Add latest changes from gitlab-org/security/gitlab@13-11-stable-ee

2 files changed, 40 insertions, 3 deletions

diff --git a/lib/gitlab/auth/scope_validator.rb b/lib/gitlab/auth/scope_validator.rb
new file mode 100644
index 00000000000..de4c36ad594
--- /dev/null
+++ b/lib/gitlab/auth/scope_validator.rb
@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+# Wrapper around a RequestAuthenticator to
+# perform authorization of scopes. Access is limited to
+# only those methods needed to validate that an API user
+# has at least one permitted scope.
+module Gitlab
+  module Auth
+    class ScopeValidator
+      def initialize(api_user, request_authenticator)
+        @api_user = api_user
+        @request_authenticator = request_authenticator
+      end
+
+      def valid_for?(permitted)
+        return true unless @api_user
+        return true if permitted.none?
+
+        scopes = permitted.map { |s| API::Scope.new(s) }
+        @request_authenticator.valid_access_token?(scopes: scopes)
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/graphql/authorize/object_authorization.rb b/lib/gitlab/graphql/authorize/object_authorization.rb
index 0bc87108871..f13acc9ea27 100644
--- a/lib/gitlab/graphql/authorize/object_authorization.rb
+++ b/lib/gitlab/graphql/authorize/object_authorization.rb
@@ -4,10 +4,11 @@ module Gitlab
   module Graphql
     module Authorize
       class ObjectAuthorization
-        attr_reader :abilities
+        attr_reader :abilities, :permitted_scopes
 
-        def initialize(abilities)
+        def initialize(abilities, scopes = %i[api read_api])
           @abilities = Array.wrap(abilities).flatten
+          @permitted_scopes = Array.wrap(scopes)
         end
 
         def none?
@@ -18,7 +19,13 @@ module Gitlab
           abilities.present?
         end
 
-        def ok?(object, current_user)
+        def ok?(object, current_user, scope_validator: nil)
+          scopes_ok?(scope_validator) && abilities_ok?(object, current_user)
+        end
+
+        private
+
+        def abilities_ok?(object, current_user)
           return true if none?
 
           subject = object.try(:declarative_policy_subject) || object
@@ -26,6 +33,12 @@ module Gitlab
             Ability.allowed?(current_user, ability, subject)
           end
         end
+
+        def scopes_ok?(validator)
+          return true unless validator.present?
+
+          validator.valid_for?(permitted_scopes)
+        end
       end
     end
   end