2012-06-29 03:30:31 +00:00
|
|
|
module Grack
|
|
|
|
class Auth < Rack::Auth::Basic
|
2012-10-21 09:12:14 +00:00
|
|
|
attr_accessor :user, :project
|
2012-06-29 03:30:31 +00:00
|
|
|
|
|
|
|
def valid?
|
2013-01-10 18:17:57 +00:00
|
|
|
# Find project by PATH_INFO from env
|
|
|
|
if m = /^\/([\w\.\/-]+)\.git/.match(@request.path_info).to_a
|
|
|
|
self.project = Project.find_with_namespace(m.last)
|
|
|
|
return false unless project
|
|
|
|
end
|
|
|
|
|
|
|
|
if @request.get? && project.public
|
|
|
|
return true
|
|
|
|
end
|
|
|
|
|
2012-06-29 07:43:15 +00:00
|
|
|
# Authentication with username and password
|
2012-11-26 09:23:08 +00:00
|
|
|
login, password = @auth.credentials
|
|
|
|
|
|
|
|
self.user = User.find_by_email(login) || User.find_by_username(login)
|
|
|
|
|
2012-06-29 13:40:23 +00:00
|
|
|
return false unless user.try(:valid_password?, password)
|
|
|
|
|
2012-11-26 09:23:08 +00:00
|
|
|
email = user.email
|
|
|
|
|
2012-07-02 08:44:45 +00:00
|
|
|
# Set GL_USER env variable
|
|
|
|
ENV['GL_USER'] = email
|
|
|
|
# Pass Gitolite update hook
|
|
|
|
ENV['GL_BYPASS_UPDATE_HOOK'] = "true"
|
|
|
|
|
2012-06-29 07:43:15 +00:00
|
|
|
# Git upload and receive
|
2012-09-17 10:36:23 +00:00
|
|
|
if @request.get?
|
2012-10-21 09:12:14 +00:00
|
|
|
validate_get_request
|
2012-09-17 10:36:23 +00:00
|
|
|
elsif @request.post?
|
2012-10-21 09:12:14 +00:00
|
|
|
validate_post_request
|
2012-06-29 10:11:37 +00:00
|
|
|
else
|
|
|
|
false
|
2012-06-29 07:43:15 +00:00
|
|
|
end
|
2012-10-21 09:12:14 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def validate_get_request
|
2012-12-11 20:28:40 +00:00
|
|
|
can?(user, :download_code, project)
|
2012-10-21 09:12:14 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def validate_post_request
|
|
|
|
if @request.path_info.end_with?('git-upload-pack')
|
2012-12-11 20:28:40 +00:00
|
|
|
can?(user, :download_code, project)
|
2012-10-21 09:12:14 +00:00
|
|
|
elsif @request.path_info.end_with?('git-receive-pack')
|
|
|
|
action = if project.protected_branch?(current_ref)
|
|
|
|
:push_code_to_protected_branches
|
|
|
|
else
|
|
|
|
:push_code
|
|
|
|
end
|
|
|
|
|
|
|
|
can?(user, action, project)
|
|
|
|
else
|
|
|
|
false
|
|
|
|
end
|
|
|
|
end
|
2012-06-29 10:11:37 +00:00
|
|
|
|
2012-10-22 15:45:42 +00:00
|
|
|
def can?(object, action, subject)
|
|
|
|
abilities.allowed?(object, action, subject)
|
|
|
|
end
|
|
|
|
|
2012-06-29 10:11:37 +00:00
|
|
|
def current_ref
|
|
|
|
if @env["HTTP_CONTENT_ENCODING"] =~ /gzip/
|
2012-08-25 07:24:21 +00:00
|
|
|
input = Zlib::GzipReader.new(@request.body).read
|
2012-06-29 10:11:37 +00:00
|
|
|
else
|
2012-08-25 07:24:21 +00:00
|
|
|
input = @request.body.read
|
2012-06-29 10:11:37 +00:00
|
|
|
end
|
2012-08-25 07:24:21 +00:00
|
|
|
# Need to reset seek point
|
|
|
|
@request.body.rewind
|
2012-10-26 12:05:57 +00:00
|
|
|
/refs\/heads\/([\w\.-]+)/.match(input).to_a.first
|
2012-06-29 10:11:37 +00:00
|
|
|
end
|
2012-10-22 15:45:42 +00:00
|
|
|
|
|
|
|
protected
|
|
|
|
|
|
|
|
def abilities
|
|
|
|
@abilities ||= begin
|
|
|
|
abilities = Six.new
|
|
|
|
abilities << Ability
|
|
|
|
abilities
|
|
|
|
end
|
|
|
|
end
|
2012-06-29 07:43:15 +00:00
|
|
|
end# Auth
|
|
|
|
end# Grack
|