BigW Consortium Gitlab
Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
G
gitlab-ce
Project
Overview
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
Registry
Registry
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Commits
Issue Boards
Open sidebar
Forest Godfrey
gitlab-ce
Commits
fc2d985b
Commit
fc2d985b
authored
May 12, 2016
by
Kamil Trzcinski
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Fix CI tests
parent
c78b97df
Hide whitespace changes
Inline
Side-by-side
Showing
8 changed files
with
38 additions
and
39 deletions
+38
-39
jwt_controller.rb
app/controllers/jwt_controller.rb
+1
-1
container_registry_authentication_service.rb
...services/jwt/container_registry_authentication_service.rb
+3
-3
1_settings.rb
config/initializers/1_settings.rb
+1
-1
rsa_token.rb
lib/jwt/rsa_token.rb
+1
-1
token.rb
lib/jwt/token.rb
+2
-3
rsa_token_spec.rb
spec/lib/jwt/rsa_token_spec.rb
+1
-1
token_spec.rb
spec/lib/jwt/token_spec.rb
+1
-1
container_registry_authentication_service_spec.rb
...ces/jwt/container_registry_authentication_service_spec.rb
+28
-28
No files found.
app/controllers/jwt_controller.rb
View file @
fc2d985b
...
...
@@ -3,7 +3,7 @@ class JwtController < ApplicationController
skip_before_action
:verify_authenticity_token
SERVICES
=
{
'container_registry'
=>
J
wt
::
ContainerRegistryAuthenticationService
,
'container_registry'
=>
J
WT
::
ContainerRegistryAuthenticationService
,
}
def
auth
...
...
app/services/jwt/container_registry_authentication_service.rb
View file @
fc2d985b
module
J
wt
module
J
WT
class
ContainerRegistryAuthenticationService
<
BaseService
def
execute
if
params
[
:offline_token
]
return
error
(
'forbidden'
,
403
)
unless
current_user
end
return
error
(
'forbidden'
,
401
)
if
scopes
.
empty
?
return
error
(
'forbidden'
,
401
)
if
scopes
.
blank
?
{
token:
authorized_token
(
scopes
).
encoded
}
end
...
...
@@ -13,7 +13,7 @@ module Jwt
private
def
authorized_token
(
access
)
token
=
::
J
wt
::
RSAToken
.
new
(
registry
.
key
)
token
=
::
J
WT
::
RSAToken
.
new
(
registry
.
key
)
token
.
issuer
=
registry
.
issuer
token
.
audience
=
params
[
:service
]
token
.
subject
=
current_user
.
try
(
:username
)
...
...
config/initializers/1_settings.rb
View file @
fc2d985b
...
...
@@ -271,7 +271,7 @@ Settings.artifacts['max_size'] ||= 100 # in megabytes
# Registry
#
Settings
[
'registry'
]
||=
Settingslogic
.
new
({})
Settings
.
registry
[
'
registry
'
]
=
false
if
Settings
.
registry
[
'enabled'
].
nil?
Settings
.
registry
[
'
enabled
'
]
=
false
if
Settings
.
registry
[
'enabled'
].
nil?
Settings
.
registry
[
'host'
]
||=
"example.com"
Settings
.
registry
[
'internal_host'
]
||=
"localhost"
Settings
.
registry
[
'key'
]
||=
nil
...
...
lib/jwt/rsa_token.rb
View file @
fc2d985b
module
J
wt
module
J
WT
class
RSAToken
<
Token
attr_reader
:key_file
...
...
lib/jwt/token.rb
View file @
fc2d985b
module
J
wt
module
J
WT
class
Token
attr_accessor
:issuer
,
:subject
,
:audience
,
:id
attr_accessor
:issued_at
,
:not_before
,
:expire_time
...
...
@@ -43,4 +43,4 @@ module Jwt
}.
compact
end
end
end
\ No newline at end of file
end
spec/lib/jwt/rsa_token_spec.rb
View file @
fc2d985b
describe
J
wt
::
RSAToken
do
describe
J
WT
::
RSAToken
do
let
(
:rsa_key
)
{
generate_key
}
let
(
:rsa_token
)
{
described_class
.
new
(
nil
)
}
let
(
:rsa_encoded
)
{
rsa_token
.
encoded
}
...
...
spec/lib/jwt/token_spec.rb
View file @
fc2d985b
describe
J
wt
::
Token
do
describe
J
WT
::
Token
do
let
(
:token
)
{
described_class
.
new
}
context
'custom parameters'
do
...
...
spec/services/jwt/container_registry_authentication_service_spec.rb
View file @
fc2d985b
require
'spec_helper'
describe
J
wt
::
ContainerRegistryAuthenticationService
,
services:
true
do
describe
J
WT
::
ContainerRegistryAuthenticationService
,
services:
true
do
let
(
:current_project
)
{
nil
}
let
(
:current_user
)
{
nil
}
let
(
:current_params
)
{
{}
}
let
(
:rsa_key
)
{
OpenSSL
::
PKey
::
RSA
.
generate
(
512
)
}
let
(
:registry_settings
)
{
let
(
:registry_settings
)
do
{
issuer:
'rspec'
,
key:
nil
}
}
end
let
(
:payload
)
{
JWT
.
decode
(
subject
[
:token
],
rsa_key
).
first
}
subject
{
described_class
.
new
(
current_project
,
current_user
,
current_params
).
execute
}
before
do
allow
(
Gitlab
.
config
.
registry
).
to
receive_messages
(
registry_settings
)
allow_any_instance_of
(
J
wt
::
RSAToken
).
to
receive
(
:key
).
and_return
(
rsa_key
)
allow_any_instance_of
(
J
WT
::
RSAToken
).
to
receive
(
:key
).
and_return
(
rsa_key
)
end
shared_examples
'an authenticated'
do
...
