Commit f18a714f authored by Dmitriy Zaporozhets's avatar Dmitriy Zaporozhets

Use GitAccess in internal api

Signed-off-by: default avatarDmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
parent 19c28822
module API module API
# Internal access API # Internal access API
class Internal < Grape::API class Internal < Grape::API
DOWNLOAD_COMMANDS = %w{ git-upload-pack git-upload-archive }
PUSH_COMMANDS = %w{ git-receive-pack }
namespace 'internal' do namespace 'internal' do
# # Check if git command is allowed to project
# Check if ssh key has access to project code
# #
# Params: # Params:
# key_id - SSH Key id # key_id - ssh key id for Git over SSH
# user_id - user id for Git over HTTP
# project - project path with namespace # project - project path with namespace
# action - git action (git-upload-pack or git-receive-pack) # action - git action (git-upload-pack or git-receive-pack)
# ref - branch name # ref - branch name
...@@ -22,43 +18,25 @@ module API ...@@ -22,43 +18,25 @@ module API
# the wiki repository as well. # the wiki repository as well.
project_path = params[:project] project_path = params[:project]
project_path.gsub!(/\.wiki/,'') if project_path =~ /\.wiki/ project_path.gsub!(/\.wiki/,'') if project_path =~ /\.wiki/
key = Key.find(params[:key_id])
project = Project.find_with_namespace(project_path) project = Project.find_with_namespace(project_path)
git_cmd = params[:action]
return false unless project return false unless project
actor = if params[:key_id]
if key.is_a? DeployKey Key.find(params[:key_id])
key.projects.include?(project) && DOWNLOAD_COMMANDS.include?(git_cmd) elsif params[:user_id]
else User.find(params[:user_id])
user = key.user
return false if user.blocked?
if Gitlab.config.ldap.enabled
if user.ldap_user?
# Check if LDAP user exists and match LDAP user_filter
unless Gitlab::LDAP::Access.new.allowed?(user)
return false
end
end
end end
action = case git_cmd return false unless actor
when *DOWNLOAD_COMMANDS
then :download_code
when *PUSH_COMMANDS
then
if project.protected_branch?(params[:ref])
:push_code_to_protected_branches
else
:push_code
end
end
user.can?(action, project) Gitlab::GitAccess.new.allowed?(
end actor,
params[:action],
project,
params[:ref],
params[:oldrev],
params[:newrev]
)
end end
# #
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment