|
2020-03-23 12:09:47 +00:00
|
|
|
finder_params[:search_namespaces] = true if params[:search_namespaces].present?
|
2019-08-28 14:26:42 +00:00
|
|
|
finder_params[:user] = params.delete(:user) if params[:user]
|
|
|
|
finder_params[:custom_attributes] = params[:custom_attributes] if params[:custom_attributes]
|
2020-07-24 15:09:39 +00:00
|
|
|
finder_params[:id_after] = sanitize_id_param(params[:id_after]) if params[:id_after]
|
|
|
|
finder_params[:id_before] = sanitize_id_param(params[:id_before]) if params[:id_before]
|
2020-04-01 09:07:45 +00:00
|
|
|
finder_params[:last_activity_after] = params[:last_activity_after] if params[:last_activity_after]
|
|
|
|
finder_params[:last_activity_before] = params[:last_activity_before] if params[:last_activity_before]
|
2020-06-19 21:08:32 +00:00
|
|
|
finder_params[:repository_storage] = params[:repository_storage] if params[:repository_storage]
|
2019-08-28 14:26:42 +00:00
|
|
|
finder_params
|
|
|
|
end
|
|
|
|
|
|
|
|
# Overridden in EE
|
|
|
|
def project_finder_params_ee
|
|
|
|
{}
|
|
|
|
end
|
|
|
|
|
2016-04-25 03:30:20 +00:00
|
|
|
private
|
|
|
|
|
2017-11-22 07:50:36 +00:00
|
|
|
# rubocop:disable Gitlab/ModuleWithInstanceVariables
|
2016-12-09 17:48:20 +00:00
|
|
|
def initial_current_user
|
|
|
|
return @initial_current_user if defined?(@initial_current_user)
|
|
|
|
|
2017-09-27 13:31:52 +00:00
|
|
|
begin
|
2017-10-12 12:38:39 +00:00
|
|
|
@initial_current_user = Gitlab::Auth::UniqueIpsLimiter.limit_user! { find_current_user! }
|
2017-11-16 16:03:19 +00:00
|
|
|
rescue Gitlab::Auth::UnauthorizedError
|
2017-09-27 13:31:52 +00:00
|
|
|
unauthorized!
|
2016-12-09 17:48:20 +00:00
|
|
|
end
|
|
|
|
end
|
2017-11-22 07:50:36 +00:00
|
|
|
# rubocop:enable Gitlab/ModuleWithInstanceVariables
|
2016-12-09 17:48:20 +00:00
|
|
|
|
|
|
|
def sudo!
|
|
|
|
return unless sudo_identifier
|
2017-10-12 12:38:39 +00:00
|
|
|
|
2017-10-30 17:49:46 +00:00
|
|
|
unauthorized! unless initial_current_user
|
2016-12-09 17:48:20 +00:00
|
|
|
|
2017-04-09 02:20:57 +00:00
|
|
|
unless initial_current_user.admin?
