gitlabhq/lib/api/helpers.rb

94 lines
2 KiB
Ruby
Raw Normal View History

2012-06-27 13:32:56 +02:00
module Gitlab
module APIHelpers
def current_user
2012-10-02 17:43:35 +02:00
@current_user ||= User.find_by_authentication_token(params[:private_token] || env["HTTP_PRIVATE_TOKEN"])
2012-06-27 13:32:56 +02:00
end
2012-07-06 15:08:17 +02:00
def user_project
2012-12-12 11:54:28 +01:00
@project ||= find_project
@project || not_found!
end
def find_project
project = Project.find_by_id(params[:id]) || Project.find_with_namespace(params[:id])
if project && can?(current_user, :read_project, project)
project
2012-07-25 14:24:28 +02:00
else
2012-12-12 11:54:28 +01:00
nil
2012-07-25 14:24:28 +02:00
end
2012-07-06 15:08:17 +02:00
end
2012-09-03 13:46:29 +02:00
def paginate(object)
object.page(params[:page]).per(params[:per_page].to_i)
end
2012-06-27 13:32:56 +02:00
def authenticate!
2012-09-10 09:41:46 +02:00
unauthorized! unless current_user
2012-06-27 13:32:56 +02:00
end
2012-09-10 08:06:11 +02:00
def authenticated_as_admin!
forbidden! unless current_user.is_admin?
end
2012-09-10 08:06:11 +02:00
def authorize! action, subject
unless abilities.allowed?(current_user, action, subject)
2012-09-10 09:41:46 +02:00
forbidden!
2012-09-10 08:06:11 +02:00
end
end
2012-12-12 11:54:28 +01:00
def can?(object, action, subject)
abilities.allowed?(object, action, subject)
end
2012-09-16 19:08:57 +02:00
def attributes_for_keys(keys)
2012-09-16 18:51:04 +02:00
attrs = {}
keys.each do |key|
attrs[key] = params[key] if params[key].present?
end
attrs
end
2012-09-10 09:41:46 +02:00
# error helpers
def forbidden!
2012-09-10 12:49:00 +02:00
render_api_error!('403 Forbidden', 403)
2012-09-10 09:41:46 +02:00
end
def bad_request!(attribute)
message = ["400 (Bad request)"]
message << "\"" + attribute.to_s + "\" not given"
render_api_error!(message.join(' '), 400)
end
2012-09-10 09:41:46 +02:00
def not_found!(resource = nil)
message = ["404"]
message << resource if resource
message << "Not Found"
2012-09-10 12:49:00 +02:00
render_api_error!(message.join(' '), 404)
2012-09-10 09:41:46 +02:00
end
def unauthorized!
2012-09-10 12:49:00 +02:00
render_api_error!('401 Unauthorized', 401)
2012-09-10 09:41:46 +02:00
end
def not_allowed!
2012-09-10 12:49:00 +02:00
render_api_error!('Method Not Allowed', 405)
end
def render_api_error!(message, status)
error!({'message' => message}, status)
2012-09-10 09:41:46 +02:00
end
2012-09-21 12:22:30 +02:00
private
2012-09-10 08:06:11 +02:00
def abilities
@abilities ||= begin
abilities = Six.new
abilities << Ability
abilities
end
end
2012-06-27 13:32:56 +02:00
end
end