helpers.rb 18.8 KB
Newer Older
1 2
# frozen_string_literal: true

3
module API
4
  module Helpers
5
    include Gitlab::Utils
6
    include Helpers::Pagination
7
    include Helpers::PaginationStrategies
8

9 10
    SUDO_HEADER = "HTTP_SUDO"
    GITLAB_SHARED_SECRET_HEADER = "Gitlab-Shared-Secret"
11
    SUDO_PARAM = :sudo
12
    API_USER_ENV = 'gitlab.api.user'
13
    API_EXCEPTION_ENV = 'gitlab.api.exception'
14
    API_RESPONSE_STATUS_CODE = 'gitlab.api.response_status_code'
15

16 17 18 19 20
    def declared_params(options = {})
      options = { include_parent_namespaces: false }.merge(options)
      declared(params, options).to_h.symbolize_keys
    end

21 22
    def check_unmodified_since!(last_modified)
      if_unmodified_since = Time.parse(headers['If-Unmodified-Since']) rescue nil
23

24
      if if_unmodified_since && last_modified && last_modified > if_unmodified_since
25 26 27 28
        render_api_error!('412 Precondition Failed', 412)
      end
    end

29 30 31 32
    def destroy_conditionally!(resource, last_updated: nil)
      last_updated ||= resource.updated_at

      check_unmodified_since!(last_updated)
33 34

      status 204
35
      body false
36

37 38 39 40 41 42 43
      if block_given?
        yield resource
      else
        resource.destroy
      end
    end

44 45 46 47 48
    # rubocop:disable Gitlab/ModuleWithInstanceVariables
    # We can't rewrite this with StrongMemoize because `sudo!` would
    # actually write to `@current_user`, and `sudo?` would immediately
    # call `current_user` again which reads from `@current_user`.
    # We should rewrite this in a way that using StrongMemoize is possible
Nihad Abbasov's avatar
Nihad Abbasov committed
49
    def current_user
50
      return @current_user if defined?(@current_user)
51

52
      @current_user = initial_current_user
53

54 55
      Gitlab::I18n.locale = @current_user&.preferred_language

56
      sudo!
57

Douwe Maan's avatar
Douwe Maan committed
58 59
      validate_access_token!(scopes: scopes_registered_for_endpoint) unless sudo?

60 61
      save_current_user_in_env(@current_user) if @current_user

62 63
      @current_user
    end
64
    # rubocop:enable Gitlab/ModuleWithInstanceVariables
65

66 67 68 69
    def save_current_user_in_env(user)
      env[API_USER_ENV] = { user_id: user.id, username: user.username }
    end

70 71
    def sudo?
      initial_current_user != current_user
Nihad Abbasov's avatar
Nihad Abbasov committed
72 73
    end

74 75 76 77
    def user_group
      @group ||= find_group!(params[:id])
    end

Nihad Abbasov's avatar
Nihad Abbasov committed
78
    def user_project
79
      @project ||= find_project!(params[:id])
80 81
    end

82
    def available_labels_for(label_parent, include_ancestor_groups: true)
83
      search_params = { include_ancestor_groups: include_ancestor_groups }
84 85 86 87 88 89

      if label_parent.is_a?(Project)
        search_params[:project_id] = label_parent.id
      else
        search_params.merge!(group_id: label_parent.id, only_group_labels: true)
      end
90 91

      LabelsFinder.new(current_user, search_params).execute
92 93
    end

94
    def find_user(id)
95
      UserFinder.new(id).find_by_id_or_username
96 97
    end

98
    # rubocop: disable CodeReuse/ActiveRecord
99
    def find_project(id)
100 101
      projects = Project.without_deleted

102
      if id.is_a?(Integer) || id =~ /^\d+$/
103
        projects.find_by(id: id)
104
      elsif id.include?("/")
105
        projects.find_by_full_path(id)
106 107
      end
    end
108
    # rubocop: enable CodeReuse/ActiveRecord
109 110 111

    def find_project!(id)
      project = find_project(id)
112

113
      if can?(current_user, :read_project, project)
114
        project
115
      else
116
        not_found!('Project')
117
      end
Nihad Abbasov's avatar
Nihad Abbasov committed
118 119
    end

