Find parent namepsace domain if auth fails for current project

Update labkit

5 files changed, 27 insertions, 9 deletions

diff --git a/acceptance_test.go b/acceptance_test.go
index 6a49de8a..0ba5d18f 100644
--- a/acceptance_test.go
+++ b/acceptance_test.go
@@ -17,7 +17,6 @@ import (
 
 	"github.com/namsral/flag"
 	"github.com/stretchr/testify/require"
-	"gotest.tools/assert"
 )
 
 var pagesBinary = flag.String("gitlab-pages-binary", "./gitlab-pages", "Path to the gitlab-pages binary")
@@ -251,7 +250,7 @@ func TestCustom404(t *testing.T) {
 
 				require.NoError(t, err)
 				defer rsp.Body.Close()
-				assert.Equal(t, http.StatusNotFound, rsp.StatusCode)
+				require.Equal(t, http.StatusNotFound, rsp.StatusCode)
 
 				page, err := ioutil.ReadAll(rsp.Body)
 				require.NoError(t, err)
diff --git a/app.go b/app.go
index c1af29c2..4ead5003 100644
--- a/app.go
+++ b/app.go
@@ -250,7 +250,7 @@ func (a *theApp) accessControlMiddleware(handler http.Handler) http.Handler {
 		// Only for projects that have access control enabled
 		if domain.IsAccessControlEnabled(r) {
 			// accessControlMiddleware
-			if a.Auth.CheckAuthentication(w, r, domain.GetProjectID(r)) {
+			if a.Auth.CheckAuthentication(w, r, domain) {
 				return
 			}
 		}
diff --git a/go.mod b/go.mod
index 049b9c57..43f78bc4 100644
--- a/go.mod
+++ b/go.mod
@@ -23,7 +23,7 @@ require (
 	github.com/stretchr/testify v1.5.1
 	github.com/tomasen/realip v0.0.0-20180522021738-f0c99a92ddce
 	github.com/wadey/gocovmerge v0.0.0-20160331181800-b5bfa59ec0ad
-	gitlab.com/gitlab-org/labkit v0.0.0-20200520155818-96e583c57891
+	gitlab.com/gitlab-org/labkit v0.0.0-20200526151107-6dcf1319fcd0
 	gitlab.com/lupine/go-mimedb v0.0.0-20180307000149-e8af1d659877
 	golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550
 	golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f
diff --git a/go.sum b/go.sum
index 550d6a7d..ceb73a62 100644
--- a/go.sum
+++ b/go.sum
@@ -327,9 +327,8 @@ github.com/yalp/jsonpath v0.0.0-20180802001716-5cc68e5049a0/go.mod h1:/LWChgwKmv
 github.com/yudai/gojsondiff v1.0.0/go.mod h1:AY32+k2cwILAkW1fbgxQ5mUmMiZFgLIV+FBNExI05xg=
 github.com/yudai/golcs v0.0.0-20170316035057-ecda9a501e82/go.mod h1:lgjkn3NuSvDfVJdfcVVdX+jpBxNmX4rDAzaS45IcYoM=
 github.com/yudai/pp v2.0.1+incompatible/go.mod h1:PuxR/8QJ7cyCkFp/aUDS+JY727OFEZkTdatxwunjIkc=
-github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-gitlab.com/gitlab-org/labkit v0.0.0-20200520155818-96e583c57891 h1:WiCGS5C0B0h+/dh5O7kUJoEZt34O/tbsis9QghNB3gE=
-gitlab.com/gitlab-org/labkit v0.0.0-20200520155818-96e583c57891/go.mod h1:SNfxkfUwVNECgtmluVayv0GWFgEjjBs5AzgsowPQuo0=
+gitlab.com/gitlab-org/labkit v0.0.0-20200526151107-6dcf1319fcd0 h1:+TiSK1umKrr6PCYCR8rJmUMk39hNynOgjZIbJmYXHm0=
+gitlab.com/gitlab-org/labkit v0.0.0-20200526151107-6dcf1319fcd0/go.mod h1:SNfxkfUwVNECgtmluVayv0GWFgEjjBs5AzgsowPQuo0=
 gitlab.com/lupine/go-mimedb v0.0.0-20180307000149-e8af1d659877 h1:k5N2m0IPaMuwWmFTO9fyTK4IEnSm35GC/p1S7VRgUyM=
 gitlab.com/lupine/go-mimedb v0.0.0-20180307000149-e8af1d659877/go.mod h1:Es0wDVbtgNqhpEXMb+yct6JKnGMrNsUSh9oio0bqqdU=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
diff --git a/internal/auth/auth.go b/internal/auth/auth.go
index 453edff2..c12207ca 100644
--- a/internal/auth/auth.go
+++ b/internal/auth/auth.go
@@ -18,6 +18,7 @@ import (
 	log "github.com/sirupsen/logrus"
 	"gitlab.com/gitlab-org/labkit/errortracking"
 
+	"gitlab.com/gitlab-org/gitlab-pages/internal/domain"
 	"gitlab.com/gitlab-org/gitlab-pages/internal/httperrors"
 	"gitlab.com/gitlab-org/gitlab-pages/internal/httptransport"
 	"gitlab.com/gitlab-org/gitlab-pages/internal/request"
@@ -511,7 +512,7 @@ func (a *Auth) RequireAuth(w http.ResponseWriter, r *http.Request) bool {
 }
 
 // CheckAuthentication checks if user is authenticated and has access to the project
-func (a *Auth) CheckAuthentication(w http.ResponseWriter, r *http.Request, projectID uint64) bool {
+func (a *Auth) CheckAuthentication(w http.ResponseWriter, r *http.Request, domain *domain.Domain) bool {
 	logRequest(r).Debug("Authenticate request")
 
 	if a == nil {
@@ -522,7 +523,26 @@ func (a *Auth) CheckAuthentication(w http.ResponseWriter, r *http.Request, proje
 		return true
 	}
 
-	return a.checkAuthentication(w, r, projectID)
+	if a.checkAuthentication(w, r, domain.GetProjectID(r)) {
+		// if auth fails, try to resolve parent namespace domain
+		r.URL.Path = "/"
+		parent, err := domain.Resolver.Resolve(r)
+		if err != nil {
+			httperrors.Serve404(w)
+			return true
+		}
+
+		// for namespace domains that have no access control enabled
+		if parent.LookupPath.IsNamespaceProject && !parent.LookupPath.HasAccessControl {
+			parent.ServeNotFoundHTTP(w, r)
+			return true
+		}
+
+		httperrors.Serve404(w)
+		return true
+	}
+
+	return false
 }
 
 // CheckResponseForInvalidToken checks response for invalid token and destroys session if it was invalid