git_access.rb 10 KB
Newer Older
1
2
# Check a user's access to perform a git action. All public methods in this
# class return an instance of `GitlabAccessStatus`
3
4
module Gitlab
  class GitAccess
5
6
    include Gitlab::Utils::StrongMemoize

7
    UnauthorizedError = Class.new(StandardError)
8
    NotFoundError = Class.new(StandardError)
9
    ProjectCreationError = Class.new(StandardError)
10
    ProjectMovedError = Class.new(NotFoundError)
11
12
13
14

    ERROR_MESSAGES = {
      upload: 'You are not allowed to upload code for this project.',
      download: 'You are not allowed to download code from this project.',
15
16
17
      auth_upload: 'You are not allowed to upload code.',
      auth_download: 'You are not allowed to download code.',
      deploy_key_upload: 'This deploy key does not have write access to this project.',
Michael Kozono's avatar
Michael Kozono committed
18
19
20
      no_repo: 'A repository for this project does not exist yet.',
      project_not_found: 'The project you were looking for could not be found.',
      account_blocked: 'Your account has been blocked.',
21
      command_not_allowed: "The command you're trying to execute is not allowed.",
Michael Kozono's avatar
Michael Kozono committed
22
      upload_pack_disabled_over_http: 'Pulling over HTTP is not allowed.',
23
      receive_pack_disabled_over_http: 'Pushing over HTTP is not allowed.',
Toon Claes's avatar
Toon Claes committed
24
      read_only: 'The repository is temporarily read-only. Please try again later.',
25
      cannot_push_to_read_only: "You can't push code to a read-only GitLab instance."
Douwe Maan's avatar
Douwe Maan committed
26
    }.freeze
27

Douwe Maan's avatar
Douwe Maan committed
28
29
    DOWNLOAD_COMMANDS = %w{ git-upload-pack git-upload-archive }.freeze
    PUSH_COMMANDS = %w{ git-receive-pack }.freeze
30
    ALL_COMMANDS = DOWNLOAD_COMMANDS + PUSH_COMMANDS
31

32
    attr_reader :actor, :project, :protocol, :authentication_abilities, :namespace_path, :project_path, :redirected_path, :auth_result_type
33

34
    def initialize(actor, project, protocol, authentication_abilities:, namespace_path: nil, project_path: nil, redirected_path: nil, auth_result_type: nil)
35
36
      @actor    = actor
      @project  = project
37
      @protocol = protocol
38
      @authentication_abilities = authentication_abilities
39
40
41
      @namespace_path = namespace_path
      @project_path = project_path
      @redirected_path = redirected_path
42
      @auth_result_type = auth_result_type
43
44
    end

45
    def check(cmd, changes)
46
      check_protocol!
Nick Thomas's avatar
Nick Thomas committed
47
      check_valid_actor!
48
      check_active_user!
49
      check_authentication_abilities!(cmd)
50
      check_command_disabled!(cmd)
51
      check_command_existence!(cmd)
52
53
54
55
56
      check_db_accessibility!(cmd)

      ensure_project_on_push!(cmd, changes)

      check_project_accessibility!
Bob Van Landuyt's avatar
Bob Van Landuyt committed
57
      add_project_moved_message!
58
      check_repository_existence!
59

60
61
      case cmd
      when *DOWNLOAD_COMMANDS
62
        check_download_access!
63
      when *PUSH_COMMANDS
64
        check_push_access!(changes)
65
      end
66

67
      true
68
69
    end

70
    def guest_can_download_code?
71
72
73
      Guest.can?(:download_code, project)
    end

74
    def user_can_download_code?
75
      authentication_abilities.include?(:download_code) && user_access.can_do_action?(:download_code)
76
77
    end

78
    def build_can_download_code?
79
      authentication_abilities.include?(:build_download_code) && user_access.can_do_action?(:build_download_code)
80
81
    end

82
83
84
85
86
87
    def request_from_ci_build?
      return false unless protocol == 'http'

      auth_result_type == :build || auth_result_type == :ci
    end

88
89
90
91
    def protocol_allowed?
      Gitlab::ProtocolAccess.allowed?(protocol)
    end

92
93
    private

94
95
96
97
98
99
100
101
    def check_valid_actor!
      return unless actor.is_a?(Key)

      unless actor.valid?
        raise UnauthorizedError, "Your SSH key #{actor.errors[:key].first}."
      end
    end

102
    def check_protocol!
103
104
      return if request_from_ci_build?

