lib/api/internal.rb

   1 module API
   2   # Internal access API
   3   class Internal < Grape::API
   4     namespace 'internal' do
   5       #
   6       # Check if ssh key has access to project code
   7       #
   8       # Params:
   9       #   key_id - SSH Key id
  10       #   project - project path with namespace
  11       #   action - git action (git-upload-pack or git-receive-pack)
  12       #   ref - branch name
  13       #
  14       get "/allowed" do
  15         # Check for *.wiki repositories.
  16         # Strip out the .wiki from the pathname before finding the
  17         # project. This applies the correct project permissions to
  18         # the wiki repository as well.
  19         project_path = params[:project]
  20         project_path.gsub!(/\.wiki/,'') if project_path =~ /\.wiki/
  21
  22         key = Key.find(params[:key_id])
  23         project = Project.find_with_namespace(project_path)
  24         git_cmd = params[:action]
  25         return false unless project
  26
  27
  28         if key.is_a? DeployKey
  29           key.projects.include?(project) && git_cmd == 'git-upload-pack'
  30         else
  31           user = key.user
  32
  33           return false if user.blocked?
  34
  35           action = case git_cmd
  36                    when 'git-upload-pack', 'git-upload-archive'
  37                      then :download_code
  38                    when 'git-receive-pack'
  39                      then
  40                      if project.protected_branch?(params[:ref])
  41                        :push_code_to_protected_branches
  42                      else
  43                        :push_code
  44                      end
  45                    end
  46
  47           user.can?(action, project)
  48         end
  49       end
  50
  51       #
  52       # Discover user by ssh key
  53       #
  54       get "/discover" do
  55         key = Key.find(params[:key_id])
  56         present key.user, with: Entities::UserSafe
  57       end
  58
  59       get "/check" do
  60         {
  61           api_version: API.version,
  62           gitlab_version: Gitlab::VERSION,
  63           gitlab_rev: Gitlab::REVISION,
  64         }
  65       end
  66     end
  67   end
  68 end
  69