diff options
author | Kamil Trzciński <ayufan@ayufan.eu> | 2017-10-12 23:59:03 +0300 |
---|---|---|
committer | Kamil Trzciński <ayufan@ayufan.eu> | 2017-10-12 23:59:03 +0300 |
commit | 3555252d808d7d939e1dd508962abe8d94cbd667 (patch) | |
tree | 7e1e83e761534033d01c7b4a32f5fffdc33ec77a /app | |
parent | 8d47e9f8e13c2ca43520b348dde0424fe6460cc9 (diff) | |
parent | 3d744009ed3f27daefb5d898f6e8b848a3630928 (diff) |
Merge branch '26763-grant-registry-auth-scope-to-admins' into 'master'
Issue JWT token with registry:catalog:* scope when requested by GitLab admin
Closes #26763 and #18392
See merge request gitlab-org/gitlab-ce!14751
Diffstat (limited to 'app')
-rw-r--r-- | app/services/auth/container_registry_authentication_service.rb | 17 |
1 files changed, 14 insertions, 3 deletions
diff --git a/app/services/auth/container_registry_authentication_service.rb b/app/services/auth/container_registry_authentication_service.rb index 9a636346899..f40cd2b06c8 100644 --- a/app/services/auth/container_registry_authentication_service.rb +++ b/app/services/auth/container_registry_authentication_service.rb @@ -56,11 +56,22 @@ module Auth def process_scope(scope) type, name, actions = scope.split(':', 3) actions = actions.split(',') - path = ContainerRegistry::Path.new(name) - return unless type == 'repository' + case type + when 'registry' + process_registry_access(type, name, actions) + when 'repository' + path = ContainerRegistry::Path.new(name) + process_repository_access(type, path, actions) + end + end + + def process_registry_access(type, name, actions) + return unless current_user&.admin? + return unless name == 'catalog' + return unless actions == ['*'] - process_repository_access(type, path, actions) + { type: type, name: name, actions: ['*'] } end def process_repository_access(type, path, actions) |