Refactor LFS token logic to use a Redis key instead of a DB field, making it a 1 use only token.

4 files changed, 42 insertions, 10 deletions

diff --git a/lib/api/entities.rb b/lib/api/entities.rb
index b4fcacca896..4f736e4ec2b 100644
--- a/lib/api/entities.rb
+++ b/lib/api/entities.rb
@@ -1,7 +1,7 @@
 module API
   module Entities
     class UserSafe < Grape::Entity
-      expose :name, :username, :lfs_token
+      expose :name, :username
     end
 
     class UserBasic < UserSafe
diff --git a/lib/api/internal.rb b/lib/api/internal.rb
index 7c0a6eaa652..760f69663ab 100644
--- a/lib/api/internal.rb
+++ b/lib/api/internal.rb
@@ -88,12 +88,13 @@ module API
       get "/discover" do
         key = Key.find(params[:key_id])
         user = key.user
+
         if user
-          user.ensure_lfs_token!
-          present user, with: Entities::UserSafe
+          token = Gitlab::LfsToken.new(user).set_token
+          { name: user.name, username: user.username, lfs_token: token }
         else
-          key.ensure_lfs_token!
-          { username: 'lfs-deploy-key', lfs_token: key.lfs_token }
+          token = Gitlab::LfsToken.new(key).set_token
+          { username: "lfs-deploy-key-#{key.id}", lfs_token: token }
         end
       end
 
diff --git a/lib/gitlab/auth.rb b/lib/gitlab/auth.rb
index 5446093de4d..e43f8119658 100644
--- a/lib/gitlab/auth.rb
+++ b/lib/gitlab/auth.rb
@@ -117,12 +117,14 @@ module Gitlab
       end
 
       def lfs_token_check(login, password)
-        if login == 'lfs-deploy-key'
-          key = DeployKey.find_by_lfs_token(password)
-          Result.new(key, :lfs_deploy_token) if key
+        if login.include?('lfs-deploy-key')
+          key = DeployKey.find(login.gsub('lfs-deploy-key-', ''))
+          token = Gitlab::LfsToken.new(key).get_value
+          Result.new(key, :lfs_deploy_token) if key && token == password
         else
-          user = User.find_by_lfs_token(password)
-          Result.new(user, :lfs_token) if user && user.username == login
+          user = User.by_login(login)
+          token = Gitlab::LfsToken.new(user).get_value
+          Result.new(user, :lfs_token) if user && token == password
         end
       end
     end
diff --git a/lib/gitlab/lfs_token.rb b/lib/gitlab/lfs_token.rb
new file mode 100644
index 00000000000..0685eb775ef
--- /dev/null
+++ b/lib/gitlab/lfs_token.rb
@@ -0,0 +1,29 @@
+module Gitlab
+  class LfsToken
+    attr_accessor :actor
+
+    def initialize(actor)
+      @actor = actor
+    end
+
+    def set_token
+      token = Devise.friendly_token(50)
+      Gitlab::Redis.with do |redis|
+        redis.set(redis_key, token, ex: 3600)
+      end
+      token
+    end
+
+    def get_value
+      Gitlab::Redis.with do |redis|
+        redis.get(redis_key)
+      end
+    end
+
+    private
+
+    def redis_key
+      "gitlab:lfs_token:#{actor.class.name.underscore}_#{actor.id}" if actor
+    end
+  end
+end