summaryrefslogtreecommitdiff
path: root/lib/api/helpers.rb
Commit message (Collapse)AuthorAgeFilesLines
* Allow public access to some Project API endpoints4269-public-apiRémy Coutable2016-12-011-0/+5
| | | | Signed-off-by: Rémy Coutable <remy@rymai.me>
* Merge branch 'grapify-projects-api' into 'master' Rémy Coutable2016-11-301-24/+2
|\ | | | | | | | | | | | | Grapify the projects API Related to #22928 See merge request !7456
| * Grapify the projects APIgrapify-projects-apiRobert Schilling2016-11-281-24/+2
| |
* | Merge branch 'jej-use-issuable-finder-instead-of-access-check' into 'security' Douwe Maan2016-11-281-3/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Replace issue access checks with use of IssuableFinder Split from !2024 to partially solve https://gitlab.com/gitlab-org/gitlab-ce/issues/23867 ## Which fixes are in this MR? :warning: - Potentially untested :bomb: - No test coverage :traffic_light: - Test coverage of some sort exists (a test failed when error raised) :vertical_traffic_light: - Test coverage of return value (a test failed when nil used) :white_check_mark: - Permissions check tested ### Issue lookup with access check Using `visible_to_user` likely makes these security issues too. See [Code smells](#code-smells). - [x] :vertical_traffic_light: app/finders/notes_finder.rb:15 [`visible_to_user`] - [x] :traffic_light: app/views/layouts/nav/_project.html.haml:73 [`visible_to_user`] [`.count`] - [x] :white_check_mark: app/services/merge_requests/build_service.rb:84 [`issue.try(:confidential?)`] - [x] :white_check_mark: lib/api/issues.rb:112 [`visible_to_user`] - CHANGELOG: Prevented API returning issues set to 'Only team members' to everyone - [x] :white_check_mark: lib/api/helpers.rb:126 [`can?(current_user, :read_issue, issue)`] Maybe here too? - [x] :white_check_mark: lib/gitlab/search_results.rb:53 [`visible_to_user`] ### Previous discussions - [ ] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#b2ff264eddf9819d7693c14ae213d941494fe2b3_128_126 - [ ] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#7b6375270d22f880bdcb085e47b519b426a5c6c7_87_87 See merge request !2031
* | Merge branch 'zj-fix-label-creation-non-members' into 'security'Douwe Maan2016-11-281-14/+0
|/ | | | | | | | Fix label creation non members Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/23416 See merge request !2006
* API: Introduce `#find_group!` which also check access permission22373-reduce-queries-in-api-helpers-find_projectRémy Coutable2016-11-241-1/+9
| | | | Signed-off-by: Rémy Coutable <remy@rymai.me>
* API: Introduce `#find_project!` which also check access permissionRémy Coutable2016-11-241-7/+10
| | | | Signed-off-by: Rémy Coutable <remy@rymai.me>
* Make API::Helpers find a project with only one queryRémy Coutable2016-11-241-1/+6
| | | | Signed-off-by: Rémy Coutable <remy@rymai.me>
* Improve style, add more testsZ.J. van de Weg2016-11-181-11/+2
|
* More coverage on service levelZ.J. van de Weg2016-11-181-0/+9
|
* Merge branch 'adam-build-missing-services-when-necessary' into 'master' Douwe Maan2016-11-161-16/+1
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Defer saving project services to the database if there are no user changes ## What does this MR do? It defers saving project services to the database as long as it is possible. It creates a project service when creating a project only if this project service has an active template. After that project services are saved on the first edit. ## Are there points in the code the reviewer needs to double check? - tests that used `build_missing_services` before the change - number of queries executed ## Why was this MR needed? Motivation in #22281 ## Does this MR meet the acceptance criteria? - [x] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added - Tests - [x] Added for this feature/bug - [x] All builds are passing - [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html) - [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides) - [x] Branch has no merge conflicts with `master` (if it does - rebase it please) - [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits) ## What are the relevant issue numbers? Fixes #22281 See merge request !6958
