Commit Graph

291 Commits

Author SHA1 Message Date
Kamil Trzciński e3fafa7632 Merge commit 'f2f58a60b76acd479e37bdbc9246ec9f9b2bea82' into object-storage-ee-to-ce-backport 2018-02-28 20:36:07 +01:00
Kamil Trzciński e0401df121 Merge commit '11c67e7c2f992299ff5918ce67995b73d1e0be6d' into object-storage-ee-to-ce-backport 2018-02-28 20:35:22 +01:00
Kamil Trzciński 5a69b51bc8 Merge commit 'b39d0c318921bae2e3a11df9ee6828291dad9864' into object-storage-ee-to-ce-backport 2018-02-28 20:06:12 +01:00
Kamil Trzciński b1f8d8a173 Merge commit '5b08d59f07fc53c1e34819fac20352119d5343e6' into object-storage-ee-to-ce-backport 2018-02-28 20:03:02 +01:00
Grzegorz Bizon 52c3b8f312 Merge branch 'zj-object-store-artifacts' into 'master'
Object store for artifacts

Closes gitlab-ce#29203

See merge request !1762
2018-02-28 20:00:27 +01:00
Bob Van Landuyt 148816cd67 Port `read_cross_project` ability from EE 2018-02-22 17:11:36 +01:00
🙈 jacopo beschi 🙉 729f05f0e3 Adds Rubocop rule for line break around conditionals 2018-01-11 16:34:01 +00:00
Stan Hu eaf9088ba8 Save user ID and username in Grape API log (api_json.log)
This will enable admins to identify who actually made the API request.

Relates to #36960
2018-01-08 21:23:24 -08:00
Sean McGivern 0f33ac6442 Merge branch 'backport-issue_3413' into 'master'
[EE-backport] Add group boards API endpoint

