Move JWT to Gitlab::JWT

app/controllers/jwt_controller.rb

@@ -3,7 +3,7 @@ class JwtController < ApplicationController
   skip_before_action :verify_authenticity_token
 
   SERVICES = {
-    'container_registry' => JWT::ContainerRegistryAuthenticationService,
+    'container_registry' => ::Gitlab::JWT::ContainerRegistryAuthenticationService,
   }
 
   def auth

app/services/jwt/container_registry_authentication_service.rb

@@ -1,69 +1,71 @@
-module JWT
+module Gitlab
-  class ContainerRegistryAuthenticationService < BaseService
+  module JWT
-    def execute
+    class ContainerRegistryAuthenticationService < BaseService
-      if params[:offline_token]
+      def execute
-        return error('forbidden', 403) unless current_user
+        if params[:offline_token]
+          return error('forbidden', 403) unless current_user
+        end
+
+        return error('forbidden', 401) if scopes.blank?
+
+        { token: authorized_token(scopes).encoded }
       end
 
-      return error('forbidden', 401) if scopes.blank?
+      private
 
-      { token: authorized_token(scopes).encoded }
+      def authorized_token(access)
-    end
+        token = ::JWT::RSAToken.new(registry.key)
-
+        token.issuer = registry.issuer
-    private
+        token.audience = params[:service]
-
+        token.subject = current_user.try(:username)
-    def authorized_token(access)
+        token[:access] = access
-      token = ::JWT::RSAToken.new(registry.key)
+        token
-      token.issuer = registry.issuer
-      token.audience = params[:service]
-      token.subject = current_user.try(:username)
-      token[:access] = access
-      token
-    end
-
-    def scopes
-      return unless params[:scope]
-
-      @scopes ||= begin
-        scope = process_scope(params[:scope])
-        [scope].compact
-      end
-    end
-
-    def process_scope(scope)
-      type, name, actions = scope.split(':', 3)
-      actions = actions.split(',')
-
-      case type
-      when 'repository'
-        process_repository_access(type, name, actions)
-      end
-    end
-
-    def process_repository_access(type, name, actions)
-      requested_project = Project.find_with_namespace(name)
-      return unless requested_project
-
-      actions = actions.select do |action|
-        can_access?(requested_project, action)
       end
 
-      { type: type, name: name, actions: actions } if actions.present?
+      def scopes
-    end
+        return unless params[:scope]
 
-    def can_access?(requested_project, requested_action)
+        @scopes ||= begin
-      case requested_action
+          scope = process_scope(params[:scope])
-      when 'pull'
+          [scope].compact
-        requested_project.public? || requested_project == project || can?(current_user, :read_container_registry, requested_project)
+        end
-      when 'push'
-        requested_project == project || can?(current_user, :create_container_registry, requested_project)
-      else
-        false
       end
-    end
 
-    def registry
+      def process_scope(scope)
-      Gitlab.config.registry
+        type, name, actions = scope.split(':', 3)
+        actions = actions.split(',')
+
+        case type
+        when 'repository'
+          process_repository_access(type, name, actions)
+        end
+      end
+
+      def process_repository_access(type, name, actions)
+        requested_project = Project.find_with_namespace(name)
+        return unless requested_project
+
+        actions = actions.select do |action|
+          can_access?(requested_project, action)
+        end
+
+        { type: type, name: name, actions: actions } if actions.present?
+      end
+
+      def can_access?(requested_project, requested_action)
+        case requested_action
+        when 'pull'
+          requested_project.public? || requested_project == project || can?(current_user, :read_container_registry, requested_project)
+        when 'push'
+          requested_project == project || can?(current_user, :create_container_registry, requested_project)
+        else
+          false
+        end
+      end
+
+      def registry
+        Gitlab.config.registry
+      end
     end
   end
 end