summaryrefslogtreecommitdiff
path: root/lib/api/ci/jobs.rb
blob: 04999b5fb44ae72e01f3495cc4b87d4e33d12e02 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
# frozen_string_literal: true

module API
  module Ci
    class Jobs < ::API::Base
      include PaginationParams
      before { authenticate! }

      resource :projects, requirements: API::NAMESPACE_OR_PROJECT_REQUIREMENTS do
        params do
          requires :id, type: String, desc: 'The ID of a project'
        end

        helpers do
          params :optional_scope do
            optional :scope, types: [String, Array[String]], desc: 'The scope of builds to show',
                             values: ::CommitStatus::AVAILABLE_STATUSES,
                             coerce_with: ->(scope) {
                               case scope
                               when String
                                 [scope]
                               when ::Hash
                                 scope.values
                               when ::Array
                                 scope
                               else
                                 ['unknown']
                               end
                             }
          end
        end

        desc 'Get a projects jobs' do
          success Entities::Ci::Job
        end
        params do
          use :optional_scope
          use :pagination
        end
        # rubocop: disable CodeReuse/ActiveRecord
        get ':id/jobs', urgency: :low, feature_category: :continuous_integration do
          authorize_read_builds!

          builds = user_project.builds.order('id DESC')
          builds = filter_builds(builds, params[:scope])

          builds = builds.preload(:user, :job_artifacts_archive, :job_artifacts, :runner, :tags, pipeline: :project)
          present paginate(builds), with: Entities::Ci::Job
        end
        # rubocop: enable CodeReuse/ActiveRecord

        desc 'Get a specific job of a project' do
          success Entities::Ci::Job
        end
        params do
          requires :job_id, type: Integer, desc: 'The ID of a job'
        end
        get ':id/jobs/:job_id', urgency: :low, feature_category: :continuous_integration do
          authorize_read_builds!

          build = find_build!(params[:job_id])

          present build, with: Entities::Ci::Job
        end

        # TODO: We should use `present_disk_file!` and leave this implementation for backward compatibility (when build trace
        #       is saved in the DB instead of file). But before that, we need to consider how to replace the value of
        #       `runners_token` with some mask (like `xxxxxx`) when sending trace file directly by workhorse.
        desc 'Get a trace of a specific job of a project'
        params do
          requires :job_id, type: Integer, desc: 'The ID of a job'
        end
        get ':id/jobs/:job_id/trace', urgency: :low, feature_category: :continuous_integration do
          authorize_read_builds!

          build = find_build!(params[:job_id])

          authorize_read_build_trace!(build) if build

          header 'Content-Disposition', "infile; filename=\"#{build.id}.log\""
          content_type 'text/plain'
          env['api.format'] = :binary

          # The trace can be nil bu body method expects a string as an argument.
          trace = build.trace.raw || ''
          body trace
        end

        desc 'Cancel a specific job of a project' do
          success Entities::Ci::Job
        end
        params do
          requires :job_id, type: Integer, desc: 'The ID of a job'
        end
        post ':id/jobs/:job_id/cancel', urgency: :low, feature_category: :continuous_integration do
          authorize_update_builds!

          build = find_build!(params[:job_id])
          authorize!(:update_build, build)

          build.cancel

          present build, with: Entities::Ci::Job
        end

        desc 'Retry a specific build of a project' do
          success Entities::Ci::Job
        end
        params do
          requires :job_id, type: Integer, desc: 'The ID of a build'
        end
        post ':id/jobs/:job_id/retry', urgency: :low, feature_category: :continuous_integration do
          authorize_update_builds!

          build = find_build!(params[:job_id])
          authorize!(:update_build, build)

          response = ::Ci::RetryJobService.new(@project, current_user).execute(build)

          if response.success?
            present response[:job], with: Entities::Ci::Job
          else
            forbidden!('Job is not retryable')
          end
        end

        desc 'Erase job (remove artifacts and the trace)' do
          success Entities::Ci::Job
        end
        params do
          requires :job_id, type: Integer, desc: 'The ID of a build'
        end
        post ':id/jobs/:job_id/erase', urgency: :low, feature_category: :continuous_integration do
          authorize_update_builds!