120
    # rubocop: disable CodeReuse/ActiveRecord
121
    def find_group(id)
122
      if id.to_s =~ /^\d+$/
123 124
        Group.find_by(id: id)
      else
125
        Group.find_by_full_path(id)
126 127
      end
    end
128
    # rubocop: enable CodeReuse/ActiveRecord
129 130 131

    def find_group!(id)
      group = find_group(id)
132 133 134 135

      if can?(current_user, :read_group, group)
        group
      else
136
        not_found!('Group')
137 138 139
      end
    end

140 141 142 143 144 145
    def check_namespace_access(namespace)
      return namespace if can?(current_user, :read_namespace, namespace)

      not_found!('Namespace')
    end

146
    # rubocop: disable CodeReuse/ActiveRecord
147 148 149 150 151 152 153
    def find_namespace(id)
      if id.to_s =~ /^\d+$/
        Namespace.find_by(id: id)
      else
        Namespace.find_by_full_path(id)
      end
    end
154
    # rubocop: enable CodeReuse/ActiveRecord
155 156

    def find_namespace!(id)
157 158
      check_namespace_access(find_namespace(id))
    end
159

160 161 162 163 164 165
    def find_namespace_by_path(path)
      Namespace.find_by_full_path(path)
    end

    def find_namespace_by_path!(path)
      check_namespace_access(find_namespace_by_path(path))
166 167
    end

168
    def find_branch!(branch_name)
Stan Hu's avatar
Stan Hu committed
169 170 171 172 173
      if Gitlab::GitRefValidator.validate(branch_name)
        user_project.repository.find_branch(branch_name) || not_found!('Branch')
      else
        render_api_error!('The branch refname is invalid', 400)
      end
174 175
    end

176 177 178 179 180 181 182 183
    def find_tag!(tag_name)
      if Gitlab::GitRefValidator.validate(tag_name)
        user_project.repository.find_tag(tag_name) || not_found!('Tag')
      else
        render_api_error!('The tag refname is invalid', 400)
      end
    end

184
    # rubocop: disable CodeReuse/ActiveRecord
185 186 187 188
    def find_project_issue(iid, project_id = nil)
      project = project_id ? find_project!(project_id) : user_project

      ::IssuesFinder.new(current_user, project_id: project.id).find_by!(iid: iid)
189
    end
190
    # rubocop: enable CodeReuse/ActiveRecord
191

192
    # rubocop: disable CodeReuse/ActiveRecord
193 194
    def find_project_merge_request(iid)
      MergeRequestsFinder.new(current_user, project_id: user_project.id).find_by!(iid: iid)
195
    end
196
    # rubocop: enable CodeReuse/ActiveRecord
197

198 199 200 201
    def find_project_commit(id)
      user_project.commit_by(oid: id)
    end

202
    # rubocop: disable CodeReuse/ActiveRecord
203 204
    def find_merge_request_with_access(iid, access_level = :read_merge_request)
      merge_request = user_project.merge_requests.find_by!(iid: iid)
205 206 207
      authorize! access_level, merge_request
      merge_request
    end
208
    # rubocop: enable CodeReuse/ActiveRecord
209

210 211 212 213
    def find_build!(id)
      user_project.builds.find(id.to_i)
    end

Nihad Abbasov's avatar
Nihad Abbasov committed
214
    def authenticate!
215
      unauthorized! unless current_user
Nihad Abbasov's avatar
Nihad Abbasov committed
216
    end
randx's avatar
randx committed
217

218
    def authenticate_non_get!
219
      authenticate! unless %w[GET HEAD].include?(route.request_method)
220 221
    end

222
    def authenticate_by_gitlab_shell_token!
223 224 225 226 227 228
      input = params['secret_token']
      input ||= Base64.decode64(headers[GITLAB_SHARED_SECRET_HEADER]) if headers.key?(GITLAB_SHARED_SECRET_HEADER)

      input&.chomp!

      unauthorized! unless Devise.secure_compare(secret_token, input)
229 230
    end

231
    def authenticated_with_can_read_all_resources!
232
      authenticate!
233
      forbidden! unless current_user.can_read_all_resources?
234 235
    end

