summaryrefslogtreecommitdiff
path: root/lib/api/api_guard.rb
Commit message (Collapse)AuthorAgeFilesLines
* Add latest changes from gitlab-org/gitlab@15-3-stable-eev15.3.0-rc42GitLab Bot2022-08-181-1/+3
|
* Add latest changes from gitlab-org/gitlab@13-11-stable-eev13.11.0-rc43GitLab Bot2021-04-201-2/+2
|
* Add latest changes from gitlab-org/gitlab@13-8-stable-eev13.8.0-rc42Robert Speicher2021-01-201-4/+9
|
* Add latest changes from gitlab-org/gitlab@13-5-stable-eev13.5.0-rc42GitLab Bot2020-10-211-0/+39
|
* Add latest changes from gitlab-org/security/gitlab@13-4-stable-eeGitLab Bot2020-09-301-2/+4
|
* Add latest changes from gitlab-org/security/gitlab@13-3-stable-eeGitLab Bot2020-09-011-1/+20
|
* Add latest changes from gitlab-org/gitlab@13-3-stable-eeGitLab Bot2020-08-201-4/+7
|
* Add latest changes from gitlab-org/gitlab@13-2-stable-eeGitLab Bot2020-07-201-3/+9
|
* Add latest changes from gitlab-org/gitlab@13-0-stable-eeGitLab Bot2020-05-201-2/+7
|
* Add latest changes from gitlab-org/gitlab@masterGitLab Bot2020-04-011-0/+4
|
* Add latest changes from gitlab-org/gitlab@masterGitLab Bot2020-03-021-19/+9
|
* Add latest changes from gitlab-org/gitlab@masterGitLab Bot2019-12-111-2/+4
|
* Add latest changes from gitlab-org/gitlab@masterGitLab Bot2019-12-101-1/+3
|
* Add latest changes from gitlab-org/gitlab@masterGitLab Bot2019-09-261-0/+24
|
* Add latest changes from gitlab-org/gitlab@masterGitLab Bot2019-09-131-0/+1
|
* Add config to disable impersonationImre Farkas2018-11-291-0/+6
| | | | | | | | Adds gitlab.impersonation_enabled config option defaulting to true to keep the current default behaviour. Only the act of impersonation is modified, impersonation token management is not affected.
* Enable frozen string in lib/api and lib/backupgfyoung2018-09-291-0/+2
| | | | | | | | | | Partially addresses #47424. Had to make changes to spec files because stubbing methods on frozen objects is a mess in RSpec and leads to failures: https://github.com/rspec/rspec-mocks/issues/1190
* Updates code using class_methods over module ClassMethodsJacopo2018-08-291-1/+1
|
* Block access to API & git when terms are enforcedBob Van Landuyt2018-05-101-1/+11
| | | | | | When terms are enforced, but the user has not accepted the terms access to the API & git is rejected with a message directing the user to the web app to accept the terms.
* Make find_user_from_sources extensible for EELin Jen-Shin2018-02-051-1/+5
|
* Changes after rebaseFrancisco Lopez2017-11-171-20/+1
|
* Moved Exceptions to Gitlab::AuthFrancisco Lopez2017-11-171-10/+10
|
* Moving exceptions to UserAuthFindersFrancisco Lopez2017-11-171-25/+10
|
* Added some more commentsFrancisco Lopez2017-11-171-7/+8
|
* Homogenising the type of the request handled by UserAuthFinder. Also tests fixedFrancisco Lopez2017-11-171-3/+0
|
* Applied some code review commentsFrancisco Lopez2017-11-171-5/+0
|
* Removing private tokenFrancisco Lopez2017-11-171-6/+1
|
* Some fixes after rebaseFrancisco Lopez2017-11-171-24/+7
|
* Updated refactor and pushing to see if test failsFrancisco Lopez2017-11-171-2/+0
|
* First refactorFrancisco Lopez2017-11-171-39/+19
|
* Add Gitlab::Utils::StrongMemoizeLin Jen-Shin (godfat)2017-11-131-3/+5
|
* Add sudo API scopeDouwe Maan2017-11-021-66/+38
|
* Remove authentication using user.private_tokenDouwe Maan2017-11-021-16/+6
|
* Move all API authentication code to APIGuardDouwe Maan2017-10-121-41/+92
|
* Make sure API responds with 401 when invalid authentication info is provideddm-api-unauthorizedDouwe Maan2017-09-281-6/+18
|
* Whitelist or fix additional `Gitlab/PublicSend` cop violationsrs-more-public-send-whitelistsRobert Speicher2017-08-141-1/+1
| | | | | An upcoming update to rubocop-gitlab-security added additional violations.
