1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
|
module API
# Runners API
class Runners < Grape::API
before { authenticate! }
resource :runners do
# Get available shared runners
#
# Example Request:
# GET /runners
get do
runners =
if current_user.is_admin?
Ci::Runner.all
else
current_user.ci_authorized_runners
end
runners = filter_runners(runners, params[:scope])
present paginate(runners), with: Entities::Runner
end
get ':id' do
runner = get_runner(params[:id])
can_show_runner?(runner) unless current_user.is_admin?
present runner, with: Entities::RunnerDetails
end
put ':id' do
runner = get_runner(params[:id])
can_update_runner?(runner) unless current_user.is_admin?
attrs = attributes_for_keys [:description, :active, :tag_list]
if runner.update(attrs)
present runner, with: Entities::RunnerDetails
else
render_validation_error!(runner)
end
end
delete ':id' do
runner = get_runner(params[:id])
can_delete_runner?(runner)
runner.destroy!
present runner, with: Entities::RunnerDetails
end
end
resource :projects do
before { authorize_admin_project }
# Get runners available for project
#
# Example Request:
# GET /projects/:id/runners
get ':id/runners' do
runners = filter_runners(Ci::Runner.owned_or_shared(user_project.id), params[:scope])
present paginate(runners), with: Entities::Runner
end
put ':id/runners/:runner_id' do
runner = get_runner(params[:runner_id])
can_enable_runner?(runner)
Ci::RunnerProject.create(runner: runner, project: user_project)
present runner, with: Entities::Runner
end
delete ':id/runners/:runner_id' do
runner_project = user_project.runner_projects.find_by(runner_id: params[:runner_id])
not_found!('Runner') unless runner_project
runner = runner_project.runner
forbidden!("Can't disable runner - only one project associated with it. Please remove runner instead") if runner.projects.count == 1
runner_project.destroy
present runner, with: Entities::Runner
end
end
helpers do
def filter_runners(runners, scope)
return runners unless scope.present?
available_scopes = ::Ci::Runner::AVAILABLE_SCOPES
unless (available_scopes && scope).empty?
runners.send(scope)
else
render_api_error!('Scope contains invalid value', 400)
end
end
def get_runner(id)
runner = Ci::Runner.find(id)
not_found!('Runner') unless runner
runner
end
def can_show_runner?(runner)
return true if runner.is_shared
forbidden!("Can't show runner's details - no access granted") unless user_can_access_runner?(runner)
end
def can_update_runner?(runner)
return true if current_user.is_admin?
forbidden!("Can't update shared runner") if runner.is_shared?
forbidden!("Can't update runner - no access granted") unless user_can_access_runner?(runner)
end
def can_delete_runner?(runner)
return true if current_user.is_admin?
forbidden!("Can't delete shared runner") if runner.is_shared?
forbidden!("Can't delete runner - associated with more than one project") if runner.projects.count > 1
forbidden!("Can't delete runner - no access granted") unless user_can_access_runner?(runner)
end
def can_enable_runner?(runner)
forbidden!("Can't enable shared runner directly") if runner.is_shared?
return true if current_user.is_admin?
forbidden!("Can't update runner - no access granted") unless user_can_access_runner?(runner)
end
def user_can_access_runner?(runner)
runner.projects.inject(false) do |final, project|
final ||= abilities.allowed?(current_user, :admin_project, project)
end
end
end
end
end
|
