Add settingslogic and limit gitlab domain usage to sepcified in config

10 files changed, 41 insertions, 8 deletions

diff --git a/app/controllers/projects_controller.rb b/app/controllers/projects_controller.rb
index 906fe96..b4138c3 100644
--- a/app/controllers/projects_controller.rb
+++ b/app/controllers/projects_controller.rb
@@ -5,7 +5,7 @@ class ProjectsController < ApplicationController
   before_filter :no_cache, only: [:status]
 
   def index
-    @projects = Project.order('id DESC')
+    @projects = Project.order('name ASC')
     @projects = @projects.public unless current_user
     @projects  = @projects.page(params[:page]).per(20)
   end
@@ -98,7 +98,7 @@ class ProjectsController < ApplicationController
   end
 
   def gitlab
-    @projects = Project.fetch(current_user)
+    @projects = Project.from_gitlab(current_user)
   end
 
   def add
diff --git a/app/controllers/user_sessions_controller.rb b/app/controllers/user_sessions_controller.rb
index eebc087..84a1f41 100644
--- a/app/controllers/user_sessions_controller.rb
+++ b/app/controllers/user_sessions_controller.rb
@@ -1,4 +1,6 @@
 class UserSessionsController < ApplicationController
+  before_filter :authenticate_user!, except: [:new, :create]
+
   def show
     @user = current_user
   end
diff --git a/app/models/network.rb b/app/models/network.rb
index e6afc8b..36edead 100644
--- a/app/models/network.rb
+++ b/app/models/network.rb
@@ -1,7 +1,7 @@
 class Network
   include HTTParty
 
-  def authenticate url, api_opts
+  def authenticate(url, api_opts)
     opts = {
       body: api_opts.to_json,
       headers: {"Content-Type" => "application/json"},
@@ -16,13 +16,19 @@ class Network
     end
   end
 
-  def projects url, api_opts
+  def projects(url, api_opts, scope = :owned)
     opts = {
       query: api_opts.merge(per_page: 1000),
       headers: {"Content-Type" => "application/json"},
     }
 
-    response = self.class.get(url + api_prefix + 'projects/owned.json', opts)
+    query = if scope == :owned
+             'projects/owned.json'
+            else
+             'projects.json'
+            end
+
+    response = self.class.get(url + api_prefix + query, opts)
 
     if response.code == 200
       response.parsed_response
diff --git a/app/models/project.rb b/app/models/project.rb
index 4a4729c..a55d6ba 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -43,12 +43,12 @@ class Project < ActiveRecord::Base
 
   before_validation :set_default_values
 
-  def self.fetch(user)
+  def self.from_gitlab(user, scope = :owned)
     opts = {
       private_token: user.private_token
     }
 
-    projects = Network.new.projects(user.url, opts)
+    projects = Network.new.projects(user.url, opts, scope)
 
     if projects
       projects.map { |pr| OpenStruct.new(pr) }
diff --git a/app/models/user_session.rb b/app/models/user_session.rb
index facbd44..c9e05d9 100644
--- a/app/models/user_session.rb
+++ b/app/models/user_session.rb
@@ -7,6 +7,9 @@ class UserSession
 
   def authenticate auth_opts
     url = auth_opts.delete(:url)
+
+    return nil unless GitlabCi.config.allowed_gitlab_urls.include?(url)
+
     user = Network.new.authenticate(url, auth_opts)
 
     if user
diff --git a/app/views/user_sessions/_form.html.haml b/app/views/user_sessions/_form.html.haml
index eacdbc4..2520754 100644
--- a/app/views/user_sessions/_form.html.haml
+++ b/app/views/user_sessions/_form.html.haml
@@ -7,6 +7,6 @@
     .controls= f.password_field :password
   .field
     = f.label :url
-    = f.text_field :url, placeholder: 'http://gitlab.company.com'
+    = f.select :url, GitlabCi.config.allowed_gitlab_urls.map {|url| [url, url] }, placeholder: 'http://gitlab.company.com'
   .form-actions
     = f.submit "Sign in", class: 'btn btn-primary'
diff --git a/config/application.yml.example b/config/application.yml.example
new file mode 100644
index 0000000..7e88082
--- /dev/null
+++ b/config/application.yml.example
@@ -0,0 +1,14 @@
+defaults: &defaults
+  allowed_gitlab_urls: 
+    - 'https://dev.gitlab.org/'
+    - 'https://staging.gitlab.org/'
+
+development:
+  <<: *defaults
+  neat_setting: 800
+
+test:
+  <<: *defaults
+
+production:
+  <<: *defaults
diff --git a/config/initializers/1_settings.rb b/config/initializers/1_settings.rb
new file mode 100644
index 0000000..c3eed7d
--- /dev/null
+++ b/config/initializers/1_settings.rb
@@ -0,0 +1,4 @@
+class Settings < Settingslogic
+  source "#{Rails.root}/config/application.yml"
+  namespace Rails.env
+end
diff --git a/config/initializers/1_app.rb b/config/initializers/2_app.rb
index 57a0911..22a95c9 100644
--- a/config/initializers/1_app.rb
+++ b/config/initializers/2_app.rb
@@ -2,4 +2,8 @@ module GitlabCi
   Version = File.read(Rails.root.join("VERSION"))
   Revision = `git log --pretty=format:'%h' -n 1`
   RunnersToken = SecureRandom.hex(10)
+
+  def self.config
+    Settings
+  end
 end
diff --git a/config/initializers/2_sidekiq.rb b/config/initializers/3_sidekiq.rb
index c2d380f..c2d380f 100644
--- a/config/initializers/2_sidekiq.rb
+++ b/config/initializers/3_sidekiq.rb