git_access.rb 5.54 KB
Newer Older
1 2 3 4 5
module Gitlab
  class GitAccess
    DOWNLOAD_COMMANDS = %w{ git-upload-pack git-upload-archive }
    PUSH_COMMANDS = %w{ git-receive-pack }

6
    attr_reader :actor, :project
7

8 9 10 11 12 13 14 15
    def initialize(actor, project)
      @actor    = actor
      @project  = project
    end

    def user
      return @user if defined?(@user)

Marin Jankovski's avatar
Marin Jankovski committed
16
      @user =
17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
        case actor
        when User
          actor
        when DeployKey
          nil
        when Key
          actor.user
        end
    end

    def deploy_key
      actor if actor.is_a?(DeployKey)
    end

    def can_push_to_branch?(ref)
32
      return false unless user
33

34
      if project.protected_branch?(ref) && !project.developers_can_push_to_protected_branch?(ref)
35 36 37 38 39 40
        user.can?(:push_code_to_protected_branches, project)
      else
        user.can?(:push_code, project)
      end
    end

41 42 43 44 45 46 47 48 49 50 51
    def can_read_project?
      if user
        user.can?(:read_project, project)
      elsif deploy_key
        deploy_key.projects.include?(project)
      else
        false
      end
    end

    def check(cmd, changes = nil)
52 53 54 55 56 57 58 59 60 61 62 63
      unless actor
        return build_status_object(false, "No user or key was provided.")
      end

      if user && !user_allowed?
        return build_status_object(false, "Your account has been blocked.")
      end

      unless project && can_read_project?
        return build_status_object(false, 'The project you were looking for could not be found.')
      end

64 65
      case cmd
      when *DOWNLOAD_COMMANDS
66
        download_access_check
67
      when *PUSH_COMMANDS
68
        push_access_check(changes)
69
      else
70
        build_status_object(false, "The command you're trying to execute is not allowed.")
71 72 73
      end
    end

74 75 76 77
    def download_access_check
      if user
        user_download_access_check
      elsif deploy_key
78
        build_status_object(true)
79 80 81 82 83
      else
        raise 'Wrong actor'
      end
    end

84 85 86 87
    def push_access_check(changes)
      if user
        user_push_access_check(changes)
      elsif deploy_key
88
        build_status_object(false, "Deploy keys are not allowed to push code.")
89 90 91 92 93 94
      else
        raise 'Wrong actor'
      end
    end

    def user_download_access_check
95 96
      unless user.can?(:download_code, project)
        return build_status_object(false, "You are not allowed to download code from this project.")
97 98
      end

99
      build_status_object(true)
100 101 102
    end

    def user_push_access_check(changes)
103 104 105 106 107
      if changes.blank?
        return build_status_object(true)
      end

      unless project.repository.exists?
108
        return build_status_object(false, "A repository for this project does not exist yet.")
109
      end
110 111 112 113

      changes = changes.lines if changes.kind_of?(String)

      # Iterate over all changes to find if user allowed all of them to be applied
114
      changes.map(&:strip).reject(&:blank?).each do |change|
115
        status = change_access_check(change)
116
        unless status.allowed?
117
          # If user does not have access to make at least one change - cancel all push
118
          return status
119 120 121
        end
      end

122
      build_status_object(true)
123 124
    end

125
    def change_access_check(change)
126 127
      oldrev, newrev, ref = change.split(' ')

Marin Jankovski's avatar
Marin Jankovski committed
128
      action =
129 130
        if project.protected_branch?(branch_name(ref))
          protected_branch_action(oldrev, newrev, branch_name(ref))
131
        elsif (tag_ref = tag_name(ref)) && protected_tag?(tag_ref)
132 133 134 135 136
          # Prevent any changes to existing git tag unless user has permissions
          :admin_project
        else
          :push_code
        end
137

138
      unless user.can?(action, project)
Douwe Maan's avatar
Douwe Maan committed
139
        status =
140 141 142 143 144 145 146 147 148 149 150
          case action
          when :force_push_code_to_protected_branches
            build_status_object(false, "You are not allowed to force push code to a protected branch on this project.")
          when :remove_protected_branches
            build_status_object(false, "You are not allowed to deleted protected branches from this project.")
          when :push_code_to_protected_branches
            build_status_object(false, "You are not allowed to push code to protected branches on this project.")
          when :admin_project
            build_status_object(false, "You are not allowed to change existing tags on this project.")
          else # :push_code
            build_status_object(false, "You are not allowed to push code to this project.")
Marin Jankovski's avatar
Marin Jankovski committed
151
          end
Douwe Maan's avatar
Douwe Maan committed
152
        return status
153
      end
154 155

      build_status_object(true)
156 157
    end

158
    def forced_push?(oldrev, newrev)
159
      Gitlab::ForcePushCheck.force_push?(project, oldrev, newrev)
160 161 162 163
    end

    private

164
    def protected_branch_action(oldrev, newrev, branch_name)
165
      # we dont allow force push to protected branch
166
      if forced_push?(oldrev, newrev)
167
        :force_push_code_to_protected_branches
168
      elsif Gitlab::Git.blank_ref?(newrev)
169 170
        # and we dont allow remove of protected branch
        :remove_protected_branches
171
      elsif project.developers_can_push_to_protected_branch?(branch_name)
172
        :push_code
173
      else
174
        :push_code_to_protected_branches
175 176 177
      end
    end

178
    def protected_tag?(tag_name)
179
      project.repository.tag_exists?(tag_name)
180 181
    end

182
    def user_allowed?
183
      Gitlab::UserAccess.allowed?(user)
184
    end
185 186 187

    def branch_name(ref)
      ref = ref.to_s
188 189
      if Gitlab::Git.branch_ref?(ref)
        Gitlab::Git.ref_name(ref)
190 191 192 193 194 195 196
      else
        nil
      end
    end

    def tag_name(ref)
      ref = ref.to_s
197 198
      if Gitlab::Git.tag_ref?(ref)
        Gitlab::Git.ref_name(ref)
199 200 201 202
      else
        nil
      end
    end
203 204 205 206 207 208

    protected

    def build_status_object(status, message = '')
      GitAccessStatus.new(status, message)
    end
209 210
  end
end