1. 07 Apr, 2018 4 commits
  2. 27 Mar, 2018 1 commit
  3. 05 Mar, 2018 1 commit
  4. 28 Feb, 2018 1 commit
  5. 02 Feb, 2018 1 commit
  6. 23 Nov, 2017 2 commits
  7. 17 Nov, 2017 2 commits
  8. 08 Nov, 2017 1 commit
  9. 02 Nov, 2017 2 commits
  10. 18 Sep, 2017 1 commit
  11. 01 Sep, 2017 1 commit
  12. 31 Aug, 2017 1 commit
    • Sean McGivern's avatar
      `current_application_settings` belongs on `Gitlab::CurrentSettings` · e1c28a485974
      Sean McGivern authored
      The initializers including this were doing so at the top level, so every object
      loaded after them had a `current_application_settings` method. However, if
      someone had rack-attack enabled (which was loaded before these initializers), it
      would try to load the API, and fail, because `Gitlab::CurrentSettings` didn't
      have that method.
      
      To fix this:
      
      1. Don't include `Gitlab::CurrentSettings` at the top level. We do not need
         `Object.new.current_application_settings` to work.
      2. Make `Gitlab::CurrentSettings` explicitly `extend self`, as we already use it
         like that in several places.
      3. Change the initializers to use that new form.
      e1c28a485974
  13. 21 Aug, 2017 1 commit
  14. 14 Aug, 2017 1 commit
  15. 02 Aug, 2017 1 commit
  16. 13 Jul, 2017 1 commit
    • Robin Bobbitt's avatar
      Fixes needed when GitLab sign-in is not enabled · 01877dc4c826
      Robin Bobbitt authored
      When sign-in is disabled:
       - skip password expiration checks
       - prevent password reset requests
       - don’t show Password tab in User Settings
       - don’t allow login with username/password for Git over HTTP requests
       - render 404 on requests to Profiles::PasswordsController
      01877dc4c826
  17. 30 Jun, 2017 1 commit
  18. 29 Jun, 2017 1 commit
    • Timothy Andrew's avatar
      Extract a `Gitlab::Scope` class. · 049b539c7df3
      Timothy Andrew authored
      - To represent an authorization scope, such as `api` or `read_user`
      - This is a better abstraction than the hash we were previously using.
      049b539c7df3
  19. 28 Jun, 2017 2 commits
    • Timothy Andrew's avatar
      Implement review comments from @DouweM for !12300. · 9e48fedac607
      Timothy Andrew authored
      - Use a struct for scopes, so we can call `scope.if` instead of `scope[:if]`
      
      - Refactor the "remove scopes whose :if condition returns false" logic to use a
        `select` rather than a `reject`.
      9e48fedac607
    • Timothy Andrew's avatar
      Fix remaining spec failures for !12300. · d788bdb8b6c8
      Timothy Andrew authored
      1. Get the spec for `lib/gitlab/auth.rb` passing.
      
        - Make the `request` argument to `AccessTokenValidationService` optional -
        `auth.rb` doesn't need to pass in a request.
      
        - Pass in scopes in the format `[{ name: 'api' }]` rather than `['api']`, which
        is what `AccessTokenValidationService` now expects.
      
      2. Get the spec for `API::V3::Users` passing
      
      2. Get the spec for `AccessTokenValidationService` passing
      d788bdb8b6c8
  20. 08 Jun, 2017 1 commit
  21. 06 Jun, 2017 1 commit
  22. 05 Jun, 2017 1 commit
    • Z.J. van de Weg's avatar
      Create read_registry scope with JWT auth · 41c7e7a42127
      Z.J. van de Weg authored
      This is the first commit doing mainly 3 things:
      1. create a new scope and allow users to use it
      2. Have the JWTController respond correctly on this
      3. Updates documentation to suggest usage of PATs
      
      There is one gotcha, there will be no support for impersonation tokens, as this
      seems not needed.
      
      Fixes gitlab-org/gitlab-ce#19219
      41c7e7a42127
  23. 21 May, 2017 1 commit
  24. 13 Apr, 2017 1 commit
  25. 07 Mar, 2017 4 commits
  26. 06 Mar, 2017 4 commits
  27. 01 Mar, 2017 1 commit