Read about our upcoming Code of Conduct on this issue

application_setting.rb 13.9 KB
Newer Older
1
2
# frozen_string_literal: true

3
class ApplicationSetting < ApplicationRecord
4
  include CacheableAttributes
5
  include CacheMarkdownField
6
  include TokenAuthenticatable
7
  include ChronicDurationAttribute
8

9
  add_authentication_token_field :runners_registration_token, encrypted: -> { Feature.enabled?(:application_settings_tokens_optional_encryption, default_enabled: true) ? :optional : :required }
10
  add_authentication_token_field :health_check_access_token
11
  add_authentication_token_field :static_objects_external_storage_auth_token
12

13
  belongs_to :instance_administration_project, class_name: "Project"
14
  belongs_to :instance_administrators_group, class_name: "Group"
15

16
17
18
19
20
21
  # Include here so it can override methods from
  # `add_authentication_token_field`
  # We don't prepend for now because otherwise we'll need to
  # fix a lot of tests using allow_any_instance_of
  include ApplicationSettingImplementation

22
23
24
25
26
27
  serialize :restricted_visibility_levels # rubocop:disable Cop/ActiveRecordSerialize
  serialize :import_sources # rubocop:disable Cop/ActiveRecordSerialize
  serialize :disabled_oauth_sign_in_sources, Array # rubocop:disable Cop/ActiveRecordSerialize
  serialize :domain_whitelist, Array # rubocop:disable Cop/ActiveRecordSerialize
  serialize :domain_blacklist, Array # rubocop:disable Cop/ActiveRecordSerialize
  serialize :repository_storages # rubocop:disable Cop/ActiveRecordSerialize
28
  serialize :asset_proxy_whitelist, Array # rubocop:disable Cop/ActiveRecordSerialize
29

30
31
32
33
34
  cache_markdown_field :sign_in_text
  cache_markdown_field :help_page_text
  cache_markdown_field :shared_runners_text, pipeline: :plain_markdown
  cache_markdown_field :after_sign_up_text

35
36
  default_value_for :id, 1

37
38
  chronic_duration_attr_writer :archive_builds_in_human_readable, :archive_builds_in_seconds

39
40
  validates :uuid, presence: true

41
  validates :outbound_local_requests_whitelist,
42
43
44
            length: { maximum: 1_000, message: N_('is too long (maximum is 1000 entries)') },
            allow_nil: false,
            qualified_domain_array: true
45

46
  validates :session_expire_delay,
47
48
            presence: true,
            numericality: { only_integer: true, greater_than_or_equal_to: 0 }
49

50
51
52
53
54
55
  validates :minimum_password_length,
            presence: true,
            numericality: { only_integer: true,
                            greater_than_or_equal_to: DEFAULT_MINIMUM_PASSWORD_LENGTH,
                            less_than_or_equal_to: Devise.password_length.max }

56
  validates :home_page_url,
57
            allow_blank: true,
58
            addressable_url: true,
59
60
61
62
            if: :home_page_url_column_exists?

  validates :help_page_support_url,
            allow_blank: true,
63
            addressable_url: true,
64
            if: :help_page_support_url_column_exists?
65

66
  validates :after_sign_out_path,
67
            allow_blank: true,
68
            addressable_url: true
69

70
  validates :admin_notification_email,
71
            devise_email: true,
72
            allow_blank: true
73

74
  validates :two_factor_grace_period,
75
76
77
78
            numericality: { greater_than_or_equal_to: 0 }

  validates :recaptcha_site_key,
            presence: true,
79
            if: :recaptcha_or_login_protection_enabled
80
81
82

  validates :recaptcha_private_key,
            presence: true,
83
            if: :recaptcha_or_login_protection_enabled
84

85
86
87
88
  validates :akismet_api_key,
            presence: true,
            if: :akismet_enabled

Pawel Chojnacki's avatar
Pawel Chojnacki committed
89
90
91
92
93
94
95
96
97
98
  validates :unique_ips_limit_per_user,
            numericality: { greater_than_or_equal_to: 1 },
            presence: true,
            if: :unique_ips_limit_enabled

  validates :unique_ips_limit_time_window,
            numericality: { greater_than_or_equal_to: 0 },
            presence: true,
            if: :unique_ips_limit_enabled