236
    def authenticated_as_admin!
237
      authenticate!
238
      forbidden! unless current_user.admin?
239 240
    end

241 242
    def authorize!(action, subject = :global, reason = nil)
      forbidden!(reason) unless can?(current_user, action, subject)
randx's avatar
randx committed
243 244
    end

Dmitriy Zaporozhets's avatar
Dmitriy Zaporozhets committed
245 246 247 248
    def authorize_push_project
      authorize! :push_code, user_project
    end

Manoj MJ's avatar
Manoj MJ committed
249 250 251 252
    def authorize_admin_tag
      authorize! :admin_tag, user_project
    end

253 254 255 256
    def authorize_admin_project
      authorize! :admin_project, user_project
    end

257 258 259 260
    def authorize_admin_group
      authorize! :admin_group, user_group
    end

261 262 263 264
    def authorize_read_builds!
      authorize! :read_build, user_project
    end

265 266 267 268
    def authorize_destroy_artifacts!
      authorize! :destroy_artifacts, user_project
    end

269 270 271 272
    def authorize_update_builds!
      authorize! :update_build, user_project
    end

273 274 275 276
    def require_repository_enabled!(subject = :global)
      not_found!("Repository") unless user_project.feature_available?(:repository, current_user)
    end

277
    def require_gitlab_workhorse!
278 279
      verify_workhorse_api!

280
      unless env['HTTP_GITLAB_WORKHORSE'].present?
281 282 283 284
        forbidden!('Request should be executed via GitLab Workhorse')
      end
    end

285 286 287 288 289 290 291 292
    def verify_workhorse_api!
      Gitlab::Workhorse.verify_api_request!(request.headers)
    rescue => e
      Gitlab::ErrorTracking.track_exception(e)

      forbidden!
    end

293 294 295 296
    def require_pages_enabled!
      not_found! unless user_project.pages_available?
    end

297 298 299 300
    def require_pages_config_enabled!
      not_found! unless Gitlab.config.pages.enabled
    end

301
    def can?(object, action, subject = :global)
302
      Ability.allowed?(object, action, subject)
303 304
    end

305 306 307 308 309 310 311 312 313 314 315
    # Checks the occurrences of required attributes, each attribute must be present in the params hash
    # or a Bad Request error is invoked.
    #
    # Parameters:
    #   keys (required) - A hash consisting of keys that must be present
    def required_attributes!(keys)
      keys.each do |key|
        bad_request!(key) unless params[key].present?
      end
    end

Valery Sizov's avatar
Valery Sizov committed
316
    def attributes_for_keys(keys, custom_params = nil)
317
      params_hash = custom_params || params
Alex Denisov's avatar
Alex Denisov committed
318 319
      attrs = {}
      keys.each do |key|
320
        if params_hash[key].present? || (params_hash.key?(key) && params_hash[key] == false)
321
          attrs[key] = params_hash[key]
322
        end
Alex Denisov's avatar
Alex Denisov committed
323
      end
324
      permitted_attrs = ActionController::Parameters.new(attrs).permit!
Jasper Maes's avatar
Jasper Maes committed
325
      permitted_attrs.to_h
Alex Denisov's avatar
Alex Denisov committed
326 327
    end

328
    # rubocop: disable CodeReuse/ActiveRecord
329 330 331
    def filter_by_iid(items, iid)
      items.where(iid: iid)
    end
332
    # rubocop: enable CodeReuse/ActiveRecord
333

334 335 336 337 338 339
    # rubocop: disable CodeReuse/ActiveRecord
    def filter_by_title(items, title)
      items.where(title: title)
    end
    # rubocop: enable CodeReuse/ActiveRecord

340 341 342 343
    def filter_by_search(items, text)
      items.search(text)
    end

344 345
    def order_options_with_tie_breaker
      order_options = { params[:order_by] => params[:sort] }
346
      order_options['id'] ||= params[:sort] || 'asc'
347 348 349
      order_options
    end

