Introduce a more-complete implementation of bin/authorized_keys

bin/authorized_keys doesn't check that the requesting user matches the expected
user, so to enable database authorized keys lookups, we currently ask the admin
to create a custom script for that purpose.

Better is to have a complete script that can perform the whole task. This commit
introduces bin/gitlab-shell-authorized-keys-check which does so.

1 files changed, 29 insertions, 0 deletions

diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index 612af76..aeebd98 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -10,9 +10,38 @@ end
 
 require 'vcr'
 require 'webmock'
+require 'webrick'
 
 VCR.configure do |c|
   c.cassette_library_dir = 'spec/vcr_cassettes'
   c.hook_into :webmock
   c.configure_rspec_metadata!
 end
+
+# like WEBrick::HTTPServer, but listens on UNIX socket
+class HTTPUNIXServer < WEBrick::HTTPServer
+  def listen(address, port)
+    socket = Socket.unix_server_socket(address)
+    socket.autoclose = false
+    server = UNIXServer.for_fd(socket.fileno)
+    socket.close
+    @listeners << server
+  end
+
+  # Workaround:
+  # https://bugs.ruby-lang.org/issues/10956
+  # Affecting Ruby 2.2
+  # Fix for 2.2 is at https://github.com/ruby/ruby/commit/ab0a64e1
+  # However, this doesn't work with 2.1. The following should work for both:
+  def start(&block)
+    @shutdown_pipe = IO.pipe
+    shutdown_pipe = @shutdown_pipe
+    super(&block)
+  end
+
+  def cleanup_shutdown_pipe(shutdown_pipe)
+    @shutdown_pipe = nil
+    return if !shutdown_pipe
+    super(shutdown_pipe)
+  end
+end