BigW Consortium Gitlab

git_access.rb 5.52 KB
Newer Older
1 2 3 4 5
module Gitlab
  class GitAccess
    DOWNLOAD_COMMANDS = %w{ git-upload-pack git-upload-archive }
    PUSH_COMMANDS = %w{ git-receive-pack }

6
    attr_reader :actor, :project
7

8 9 10 11 12 13 14 15
    def initialize(actor, project)
      @actor    = actor
      @project  = project
    end

    def user
      return @user if defined?(@user)

16
      @user =
17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
        case actor
        when User
          actor
        when DeployKey
          nil
        when Key
          actor.user
        end
    end

    def deploy_key
      actor if actor.is_a?(DeployKey)
    end

    def can_push_to_branch?(ref)
32
      return false unless user
33

34
      if project.protected_branch?(ref) && !project.developers_can_push_to_protected_branch?(ref)
35 36 37 38 39 40
        user.can?(:push_code_to_protected_branches, project)
      else
        user.can?(:push_code, project)
      end
    end

41 42 43 44 45 46 47 48 49 50 51
    def can_read_project?
      if user
        user.can?(:read_project, project)
      elsif deploy_key
        deploy_key.projects.include?(project)
      else
        false
      end
    end

    def check(cmd, changes = nil)
52 53 54 55 56 57 58 59 60 61 62 63
      unless actor
        return build_status_object(false, "No user or key was provided.")
      end

      if user && !user_allowed?
        return build_status_object(false, "Your account has been blocked.")
      end

      unless project && can_read_project?
        return build_status_object(false, 'The project you were looking for could not be found.')
      end

64 65
      case cmd
      when *DOWNLOAD_COMMANDS
66
        download_access_check
67
      when *PUSH_COMMANDS
68
        push_access_check(changes)
69
      else
70
        build_status_object(false, "The command you're trying to execute is not allowed.")
71 72 73
      end
    end

74 75 76 77
    def download_access_check
      if user
        user_download_access_check
      elsif deploy_key
78
        build_status_object(true)
79 80 81 82 83
      else
        raise 'Wrong actor'
      end
    end

84 85 86 87
    def push_access_check(changes)
      if user
        user_push_access_check(changes)
      elsif deploy_key
88
        build_status_object(false, "Deploy keys are not allowed to push code.")
89 90 91 92 93 94
      else
        raise 'Wrong actor'
      end
    end

    def user_download_access_check
95 96
      unless user.can?(:download_code, project)
        return build_status_object(false, "You are not allowed to download code from this project.")
97 98
      end

99
      build_status_object(true)
100 101 102
    end

    def user_push_access_check(changes)
103 104 105 106 107
      if changes.blank?
        return build_status_object(true)
      end

      unless project.repository.exists?
108
        return build_status_object(false, "A repository for this project does not exist yet.")
109
      end
110 111 112 113

      changes = changes.lines if changes.kind_of?(String)

      # Iterate over all changes to find if user allowed all of them to be applied
114
      changes.map(&:strip).reject(&:blank?).each do |change|
115
        status = change_access_check(change)
116
        unless status.allowed?
117
          # If user does not have access to make at least one change - cancel all push
118
          return status
119 120 121
        end
      end

122
      build_status_object(true)
123 124
    end

125
    def change_access_check(change)
126 127
      oldrev, newrev, ref = change.split(' ')

128
      action =
129 130 131 132 133 134 135 136
        if project.protected_branch?(branch_name(ref))
          protected_branch_action(oldrev, newrev, branch_name(ref))
        elsif protected_tag?(tag_name(ref))
          # Prevent any changes to existing git tag unless user has permissions
          :admin_project
        else
          :push_code
        end
137

138
      unless user.can?(action, project)
Douwe Maan committed
139
        status =
140 141 142 143 144 145 146 147 148 149 150
          case action
          when :force_push_code_to_protected_branches
            build_status_object(false, "You are not allowed to force push code to a protected branch on this project.")
          when :remove_protected_branches
            build_status_object(false, "You are not allowed to deleted protected branches from this project.")
          when :push_code_to_protected_branches
            build_status_object(false, "You are not allowed to push code to protected branches on this project.")
          when :admin_project
            build_status_object(false, "You are not allowed to change existing tags on this project.")
          else # :push_code
            build_status_object(false, "You are not allowed to push code to this project.")
151
          end
Douwe Maan committed
152
        return status
153
      end
154 155

      build_status_object(true)
156 157
    end

158
    def forced_push?(oldrev, newrev)
159
      Gitlab::ForcePushCheck.force_push?(project, oldrev, newrev)
160 161 162 163
    end

    private

164
    def protected_branch_action(oldrev, newrev, branch_name)
165
      # we dont allow force push to protected branch
166
      if forced_push?(oldrev, newrev)
167
        :force_push_code_to_protected_branches
168
      elsif Gitlab::Git.blank_ref?(newrev)
169 170
        # and we dont allow remove of protected branch
        :remove_protected_branches
171
      elsif project.developers_can_push_to_protected_branch?(branch_name)
172
        :push_code
173
      else
174
        :push_code_to_protected_branches
175 176 177
      end
    end

178
    def protected_tag?(tag_name)
179 180 181
      project.repository.tag_names.include?(tag_name)
    end

182
    def user_allowed?
183
      Gitlab::UserAccess.allowed?(user)
184
    end
185 186 187

    def branch_name(ref)
      ref = ref.to_s
188 189
      if Gitlab::Git.branch_ref?(ref)
        Gitlab::Git.ref_name(ref)
190 191 192 193 194 195 196
      else
        nil
      end
    end

    def tag_name(ref)
      ref = ref.to_s
197 198
      if Gitlab::Git.tag_ref?(ref)
        Gitlab::Git.ref_name(ref)
199 200 201 202
      else
        nil
      end
    end
203 204 205 206 207 208

    protected

    def build_status_object(status, message = '')
      GitAccessStatus.new(status, message)
    end
209 210
  end
end