350 351
    # error helpers

352 353 354 355
    def forbidden!(reason = nil)
      message = ['403 Forbidden']
      message << " - #{reason}" if reason
      render_api_error!(message.join(' '), 403)
356 357
    end

358 359
    def bad_request!(attribute)
      message = ["400 (Bad request)"]
360
      message << "\"" + attribute.to_s + "\" not given" if attribute
361 362 363
      render_api_error!(message.join(' '), 400)
    end

364 365 366 367
    def not_found!(resource = nil)
      message = ["404"]
      message << resource if resource
      message << "Not Found"
Alex Denisov's avatar
Alex Denisov committed
368
      render_api_error!(message.join(' '), 404)
369 370
    end

371 372 373 374 375 376
    def check_sha_param!(params, merge_request)
      if params[:sha] && merge_request.diff_head_sha != params[:sha]
        render_api_error!("SHA does not match HEAD of source branch: #{merge_request.diff_head_sha}", 409)
      end
    end

377
    def unauthorized!
Alex Denisov's avatar
Alex Denisov committed
378
      render_api_error!('401 Unauthorized', 401)
379 380 381
    end

    def not_allowed!
382 383 384
      render_api_error!('405 Method Not Allowed', 405)
    end

385 386 387 388
    def not_acceptable!
      render_api_error!('406 Not Acceptable', 406)
    end

Shinya Maeda's avatar
Shinya Maeda committed
389 390 391 392
    def service_unavailable!
      render_api_error!('503 Service Unavailable', 503)
    end

393 394 395 396
    def conflict!(message = nil)
      render_api_error!(message || '409 Conflict', 409)
    end

397
    def file_too_large!
398 399 400
      render_api_error!('413 Request Entity Too Large', 413)
    end

401
    def not_modified!
402
      render_api_error!('304 Not Modified', 304)
403 404
    end

405 406 407 408
    def no_content!
      render_api_error!('204 No Content', 204)
    end

409 410 411 412
    def created!
      render_api_error!('201 Created', 201)
    end

413 414 415 416
    def accepted!
      render_api_error!('202 Accepted', 202)
    end

417
    def render_validation_error!(model)
418
      if model.errors.any?
419
        render_api_error!(model_error_messages(model) || '400 Bad Request', 400)
420
      end
Alex Denisov's avatar
Alex Denisov committed
421 422
    end

423 424 425 426
    def model_error_messages(model)
      model.errors.messages
    end

427 428 429 430
    def render_spam_error!
      render_api_error!({ error: 'Spam detected' }, 400)
    end

Alex Denisov's avatar
Alex Denisov committed
431
    def render_api_error!(message, status)
432 433 434 435 436
      # grape-logging doesn't pass the status code, so this is a
      # workaround for getting that information in the loggers:
      # https://github.com/aserafin/grape_logging/issues/71
      env[API_RESPONSE_STATUS_CODE] = Rack::Utils.status_code(status)

437
      error!({ 'message' => message }, status, header)
438 439
    end

Stan Hu's avatar
Stan Hu committed
440
    def handle_api_exception(exception)
441
      if report_exception?(exception)
Stan Hu's avatar
Stan Hu committed
442
        define_params_for_grape_middleware
443
        Gitlab::ErrorTracking.with_context(current_user) do
444
          Gitlab::ErrorTracking.track_exception(exception)
445
        end
Stan Hu's avatar
Stan Hu committed
446 447
      end

448 449 450
      # This is used with GrapeLogging::Loggers::ExceptionLogger
      env[API_EXCEPTION_ENV] = exception

Stan Hu's avatar
Stan Hu committed
451 452 453
      # lifted from https://github.com/rails/rails/blob/master/actionpack/lib/action_dispatch/middleware/debug_exceptions.rb#L60
      trace = exception.backtrace

454
      message = ["\n#{exception.class} (#{exception.message}):\n"]
Stan Hu's avatar
Stan Hu committed
455 456
      message << exception.annoted_source_code.to_s if exception.respond_to?(:annoted_source_code)
      message << "  " << trace.join("\n  ")
457
      message = message.join
Stan Hu's avatar
Stan Hu committed
458 459