105
106
107
108
109
110
111
      unless protocol_allowed?
        raise UnauthorizedError, "Git access over #{protocol.upcase} is not allowed"
      end
    end

    def check_active_user!
      if user && !user_access.allowed?
Michael Kozono's avatar
Michael Kozono committed
112
        raise UnauthorizedError, ERROR_MESSAGES[:account_blocked]
113
114
115
      end
    end

116
117
118
119
120
121
122
123
124
125
126
127
128
    def check_authentication_abilities!(cmd)
      case cmd
      when *DOWNLOAD_COMMANDS
        unless authentication_abilities.include?(:download_code) || authentication_abilities.include?(:build_download_code)
          raise UnauthorizedError, ERROR_MESSAGES[:auth_download]
        end
      when *PUSH_COMMANDS
        unless authentication_abilities.include?(:push_code)
          raise UnauthorizedError, ERROR_MESSAGES[:auth_upload]
        end
      end
    end

129
130
    def check_project_accessibility!
      if project.blank? || !can_read_project?
131
        raise NotFoundError, ERROR_MESSAGES[:project_not_found]
132
133
134
      end
    end

Bob Van Landuyt's avatar
Bob Van Landuyt committed
135
    def add_project_moved_message!
136
      return if redirected_path.nil?
137

138
      project_moved = Checks::ProjectMoved.new(project, user, protocol, redirected_path)
139

Bob Van Landuyt's avatar
Bob Van Landuyt committed
140
      project_moved.add_message
141
142
    end

143
    def check_command_disabled!(cmd)
Michael Kozono's avatar
Michael Kozono committed
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
      if upload_pack?(cmd)
        check_upload_pack_disabled!
      elsif receive_pack?(cmd)
        check_receive_pack_disabled!
      end
    end

    def check_upload_pack_disabled!
      if http? && upload_pack_disabled_over_http?
        raise UnauthorizedError, ERROR_MESSAGES[:upload_pack_disabled_over_http]
      end
    end

    def check_receive_pack_disabled!
      if http? && receive_pack_disabled_over_http?
        raise UnauthorizedError, ERROR_MESSAGES[:receive_pack_disabled_over_http]
160
161
162
      end
    end

163
164
    def check_command_existence!(cmd)
      unless ALL_COMMANDS.include?(cmd)
Michael Kozono's avatar
Michael Kozono committed
165
        raise UnauthorizedError, ERROR_MESSAGES[:command_not_allowed]
166
167
168
      end
    end

169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
    def check_db_accessibility!(cmd)
      return unless receive_pack?(cmd)

      if Gitlab::Database.read_only?
        raise UnauthorizedError, push_to_read_only_message
      end
    end

    def ensure_project_on_push!(cmd, changes)
      return if project || deploy_key?
      return unless receive_pack?(cmd) && changes == '_any' && authentication_abilities.include?(:push_code)

      namespace = Namespace.find_by_full_path(namespace_path)

      return unless user&.can?(:create_projects, namespace)

      project_params = {
        path: project_path,
        namespace_id: namespace.id,
        visibility_level: Gitlab::VisibilityLevel::PRIVATE
      }

      project = Projects::CreateService.new(user, project_params).execute

      unless project.saved?
        raise ProjectCreationError, "Could not create project: #{project.errors.full_messages.join(', ')}"
      end

      @project = project
      user_access.project = @project

      Checks::ProjectCreated.new(project, user, protocol).add_message
    end

    def check_repository_existence!
204
      unless repository.exists?
205
        raise NotFoundError, ERROR_MESSAGES[:no_repo]
206
207
208
      end
    end