| * Defer saving project services to the database if there are no user changesadam-build-missing-services-when-necessaryAdam Niedzielski2016-11-161-16/+1
| |
* | Use #to_h to convert params to a hashgrapify-to-hRobert Schilling2016-11-141-0/+5
|/
* Fix project features default valuesFelipe Artur2016-11-011-8/+2
|
* API: Fix booleans not recognized as such when using the `to_boolean` helper23890-api-should-accepts-booleanRémy Coutable2016-10-271-0/+1
| | | | Signed-off-by: Rémy Coutable <remy@rymai.me>
* Validate label params against all labels available to project on the APIDouglas Barbosa Alexandre2016-10-191-10/+9
|
* Merge branch 'memoize_shell_secret_token' into 'master' Rémy Coutable2016-10-071-1/+1
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Memoize Github::Shell's secret token ## What does this MR do? `API::Helpers#secret_token` was reading the secret file on every invocation. This MR reads the file in the `gitlab_shell_secret_token.rb` initializer and saves it as a class variable at `Gitlab::Shell.secret_token` ## Are there points in the code the reviewer needs to double check? - I'm not sure if the use of `cattr_accessor` is the best approach, or if should be moved into the `class << self` block? - Should `API::Helpers#secret_token` be removed in favor of using `Gitlab::Shell.secret_token`? ## Why was this MR needed? Performance optimization. Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/22510 See merge request !6599
| * Load Github::Shell's secret token from file on initialization instead of ↵Justin DiPierro2016-10-061-1/+1
| | | | | | | | every request.
* | Switch from request to env in ::API::HelpersNick Thomas2016-10-061-1/+1
|/ | | | | | Per https://gitlab.com/gitlab-org/gitlab-ce/issues/22820, this helper is mixed in to classes that lack a `request` method. They do include `env`, so use it instead.
* API: disable rails session auth for non-GET/HEAD requestsNick Thomas2016-09-231-1/+4
|
* Enable Warden for the Grape APINick Thomas2016-09-191-3/+20
| | | | | | | | | | | | | | The practical effect of this commit is to make the API check the Rails session cookie for authentication details. If the cookie is present and valid, it will be used to authenticate. The API now has several authentication options for users. They follow in this order of precedence: * Authentication token * Personal access token * OAuth2 Bearer token (Doorkeeper - application access) * Rails session cookie
* Change response for /ci/api/v1/builds/register.json from 404 to 204Tomasz Maczukin2016-09-131-0/+4
|
* use a nil subject when we want to check global abilitieshttp://jneen.net/2016-08-301-1/+1
|
* remove Ability.abilitieshttp://jneen.net/2016-08-301-5/+1
|
* remove six, and use a Set insteadhttp://jneen.net/2016-08-301-5/+1
|
* Add Sentry logging to API callsadd-sentry-logging-to-apiStan Hu2016-08-241-0/+32
| | | | Closes #21043
* Restore back-compatibility for current members API endpointsRémy Coutable2016-08-101-1/+0
| | | | Signed-off-by: Rémy Coutable <remy@rymai.me>
* New AccessRequests API endpoints for Group & ProjectRémy Coutable2016-08-101-19/+6
| | | | | | | | Also, mutualize AccessRequests and Members endpoints for Group & Project. New API documentation for the AccessRequests endpoints. Signed-off-by: Rémy Coutable <remy@rymai.me>
* Replace parse_boolean with to_booleanRobert Schilling2016-07-201-5/+1
|
* API: Expose 'developers_can_push' for branchesRobert Schilling2016-07-191-0/+7
|
* Revert "Revert "Merge branch '18193-developers-can-merge' into 'master' ""Rémy Coutable2016-07-181-1/+1
| | | | | | | | This reverts commit 530f5158e297f3cde27f3566cfe13bad74ba3b50. See !4892. Signed-off-by: Rémy Coutable <remy@rymai.me>
* Revert "Merge branch '18193-developers-can-merge' into 'master' "Robert Speicher2016-07-131-1/+1
| | | | | This reverts commit 9ca633eb4c62231e4ddff5466c723cf8e2bdb25d, reversing changes made to fb229bbf7970ba908962b837b270adf56f14098f.
