Commit 63cdf1ae authored by Kamil Trzcinski's avatar Kamil Trzcinski

Use Auth::ContainerRegistryAuthenticationService

parent 774a5107
...@@ -4,7 +4,7 @@ class JwtController < ApplicationController ...@@ -4,7 +4,7 @@ class JwtController < ApplicationController
before_action :authenticate_project_or_user before_action :authenticate_project_or_user
SERVICES = { SERVICES = {
'container_registry' => ::Gitlab::JWT::ContainerRegistryAuthenticationService, 'container_registry' => Auth::ContainerRegistryAuthenticationService,
} }
def auth def auth
......
module Auth
class ContainerRegistryAuthenticationService < BaseService
def execute
if params[:offline_token]
return error('forbidden', 403) unless current_user
end
return error('forbidden', 401) if scopes.blank?
{ token: authorized_token(scopes).encoded }
end
private
def authorized_token(access)
token = ::JWT::RSAToken.new(registry.key)
token.issuer = registry.issuer
token.audience = params[:service]
token.subject = current_user.try(:username)
token[:access] = access
token
end
def scopes
return unless params[:scope]
@scopes ||= begin
scope = process_scope(params[:scope])
[scope].compact
end
end
def process_scope(scope)
type, name, actions = scope.split(':', 3)
actions = actions.split(',')
case type
when 'repository'
process_repository_access(type, name, actions)
end
end
def process_repository_access(type, name, actions)
requested_project = Project.find_with_namespace(name)
return unless requested_project
actions = actions.select do |action|
can_access?(requested_project, action)
end
{ type: type, name: name, actions: actions } if actions.present?
end
def can_access?(requested_project, requested_action)
case requested_action
when 'pull'
requested_project.public? || requested_project == project || can?(current_user, :read_container_registry, requested_project)
when 'push'
requested_project == project || can?(current_user, :create_container_registry, requested_project)
else
false
end
end
def registry
Gitlab.config.registry
end
end
end
module Gitlab
module JWT
class ContainerRegistryAuthenticationService < BaseService
def execute
if params[:offline_token]
return error('forbidden', 403) unless current_user
end
return error('forbidden', 401) if scopes.blank?
{ token: authorized_token(scopes).encoded }
end
private
def authorized_token(access)
token = ::JWT::RSAToken.new(registry.key)
token.issuer = registry.issuer
token.audience = params[:service]
token.subject = current_user.try(:username)
token[:access] = access
token
end
def scopes
return unless params[:scope]
@scopes ||= begin
scope = process_scope(params[:scope])
[scope].compact
end
end
def process_scope(scope)
type, name, actions = scope.split(':', 3)
actions = actions.split(',')
case type
when 'repository'
process_repository_access(type, name, actions)
end
end
def process_repository_access(type, name, actions)
requested_project = Project.find_with_namespace(name)
return unless requested_project
actions = actions.select do |action|
can_access?(requested_project, action)
end
{ type: type, name: name, actions: actions } if actions.present?
end
def can_access?(requested_project, requested_action)
case requested_action
when 'pull'
requested_project.public? || requested_project == project || can?(current_user, :read_container_registry, requested_project)
when 'push'
requested_project == project || can?(current_user, :create_container_registry, requested_project)
else
false
end
end
def registry
Gitlab.config.registry
end
end
end
end
require 'spec_helper' require 'spec_helper'
describe Gitlab::JWT::ContainerRegistryAuthenticationService, services: true do describe JWT::ContainerRegistryAuthenticationService, services: true do
let(:current_project) { nil } let(:current_project) { nil }
let(:current_user) { nil } let(:current_user) { nil }
let(:current_params) { {} } let(:current_params) { {} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment