diff options
author | Timothy Andrew <mail@timothyandrew.net> | 2016-11-22 12:04:23 +0300 |
---|---|---|
committer | Timothy Andrew <mail@timothyandrew.net> | 2016-12-16 13:59:31 +0300 |
commit | 7fa06ed55d18af4d055041eb27d38fecf9b5548f (patch) | |
tree | d2565cdc70269e5f244e7cf542170b0d5d8cf7aa /config/initializers/doorkeeper.rb | |
parent | 6c809dfae84e702f7a49d3fac5725745264e0ff9 (diff) |
Calls to the API are checked for scope.
- Move the `Oauth2::AccessTokenValidationService` class to
`AccessTokenValidationService`, since it is now being used for
personal access token validation as well.
- Each API endpoint declares the scopes it accepts (if any). Currently,
the top level API module declares the `api` scope, and the `Users` API
module declares the `read_user` scope (for GET requests).
- Move the `find_user_by_private_token` from the API `Helpers` module to
the `APIGuard` module, to avoid littering `Helpers` with more
auth-related methods to support `find_user_by_private_token`
Diffstat (limited to 'config/initializers/doorkeeper.rb')
-rw-r--r-- | config/initializers/doorkeeper.rb | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/config/initializers/doorkeeper.rb b/config/initializers/doorkeeper.rb index fc4b0a72add..88cd0f5f652 100644 --- a/config/initializers/doorkeeper.rb +++ b/config/initializers/doorkeeper.rb @@ -52,8 +52,8 @@ Doorkeeper.configure do # Define access token scopes for your provider # For more information go to # https://github.com/doorkeeper-gem/doorkeeper/wiki/Using-Scopes - default_scopes :api - # optional_scopes :write, :update + default_scopes(*Gitlab::Auth::DEFAULT_SCOPES) + optional_scopes(*Gitlab::Auth::OPTIONAL_SCOPES) # Change the way client credentials are retrieved from the request object. # By default it retrieves first from the `HTTP_AUTHORIZATION` header, then |