BigW Consortium Gitlab

git_access.rb 5.67 KB
Newer Older
1 2 3 4 5
module Gitlab
  class GitAccess
    DOWNLOAD_COMMANDS = %w{ git-upload-pack git-upload-archive }
    PUSH_COMMANDS = %w{ git-receive-pack }

6
    attr_reader :actor, :project
7

8 9 10 11 12 13 14 15
    def initialize(actor, project)
      @actor    = actor
      @project  = project
    end

    def user
      return @user if defined?(@user)

16
      @user =
17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
        case actor
        when User
          actor
        when DeployKey
          nil
        when Key
          actor.user
        end
    end

    def deploy_key
      actor if actor.is_a?(DeployKey)
    end

    def can_push_to_branch?(ref)
32
      return false unless user
33

34
      if project.protected_branch?(ref) && !project.developers_can_push_to_protected_branch?(ref)
35 36 37 38 39 40
        user.can?(:push_code_to_protected_branches, project)
      else
        user.can?(:push_code, project)
      end
    end

41 42 43 44 45 46 47 48 49 50 51
    def can_read_project?
      if user
        user.can?(:read_project, project)
      elsif deploy_key
        deploy_key.projects.include?(project)
      else
        false
      end
    end

    def check(cmd, changes = nil)
52 53 54 55 56 57 58 59 60 61 62 63
      unless actor
        return build_status_object(false, "No user or key was provided.")
      end

      if user && !user_allowed?
        return build_status_object(false, "Your account has been blocked.")
      end

      unless project && can_read_project?
        return build_status_object(false, 'The project you were looking for could not be found.')
      end

64 65
      case cmd
      when *DOWNLOAD_COMMANDS
66
        download_access_check
67
      when *PUSH_COMMANDS
68
        push_access_check(changes)
69
      else
70
        build_status_object(false, "The command you're trying to execute is not allowed.")
71 72 73
      end
    end

74 75 76 77
    def download_access_check
      if user
        user_download_access_check
      elsif deploy_key
78
        build_status_object(true)
79 80 81 82 83
      else
        raise 'Wrong actor'
      end
    end

84 85 86 87
    def push_access_check(changes)
      if user
        user_push_access_check(changes)
      elsif deploy_key
88
        build_status_object(false, "Deploy keys are not allowed to push code.")
89 90 91 92 93 94
      else
        raise 'Wrong actor'
      end
    end

    def user_download_access_check
95 96
      unless user.can?(:download_code, project)
        return build_status_object(false, "You are not allowed to download code from this project.")
97 98
      end

99
      build_status_object(true)
100 101 102
    end

    def user_push_access_check(changes)
103 104 105 106 107
      if changes.blank?
        return build_status_object(true)
      end

      unless project.repository.exists?
108
        return build_status_object(false, "A repository for this project does not exist yet.")
109
      end
110 111 112 113

      changes = changes.lines if changes.kind_of?(String)

      # Iterate over all changes to find if user allowed all of them to be applied
114
      changes.map(&:strip).reject(&:blank?).each do |change|
115
        status = change_access_check(change)
116
        unless status.allowed?
117
          # If user does not have access to make at least one change - cancel all push
118
          return status
119 120 121
        end
      end

122
      build_status_object(true)
123 124
    end

125 126 127 128 129
    def can_user_do_action?(action)
      @permission_cache ||= {}
      @permission_cache[action] ||= user.can?(action, project)
    end

130
    def change_access_check(change)
131 132
      oldrev, newrev, ref = change.split(' ')

133
      action =
134 135
        if project.protected_branch?(branch_name(ref))
          protected_branch_action(oldrev, newrev, branch_name(ref))
136
        elsif (tag_ref = tag_name(ref)) && protected_tag?(tag_ref)
137 138 139 140 141
          # Prevent any changes to existing git tag unless user has permissions
          :admin_project
        else
          :push_code
        end
142

143
      unless can_user_do_action?(action)
Douwe Maan committed
144
        status =
145 146 147 148 149 150 151 152 153 154 155
          case action
          when :force_push_code_to_protected_branches
            build_status_object(false, "You are not allowed to force push code to a protected branch on this project.")
          when :remove_protected_branches
            build_status_object(false, "You are not allowed to deleted protected branches from this project.")
          when :push_code_to_protected_branches
            build_status_object(false, "You are not allowed to push code to protected branches on this project.")
          when :admin_project
            build_status_object(false, "You are not allowed to change existing tags on this project.")
          else # :push_code
            build_status_object(false, "You are not allowed to push code to this project.")
156
          end
Douwe Maan committed
157
        return status
158
      end
159 160

      build_status_object(true)
161 162
    end

163
    def forced_push?(oldrev, newrev)
164
      Gitlab::ForcePushCheck.force_push?(project, oldrev, newrev)
165 166 167 168
    end

    private

169
    def protected_branch_action(oldrev, newrev, branch_name)
170
      # we dont allow force push to protected branch
171
      if forced_push?(oldrev, newrev)
172
        :force_push_code_to_protected_branches
173
      elsif Gitlab::Git.blank_ref?(newrev)
174 175
        # and we dont allow remove of protected branch
        :remove_protected_branches
176
      elsif project.developers_can_push_to_protected_branch?(branch_name)
177
        :push_code
178
      else
179
        :push_code_to_protected_branches
180 181 182
      end
    end

183
    def protected_tag?(tag_name)
184
      project.repository.tag_exists?(tag_name)
185 186
    end

187
    def user_allowed?
188
      Gitlab::UserAccess.allowed?(user)
189
    end
190 191 192

    def branch_name(ref)
      ref = ref.to_s
193 194
      if Gitlab::Git.branch_ref?(ref)
        Gitlab::Git.ref_name(ref)
195 196 197 198 199 200 201
      else
        nil
      end
    end

    def tag_name(ref)
      ref = ref.to_s
202 203
      if Gitlab::Git.tag_ref?(ref)
        Gitlab::Git.ref_name(ref)
204 205 206 207
      else
        nil
      end
    end
208 209 210 211 212 213

    protected

    def build_status_object(status, message = '')
      GitAccessStatus.new(status, message)
    end
214 215
  end
end