Read about our upcoming Code of Conduct on this issue

helpers.rb 4.35 KB
Newer Older
1
module API
Nihad Abbasov's avatar
Nihad Abbasov committed
2
  module APIHelpers
3
4
5
6
7
    PRIVATE_TOKEN_HEADER = "HTTP_PRIVATE_TOKEN"
    PRIVATE_TOKEN_PARAM = :private_token
    SUDO_HEADER ="HTTP_SUDO"
    SUDO_PARAM = :sudo

Nihad Abbasov's avatar
Nihad Abbasov committed
8
    def current_user
9
      private_token = (params[PRIVATE_TOKEN_PARAM] || env[PRIVATE_TOKEN_HEADER]).to_s
skv's avatar
skv committed
10
      @current_user ||= User.find_by(authentication_token: private_token)
11
12
13
14
15

      unless @current_user && Gitlab::UserAccess.allowed?(@current_user)
        return nil
      end

16
      identifier = sudo_identifier()
17

18
19
20
      # If the sudo is the current user do nothing
      if (identifier && !(@current_user.id == identifier || @current_user.username == identifier))
        render_api_error!('403 Forbidden: Must be admin to use sudo', 403) unless @current_user.is_admin?
Nihad Abbasov's avatar
Nihad Abbasov committed
21
        @current_user = User.by_username_or_id(identifier)
Nihad Abbasov's avatar
Nihad Abbasov committed
22
        not_found!("No user id or username for: #{identifier}") if @current_user.nil?
23
      end
24

25
26
27
28
      @current_user
    end

    def sudo_identifier()
29
      identifier ||= params[SUDO_PARAM] ||= env[SUDO_HEADER]
30

31
      # Regex for integers
32
33
34
35
36
      if (!!(identifier =~ /^[0-9]+$/))
        identifier.to_i
      else
        identifier
      end
Nihad Abbasov's avatar
Nihad Abbasov committed
37
38
    end

Nihad Abbasov's avatar
Nihad Abbasov committed
39
    def user_project
40
      @project ||= find_project(params[:id])
41
42
43
      @project || not_found!
    end

44
    def find_project(id)
45
      project = Project.find_with_namespace(id) || Project.find_by(id: id)
46
47
48

      if project && can?(current_user, :read_project, project)
        project
49
      else
50
        nil
51
      end
Nihad Abbasov's avatar
Nihad Abbasov committed
52
53
    end

54
55
56
57
58
59
    def paginate(relation)
      per_page  = params[:per_page].to_i
      paginated = relation.page(params[:page]).per(per_page)
      add_pagination_headers(paginated, per_page)

      paginated
Nihad Abbasov's avatar
Nihad Abbasov committed
60
61
    end

Nihad Abbasov's avatar
Nihad Abbasov committed
62
    def authenticate!
63
      unauthorized! unless current_user
Nihad Abbasov's avatar
Nihad Abbasov committed
64
    end
randx's avatar
randx committed
65

66
67
68
69
    def authenticated_as_admin!
      forbidden! unless current_user.is_admin?
    end

randx's avatar
randx committed
70
71
    def authorize! action, subject
      unless abilities.allowed?(current_user, action, subject)
72
        forbidden!
randx's avatar
randx committed
73
74
75
      end
    end

Dmitriy Zaporozhets's avatar
Dmitriy Zaporozhets committed
76
77
78
79
    def authorize_push_project
      authorize! :push_code, user_project
    end

80
81
82
83
    def authorize_admin_project
      authorize! :admin_project, user_project
    end

84
85
86
87
    def can?(object, action, subject)
      abilities.allowed?(object, action, subject)
    end

88
89
90
91
92
93
94
95
96
97
98
    # Checks the occurrences of required attributes, each attribute must be present in the params hash
    # or a Bad Request error is invoked.
    #
    # Parameters:
    #   keys (required) - A hash consisting of keys that must be present
    def required_attributes!(keys)
      keys.each do |key|
        bad_request!(key) unless params[key].present?
      end
    end

Alex Denisov's avatar
Alex Denisov committed
99
    def attributes_for_keys(keys)
Alex Denisov's avatar
Alex Denisov committed
100
      attrs = {}
101

Alex Denisov's avatar
Alex Denisov committed
102
      keys.each do |key|
103
104
105
        if params[key].present? or (params.has_key?(key) and params[key] == false)
          attrs[key] = params[key]
        end
Alex Denisov's avatar
Alex Denisov committed
106
      end
107
108

      ActionController::Parameters.new(attrs).permit!
Alex Denisov's avatar
Alex Denisov committed
109
110
    end

111
112
113
    # error helpers

    def forbidden!
Alex Denisov's avatar
Alex Denisov committed
114
      render_api_error!('403 Forbidden', 403)
115
116
    end

117
118
119
120
121
122
    def bad_request!(attribute)
      message = ["400 (Bad request)"]
      message << "\"" + attribute.to_s + "\" not given"
      render_api_error!(message.join(' '), 400)
    end

123
124
125
126
    def not_found!(resource = nil)
      message = ["404"]
      message << resource if resource
      message << "Not Found"
Alex Denisov's avatar
Alex Denisov committed
127
      render_api_error!(message.join(' '), 404)
128
129
130
    end

    def unauthorized!
Alex Denisov's avatar
Alex Denisov committed
131
      render_api_error!('401 Unauthorized', 401)
132
133
134
    end

    def not_allowed!
Alex Denisov's avatar
Alex Denisov committed
135
136
137
138
139
      render_api_error!('Method Not Allowed', 405)
    end

    def render_api_error!(message, status)
      error!({'message' => message}, status)
140
141
    end

142
    private
randx's avatar
randx committed
143

144
145
146
147
148
149
150
151
152
153
154
155
    def add_pagination_headers(paginated, per_page)
      request_url = request.url.split('?').first

      links = []
      links << %(<#{request_url}?page=#{paginated.current_page - 1}&per_page=#{per_page}>; rel="prev") unless paginated.first_page?
      links << %(<#{request_url}?page=#{paginated.current_page + 1}&per_page=#{per_page}>; rel="next") unless paginated.last_page?
      links << %(<#{request_url}?page=1&per_page=#{per_page}>; rel="first")
      links << %(<#{request_url}?page=#{paginated.total_pages}&per_page=#{per_page}>; rel="last")

      header 'Link', links.join(', ')
    end

randx's avatar
randx committed
156
157
    def abilities
      @abilities ||= begin
158
159
160
161
                       abilities = Six.new
                       abilities << Ability
                       abilities
                     end
randx's avatar
randx committed
162
    end
Nihad Abbasov's avatar
Nihad Abbasov committed
163
164
  end
end