1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
# frozen_string_literal: true
module API
class PersonalAccessTokens < ::API::Base
include ::API::PaginationParams
feature_category :authentication_and_authorization
desc 'Get all Personal Access Tokens' do
detail 'This feature was added in GitLab 13.3'
success Entities::PersonalAccessToken
end
params do
optional :user_id, type: Integer, desc: 'Filter PATs by User ID'
optional :revoked, type: Boolean, desc: 'Filter PATs where revoked state matches parameter'
optional :state, type: String, desc: 'Filter PATs which are either active or not',
values: %w[active inactive]
optional :created_before, type: DateTime, desc: 'Filter PATs which were created before given datetime'
optional :created_after, type: DateTime, desc: 'Filter PATs which were created after given datetime'
optional :last_used_before, type: DateTime, desc: 'Filter PATs which were used before given datetime'
optional :last_used_after, type: DateTime, desc: 'Filter PATs which were used after given datetime'
optional :search, type: String, desc: 'Filters PATs by its name'
use :pagination
end
before do
authenticate!
restrict_non_admins! unless current_user.can_admin_all_resources?
end
helpers ::API::Helpers::PersonalAccessTokensHelpers
resources :personal_access_tokens do
get do
tokens = PersonalAccessTokensFinder.new(finder_params(current_user), current_user).execute
present paginate(tokens), with: Entities::PersonalAccessToken
end
get ':id' do
token = PersonalAccessToken.find_by_id(params[:id])
allowed = Ability.allowed?(current_user, :read_user_personal_access_tokens, token&.user)
if allowed
present token, with: Entities::PersonalAccessToken
else
# Only admins should be informed if the token doesn't exist
current_user.can_admin_all_resources? ? not_found! : unauthorized!
end
end
delete ':id' do
token = find_token(params[:id])
revoke_token(token)
end
end
end
end
|
