Class: Auth::ContainerRegistryAuthenticationService

Inherits:
BaseService
  • Object
show all
Defined in:
app/services/auth/container_registry_authentication_service.rb

Constant Summary collapse

AUDIENCE = 
'container_registry'
REGISTRY_LOGIN_ABILITIES = 
[
  :read_container_image,
  :create_container_image,
  :destroy_container_image,
  :destroy_container_image_tag,
  :update_container_image,
  :admin_container_image,
  :build_read_container_image,
  :build_create_container_image,
  :build_destroy_container_image
].freeze
PROTECTED_TAG_ACTIONS = 
%w[push delete].freeze
ALLOWED_REGISTRY_SCOPE_NAMES = 
%w[catalog statistics].freeze

Constants inherited from BaseService

BaseService::UnauthorizedError

Instance Attribute Summary

Attributes inherited from BaseService

#current_user, #params, #project

Class Method Summary collapse

Instance Method Summary collapse

Methods inherited from BaseService

#initialize

Methods included from BaseServiceUtility

#deny_visibility_level, #event_service, #log_error, #log_info, #notification_service, #system_hook_service, #todo_service, #visibility_level

Methods included from Gitlab::Allowable

#can?, #can_all?, #can_any?

Constructor Details

This class inherits a constructor from BaseService

Class Method Details

.access_metadata(project: nil, path: nil, use_key_as_project_path: false, actions: [], user: nil) ⇒ Object 



111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
 
# File 'app/services/auth/container_registry_authentication_service.rb', line 111

def self.access_metadata(project: nil, path: nil, use_key_as_project_path: false, actions: [], user: nil)
  return access_metadata_with_key_as_project_path(project:, path:, actions:, user:) if use_key_as_project_path

  if project.nil?
    return if path.nil? # If no path is given, return early
    return if path == 'import' # Ignore the special 'import' path

    # If the path ends with '/*', remove it so we can parse the actual repository path
    path = path.chomp('/*')

    # Parse the repository project from the path
    begin
      project = ContainerRegistry::Path.new(path).repository_project
    rescue ContainerRegistry::Path::InvalidRegistryPathError
      # If the path is invalid, gracefully handle the error
      return
    end
  end

  {
    project_path: project&.full_path&.downcase,
    project_id: project&.id,
    root_namespace_id: project&.root_ancestor&.id
  }.merge(patterns_metadata(project, user, actions)).compact
end

.access_metadata_with_key_as_project_path(project:, path:, actions: [], user: nil) ⇒ Object 



139
140
141
 
# File 'app/services/auth/container_registry_authentication_service.rb', line 139

def self.access_metadata_with_key_as_project_path(project:, path:, actions: [], user: nil)
  { project_path: path.chomp('/*').downcase }.merge(patterns_metadata(project, user, actions)).compact
end

.access_token(names_and_actions, type = 'repository', use_key_as_project_path: false, project: nil) ⇒ Object 



88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
 
# File 'app/services/auth/container_registry_authentication_service.rb', line 88

def self.access_token(names_and_actions, type = 'repository', use_key_as_project_path: false, project: nil)
  registry = Gitlab.config.registry
  token = JSONWebToken::RSAToken.new(registry.key)
  token.issuer = registry.issuer
  token.audience = AUDIENCE
  token.expire_time = token_expire_at

  token[:access] = names_and_actions.map do |name, actions|
    {
      type: type,
      name: name,
      actions: actions,
      meta: access_metadata(path: name, use_key_as_project_path: use_key_as_project_path, actions: actions, project: project)
    }.compact
  end

  token.encoded
end

.full_access_token(*names) ⇒ Object 



38
39
40
41
 
# File 'app/services/auth/container_registry_authentication_service.rb', line 38

def self.full_access_token(*names)
  names_and_actions = names.index_with { %w[*] }
  access_token(names_and_actions)
end

.patterns_metadata(project, user, actions) ⇒ Object 



143
144
145
146
147
 
# File 'app/services/auth/container_registry_authentication_service.rb', line 143

def self.patterns_metadata(project, user, actions)
  {
    tag_deny_access_patterns: tag_deny_access_patterns(project, user, actions)
  }
end