      API.logger.add Logger::FATAL, message
460 461 462 463 464 465 466 467 468

      response_message =
        if Rails.env.test?
          message
        else
          '500 Internal Server Error'
        end

      rack_response({ 'message' => response_message }.to_json, 500)
Stan Hu's avatar
Stan Hu committed
469 470
    end

471
    # project helpers
Valery Sizov's avatar
Valery Sizov committed
472

473
    # rubocop: disable CodeReuse/ActiveRecord
474
    def reorder_projects(projects)
475
      projects.reorder(order_options_with_tie_breaker)
Valery Sizov's avatar
Valery Sizov committed
476
    end
477
    # rubocop: enable CodeReuse/ActiveRecord
Valery Sizov's avatar
Valery Sizov committed
478

479
    def project_finder_params
480
      project_finder_params_ce.merge(project_finder_params_ee)
481 482
    end

483 484
    # file helpers

485
    def present_disk_file!(path, filename, content_type = 'application/octet-stream')
486
      filename ||= File.basename(path)
Heinrich Lee Yu's avatar
Heinrich Lee Yu committed
487
      header['Content-Disposition'] = ActionDispatch::Http::ContentDisposition.format(disposition: 'attachment', filename: filename)
488 489 490 491 492 493 494 495 496
      header['Content-Transfer-Encoding'] = 'binary'
      content_type content_type

      # Support download acceleration
      case headers['X-Sendfile-Type']
      when 'X-Sendfile'
        header['X-Sendfile'] = path
        body
      else
497
        file path
498 499 500
      end
    end

501
    def present_carrierwave_file!(file, supports_direct_download: true)
502
      return not_found! unless file&.exists?
vanadium23's avatar
vanadium23 committed
503

504 505 506 507
      if file.file_storage?
        present_disk_file!(file.path, file.filename)
      elsif supports_direct_download && file.class.direct_download_enabled?
        redirect(file.url)
508
      else
509
        header(*Gitlab::Workhorse.send_url(file.url))
510 511
        status :ok
        body
Kamil Trzcinski's avatar
Kamil Trzcinski committed
512 513 514
      end
    end

515 516 517 518 519 520 521 522 523 524 525
    def track_event(action = action_name, **args)
      category = args.delete(:category) || self.options[:for].name
      raise "invalid category" unless category

      ::Gitlab::Tracking.event(category, action.to_s, **args)
    rescue => error
      Rails.logger.warn( # rubocop:disable Gitlab/RailsLogger
        "Tracking event failed for action: #{action}, category: #{category}, message: #{error.message}"
      )
    end

526 527
    protected

528 529 530 531
    def project_finder_params_visibility_ce
      finder_params = {}
      finder_params[:min_access_level] = params[:min_access_level] if params[:min_access_level]
      finder_params[:visibility_level] = Gitlab::VisibilityLevel.level_value(params[:visibility]) if params[:visibility]
532 533 534 535
      finder_params[:owned] = true if params[:owned].present?
      finder_params[:non_public] = true if params[:membership].present?
      finder_params[:starred] = true if params[:starred].present?
      finder_params[:archived] = archived_param unless params[:archived].nil?
536 537 538 539 540
      finder_params
    end

    def project_finder_params_ce
      finder_params = project_finder_params_visibility_ce
Ravishankar's avatar
Ravishankar committed
541 542
      finder_params[:with_issues_enabled] = true if params[:with_issues_enabled].present?
      finder_params[:with_merge_requests_enabled] = true if params[:with_merge_requests_enabled].present?
543
      finder_params[:without_deleted] = true
544
      finder_params[:search] = params[:search] if params[:search]
545
      finder_params[:search_namespaces] = true if params[:search_namespaces].present?
546 547
      finder_params[:user] = params.delete(:user) if params[:user]
      finder_params[:custom_attributes] = params[:custom_attributes] if params[:custom_attributes]
548 549
      finder_params[:id_after] = params[:id_after] if params[:id_after]
      finder_params[:id_before] = params[:id_before] if params[:id_before]
550 551
      finder_params[:last_activity_after] = params[:last_activity_after] if params[:last_activity_after]
      finder_params[:last_activity_before] = params[:last_activity_before] if params[:last_activity_before]
552
      finder_params[:repository_storage] = params[:repository_storage] if params[:repository_storage]
553 554 555 556 557 558 559 560
      finder_params
    end

