summaryrefslogtreecommitdiff
path: root/lib/api/internal/base.rb
blob: 11f2a2ea1c0271005d53e46dcfb2220bc7fe164d (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
# frozen_string_literal: true

module API
  # Internal access API
  module Internal
    class Base < Grape::API
      before { authenticate_by_gitlab_shell_token! }

      helpers ::API::Helpers::InternalHelpers

      UNKNOWN_CHECK_RESULT_ERROR = 'Unknown check result'.freeze

      helpers do
        def response_with_status(code: 200, success: true, message: nil, **extra_options)
          status code
          { status: success, message: message }.merge(extra_options).compact
        end

        def lfs_authentication_url(project)
          # This is a separate method so that EE can alter its behaviour more
          # easily.
          project.http_url_to_repo
        end

        def ee_post_receive_response_hook(response)
          # Hook for EE to add messages
        end

        def check_allowed(params)
          # This is a separate method so that EE can alter its behaviour more
          # easily.

          # Stores some Git-specific env thread-safely
          env = parse_env
          Gitlab::Git::HookEnv.set(gl_repository, env) if project

          actor.update_last_used_at!
          access_checker = access_checker_for(actor, params[:protocol])

          check_result = begin
                           result = access_checker.check(params[:action], params[:changes])
                           @project ||= access_checker.project
                           result
                         rescue Gitlab::GitAccess::UnauthorizedError => e
                           return response_with_status(code: 401, success: false, message: e.message)
                         rescue Gitlab::GitAccess::TimeoutError => e
                           return response_with_status(code: 503, success: false, message: e.message)
                         rescue Gitlab::GitAccess::NotFoundError => e
                           return response_with_status(code: 404, success: false, message: e.message)
                         end

          log_user_activity(actor.user)

          case check_result
          when ::Gitlab::GitAccessResult::Success
            payload = {
              gl_repository: gl_repository,
              gl_project_path: gl_project_path,
              gl_id: Gitlab::GlId.gl_id(actor.user),
              gl_username: actor.username,
              git_config_options: [],
              gitaly: gitaly_payload(params[:action]),
              gl_console_messages: check_result.console_messages
            }

            # Custom option for git-receive-pack command
            receive_max_input_size = Gitlab::CurrentSettings.receive_max_input_size.to_i
            if receive_max_input_size > 0
              payload[:git_config_options] << "receive.maxInputSize=#{receive_max_input_size.megabytes}"

              if Feature.enabled?(:gitaly_upload_pack_filter, project)
                payload[:git_config_options] << "uploadpack.allowFilter=true" << "uploadpack.allowAnySHA1InWant=true"
              end
            end

            response_with_status(**payload)
          when ::Gitlab::GitAccessResult::CustomAction
            response_with_status(code: 300, payload: check_result.payload, gl_console_messages: check_result.console_messages)
          else
            response_with_status(code: 500, success: false, message: UNKNOWN_CHECK_RESULT_ERROR)
          end
        end
      end

      namespace 'internal' do
        # Check if git command is allowed for project
        #
        # Params:
        #   key_id - ssh key id for Git over SSH
        #   user_id - user id for Git over HTTP or over SSH in keyless SSH CERT mode
        #   username - user name for Git over SSH in keyless SSH cert mode
        #   protocol - Git access protocol being used, e.g. HTTP or SSH
        #   project - project full_path (not path on disk)
        #   action - git action (git-upload-pack or git-receive-pack)
        #   changes - changes as "oldrev newrev ref", see Gitlab::ChangesList
        #   check_ip - optional, only in EE version, may limit access to
        #     group resources based on its IP restrictions
        post "/allowed" do
          # It was moved to a separate method so that EE can alter its behaviour more
          # easily.
          check_allowed(params)
        end

        post "/lfs_authenticate" do
          status 200

          unless actor.key_or_user
            raise ActiveRecord::RecordNotFound.new('User not found!')
          end

          actor.update_last_used_at!

