Enable serving static objects from an external storagestatic-objects-external-storage

It consists of two parts:

1. Redirecting users to the configured external storage
1. Allowing the external storage to request the static object(s)
   on behalf of the user by means of specific tokens

Part of https://gitlab.com/gitlab-com/gl-infra/infrastructure/issues/6829

2 files changed, 25 insertions, 1 deletions

diff --git a/lib/gitlab/auth/request_authenticator.rb b/lib/gitlab/auth/request_authenticator.rb
index 176766d1a8b..aca8804b04c 100644
--- a/lib/gitlab/auth/request_authenticator.rb
+++ b/lib/gitlab/auth/request_authenticator.rb
@@ -24,7 +24,9 @@ module Gitlab
       end
 
       def find_sessionless_user(request_format)
-        find_user_from_web_access_token(request_format) || find_user_from_feed_token(request_format)
+        find_user_from_web_access_token(request_format) ||
+          find_user_from_feed_token(request_format) ||
+          find_user_from_static_object_token(request_format)
       rescue Gitlab::Auth::AuthenticationError
         nil
       end
diff --git a/lib/gitlab/auth/user_auth_finders.rb b/lib/gitlab/auth/user_auth_finders.rb
index 97755117edc..76d41eede23 100644
--- a/lib/gitlab/auth/user_auth_finders.rb
+++ b/lib/gitlab/auth/user_auth_finders.rb
@@ -28,6 +28,15 @@ module Gitlab
         current_request.env['warden']&.authenticate if verified_request?
       end
 
+      def find_user_from_static_object_token(request_format)
+        return unless valid_static_objects_format?(request_format)
+
+        token = current_request.params[:token].presence || current_request.headers['X-Gitlab-Static-Object-Token'].presence
+        return unless token
+
+        User.find_by_static_object_token(token) || raise(UnauthorizedError)
+      end
+
       def find_user_from_feed_token(request_format)
         return unless valid_rss_format?(request_format)
 
@@ -154,6 +163,15 @@ module Gitlab
         end
       end
 
+      def valid_static_objects_format?(request_format)
+        case request_format
+        when :archive
+          archive_request?
+        else
+          false
+        end
+      end
+
       def rss_request?
         current_request.path.ends_with?('.atom') || current_request.format.atom?
       end
@@ -165,6 +183,10 @@ module Gitlab
       def api_request?
         current_request.path.starts_with?("/api/")
       end
+
+      def archive_request?
+        current_request.path.include?('/-/archive/')
+      end
     end
   end
 end