99
100
101
102
  validates :plantuml_url,
            presence: true,
            if: :plantuml_enabled

103
104
105
106
  validates :sourcegraph_url,
            presence: true,
            if: :sourcegraph_enabled

107
108
109
110
111
  validates :snowplow_collector_hostname,
            presence: true,
            hostname: true,
            if: :snowplow_enabled

112
113
114
115
116
  validates :snowplow_iglu_registry_url,
            addressable_url: true,
            allow_blank: true,
            if: :snowplow_enabled

117
118
119
120
  validates :max_attachment_size,
            presence: true,
            numericality: { only_integer: true, greater_than: 0 }

121
122
123
124
  validates :max_artifacts_size,
            presence: true,
            numericality: { only_integer: true, greater_than: 0 }

125
126
127
128
129
  validates :max_pages_size,
            presence: true,
            numericality: { only_integer: true, greater_than: 0,
                            less_than: ::Gitlab::Pages::MAX_SIZE / 1.megabyte }

130
  validates :default_artifacts_expire_in, presence: true, duration: true
131

132
133
134
135
  validates :container_registry_token_expire_delay,
            presence: true,
            numericality: { only_integer: true, greater_than: 0 }

136
137
  validates :repository_storages, presence: true
  validate :check_repository_storages
138

139
140
141
142
143
  validates :auto_devops_domain,
            allow_blank: true,
            hostname: { allow_numeric_hostname: true, require_valid_tld: true },
            if: :auto_devops_enabled?

144
  validates :enabled_git_access_protocol,
145
            inclusion: { in: %w(ssh http), allow_blank: true }
146

147
  validates :domain_blacklist,
148
            presence: { message: 'Domain blacklist cannot be empty if Blacklist is enabled.' },
149
150
            if: :domain_blacklist_enabled?

Jacob Vosmaer's avatar
Jacob Vosmaer committed
151
152
153
154
155
156
  validates :housekeeping_incremental_repack_period,
            presence: true,
            numericality: { only_integer: true, greater_than: 0 }

  validates :housekeeping_full_repack_period,
            presence: true,
157
            numericality: { only_integer: true, greater_than_or_equal_to: :housekeeping_incremental_repack_period }
Jacob Vosmaer's avatar
Jacob Vosmaer committed
158
159
160

  validates :housekeeping_gc_period,
            presence: true,
161
            numericality: { only_integer: true, greater_than_or_equal_to: :housekeeping_full_repack_period }
Jacob Vosmaer's avatar
Jacob Vosmaer committed
162

163
164
165
166
  validates :terminal_max_session_time,
            presence: true,
            numericality: { only_integer: true, greater_than_or_equal_to: 0 }

167
168
169
170
  validates :polling_interval_multiplier,
            presence: true,
            numericality: { greater_than_or_equal_to: 0 }

171
172
  validates :gitaly_timeout_default,
            presence: true,
173
174
175
176
177
            numericality: {
              only_integer: true,
              greater_than_or_equal_to: 0,
              less_than_or_equal_to: Settings.gitlab.max_request_duration_seconds
            }
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195

  validates :gitaly_timeout_medium,
            presence: true,
            numericality: { only_integer: true, greater_than_or_equal_to: 0 }
  validates :gitaly_timeout_medium,
            numericality: { less_than_or_equal_to: :gitaly_timeout_default },
            if: :gitaly_timeout_default
  validates :gitaly_timeout_medium,
            numericality: { greater_than_or_equal_to: :gitaly_timeout_fast },
            if: :gitaly_timeout_fast

  validates :gitaly_timeout_fast,
            presence: true,
            numericality: { only_integer: true, greater_than_or_equal_to: 0 }
  validates :gitaly_timeout_fast,
            numericality: { less_than_or_equal_to: :gitaly_timeout_default },
            if: :gitaly_timeout_default

