1 files changed, 28 insertions, 9 deletions

diff --git a/lib/api/nuget_packages.rb b/lib/api/nuget_packages.rb
index eb7d320a0f5..56c4de2071d 100644
--- a/lib/api/nuget_packages.rb
+++ b/lib/api/nuget_packages.rb
@@ -54,7 +54,9 @@ module API
     params do
       requires :id, type: String, desc: 'The ID of a project', regexp: POSITIVE_INTEGER_REGEX
     end
-    route_setting :authentication, deploy_token_allowed: true
+
+    route_setting :authentication, deploy_token_allowed: true, job_token_allowed: :basic_auth, basic_auth_personal_access_token: true
+
     resource :projects, requirements: API::NAMESPACE_OR_PROJECT_REQUIREMENTS do
       before do
         authorized_user_project
@@ -65,7 +67,9 @@ module API
         desc 'The NuGet Service Index' do
           detail 'This feature was introduced in GitLab 12.6'
         end
-        route_setting :authentication, deploy_token_allowed: true
+
+        route_setting :authentication, deploy_token_allowed: true, job_token_allowed: :basic_auth, basic_auth_personal_access_token: true
+
         get 'index', format: :json do
           authorize_read_package!(authorized_user_project)
 
@@ -79,10 +83,13 @@ module API
         desc 'The NuGet Package Publish endpoint' do
           detail 'This feature was introduced in GitLab 12.6'
         end
+
         params do
           requires :package, type: ::API::Validations::Types::WorkhorseFile, desc: 'The package file to be published (generated by Multipart middleware)'
         end
-        route_setting :authentication, deploy_token_allowed: true
+
+        route_setting :authentication, deploy_token_allowed: true, job_token_allowed: :basic_auth, basic_auth_personal_access_token: true
+
         put do
           authorize_upload!(authorized_user_project)
 
@@ -107,7 +114,9 @@ module API
 
           forbidden!
         end
-        route_setting :authentication, deploy_token_allowed: true
+
+        route_setting :authentication, deploy_token_allowed: true, job_token_allowed: :basic_auth, basic_auth_personal_access_token: true
+
         put 'authorize' do
           authorize_workhorse!(subject: authorized_user_project, has_length: false)
         end
@@ -124,7 +133,9 @@ module API
           desc 'The NuGet Metadata Service - Package name level' do
             detail 'This feature was introduced in GitLab 12.8'
           end
-          route_setting :authentication, deploy_token_allowed: true
+
+          route_setting :authentication, deploy_token_allowed: true, job_token_allowed: :basic_auth, basic_auth_personal_access_token: true
+
           get 'index', format: :json do
             present ::Packages::Nuget::PackagesMetadataPresenter.new(find_packages),
                     with: ::API::Entities::Nuget::PackagesMetadata
@@ -136,7 +147,9 @@ module API
           params do
             requires :package_version, type: String, desc: 'The NuGet package version', regexp: API::NO_SLASH_URL_PART_REGEX
           end
-          route_setting :authentication, deploy_token_allowed: true
+
+          route_setting :authentication, deploy_token_allowed: true, job_token_allowed: :basic_auth, basic_auth_personal_access_token: true
+
           get '*package_version', format: :json do
             present ::Packages::Nuget::PackageMetadataPresenter.new(find_package),
                     with: ::API::Entities::Nuget::PackageMetadata
@@ -155,7 +168,9 @@ module API
           desc 'The NuGet Content Service - index request' do
             detail 'This feature was introduced in GitLab 12.8'
           end
-          route_setting :authentication, deploy_token_allowed: true
+
+          route_setting :authentication, deploy_token_allowed: true, job_token_allowed: :basic_auth, basic_auth_personal_access_token: true
+
           get 'index', format: :json do
             present ::Packages::Nuget::PackagesVersionsPresenter.new(find_packages),
                     with: ::API::Entities::Nuget::PackagesVersions
@@ -168,7 +183,9 @@ module API
             requires :package_version, type: String, desc: 'The NuGet package version', regexp: API::NO_SLASH_URL_PART_REGEX
             requires :package_filename, type: String, desc: 'The NuGet package filename', regexp: API::NO_SLASH_URL_PART_REGEX
           end
-          route_setting :authentication, deploy_token_allowed: true
+
+          route_setting :authentication, deploy_token_allowed: true, job_token_allowed: :basic_auth, basic_auth_personal_access_token: true
+
           get '*package_version/*package_filename', format: :nupkg do
             filename = "#{params[:package_filename]}.#{params[:format]}"
             package_file = ::Packages::PackageFileFinder.new(find_package, filename, with_file_name_like: true)
@@ -198,7 +215,9 @@ module API
           desc 'The NuGet Search Service' do
             detail 'This feature was introduced in GitLab 12.8'
           end
-          route_setting :authentication, deploy_token_allowed: true
+
+          route_setting :authentication, deploy_token_allowed: true, job_token_allowed: :basic_auth, basic_auth_personal_access_token: true
+
           get format: :json do
             search_options = {
               include_prerelease_versions: params[:prerelease],