Commit 654d5ad3 authored by Kamil Trzcinski's avatar Kamil Trzcinski

Merge branch 'docker-registry' into docker-registry-view

parents 906c8804 63cdf1ae
...@@ -4,7 +4,7 @@ class JwtController < ApplicationController ...@@ -4,7 +4,7 @@ class JwtController < ApplicationController
before_action :authenticate_project_or_user before_action :authenticate_project_or_user
SERVICES = { SERVICES = {
::Gitlab::JWT::ContainerRegistryAuthenticationService::AUDIENCE => ::Gitlab::JWT::ContainerRegistryAuthenticationService, Auth::ContainerRegistryAuthenticationService::AUDIENCE => Auth::ContainerRegistryAuthenticationService,
} }
def auth def auth
......
...@@ -330,7 +330,7 @@ class Project < ActiveRecord::Base ...@@ -330,7 +330,7 @@ class Project < ActiveRecord::Base
def container_registry_repository def container_registry_repository
@container_registry_repository ||= begin @container_registry_repository ||= begin
token = Gitlab::JWT::ContainerRegistryAuthenticationService.full_access_token(path_with_namespace) token = Auth::ContainerRegistryAuthenticationService.full_access_token(path_with_namespace)
url = Gitlab.config.registry.api_url url = Gitlab.config.registry.api_url
host_port = Gitlab.config.registry.host_port host_port = Gitlab.config.registry.host_port
registry = ContainerRegistry::Registry.new(url, token: token, path: host_port) registry = ContainerRegistry::Registry.new(url, token: token, path: host_port)
......
module Auth
class ContainerRegistryAuthenticationService < BaseService
AUDIENCE = 'container_registry'
def execute
return error('not found', 404) unless registry.enabled
if params[:offline_token]
return error('forbidden', 403) unless current_user
end
return error('forbidden', 401) if scopes.blank?
{ token: authorized_token(scopes).encoded }
end
def self.full_access_token(*names)
registry = Gitlab.config.registry
token = ::JWT::RSAToken.new(registry.key)
token.issuer = registry.issuer
token.audience = AUDIENCE
token[:access] = names.map do |name|
{ type: 'repository', name: name, actions: %w(pull push) }
end
token.encoded
end
private
def authorized_token(access)
token = ::JWT::RSAToken.new(registry.key)
token.issuer = registry.issuer
token.audience = params[:service]
token.subject = current_user.try(:username)
token[:access] = access
token
end
def scopes
return unless params[:scope]
@scopes ||= begin
scope = process_scope(params[:scope])
[scope].compact
end
end
def process_scope(scope)
type, name, actions = scope.split(':', 3)
actions = actions.split(',')
case type
when 'repository'
process_repository_access(type, name, actions)
end
end
def process_repository_access(type, name, actions)
requested_project = Project.find_with_namespace(name)
return unless requested_project
actions = actions.select do |action|
can_access?(requested_project, action)
end
{ type: type, name: name, actions: actions } if actions.present?
end
def can_access?(requested_project, requested_action)
case requested_action
when 'pull'
requested_project.public? || requested_project == project || can?(current_user, :read_container_registry, requested_project)
when 'push'
requested_project == project || can?(current_user, :create_container_registry, requested_project)
else
false
end
end
def registry
Gitlab.config.registry
end
end
end
module Gitlab
module JWT
class ContainerRegistryAuthenticationService < BaseService
AUDIENCE = 'container_registry'
def execute
return error('not found', 404) unless registry.enabled
if params[:offline_token]
return error('forbidden', 403) unless current_user
end
return error('forbidden', 401) if scopes.blank?
{ token: authorized_token(scopes).encoded }
end
def self.full_access_token(*names)
registry = Gitlab.config.registry
token = ::JWT::RSAToken.new(registry.key)
token.issuer = registry.issuer
token.audience = AUDIENCE
token[:access] = names.map do |name|
{ type: 'repository', name: name, actions: %w(pull push) }
end
token.encoded
end
private
def authorized_token(access)
token = ::JWT::RSAToken.new(registry.key)
token.issuer = registry.issuer
token.audience = params[:service]
token.subject = current_user.try(:username)
token[:access] = access
token
end
def scopes
return unless params[:scope]
@scopes ||= begin
scope = process_scope(params[:scope])
[scope].compact
end
end
def process_scope(scope)
type, name, actions = scope.split(':', 3)
actions = actions.split(',')
case type
when 'repository'
process_repository_access(type, name, actions)
end
end
def process_repository_access(type, name, actions)
requested_project = Project.find_with_namespace(name)
return unless requested_project
actions = actions.select do |action|
can_access?(requested_project, action)
end
{ type: type, name: name, actions: actions } if actions.present?
end
<<<<<<< HEAD
def can_access?(requested_project, requested_action)
return false unless requested_project.container_registry_enabled?
case requested_action
when 'pull'
requested_project == project || can?(current_user, :read_container_registry, requested_project)
when 'push'
requested_project == project || can?(current_user, :create_container_registry, requested_project)
else
false
=======
def can_access?(requested_project, requested_action)
case requested_action
when 'pull'
requested_project.public? || requested_project == project || can?(current_user, :read_container_registry, requested_project)
when 'push'
requested_project == project || can?(current_user, :create_container_registry, requested_project)
else
false
end
>>>>>>> docker-registry
end
def registry
Gitlab.config.registry
end
end
end
end
...@@ -16,7 +16,7 @@ describe "Container Registry" do ...@@ -16,7 +16,7 @@ describe "Container Registry" do
project.team << [@user, :developer] project.team << [@user, :developer]
stub_container_registry(*tags) stub_container_registry(*tags)
allow(Gitlab.config.registry).to receive_messages(registry_settings) allow(Gitlab.config.registry).to receive_messages(registry_settings)
allow(Gitlab::JWT::ContainerRegistryAuthenticationService).to receive(:full_access_token).and_return('token') allow(Auth::ContainerRegistryAuthenticationService).to receive(:full_access_token).and_return('token')
end end
describe 'GET /:project/container_registry' do describe 'GET /:project/container_registry' do
......
require 'spec_helper' require 'spec_helper'
describe Gitlab::JWT::ContainerRegistryAuthenticationService, services: true do describe Auth::ContainerRegistryAuthenticationService, services: true do
let(:current_project) { nil } let(:current_project) { nil }
let(:current_user) { nil } let(:current_user) { nil }
let(:current_params) { {} } let(:current_params) { {} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment