diff options
author | Douwe Maan <douwe@selenight.nl> | 2017-11-23 14:41:29 +0300 |
---|---|---|
committer | Douwe Maan <douwe@selenight.nl> | 2017-11-23 18:32:08 +0300 |
commit | 453b17809395fda045f5685268cae58c1dceb881 (patch) | |
tree | c02bac315c2d5d66417c52649a5951ddbffecdd1 /lib/gitlab/auth.rb | |
parent | 7084c096732dcd041fbdcd22ba17233941683c04 (diff) |
Fix pulling and pushing using a personal access token with the sudo scope
Diffstat (limited to 'lib/gitlab/auth.rb')
-rw-r--r-- | lib/gitlab/auth.rb | 25 |
1 files changed, 10 insertions, 15 deletions
diff --git a/lib/gitlab/auth.rb b/lib/gitlab/auth.rb index cbbc51db99e..0e7958ef90f 100644 --- a/lib/gitlab/auth.rb +++ b/lib/gitlab/auth.rb @@ -128,7 +128,7 @@ module Gitlab token = PersonalAccessTokensFinder.new(state: 'active').find_by(token: password) if token && valid_scoped_token?(token, available_scopes) - Gitlab::Auth::Result.new(token.user, nil, :personal_access_token, abilities_for_scope(token.scopes)) + Gitlab::Auth::Result.new(token.user, nil, :personal_access_token, abilities_for_scopes(token.scopes)) end end @@ -140,10 +140,15 @@ module Gitlab AccessTokenValidationService.new(token).include_any_scope?(scopes) end - def abilities_for_scope(scopes) - scopes.map do |scope| - self.public_send(:"#{scope}_scope_authentication_abilities") # rubocop:disable GitlabSecurity/PublicSend - end.flatten.uniq + def abilities_for_scopes(scopes) + abilities_by_scope = { + api: full_authentication_abilities, + read_registry: [:read_container_image] + } + + scopes.flat_map do |scope| + abilities_by_scope.fetch(scope.to_sym, []) + end.uniq end def lfs_token_check(login, password, project) @@ -222,16 +227,6 @@ module Gitlab :admin_container_image ] end - alias_method :api_scope_authentication_abilities, :full_authentication_abilities - - def read_registry_scope_authentication_abilities - [:read_container_image] - end - - # The currently used auth method doesn't allow any actions for this scope - def read_user_scope_authentication_abilities - [] - end def available_scopes(current_user = nil) scopes = API_SCOPES + registry_scopes |