gitlabhq/lib/gitlab/backend/grack_auth.rb

require_relative 'shell_env'

module Grack
  class Auth < Rack::Auth::Basic
    attr_accessor :user, :project

    def call(env)
      @env = env
      @request = Rack::Request.new(env)
      @auth = Request.new(env)

      # Need this patch due to the rails mount
      @env['PATH_INFO'] = @request.path
      @env['SCRIPT_NAME'] = ""

      return render_not_found unless project
      return unauthorized unless project.public || @auth.provided?
      return bad_request if @auth.provided? && !@auth.basic?

      if valid?
        if @auth.provided?
          @env['REMOTE_USER'] = @auth.username
        end
        return @app.call(env)
      else
        unauthorized
      end
    end

    def valid?
      if @auth.provided?
        # Authentication with username and password
        login, password = @auth.credentials
        self.user = User.find_by_email(login) || User.find_by_username(login)
        return false unless user.try(:valid_password?, password)

        Gitlab::ShellEnv.set_env(user)
      end

      # Git upload and receive
      if @request.get?
        validate_get_request
      elsif @request.post?
        validate_post_request
      else
        false
      end
    end

    def validate_get_request
      project.public || can?(user, :download_code, project)
    end

    def validate_post_request
      if @request.path_info.end_with?('git-upload-pack')
        project.public || can?(user, :download_code, project)
      elsif @request.path_info.end_with?('git-receive-pack')
        action = if project.protected_branch?(current_ref)
                   :push_code_to_protected_branches
                 else
                   :push_code
                 end

        can?(user, action, project)
      else
        false
      end
    end

    def can?(object, action, subject)
      abilities.allowed?(object, action, subject)
    end

    def current_ref
      if @env["HTTP_CONTENT_ENCODING"] =~ /gzip/
        input = Zlib::GzipReader.new(@request.body).read
      else
        input = @request.body.read
      end
      # Need to reset seek point
      @request.body.rewind
      /refs\/heads\/([\w\.-]+)/.match(input).to_a.last
    end

    def project
      unless instance_variable_defined? :@project
        # Find project by PATH_INFO from env
        if m = /^\/([\w\.\/-]+)\.git/.match(@request.path_info).to_a
          @project = Project.find_with_namespace(m.last)
        end
      end
      return @project
    end

    PLAIN_TYPE = {"Content-Type" => "text/plain"}

    def render_not_found
      [404, PLAIN_TYPE, ["Not Found"]]
    end

    protected

    def abilities
      @abilities ||= begin
                       abilities = Six.new
                       abilities << Ability
                       abilities
                     end
    end
  end# Auth
end# Grack