Allow GitLab Shell to check for allowed access based on the used Git protocol.

hooks/pre-receive

@@ -5,12 +5,15 @@
 
 refs = $stdin.read
 key_id  = ENV['GL_ID']
+protocol = ENV['PROTOCOL']
 repo_path = Dir.pwd
 
 require_relative '../lib/gitlab_custom_hook'
 require_relative '../lib/gitlab_access'
 
-if GitlabAccess.new(repo_path, key_id, refs).exec &&
+protocol ||= 'http'
+
+if GitlabAccess.new(repo_path, key_id, refs, protocol).exec &&
     GitlabCustomHook.new.pre_receive(refs, repo_path)
   exit 0
 else

lib/gitlab_access.rb

@@ -9,18 +9,19 @@ class GitlabAccess
 
   include NamesHelper
 
-  attr_reader :config, :repo_path, :repo_name, :changes
+  attr_reader :config, :repo_path, :repo_name, :changes, :protocol
 
-  def initialize(repo_path, actor, changes)
+  def initialize(repo_path, actor, changes, protocol = nil)
     @config = GitlabConfig.new
     @repo_path = repo_path.strip
     @actor = actor
     @repo_name = extract_repo_name(@repo_path.dup)
     @changes = changes.lines
+    @protocol = protocol
   end
 
   def exec
-    status = api.check_access('git-receive-pack', @repo_name, @actor, @changes)
+    status = api.check_access('git-receive-pack', @repo_name, @actor, @changes, @protocol)
 
     raise AccessDeniedError, status.message unless status.allowed?
 

lib/gitlab_net.rb

@@ -14,7 +14,7 @@ class GitlabNet
   CHECK_TIMEOUT = 5
   READ_TIMEOUT = 300
 
-  def check_access(cmd, repo, actor, changes)
+  def check_access(cmd, repo, actor, changes, protocol = nil)
     project_name = repo.gsub("'", "")
     project_name = project_name.gsub(/\.git\Z/, "")
     project_name = project_name.gsub(/\A\//, "")
@@ -24,6 +24,7 @@ class GitlabNet
       action: cmd,
       changes: changes,
       project: project_name,
+      protocol: protocol
     }
 
     if actor =~ /\Akey\-\d+\Z/

lib/gitlab_shell.rb

@@ -85,7 +85,7 @@ class GitlabShell
   end
 
   def verify_access
-    status = api.check_access(@git_access, @repo_name, @key_id, '_any')
+    status = api.check_access(@git_access, @repo_name, @key_id, '_any', 'ssh')
 
     raise AccessDeniedError, status.message unless status.allowed?