.pull_access_token(*names) ⇒ Object 



43
44
45
46
 
# File 'app/services/auth/container_registry_authentication_service.rb', line 43

def self.pull_access_token(*names)
  names_and_actions = names.index_with { %w[pull] }
  access_token(names_and_actions)
end

.pull_nested_repositories_access_token(name) ⇒ Object 



48
49
50
51
52
53
54
55
 
# File 'app/services/auth/container_registry_authentication_service.rb', line 48

def self.pull_nested_repositories_access_token(name)
  name = name.chomp('/')

  access_token({
    name => %w[pull],
    "#{name}/*" => %w[pull]
  })
end

.push_pull_move_repositories_access_token(name, new_namespace, project:) ⇒ Object 



70
71
72
73
74
75
76
77
78
79
80
81
82
 
# File 'app/services/auth/container_registry_authentication_service.rb', line 70

def self.push_pull_move_repositories_access_token(name, new_namespace, project:)
  name = name.chomp('/')

  access_token(
    {
      name => %w[pull push],
      "#{name}/*" => %w[pull],
      "#{new_namespace}/*" => %w[push]
    },
    project: project,
    use_key_as_project_path: true
  )
end

.push_pull_nested_repositories_access_token(name, project:) ⇒ Object 



57
58
59
60
61
62
63
64
65
66
67
68
 
# File 'app/services/auth/container_registry_authentication_service.rb', line 57

def self.push_pull_nested_repositories_access_token(name, project:)
  name = name.chomp('/')

  access_token(
    {
      name => %w[pull push],
      "#{name}/*" => %w[pull]
    },
    project: project,
    use_key_as_project_path: true
  )
end

.statistics_token ⇒ Object 



84
85
86
 
# File 'app/services/auth/container_registry_authentication_service.rb', line 84

def self.statistics_token
  access_token({ 'statistics' => ['*'] }, 'registry')
end

.tag_deny_access_patterns(project, user, actions) ⇒ Object 



149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
 
# File 'app/services/auth/container_registry_authentication_service.rb', line 149

def self.tag_deny_access_patterns(project, user, actions)
  return if project.nil? || user.nil?

  rules = project.container_registry_protection_tag_rules
  return unless rules.mutable.any?

  # Expand the special `*` action into individual actions (pull + push + delete), which is what it represents. The
  # `pull` action is not part of the protected tags feature, so we can ignore it right here. Additionally, although
  # unexpected for realistic scenarios (known client tools), it's technically possible for repeated actions to get
  # this far in the code, so deduplicate them.
  actions_to_check = actions.include?('*') ? PROTECTED_TAG_ACTIONS : actions.uniq
  actions_to_check.delete('pull')

  patterns = actions_to_check.index_with { [] }

  # Admins get unrestricted access with protected tags, but the registry expects to always see an array for each granted actions, so we
  # can return early here, but not any earlier.
  return patterns if user.can_admin_all_resources?

  user_access_level = project.team.max_member_access(user.id)
  applicable_rules = rules.for_actions_and_access(actions_to_check, user_access_level)

  applicable_rules.each do |rule|
    if actions_to_check.include?('push') && rule.push_restricted?(user_access_level)
      patterns['push'] << rule.tag_name_pattern
    end

    if actions_to_check.include?('delete') && rule.delete_restricted?(user_access_level)
      patterns['delete'] << rule.tag_name_pattern
    end
  end

  patterns
end

.token_expire_at ⇒ Object 



107
108
109
 
# File 'app/services/auth/container_registry_authentication_service.rb', line 107

def self.token_expire_at
  Time.current + Gitlab::CurrentSettings.container_registry_token_expire_delay.minutes
end

Instance Method Details

#execute(authentication_abilities:) ⇒ Object 



20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
 
# File 'app/services/auth/container_registry_authentication_service.rb', line 20

def execute(authentication_abilities:)
  @authentication_abilities = authentication_abilities

  return error('UNAVAILABLE', status: 404, message: 'registry not enabled') unless registry.enabled

  return error('DENIED', status: 403, message: 'access forbidden') unless has_registry_ability?

  unless scopes.any? || current_user || deploy_token || project
    return error('DENIED', status: 403, message: 'access forbidden')
  end

  if repository_path_push_protected?
    return error('DENIED', status: 403, message: 'Pushing to protected repository path forbidden')
  end

  { token: authorized_token(*scopes).encoded }
end