Only use API scopes for personal access tokens

1 files changed, 10 insertions, 0 deletions

diff --git a/app/models/personal_access_token.rb b/app/models/personal_access_token.rb
index 10a34c42fd8..f3e38aba7c9 100644
--- a/app/models/personal_access_token.rb
+++ b/app/models/personal_access_token.rb
@@ -9,6 +9,8 @@ class PersonalAccessToken < ActiveRecord::Base
   scope :active, -> { where(revoked: false).where("expires_at >= NOW() OR expires_at IS NULL") }
   scope :inactive, -> { where("revoked = true OR expires_at < NOW()") }
 
+  validate :validate_scopes
+
   def self.generate(params)
     personal_access_token = self.new(params)
     personal_access_token.ensure_token
@@ -19,4 +21,12 @@ class PersonalAccessToken < ActiveRecord::Base
     self.revoked = true
     self.save
   end
+
+  protected
+
+  def validate_scopes
+    unless Set.new(scopes.map(&:to_sym)).subset?(Set.new(Gitlab::Auth::API_SCOPES))
+      errors.add :scopes, "can only contain API scopes"
+    end
+  end
 end