196
197
198
199
200
201
  validates :diff_max_patch_bytes,
            presence: true,
            numericality: { only_integer: true,
                            greater_than_or_equal_to: Gitlab::Git::Diff::DEFAULT_MAX_PATCH_BYTES,
                            less_than_or_equal_to: Gitlab::Git::Diff::MAX_PATCH_BYTES_UPPER_BOUND }

202
203
  validates :user_default_internal_regex, js_regex: true, allow_nil: true

204
205
  validates :commit_email_hostname, format: { with: /\A[^@]+\z/ }

206
207
208
209
  validates :archive_builds_in_seconds,
            allow_nil: true,
            numericality: { only_integer: true, greater_than_or_equal_to: 1.day.seconds }

Jan Provaznik's avatar
Jan Provaznik committed
210
211
212
213
  validates :local_markdown_version,
            allow_nil: true,
            numericality: { only_integer: true, greater_than_or_equal_to: 0, less_than: 65536 }

214
215
216
217
218
219
220
221
222
223
224
  validates :asset_proxy_url,
            presence: true,
            allow_blank: false,
            url: true,
            if: :asset_proxy_enabled?

  validates :asset_proxy_secret_key,
            presence: true,
            allow_blank: false,
            if: :asset_proxy_enabled?

225
226
227
228
229
230
231
  validates :static_objects_external_storage_url,
            addressable_url: true, allow_blank: true

  validates :static_objects_external_storage_auth_token,
            presence: true,
            if: :static_objects_external_storage_url?

232
233
234
235
  validates :protected_paths,
            length: { maximum: 100, message: N_('is too long (maximum is 100 entries)') },
            allow_nil: false

236
237
238
  validates :push_event_hooks_limit,
            numericality: { greater_than_or_equal_to: 0 }

239
240
241
  validates :push_event_activities_limit,
            numericality: { greater_than_or_equal_to: 0 }

242
243
  validates :snippet_size_limit, numericality: { only_integer: true, greater_than: 0 }

244
  SUPPORTED_KEY_TYPES.each do |type|
245
    validates :"#{type}_key_restriction", presence: true, key_restriction: { type: type }
246
  end
247

Nick Thomas's avatar
Nick Thomas committed
248
249
  validates :allowed_key_types, presence: true

250
  validates_each :restricted_visibility_levels do |record, attr, value|
Z.J. van de Weg's avatar
Z.J. van de Weg committed
251
    value&.each do |level|
252
      unless Gitlab::VisibilityLevel.options.value?(level)
253
        record.errors.add(attr, _("'%{level}' is not a valid visibility level") % { level: level })
254
255
256
257
      end
    end
  end

258
  validates_each :import_sources do |record, attr, value|
Z.J. van de Weg's avatar
Z.J. van de Weg committed
259
    value&.each do |source|
260
      unless Gitlab::ImportSources.options.value?(source)
261
        record.errors.add(attr, _("'%{source}' is not a import source") % { source: source })
262
263
264
265
      end
    end
  end

Bob Van Landuyt's avatar
Bob Van Landuyt committed
266
267
  validate :terms_exist, if: :enforce_terms?

268
269
270
271
272
  validates :external_authorization_service_default_label,
            presence: true,
            if: :external_authorization_service_enabled

  validates :external_authorization_service_url,
273
            addressable_url: true, allow_blank: true,
274
275
276
277
278
279
280
281
282
283
            if: :external_authorization_service_enabled

  validates :external_authorization_service_timeout,
            numericality: { greater_than: 0, less_than_or_equal_to: 10 },
            if: :external_authorization_service_enabled

  validates :external_auth_client_key,
            presence: true,
            if: -> (setting) { setting.external_auth_client_cert.present? }

284
285
286
287
288
289
290
291
292
293
  validates :lets_encrypt_notification_email,
            devise_email: true,
            format: { without: /@example\.(com|org|net)\z/,
                      message: N_("Let's Encrypt does not accept emails on example.com") },
            allow_blank: true

  validates :lets_encrypt_notification_email,
            presence: true,
            if: :lets_encrypt_terms_of_service_accepted?