...
@@ -26,13 +26,13 @@ describe Jwt::ContainerRegistryAuthenticationService, services: true do
end
shared_examples
'a accessible'
do
let
(
:access
)
{
let
(
:access
)
do
[{
'type'
=>
'repository'
,
'name'
=>
project
.
path_with_namespace
,
'actions'
=>
actions
,
}]
}
end
it_behaves_like
'an authenticated'
it
{
expect
(
payload
).
to
include
(
'access'
=>
access
)
}
...
...
@@ -68,9 +68,9 @@ describe Jwt::ContainerRegistryAuthenticationService, services: true do
context
'allow developer to push images'
do
before
{
project
.
team
<<
[
current_user
,
:developer
]
}
let
(
:current_params
)
{
let
(
:current_params
)
do
{
scope:
"repository:
#{
project
.
path_with_namespace
}
:push"
}
}
end
it_behaves_like
'a pushable'
end
...
...
@@ -78,9 +78,9 @@ describe Jwt::ContainerRegistryAuthenticationService, services: true do
context
'allow reporter to pull images'
do
before
{
project
.
team
<<
[
current_user
,
:reporter
]
}
let
(
:current_params
)
{
let
(
:current_params
)
do
{
scope:
"repository:
#{
project
.
path_with_namespace
}
:pull"
}
}
end
it_behaves_like
'a pullable'
end
...
...
@@ -88,9 +88,9 @@ describe Jwt::ContainerRegistryAuthenticationService, services: true do
context
'return a least of privileges'
do
before
{
project
.
team
<<
[
current_user
,
:reporter
]
}
let
(
:current_params
)
{
let
(
:current_params
)
do
{
scope:
"repository:
#{
project
.
path_with_namespace
}
:push,pull"
}
}
end
it_behaves_like
'a pullable'
end
...
...
@@ -98,9 +98,9 @@ describe Jwt::ContainerRegistryAuthenticationService, services: true do
context
'disallow guest to pull or push images'
do
before
{
project
.
team
<<
[
current_user
,
:guest
]
}
let
(
:current_params
)
{
let
(
:current_params
)
do
{
scope:
"repository:
#{
project
.
path_with_namespace
}
:pull,push"
}
}
end
it_behaves_like
'a forbidden'
end
...
...
@@ -110,9 +110,9 @@ describe Jwt::ContainerRegistryAuthenticationService, services: true do
let
(
:current_project
)
{
create
(
:empty_project
)
}
context
'allow to pull and push images'
do
let
(
:current_params
)
{
let
(
:current_params
)
do
{
scope:
"repository:
#{
current_project
.
path_with_namespace
}
:pull,push"
}
}
end
it_behaves_like
'a pullable and pushable'
do
let
(
:project
)
{
current_project
}
...
...
@@ -121,9 +121,9 @@ describe Jwt::ContainerRegistryAuthenticationService, services: true do
context
'for other projects'
do
context
'when pulling'
do
let
(
:current_params
)
{
let
(
:current_params
)
do
{
scope:
"repository:
#{
project
.
path_with_namespace
}
:pull"
}
}
end
context
'allow for public'
do
let
(
:project
)
{
create
(
:empty_project
,
:public
)
}
...
...
@@ -137,9 +137,9 @@ describe Jwt::ContainerRegistryAuthenticationService, services: true do
end
context
'when pushing'
do
let
(
:current_params
)
{
let
(
:current_params
)
do
{
scope:
"repository:
#{
project
.
path_with_namespace
}
:push"
}
}
end
context
'disallow for all'
do
let
(
:project
)
{
create
(
:empty_project
,
:public
)
}
...
...
@@ -152,9 +152,9 @@ describe Jwt::ContainerRegistryAuthenticationService, services: true do
context
'unauthorized'
do
context
'for invalid scope'
do
let
(
:current_params
)
{
let
(
:current_params
)
do
{
scope:
'invalid:aa:bb'
}
}
end
it_behaves_like
'a forbidden'
end
...
...
@@ -162,9 +162,9 @@ describe Jwt::ContainerRegistryAuthenticationService, services: true do
context
'for private project'
do
let
(
:project
)
{
create
(
:empty_project
,
:private
)
}
let
(
:current_params
)
{
let
(
:current_params
)
do
{
scope:
"repository:
#{
project
.
path_with_namespace
}
:pull"
}
}
end
it_behaves_like
'a forbidden'
end
...
...
@@ -173,17 +173,17 @@ describe Jwt::ContainerRegistryAuthenticationService, services: true do
let
(
:project
)
{
create
(
:empty_project
,
:public
)
}
context
'when pulling and pushing'
do
let
(
:current_params
)
{
let
(
:current_params
)
do
{
scope:
"repository:
#{
project
.
path_with_namespace
}
:pull,push"
}
}
end
it_behaves_like
'a pullable'
end
context
'when pushing'
do
let
(
:current_params
)
{
let
(
:current_params
)
do
{
scope:
"repository:
#{
project
.
path_with_namespace
}
:push"
}
}
end
it_behaves_like
'a forbidden'
end
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment