diff options
author | Kamil Trzcinski <ayufan@ayufan.eu> | 2016-05-12 12:48:41 -0500 |
---|---|---|
committer | Kamil Trzcinski <ayufan@ayufan.eu> | 2016-05-12 12:48:41 -0500 |
commit | 4d84ba43d8db6a205e79dd8cf723be7ceebf6925 (patch) | |
tree | 708d81727b559a1043e98788e0ef296893c126e2 | |
parent | d05f0030a3de42ab3ec6d8c8be290b74698bb929 (diff) | |
parent | fc2d985bfaa156ad052858cd2025b0300327ff95 (diff) | |
download | gitlab-ce-4d84ba43d8db6a205e79dd8cf723be7ceebf6925.tar.gz |
Merge branch 'docker-registry' into docker-registry-view
-rw-r--r-- | app/services/jwt/container_registry_authentication_service.rb | 6 | ||||
-rw-r--r-- | config/initializers/1_settings.rb | 2 | ||||
-rw-r--r-- | lib/jwt/rsa_token.rb | 2 | ||||
-rw-r--r-- | lib/jwt/token.rb | 4 | ||||
-rw-r--r-- | spec/lib/jwt/rsa_token_spec.rb | 2 | ||||
-rw-r--r-- | spec/lib/jwt/token_spec.rb | 2 | ||||
-rw-r--r-- | spec/services/jwt/container_registry_authentication_service_spec.rb | 56 |
7 files changed, 37 insertions, 37 deletions
diff --git a/app/services/jwt/container_registry_authentication_service.rb b/app/services/jwt/container_registry_authentication_service.rb index 2edee1f0ab0..bc7e663caa6 100644 --- a/app/services/jwt/container_registry_authentication_service.rb +++ b/app/services/jwt/container_registry_authentication_service.rb @@ -1,4 +1,4 @@ -module Jwt +module JWT class ContainerRegistryAuthenticationService < BaseService AUDIENCE = 'container_registry' @@ -7,7 +7,7 @@ module Jwt return error('forbidden', 403) unless current_user end - return error('forbidden', 401) if scopes.empty? + return error('forbidden', 401) if scopes.blank? { token: authorized_token(scopes).encoded } end @@ -26,7 +26,7 @@ module Jwt private def authorized_token(access) - token = ::Jwt::RSAToken.new(registry.key) + token = ::JWT::RSAToken.new(registry.key) token.issuer = registry.issuer token.audience = AUDIENCE token.subject = current_user.try(:username) diff --git a/config/initializers/1_settings.rb b/config/initializers/1_settings.rb index 1040d840e30..3853845fee8 100644 --- a/config/initializers/1_settings.rb +++ b/config/initializers/1_settings.rb @@ -271,7 +271,7 @@ Settings.artifacts['max_size'] ||= 100 # in megabytes # Registry # Settings['registry'] ||= Settingslogic.new({}) -Settings.registry['registry'] = false if Settings.registry['enabled'].nil? +Settings.registry['enabled'] = false if Settings.registry['enabled'].nil? Settings.registry['host'] ||= "example.com" Settings.registry['internal_host']||= "localhost" Settings.registry['key'] ||= nil diff --git a/lib/jwt/rsa_token.rb b/lib/jwt/rsa_token.rb index cc265e3b31a..0438135ad54 100644 --- a/lib/jwt/rsa_token.rb +++ b/lib/jwt/rsa_token.rb @@ -1,4 +1,4 @@ -module Jwt +module JWT class RSAToken < Token attr_reader :key_file diff --git a/lib/jwt/token.rb b/lib/jwt/token.rb index 765ab0d60c7..f13abf2b71f 100644 --- a/lib/jwt/token.rb +++ b/lib/jwt/token.rb @@ -1,4 +1,4 @@ -module Jwt +module JWT class Token attr_accessor :issuer, :subject, :audience, :id attr_accessor :issued_at, :not_before, :expire_time @@ -43,4 +43,4 @@ module Jwt }.compact end end -end
\ No newline at end of file +end diff --git a/spec/lib/jwt/rsa_token_spec.rb b/spec/lib/jwt/rsa_token_spec.rb index 710801923e7..a5b1d3a67dc 100644 --- a/spec/lib/jwt/rsa_token_spec.rb +++ b/spec/lib/jwt/rsa_token_spec.rb @@ -1,4 +1,4 @@ -describe Jwt::RSAToken do +describe JWT::RSAToken do let(:rsa_key) { generate_key } let(:rsa_token) { described_class.new(nil) } let(:rsa_encoded) { rsa_token.encoded } diff --git a/spec/lib/jwt/token_spec.rb b/spec/lib/jwt/token_spec.rb index a56b4cf39b5..92fdc3f1b7c 100644 --- a/spec/lib/jwt/token_spec.rb +++ b/spec/lib/jwt/token_spec.rb @@ -1,4 +1,4 @@ -describe Jwt::Token do +describe JWT::Token do let(:token) { described_class.new } context 'custom parameters' do diff --git a/spec/services/jwt/container_registry_authentication_service_spec.rb b/spec/services/jwt/container_registry_authentication_service_spec.rb index ea91f499d0a..1873ea2639b 100644 --- a/spec/services/jwt/container_registry_authentication_service_spec.rb +++ b/spec/services/jwt/container_registry_authentication_service_spec.rb @@ -1,23 +1,23 @@ require 'spec_helper' -describe Jwt::ContainerRegistryAuthenticationService, services: true do +describe JWT::ContainerRegistryAuthenticationService, services: true do let(:current_project) { nil } let(:current_user) { nil } let(:current_params) { {} } let(:rsa_key) { OpenSSL::PKey::RSA.generate(512) } - let(:registry_settings) { + let(:registry_settings) do { issuer: 'rspec', key: nil } - } + end let(:payload) { JWT.decode(subject[:token], rsa_key).first } subject { described_class.new(current_project, current_user, current_params).execute } before do allow(Gitlab.config.registry).to receive_messages(registry_settings) - allow_any_instance_of(Jwt::RSAToken).to receive(:key).and_return(rsa_key) + allow_any_instance_of(JWT::RSAToken).to receive(:key).and_return(rsa_key) end shared_examples 'an authenticated' do @@ -26,13 +26,13 @@ describe Jwt::ContainerRegistryAuthenticationService, services: true do end shared_examples 'a accessible' do - let(:access) { + let(:access) do [{ 'type' => 'repository', 'name' => project.path_with_namespace, 'actions' => actions, }] - } + end it_behaves_like 'an authenticated' it { expect(payload).to include('access' => access) } @@ -68,9 +68,9 @@ describe Jwt::ContainerRegistryAuthenticationService, services: true do context 'allow developer to push images' do before { project.team << [current_user, :developer] } - let(:current_params) { + let(:current_params) do { scope: "repository:#{project.path_with_namespace}:push" } - } + end it_behaves_like 'a pushable' end @@ -78,9 +78,9 @@ describe Jwt::ContainerRegistryAuthenticationService, services: true do context 'allow reporter to pull images' do before { project.team << [current_user, :reporter] } - let(:current_params) { + let(:current_params) do { scope: "repository:#{project.path_with_namespace}:pull" } - } + end it_behaves_like 'a pullable' end @@ -88,9 +88,9 @@ describe Jwt::ContainerRegistryAuthenticationService, services: true do context 'return a least of privileges' do before { project.team << [current_user, :reporter] } - let(:current_params) { + let(:current_params) do { scope: "repository:#{project.path_with_namespace}:push,pull" } - } + end it_behaves_like 'a pullable' end @@ -98,9 +98,9 @@ describe Jwt::ContainerRegistryAuthenticationService, services: true do context 'disallow guest to pull or push images' do before { project.team << [current_user, :guest] } - let(:current_params) { + let(:current_params) do { scope: "repository:#{project.path_with_namespace}:pull,push" } - } + end it_behaves_like 'a forbidden' end @@ -110,9 +110,9 @@ describe Jwt::ContainerRegistryAuthenticationService, services: true do let(:current_project) { create(:empty_project) } context 'allow to pull and push images' do - let(:current_params) { + let(:current_params) do { scope: "repository:#{current_project.path_with_namespace}:pull,push" } - } + end it_behaves_like 'a pullable and pushable' do let(:project) { current_project } @@ -121,9 +121,9 @@ describe Jwt::ContainerRegistryAuthenticationService, services: true do context 'for other projects' do context 'when pulling' do - let(:current_params) { + let(:current_params) do { scope: "repository:#{project.path_with_namespace}:pull" } - } + end context 'allow for public' do let(:project) { create(:empty_project, :public) } @@ -137,9 +137,9 @@ describe Jwt::ContainerRegistryAuthenticationService, services: true do end context 'when pushing' do - let(:current_params) { + let(:current_params) do { scope: "repository:#{project.path_with_namespace}:push" } - } + end context 'disallow for all' do let(:project) { create(:empty_project, :public) } @@ -152,9 +152,9 @@ describe Jwt::ContainerRegistryAuthenticationService, services: true do context 'unauthorized' do context 'for invalid scope' do - let(:current_params) { + let(:current_params) do { scope: 'invalid:aa:bb' } - } + end it_behaves_like 'a forbidden' end @@ -162,9 +162,9 @@ describe Jwt::ContainerRegistryAuthenticationService, services: true do context 'for private project' do let(:project) { create(:empty_project, :private) } - let(:current_params) { + let(:current_params) do { scope: "repository:#{project.path_with_namespace}:pull" } - } + end it_behaves_like 'a forbidden' end @@ -173,17 +173,17 @@ describe Jwt::ContainerRegistryAuthenticationService, services: true do let(:project) { create(:empty_project, :public) } context 'when pulling and pushing' do - let(:current_params) { + let(:current_params) do { scope: "repository:#{project.path_with_namespace}:pull,push" } - } + end it_behaves_like 'a pullable' end context 'when pushing' do - let(:current_params) { + let(:current_params) do { scope: "repository:#{project.path_with_namespace}:push" } - } + end it_behaves_like 'a forbidden' end |