|
2016-12-09 17:48:20 +00:00
|
|
|
forbidden!('Must be admin to use sudo')
|
|
|
|
end
|
|
|
|
|
2017-10-12 12:38:39 +00:00
|
|
|
unless access_token
|
|
|
|
forbidden!('Must be authenticated using an OAuth or Personal Access Token to use sudo')
|
2016-12-09 17:48:20 +00:00
|
|
|
end
|
|
|
|
|
2017-10-12 12:38:39 +00:00
|
|
|
validate_access_token!(scopes: [:sudo])
|
|
|
|
|
2016-12-13 14:53:00 +00:00
|
|
|
sudoed_user = find_user(sudo_identifier)
|
2017-10-30 17:49:46 +00:00
|
|
|
not_found!("User with ID or username '#{sudo_identifier}'") unless sudoed_user
|
2016-12-09 17:48:20 +00:00
|
|
|
|
2017-11-22 07:50:36 +00:00
|
|
|
@current_user = sudoed_user # rubocop:disable Gitlab/ModuleWithInstanceVariables
|
2016-12-09 17:48:20 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def sudo_identifier
|
2016-12-13 14:53:00 +00:00
|
|
|
@sudo_identifier ||= params[SUDO_PARAM] || env[SUDO_HEADER]
|
2016-12-09 17:48:20 +00:00
|
|
|
end
|
|
|
|
|
2016-04-25 03:30:20 +00:00
|
|
|
def secret_token
|
2016-09-29 16:46:54 +00:00
|
|
|
Gitlab::Shell.secret_token
|
2016-04-25 03:30:20 +00:00
|
|
|
end
|
|
|
|
|
2016-06-06 11:16:30 +00:00
|
|
|
def send_git_blob(repository, blob)
|
|
|
|
env['api.format'] = :txt
|
|
|
|
content_type 'text/plain'
|
2020-01-29 18:08:47 +00:00
|
|
|
header['Content-Disposition'] = ActionDispatch::Http::ContentDisposition.format(disposition: 'inline', filename: blob.name)
|
2019-01-10 12:30:19 +00:00
|
|
|
|
|
|
|
# Let Workhorse examine the content and determine the better content disposition
|
|
|
|
header[Gitlab::Workhorse::DETECT_HEADER] = "true"
|
|
|
|
|
2016-06-10 10:29:15 +00:00
|
|
|
header(*Gitlab::Workhorse.send_git_blob(repository, blob))
|
2016-06-06 11:16:30 +00:00
|
|
|
end
|
|
|
|
|
2018-02-19 20:41:04 +00:00
|
|
|
def send_git_archive(repository, **kwargs)
|
|
|
|
header(*Gitlab::Workhorse.send_git_archive(repository, **kwargs))
|
2016-06-06 11:16:30 +00:00
|
|
|
end
|
2016-06-11 14:16:32 +00:00
|
|
|
|
2020-05-15 18:07:52 +00:00
|
|
|
def send_artifacts_entry(file, entry)
|
|
|
|
header(*Gitlab::Workhorse.send_artifacts_entry(file, entry))
|
2017-09-05 09:16:49 +00:00
|
|
|
end
|
|
|
|
|
2017-09-29 11:14:08 +00:00
|
|
|
# The Grape Error Middleware only has access to `env` but not `params` nor
|
|
|
|
# `request`. We workaround this by defining methods that returns the right
|
|
|
|
# values.
|
2016-08-19 00:06:33 +00:00
|
|
|
def define_params_for_grape_middleware
|
2019-01-07 08:35:53 +00:00
|
|
|
self.define_singleton_method(:request) { ActionDispatch::Request.new(env) }
|
2017-09-29 11:14:08 +00:00
|
|
|
self.define_singleton_method(:params) { request.params.symbolize_keys }
|
2016-08-19 00:06:33 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
# We could get a Grape or a standard Ruby exception. We should only report anything that
|
|
|
|
# is clearly an error.
|
|
|
|
def report_exception?(exception)
|
|
|
|
return true unless exception.respond_to?(:status)
|
|
|
|
|
|
|
|
exception.status == 500
|
|
|
|
end
|
2018-07-11 18:17:18 +00:00
|
|
|
|
|
|
|
def archived_param
|
|
|
|
return 'only' if params[:archived]
|
|
|
|
|
|
|
|
params[:archived]
|
|
|
|
end
|
2019-07-24 14:15:50 +00:00
|
|
|
|
|
|
|
def ip_address
|
|
|
|
env["action_dispatch.remote_ip"].to_s || request.ip
|
|
|
|
end
|
2020-07-24 15:09:39 +00:00
|
|
|
|
|
|
|
def sanitize_id_param(id)
|
|
|
|
id.present? ? id.to_i : nil
|
|
|
|
end
|
2016-04-25 03:30:20 +00:00
|
|
|
end
|
|
|
|
end
|
2019-09-13 13:26:31 +00:00
|
|
|
|
|
|
|
API::Helpers.prepend_if_ee('EE::API::Helpers')
|