          Gitlab::LfsToken
            .new(actor.key_or_user)
            .authentication_payload(lfs_authentication_url(project))
        end

        #
        # Get a ssh key using the fingerprint
        #
        # rubocop: disable CodeReuse/ActiveRecord
        get '/authorized_keys' do
          fingerprint = params.fetch(:fingerprint) do
            Gitlab::InsecureKeyFingerprint.new(params.fetch(:key)).fingerprint
          end
          key = Key.find_by(fingerprint: fingerprint)
          not_found!('Key') if key.nil?
          present key, with: Entities::SSHKey
        end
        # rubocop: enable CodeReuse/ActiveRecord

        #
        # Discover user by ssh key, user id or username
        #
        get '/discover' do
          present actor.user, with: Entities::UserSafe
        end

        get '/check' do
          {
            api_version: API.version,
            gitlab_version: Gitlab::VERSION,
            gitlab_rev: Gitlab.revision,
            redis: redis_ping
          }
        end
        post '/two_factor_recovery_codes' do
          status 200

          actor.update_last_used_at!
          user = actor.user

          if params[:key_id]
            unless actor.key
              break { success: false, message: 'Could not find the given key' }
            end

            if actor.key.is_a?(DeployKey)
              break { success: false, message: 'Deploy keys cannot be used to retrieve recovery codes' }
            end

            unless user
              break { success: false, message: 'Could not find a user for the given key' }
            end
          elsif params[:user_id] && user.nil?
            break { success: false, message: 'Could not find the given user' }
          end

          unless user.two_factor_enabled?
            break { success: false, message: 'Two-factor authentication is not enabled for this user' }
          end

          codes = nil

          ::Users::UpdateService.new(current_user, user: user).execute! do |user|
            codes = user.generate_otp_backup_codes!
          end

          { success: true, recovery_codes: codes }
        end

        post '/pre_receive' do
          status 200

          reference_counter_increased = Gitlab::ReferenceCounter.new(params[:gl_repository]).increase

          { reference_counter_increased: reference_counter_increased }
        end

        post '/notify_post_receive' do
          status 200

          # TODO: Re-enable when Gitaly is processing the post-receive notification
          # return unless Gitlab::GitalyClient.enabled?
          #
          # begin
          #   repository = wiki? ? project.wiki.repository : project.repository
          #   Gitlab::GitalyClient::NotificationService.new(repository.raw_repository).post_receive
          # rescue GRPC::Unavailable => e
          #   render_api_error!(e, 500)
          # end
        end

        post '/post_receive' do
          status 200

          response = Gitlab::InternalPostReceive::Response.new
          user = actor.user
          push_options = Gitlab::PushOptions.new(params[:push_options])

          response.reference_counter_decreased = Gitlab::ReferenceCounter.new(params[:gl_repository]).decrease

          PostReceive.perform_async(params[:gl_repository], params[:identifier],
                                    params[:changes], push_options.as_json)

          mr_options = push_options.get(:merge_request)
          if mr_options.present?
            message = process_mr_push_options(mr_options, project, user, params[:changes])
            response.add_alert_message(message)
          end

          broadcast_message = BroadcastMessage.current&.last&.message
          response.add_alert_message(broadcast_message)

          response.add_merge_request_urls(merge_request_urls)

          # Neither User nor Project are guaranteed to be returned; an orphaned write deploy
          # key could be used
          if user && project
            redirect_message = Gitlab::Checks::ProjectMoved.fetch_message(user.id, project.id)
            project_created_message = Gitlab::Checks::ProjectCreated.fetch_message(user.id, project.id)

            response.add_basic_message(redirect_message)
            response.add_basic_message(project_created_message)
          end

          ee_post_receive_response_hook(response)

          present response, with: Entities::InternalPostReceive::Response
        end
      end
    end
  end
end

API::Internal::Base.prepend_if_ee('EE::API::Internal::Base')