* Refactor `Gitlab::GitAccess`Timothy Andrew2016-07-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1. Don't use case statements for dispatch anymore. This leads to a lot of duplication, and makes the logic harder to follow. 2. Remove duplicated logic. - For example, the `can_push_to_branch?` exists, but we also have a different way of checking the same condition within `change_access_check`. - This kind of duplication is removed, and the `can_push_to_branch?` method is used in both places. 3. Move checks returning true/false to `UserAccess`. - All public methods in `GitAccess` now return an instance of `GitAccessStatus`. Previously, some methods would return true/false as well, which was confusing. - It makes sense for these kinds of checks to be at the level of a user, so the `UserAccess` class was repurposed for this. The prior `UserAccess.allowed?` classmethod is converted into an instance method. - All external uses of these checks have been migrated to use the `UserAccess` class 4. Move the "change_access_check" into a separate class. - Create the `GitAccess::ChangeAccessCheck` class to run these checks, which are quite substantial. - `ChangeAccessCheck` returns an instance of `GitAccessStatus` as well. 5. Break out the boolean logic in `ChangeAccessCheck` into `if/else` chains - this seems more readable. 6. I can understand that this might look like overkill for !4892, but I think this is a good opportunity to clean it up. - http://martinfowler.com/bliki/OpportunisticRefactoring.html
* Implement @DouweM's feedback.Timothy Andrew2016-06-161-11/+3
| | | | | | | | | | | | | - Extract a duplicated `redirect_to` - Fix a typo: "token", not "certificate" - Have the "Expires at" datepicker be attached to a text field, not inline - Have both private tokens and personal access tokens verified in a single "authenticate_from_private_token" method, both in the application and API. Move relevant logic to `User#find_by_personal_access_token` - Remove unnecessary constants relating to API auth. We don't need a separate constant for personal access tokens since the param is the same as for private tokens.
* Merge remote-tracking branch 'origin/master' into 2979-personal-access-tokensTimothy Andrew2016-06-141-0/+18
|\
| * Fix Error 500 when using closes_issues API with an external issue trackerStan Hu2016-06-111-0/+8
| | | | | | | | Closes #18484
| * Satisfy Rubocopworkhorse-helpersDouwe Maan2016-06-101-2/+2
| |
| * Add workhorse controller and API helpersDouwe Maan2016-06-061-0/+10
| |
* | Merge remote-tracking branch 'origin/master' into 2979-personal-access-tokensTimothy Andrew2016-06-031-2/+13
|\ \ | |/
| * Enable Style/DefWithParentheses cop and fix single offenseRobert Speicher2016-05-231-1/+1
| |
| * Codestyle: make sure we have space around operatorsGabriel Mazetto2016-05-131-1/+1
| |
| * Add API endpoints for un/subscribing from/to a labelAhmad Sherif2016-05-121-0/+11
| | | | | | | | Closes #15638
* | Reuse the private token param and header for personal access tokens.Timothy Andrew2016-05-111-2/+2
| | | | | | | | | | | | | | | | - https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/3749#note_11626427 - Personal access tokens are still a separate entity as far as the codebase is concerned - they just happen to use the same entry point as private tokens. - Update tests and documentation to reflect this change
* | Merge remote-tracking branch 'origin/master' into 2979-personal-access-tokensTimothy Andrew2016-05-111-0/+16
|\ \ | |/
| * API support for the 'since' and 'until' operators on commit requestsPaco Guzman2016-04-291-0/+16
| | | | | | - Parameter validation as ISO8601 format
* | Combine `API::Helpers::Core` and `API::Helpers::Authentication` back into ↵Timothy Andrew2016-04-281-0/+397
| | | | | | | | | | | | | | `API::Helpers` - Makes the MR easier to read; this can go in a separate MR - This is a (sort of) revert of 99bea01
* | Refactor `API::Helpers` into `API::Helpers::Core` and ↵Timothy Andrew2016-04-281-385/+0
|/ | | | `API::Helpers::Authentication`
* Merge branch 'api-star-project' into 'master' Rémy Coutable2016-04-131-0/+4
|\ | | | | | | | | | | | | | | | | | | API: Star and unstar a project Add two new endpoints `POST /projects/:id/star` and `POST /projects/:id/unstar` to star and unstar a project. * Closes #12739 See merge request !3578
| * Styling changes to code and docsRobert Schilling2016-04-131-1/+1
| |
| * API: Star and unstar a projectRobert Schilling2016-04-131-0/+4
| |
View Lorry Controller Status