Class Grack::Auth < Rack::Auth::Basic

# File lib/gitlab/backend/grack_auth.rb, line 56
def can?(object, action, subject)
  abilities.allowed?(object, action, subject)
end

# File lib/gitlab/backend/grack_auth.rb, line 60
def current_ref
  if @env["HTTP_CONTENT_ENCODING"] =~ %rgzip/
    input = Zlib::GzipReader.new(@request.body).read
  else
    input = @request.body.read
  end
  # Need to reset seek point
  @request.body.rewind
  %rrefs\/heads\/([\w\.-]+)/.match(input).to_a.first
end

# File lib/gitlab/backend/grack_auth.rb, line 5
def valid?
  # Authentication with username and password
  login, password = @auth.credentials

  self.user = User.find_by_email(login) || User.find_by_username(login)

  return false unless user.try(:valid_password?, password)

  email = user.email

  # Set GL_USER env variable
  ENV['GL_USER'] = email
  # Pass Gitolite update hook
  ENV['GL_BYPASS_UPDATE_HOOK'] = "true"

  # Find project by PATH_INFO from env
  if m = %r^\/([\w\.\/-]+)\.git/.match(@request.path_info).to_a
    self.project = Project.find_with_namespace(m.last)
    return false unless project
  end

  # Git upload and receive
  if @request.get?
    validate_get_request
  elsif @request.post?
    validate_post_request
  else
    false
  end
end

# File lib/gitlab/backend/grack_auth.rb, line 36
def validate_get_request
  can?(user, :download_code, project)
end

# File lib/gitlab/backend/grack_auth.rb, line 40
def validate_post_request
  if @request.path_info.end_with?('git-upload-pack')
    can?(user, :download_code, project)
  elsif @request.path_info.end_with?('git-receive-pack')
    action = if project.protected_branch?(current_ref)
               :push_code_to_protected_branches
             else
               :push_code
             end

    can?(user, action, project)
  else
    false
  end
end

# File lib/gitlab/backend/grack_auth.rb, line 73
def abilities
  @abilities ||= begin
                   abilities = Six.new
                   abilities << Ability
                   abilities
                 end
end