summaryrefslogtreecommitdiff
path: root/lib/api/maven_packages.rb
blob: 22f7b07809bd2a134b55fcc4a4ae8292fee004a7 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
# frozen_string_literal: true
module API
  class MavenPackages < ::API::Base
    MAVEN_ENDPOINT_REQUIREMENTS = {
      file_name: API::NO_SLASH_URL_PART_REGEX
    }.freeze

    feature_category :package_registry

    content_type :md5, 'text/plain'
    content_type :sha1, 'text/plain'
    content_type :binary, 'application/octet-stream'

    rescue_from ActiveRecord::RecordInvalid do |e|
      render_api_error!(e.message, 400)
    end

    before do
      require_packages_enabled!
      authenticate_non_get!
    end

    helpers ::API::Helpers::PackagesHelpers

    helpers do
      def path_exists?(path)
        # return true when FF disabled so that processing the request is not stopped
        return true unless Feature.enabled?(:check_maven_path_first, default_enabled: :yaml)
        return false if path.blank?

        Packages::Maven::Metadatum.with_path(path)
                                  .exists?
      end

      def extract_format(file_name)
        name, _, format = file_name.rpartition('.')

        if %w(md5 sha1).include?(format)
          [name, format]
        else
          [file_name, format]
        end
      end

      def verify_package_file(package_file, uploaded_file)
        stored_sha256 = Digest::SHA256.hexdigest(package_file.file_sha1)
        expected_sha256 = uploaded_file.sha256

        if stored_sha256 == expected_sha256
          no_content!
        else
          conflict!
        end
      end

      def find_project_by_path(path)
        project_path = path.rpartition('/').first
        Project.find_by_full_path(project_path)
      end

      def jar_file?(format)
        format == 'jar'
      end

      def present_carrierwave_file_with_head_support!(file, supports_direct_download: true)
        if head_request_on_aws_file?(file, supports_direct_download) && !file.file_storage?
          return redirect(signed_head_url(file))
        end

        present_carrierwave_file!(file, supports_direct_download: supports_direct_download)
      end

      def signed_head_url(file)
        fog_storage = ::Fog::Storage.new(file.fog_credentials)
        fog_dir = fog_storage.directories.new(key: file.fog_directory)
        fog_file = fog_dir.files.new(key: file.path)
        expire_at = ::Fog::Time.now + file.fog_authenticated_url_expiration

        fog_file.collection.head_url(fog_file.key, expire_at)
      end

      def head_request_on_aws_file?(file, supports_direct_download)
        Gitlab.config.packages.object_store.enabled &&
          supports_direct_download &&
          file.class.direct_download_enabled? &&
          request.head? &&
          file.fog_credentials[:provider] == 'AWS'
      end

      def fetch_package(file_name:, project: nil, group: nil)
        order_by_package_file = file_name.include?(::Packages::Maven::Metadata.filename) &&
                                  !params[:path].include?(::Packages::Maven::FindOrCreatePackageService::SNAPSHOT_TERM)

        ::Packages::Maven::PackageFinder.new(
          current_user,
          project || group,
          path: params[:path],
          order_by_package_file: order_by_package_file
        ).execute!
      end
    end

    desc 'Download the maven package file at instance level' do
      detail 'This feature was introduced in GitLab 11.6'
    end
    params do
      requires :path, type: String, desc: 'Package path'
      requires :file_name, type: String, desc: 'Package file name'
    end
    route_setting :authentication, job_token_allowed: true, deploy_token_allowed: true
    get 'packages/maven/*path/:file_name', requirements: MAVEN_ENDPOINT_REQUIREMENTS do
      # return a similar failure to authorize_read_package!(project)
      forbidden! unless path_exists?(params[:path])

      file_name, format = extract_format(params[:file_name])

      # To avoid name collision we require project path and project package be the same.
      # For packages that have different name from the project we should use
      # the endpoint that includes project id
      project = find_project_by_path(params[:path])

      authorize_read_package!(project)

      package = fetch_package(file_name: file_name, project: project)

      package_file = ::Packages::PackageFileFinder
        .new(package, file_name).execute!