    # Overridden in EE
    def project_finder_params_ee
      {}
    end

561
    private
randx's avatar
randx committed
562

563
    # rubocop:disable Gitlab/ModuleWithInstanceVariables
564
    def initial_current_user
565
      return @initial_current_user if defined?(@initial_current_user)
566

567
      begin
568
        @initial_current_user = Gitlab::Auth::UniqueIpsLimiter.limit_user! { find_current_user! }
569
      rescue Gitlab::Auth::UnauthorizedError
570
        unauthorized!
571 572
      end
    end
573
    # rubocop:enable Gitlab/ModuleWithInstanceVariables
574 575 576

    def sudo!
      return unless sudo_identifier
Douwe Maan's avatar
Douwe Maan committed
577

578
      unauthorized! unless initial_current_user
579

580
      unless initial_current_user.admin?
581 582 583
        forbidden!('Must be admin to use sudo')
      end

Douwe Maan's avatar
Douwe Maan committed
584 585
      unless access_token
        forbidden!('Must be authenticated using an OAuth or Personal Access Token to use sudo')
586 587
      end

Douwe Maan's avatar
Douwe Maan committed
588 589
      validate_access_token!(scopes: [:sudo])

590
      sudoed_user = find_user(sudo_identifier)
591
      not_found!("User with ID or username '#{sudo_identifier}'") unless sudoed_user
Douwe Maan's avatar
Douwe Maan committed
592

593
      @current_user = sudoed_user # rubocop:disable Gitlab/ModuleWithInstanceVariables
594 595 596
    end

    def sudo_identifier
597
      @sudo_identifier ||= params[SUDO_PARAM] || env[SUDO_HEADER]
598 599
    end

600
    def secret_token
601
      Gitlab::Shell.secret_token
602
    end
Vinnie Okada's avatar
Vinnie Okada committed
603

604 605 606
    def send_git_blob(repository, blob)
      env['api.format'] = :txt
      content_type 'text/plain'
Heinrich Lee Yu's avatar
Heinrich Lee Yu committed
607
      header['Content-Disposition'] = ActionDispatch::Http::ContentDisposition.format(disposition: 'inline', filename: blob.name)
608 609 610 611

      # Let Workhorse examine the content and determine the better content disposition
      header[Gitlab::Workhorse::DETECT_HEADER] = "true"

Douwe Maan's avatar
Douwe Maan committed
612
      header(*Gitlab::Workhorse.send_git_blob(repository, blob))
613 614
    end

615 616
    def send_git_archive(repository, **kwargs)
      header(*Gitlab::Workhorse.send_git_archive(repository, **kwargs))
617
    end
618

619 620
    def send_artifacts_entry(file, entry)
      header(*Gitlab::Workhorse.send_artifacts_entry(file, entry))
621 622
    end

623 624 625
    # The Grape Error Middleware only has access to `env` but not `params` nor
    # `request`. We workaround this by defining methods that returns the right
    # values.
Stan Hu's avatar
Stan Hu committed
626
    def define_params_for_grape_middleware
627
      self.define_singleton_method(:request) { ActionDispatch::Request.new(env) }
628
      self.define_singleton_method(:params) { request.params.symbolize_keys }
Stan Hu's avatar
Stan Hu committed
629 630 631 632 633 634 635 636 637
    end

    # We could get a Grape or a standard Ruby exception. We should only report anything that
    # is clearly an error.
    def report_exception?(exception)
      return true unless exception.respond_to?(:status)

      exception.status == 500
    end
638 639 640 641 642 643

    def archived_param
      return 'only' if params[:archived]

      params[:archived]
    end
644 645 646 647

    def ip_address
      env["action_dispatch.remote_ip"].to_s || request.ip
    end
Nihad Abbasov's avatar
Nihad Abbasov committed
648 649
  end
end
650

651
API::Helpers.prepend_if_ee('EE::API::Helpers')