209
    def check_download_access!
210
      passed = deploy_key? ||
211
        deploy_token? ||
212
        user_can_download_code? ||
213
214
        build_can_download_code? ||
        guest_can_download_code?
215
216
217
218
219
220

      unless passed
        raise UnauthorizedError, ERROR_MESSAGES[:download]
      end
    end

221
    def check_push_access!(changes)
222
      if project.repository_read_only?
Toon Claes's avatar
Toon Claes committed
223
224
225
        raise UnauthorizedError, ERROR_MESSAGES[:read_only]
      end

226
      if deploy_key?
227
228
229
        unless deploy_key.can_push_to?(project)
          raise UnauthorizedError, ERROR_MESSAGES[:deploy_key_upload]
        end
230
      elsif user
231
        # User access is verified in check_change_access!
232
233
234
235
      else
        raise UnauthorizedError, ERROR_MESSAGES[:upload]
      end

236
      return if changes.blank? # Allow access this is needed for EE.
237

238
      check_change_access!(changes)
239
240
    end

241
    def check_change_access!(changes)
242
243
244
245
246
      # If there are worktrees with a HEAD pointing to a non-existent object,
      # calls to `git rev-list --all` will fail in git 2.15+. This should also
      # clear stale lock files.
      project.repository.clean_stale_repository_files

247
248
249
      changes_list = Gitlab::ChangesList.new(changes)

      # Iterate over all changes to find if user allowed all of them to be applied
250
251
252
      changes_list.each.with_index do |change, index|
        first_change = index == 0

253
254
        # If user does not have access to make at least one change, cancel all
        # push by allowing the exception to bubble up
255
        check_single_change_access(change, skip_lfs_integrity_check: !first_change)
256
257
258
      end
    end

259
    def check_single_change_access(change, skip_lfs_integrity_check: false)
260
      Checks::ChangeAccess.new(
261
262
263
        change,
        user_access: user_access,
        project: project,
264
        skip_authorization: deploy_key?,
265
        skip_lfs_integrity_check: skip_lfs_integrity_check,
266
267
        protocol: protocol
      ).exec
268
269
    end

270
    def deploy_key
271
272
273
274
275
      actor if deploy_key?
    end

    def deploy_key?
      actor.is_a?(DeployKey)
276
    end
277

278
279
280
281
282
283
284
285
    def deploy_token
      actor if deploy_token?
    end

    def deploy_token?
      actor.is_a?(DeployToken)
    end

286
287
288
289
    def ci?
      actor == :ci
    end

290
    def can_read_project?
291
      if deploy_key?
292
        deploy_key.has_access_to?(project)
293
294
      elsif deploy_token?
        deploy_token.has_access_to?(project)
295
      elsif user
296
        user.can?(:read_project, project)
297
298
      elsif ci?
        true # allow CI (build without a user) for backwards compatibility
299
      end || Guest.can?(:read_project, project)
300
301
    end

302
303
304
305
306
307
308
309
310
311
312
313
    def http?
      protocol == 'http'
    end

    def upload_pack?(command)
      command == 'git-upload-pack'
    end

    def receive_pack?(command)
      command == 'git-receive-pack'
    end

Michael Kozono's avatar
Michael Kozono committed
314
315
316
317
318
319
320
321
    def upload_pack_disabled_over_http?
      !Gitlab.config.gitlab_shell.upload_pack
    end

    def receive_pack_disabled_over_http?
      !Gitlab.config.gitlab_shell.receive_pack
    end

322
323
    protected

324
325
326
327
328
329
330
    def user
      return @user if defined?(@user)

      @user =
        case actor
        when User
          actor
331
332
        when DeployKey
          nil
333
        when Key
334
          actor.user
335
336
        when :ci
          nil
337
338
        end
    end
339
340
341
342
343
344
345
346

    def user_access
      @user_access ||= if ci?
                         CiAccess.new
                       else
                         UserAccess.new(user, project: project)
                       end
    end
347
348
349
350

    def push_to_read_only_message
      ERROR_MESSAGES[:cannot_push_to_read_only]
    end
351
352
353
354

    def repository
      project.repository
    end
355
356
  end
end