      case format
      when 'md5'
        package_file.file_md5
      when 'sha1'
        package_file.file_sha1
      else
        track_package_event('pull_package', :maven) if jar_file?(format)
        present_carrierwave_file_with_head_support!(package_file.file)
      end
    end

    desc 'Download the maven package file at a group level' do
      detail 'This feature was introduced in GitLab 11.7'
    end
    params do
      requires :id, type: String, desc: 'The ID of a group'
    end
    resource :groups, requirements: API::NAMESPACE_OR_PROJECT_REQUIREMENTS do
      params do
        requires :path, type: String, desc: 'Package path'
        requires :file_name, type: String, desc: 'Package file name'
      end
      route_setting :authentication, job_token_allowed: true, deploy_token_allowed: true
      get ':id/-/packages/maven/*path/:file_name', requirements: MAVEN_ENDPOINT_REQUIREMENTS do
        # return a similar failure to group = find_group(params[:id])
        not_found!('Group') unless path_exists?(params[:path])

        file_name, format = extract_format(params[:file_name])

        group = find_group(params[:id])

        not_found!('Group') unless can?(current_user, :read_group, group)

        package = fetch_package(file_name: file_name, group: group)

        authorize_read_package!(package.project)

        package_file = ::Packages::PackageFileFinder
          .new(package, file_name).execute!

        case format
        when 'md5'
          package_file.file_md5
        when 'sha1'
          package_file.file_sha1
        else
          track_package_event('pull_package', :maven) if jar_file?(format)

          present_carrierwave_file_with_head_support!(package_file.file)
        end
      end
    end

    params do
      requires :id, type: String, desc: 'The ID of a project'
    end
    resource :projects, requirements: API::NAMESPACE_OR_PROJECT_REQUIREMENTS do
      desc 'Download the maven package file' do
        detail 'This feature was introduced in GitLab 11.3'
      end
      params do
        requires :path, type: String, desc: 'Package path'
        requires :file_name, type: String, desc: 'Package file name'
      end
      route_setting :authentication, job_token_allowed: true, deploy_token_allowed: true
      get ':id/packages/maven/*path/:file_name', requirements: MAVEN_ENDPOINT_REQUIREMENTS do
        # return a similar failure to user_project
        not_found!('Project') unless path_exists?(params[:path])

        authorize_read_package!(user_project)

        file_name, format = extract_format(params[:file_name])

        package = fetch_package(file_name: file_name, project: user_project)

        package_file = ::Packages::PackageFileFinder
          .new(package, file_name).execute!

        case format
        when 'md5'
          package_file.file_md5
        when 'sha1'
          package_file.file_sha1
        else
          track_package_event('pull_package', :maven) if jar_file?(format)

          present_carrierwave_file_with_head_support!(package_file.file)
        end
      end

      desc 'Workhorse authorize the maven package file upload' do
        detail 'This feature was introduced in GitLab 11.3'
      end
      params do
        requires :path, type: String, desc: 'Package path'
        requires :file_name, type: String, desc: 'Package file name', regexp: Gitlab::Regex.maven_file_name_regex
      end
      route_setting :authentication, job_token_allowed: true, deploy_token_allowed: true
      put ':id/packages/maven/*path/:file_name/authorize', requirements: MAVEN_ENDPOINT_REQUIREMENTS do
        authorize_upload!

        status 200
        content_type Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE
        ::Packages::PackageFileUploader.workhorse_authorize(has_length: true, maximum_size: user_project.actual_limits.maven_max_file_size)
      end

      desc 'Upload the maven package file' do
        detail 'This feature was introduced in GitLab 11.3'
      end
      params do
        requires :path, type: String, desc: 'Package path'
        requires :file_name, type: String, desc: 'Package file name', regexp: Gitlab::Regex.maven_file_name_regex
        requires :file, type: ::API::Validations::Types::WorkhorseFile, desc: 'The package file to be published (generated by Multipart middleware)'
      end
      route_setting :authentication, job_token_allowed: true, deploy_token_allowed: true
      put ':id/packages/maven/*path/:file_name', requirements: MAVEN_ENDPOINT_REQUIREMENTS do
        authorize_upload!
        bad_request!('File is too large') if user_project.actual_limits.exceeded?(:maven_max_file_size, params[:file].size)

        file_name, format = extract_format(params[:file_name])

        result = ::Packages::Maven::FindOrCreatePackageService
          .new(user_project, current_user, params.merge(build: current_authenticated_job)).execute

        bad_request!(result.errors.first) if result.error?

        package = result.payload[:package]

        case format
        when 'sha1'
          # After uploading a file, Maven tries to upload a sha1 and md5 version of it.
          # Since we store md5/sha1 in database we simply need to validate our hash
          # against one uploaded by Maven. We do this for `sha1` format.
          package_file = ::Packages::PackageFileFinder
            .new(package, file_name).execute!

          verify_package_file(package_file, params[:file])
        when 'md5'
          ''
        else
          track_package_event('push_package', :maven) if jar_file?(format)

          file_params = {
            file:      params[:file],
            size:      params['file.size'],
            file_name: file_name,
            file_type: params['file.type'],
            file_sha1: params['file.sha1'],
            file_md5:  params['file.md5']
          }

          ::Packages::CreatePackageFileService.new(package, file_params.merge(build: current_authenticated_job)).execute
        end
      end
    end
  end
end