          build = find_build!(params[:job_id])
          authorize!(:erase_build, build)
          break forbidden!('Job is not erasable!') unless build.erasable?

          build.erase(erased_by: current_user)
          present build, with: Entities::Ci::Job
        end

        desc 'Trigger an actionable job (manual, delayed, etc)' do
          success Entities::Ci::JobBasic
          detail 'This feature was added in GitLab 8.11'
        end
        params do
          requires :job_id, type: Integer, desc: 'The ID of a Job'
          optional :job_variables_attributes, type: Array,
            desc: 'User defined variables that will be included when running the job' do
            requires :key, type: String, desc: 'The name of the variable'
            requires :value, type: String, desc: 'The value of the variable'
          end
        end

        post ':id/jobs/:job_id/play', urgency: :low, feature_category: :continuous_integration do
          authorize_read_builds!

          job = find_job!(params[:job_id])

          authorize!(:play_job, job)

          bad_request!("Unplayable Job") unless job.playable?

          job.play(current_user, params[:job_variables_attributes])

          status 200

          if job.is_a?(::Ci::Build)
            present job, with: Entities::Ci::Job
          else
            present job, with: Entities::Ci::Bridge
          end
        end
      end

      resource :job do
        desc 'Get current job using job token' do
          success Entities::Ci::Job
        end
        route_setting :authentication, job_token_allowed: true
        get '', feature_category: :continuous_integration, urgency: :low do
          validate_current_authenticated_job

          present current_authenticated_job, with: Entities::Ci::Job
        end

        desc 'Get current agents' do
          detail 'Retrieves a list of agents for the given job token'
        end
        route_setting :authentication, job_token_allowed: true
        get '/allowed_agents', urgency: :low, feature_category: :kubernetes_management do
          validate_current_authenticated_job

          status 200

          pipeline = current_authenticated_job.pipeline
          project = current_authenticated_job.project
          agent_authorizations = ::Clusters::AgentAuthorizationsFinder.new(project).execute
          project_groups = project.group&.self_and_ancestor_ids&.map { |id| { id: id } } || []
          user_access_level = project.team.max_member_access(current_user.id)
          roles_in_project = Gitlab::Access.sym_options_with_owner
            .select { |_role, role_access_level| role_access_level <= user_access_level }
            .map(&:first)

          environment = if environment_slug = current_authenticated_job.deployment&.environment&.slug
                          { slug: environment_slug }
                        end

          # See https://gitlab.com/gitlab-org/cluster-integration/gitlab-agent/-/blob/master/doc/kubernetes_ci_access.md#apiv4joballowed_agents-api
          {
            allowed_agents: Entities::Clusters::AgentAuthorization.represent(agent_authorizations),
            job: { id: current_authenticated_job.id },
            pipeline: { id: pipeline.id },
            project: { id: project.id, groups: project_groups },
            user: { id: current_user.id, username: current_user.username, roles_in_project: roles_in_project },
            environment: environment
          }.compact
        end
      end

      helpers do
        # rubocop: disable CodeReuse/ActiveRecord
        def filter_builds(builds, scope)
          return builds if scope.nil? || scope.empty?

          available_statuses = ::CommitStatus::AVAILABLE_STATUSES

          unknown = scope - available_statuses
          render_api_error!('Scope contains invalid value(s)', 400) unless unknown.empty?

          builds.where(status: available_statuses && scope)
        end
        # rubocop: enable CodeReuse/ActiveRecord

        def validate_current_authenticated_job
          # current_authenticated_job will be nil if user is using
          # a valid authentication (like PRIVATE-TOKEN) that is not CI_JOB_TOKEN
          not_found!('Job') unless current_authenticated_job
        end
      end
    end
  end
end