294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
  validates :eks_integration_enabled,
            inclusion: { in: [true, false] }

  validates :eks_account_id,
            format: { with: Gitlab::Regex.aws_account_id_regex,
                      message: Gitlab::Regex.aws_account_id_message },
            if: :eks_integration_enabled?

  validates :eks_access_key_id,
            length: { in: 16..128 },
            if: :eks_integration_enabled?

  validates :eks_secret_access_key,
            presence: true,
            if: :eks_integration_enabled?

310
311
312
313
314
315
  validates_with X509CertificateCredentialsValidator,
                 certificate: :external_auth_client_cert,
                 pkey: :external_auth_client_key,
                 pass: :external_auth_client_key_pass,
                 if: -> (setting) { setting.external_auth_client_cert.present? }

316
317
318
319
320
321
  validates :default_ci_config_path,
    format: { without: %r{(\.{2}|\A/)},
              message: N_('cannot include leading slash or directory traversal.') },
    length: { maximum: 255 },
    allow_blank: true

322
323
324
325
326
327
  attr_encrypted :asset_proxy_secret_key,
                 mode: :per_attribute_iv,
                 key: Settings.attr_encrypted_db_key_base_truncated,
                 algorithm: 'aes-256-cbc',
                 insecure_mode: true

328
329
330
331
332
333
334
335
  private_class_method def self.encryption_options_base_truncated_aes_256_gcm
    {
      mode: :per_attribute_iv,
      key: Settings.attr_encrypted_db_key_base_truncated,
      algorithm: 'aes-256-gcm',
      encode: true
    }
  end
336

337
338
339
340
341
342
343
344
345
346
  attr_encrypted :external_auth_client_key, encryption_options_base_truncated_aes_256_gcm
  attr_encrypted :external_auth_client_key_pass, encryption_options_base_truncated_aes_256_gcm
  attr_encrypted :lets_encrypt_private_key, encryption_options_base_truncated_aes_256_gcm
  attr_encrypted :eks_secret_access_key, encryption_options_base_truncated_aes_256_gcm
  attr_encrypted :akismet_api_key, encryption_options_base_truncated_aes_256_gcm
  attr_encrypted :elasticsearch_aws_secret_access_key, encryption_options_base_truncated_aes_256_gcm
  attr_encrypted :recaptcha_private_key, encryption_options_base_truncated_aes_256_gcm
  attr_encrypted :recaptcha_site_key, encryption_options_base_truncated_aes_256_gcm
  attr_encrypted :slack_app_secret, encryption_options_base_truncated_aes_256_gcm
  attr_encrypted :slack_app_verification_token, encryption_options_base_truncated_aes_256_gcm
347

348
  before_validation :ensure_uuid!
349

350
  before_save :ensure_runners_registration_token
351
  before_save :ensure_health_check_access_token
352

353
  after_commit do
Bob Van Landuyt's avatar
Bob Van Landuyt committed
354
    reset_memoized_terms
355
  end
356
  after_commit :expire_performance_bar_allowed_user_ids_cache, if: -> { previous_changes.key?('performance_bar_allowed_group_id') }
357

358
359
360
361
  def sourcegraph_url_is_com?
    !!(sourcegraph_url =~ /\Ahttps:\/\/(www\.)?sourcegraph\.com/)
  end

362
  def self.create_from_defaults
363
364
365
    transaction(requires_new: true) do
      super
    end
366
367
368
369
  rescue ActiveRecord::RecordNotUnique
    # We already have an ApplicationSetting record, so just return it.
    current_without_cache
  end
370
371
372
373
374
375
376
377

  # By default, the backend is Rails.cache, which uses
  # ActiveSupport::Cache::RedisStore. Since loading ApplicationSetting
  # can cause a significant amount of load on Redis, let's cache it in
  # memory.
  def self.cache_backend
    Gitlab::ThreadMemoryCache.cache_backend
  end
378
379
380
381

  def recaptcha_or_login_protection_enabled
    recaptcha_enabled || login_recaptcha_protection_enabled
  end
382
end
383
384

ApplicationSetting.prepend_if_ee('EE::ApplicationSetting')