* Extract a `Gitlab::Scope` class.Timothy Andrew2017-06-291-1/+1
| | | | | - To represent an authorization scope, such as `api` or `read_user` - This is a better abstraction than the hash we were previously using.
* Implement review comments from @DouweM for !12300.Timothy Andrew2017-06-281-1/+1
| | | | | | | - Use a struct for scopes, so we can call `scope.if` instead of `scope[:if]` - Refactor the "remove scopes whose :if condition returns false" logic to use a `select` rather than a `reject`.
* Implement review comments from @dbalexandre for !12300.Timothy Andrew2017-06-281-7/+5
|
* Fix remaining spec failures for !12300.Timothy Andrew2017-06-281-2/+2
| | | | | | | | | | | | | | 1. Get the spec for `lib/gitlab/auth.rb` passing. - Make the `request` argument to `AccessTokenValidationService` optional - `auth.rb` doesn't need to pass in a request. - Pass in scopes in the format `[{ name: 'api' }]` rather than `['api']`, which is what `AccessTokenValidationService` now expects. 2. Get the spec for `API::V3::Users` passing 2. Get the spec for `AccessTokenValidationService` passing
* When verifying scopes, manually include scopes from `API::API`.Timothy Andrew2017-06-281-6/+4
| | | | | | | | - They are not included automatically since `API::Users` does not inherit from `API::API`, as I initially assumed. - Scopes declared in `API::API` are considered global (to the API), and need to be included in all cases.
* Allow API scope declarations to be applied conditionally.Timothy Andrew2017-06-281-2/+2
| | | | | | | | | | | - Scope declarations of the form: allow_access_with_scope :read_user, if: -> (request) { request.get? } will only apply for `GET` requests - Add a negative test to a `POST` endpoint in the `users` API to test this. Also test for this case in the `AccessTokenValidationService` unit tests.
* Initial attempt at refactoring API scope declarations.Timothy Andrew2017-06-281-12/+21
| | | | | | | | | | - Declaring an endpoint's scopes in a `before` block has proved to be unreliable. For example, if we're accessing the `API::Users` endpoint - code in a `before` block in `API::API` wouldn't be able to see the scopes set in `API::Users` since the `API::API` `before` block runs first. - This commit moves these declarations to the class level, since they don't need to change once set.
* Enable Style/Proc cop for rubocopmhasbini2017-04-021-1/+1
|
* Enable and autocorrect the CustomErrorClass copSean McGivern2017-03-011-7/+4
|
* Fix code for copsDouwe Maan2017-02-231-1/+1
|
* Enable Style/SpaceInsideBracketsDouwe Maan2017-02-231-1/+1
|
* Enable Style/MutableConstantDouwe Maan2017-02-231-1/+1
|
* Convert AccessTokenValidationService into a class.Timothy Andrew2016-12-161-2/+2
| | | | | | | | | | - Previously, AccessTokenValidationService was a module, and all its public methods accepted a token. It makes sense to convert it to a class which accepts a token during initialization. - Also rename the `sufficient_scope?` method to `include_any_scope?` - Based on feedback from @rymai
* Implement minor changes from @dbalexandre's review.Timothy Andrew2016-12-161-11/+15
| | | | | | | | | | | - Mainly whitespace changes. - Require the migration adding the `scope` column to the `personal_access_tokens` table to have downtime, since API calls will fail if the new code is in place, but the migration hasn't run. - Minor refactoring - load `@scopes` in a `before_action`, since we're doing it in three different places.
View Lorry Controller Status