See merge request gitlab-org/gitlab-ce!16194
2018-01-05 14:17:19 +00:00
Felipe Artur 5e148d4e93 EE-BACKPORT group boards 2018-01-04 17:28:10 -02:00
Rubén Dávila cf8f09636b Fix API endpoints to edit wiki pages where project belongs to a group
In some cases is prefered to manually create a ProjectWiki over using
Project#wiki. This is because Project#wiki always uses the #owner (which
is a User sometimes) as the
author of the wiki changes but sometimes the owner is a Group and it
doesn't respond to #username
2018-01-03 00:22:01 -05:00
Lin Jen-Shin 85be6d83be Merge remote-tracking branch 'upstream/master' into no-ivar-in-modules
* upstream/master: (170 commits)
  support ordering of project notes in notes api
  Redirect to an already forked project if it exists
  Reschedule the migration to populate fork networks
  Create fork networks for forks for which the source was deleted.
  Fix item name and namespace text overflow in Projects dropdown
  Minor backport from EE
  fix link that was linking to `html` instead of `md`
  Backport epic tasklist
  Add timeouts for Gitaly calls
  SSHUploadPack over Gitaly is now OptOut
  fix icon colors in commit list
  Fix star icon color/stroke
  Backport border inline edit
  Add checkboxes to automatically run AutoDevops pipeline
  BE for automatic pipeline when enabling Auto DevOps
  I am certainly weary of debugging sidekiq but I don't think that's what was meant
  Ensure MRs always use branch refs for comparison
  Fix issue comment submit button disabled on GFM paste
  Lock seed-fu at the correct version in Gemfile.lock
  Improve indexes on merge_request_diffs
  ...
2017-11-30 15:20:00 +08:00
Tomasz Maczukin 97f966c445
Introduce :read_namespace access policy for namespace and group 2017-11-23 17:44:05 +01:00
Tomasz Maczukin dfbfd3c7d7
Allow request namespace by ID or path 2017-11-23 17:44:05 +01:00
Lin Jen-Shin 663593e87e Merge remote-tracking branch 'upstream/master' into no-ivar-in-modules
* upstream/master: (126 commits)
  Update VERSION to 10.3.0-pre
  Update CHANGELOG.md for 10.2.0
  default fill color for SVGs
  ignore hashed repos (for now) when using `rake gitlab:cleanup:repos`
  Use Redis cache for branch existence checks
  Update CONTRIBUTING.md: Link definition of done to criteria
  Use `make install` for Gitaly setups in non-test environments
  FileUploader should check for hashed_storage?(:attachments) to use disk_path
  Set the default gitlab-shell timeout to 3 hours
  Update composite pipelines index to include "id"
  Use arrays in Pipeline#latest_builds_with_artifacts
  Fix blank states using old css
  Skip confirmation user api
  Custom issue tracker
  Revert "check for `read_only?` first before seeing if request is disallowed"
  add `#with_metadata` scope to remove a N+1 from the notes' API
  Fix promoting milestone updating all issuables without milestone
  Batchload blobs for diff generation
  check for `read_only?` first before seeing if request is disallowed
  use `Gitlab::Routing.url_helpers` instead of `Rails.application.routes.url_helpers`
  ...
2017-11-22 17:07:01 +08:00
Lin Jen-Shin 07d3d44775 Move ModuleWithInstanceVariables to Gitlab namespace
And use .rubocop.yml to exclude paths we don't care,
rather than using the cop itself to exclude.
2017-11-22 17:06:57 +08:00
Lin Jen-Shin 9ac0c76b78 Use StrongMemoize and enable/disable cops properly 2017-11-18 01:01:53 +08:00
Lin Jen-Shin 0af35d7e30 Merge remote-tracking branch 'upstream/master' into no-ivar-in-modules
* upstream/master: (507 commits)
  Add dropdowns documentation
  Convert migration to populate latest merge request ID into a background migration
  Set 0.69.0 instead of latest for codeclimate image
  De-duplicate background migration matchers defined in spec/support/migrations_helpers.rb
  Update database_debugging.md
  Update database_debugging.md
  Move installation of apps higher
  Change to Google Kubernetes Cluster and add internal links
  Add Ingress description from official docs
  Add info on creating your own k8s cluster from the cluster page
  Add info about the installed apps in the Cluster docs
  Resolve "lock/confidential issuable sidebar custom svg icons iteration"
  Update HA README.md to clarify GitLab support does not troubleshoot DRBD.
  Update license_finder to 3.1.1
  Make sure NotesActions#noteable returns a Noteable in the update action
  Cache the number of user SSH keys
  Adjust openid_connect_spec to use `raise_error`
  Resolve "Clicking on GPG verification badge jumps to top of the page"
  Add changelog for container repository path update
  Update container repository path reference
  ...
2017-11-17 19:19:06 +08:00
Francisco Lopez 1436598e49 Moved Exceptions to Gitlab::Auth 2017-11-17 10:02:11 +01:00
Francisco Lopez aa84ef1e1a Moving exceptions to UserAuthFinders 2017-11-17 10:02:11 +01:00
Travis Miller 1162d89ac4 Add administrative endpoint to list all pages domains 2017-11-13 16:05:44 +00:00
Lin Jen-Shin fc6aad0b44 Merge remote-tracking branch 'upstream/master' into no-ivar-in-modules
* upstream/master: (1723 commits)
  Resolve "Editor icons"
  Refactor issuable destroy action
  Ignore routes matching legacy_*_redirect in route specs
  Gitlab::Git::RevList and LfsChanges use lazy popen
  Gitlab::Git::Popen can lazily hand output to a block
  Merge branch 'master-i18n' into 'master'
  Remove unique validation from external_url in Environment
  Expose `duration` in Job API entity
  Add TimeCop freeze for DST and Regular time
  Harcode project visibility
  update a changelog
  Put a condition to old migration that adds fast_forward column to MRs
  Expose project visibility as CI variable
  fix flaky tests by removing unneeded clicks and focus actions
  fix flaky test in gfm_autocomplete_spec.rb
  Use Gitlab::Git operations for repository mirroring
  Encapsulate git operations for mirroring in Gitlab::Git
  Create a Wiki Repository's raw_repository properly
  Add `Gitlab::Git::Repository#fetch` command
  Fix Gitlab::Metrics::System#real_time and #monotonic_time doc
  ...
2017-11-06 21:44:57 +08:00
Markus Koller 6902848a9c
Support custom attributes on projects 2017-11-06 10:51:46 +01:00
Douwe Maan b7c8f7d76d Update specs for sudo behavior 2017-11-02 11:39:03 +01:00
Douwe Maan 3f24f9ed18 Add sudo API scope 2017-11-02 11:39:03 +01:00
Travis Miller 8d1ab256bf Add pages domains API implementation 2017-10-22 08:04:43 -05:00
Douwe Maan 025c6eeaa1 Move all API authentication code to APIGuard 2017-10-12 11:13:37 +02:00
Alejandro Rodríguez 60a35e4230 Send API parameters as extra data for sentry errors 2017-10-05 18:31:34 -03:00
Rémy Coutable 3040b994df
Ensure no exception is raised when Raven tries to get the current user in API context
Signed-off-by: Rémy Coutable <remy@rymai.me>
2017-09-29 18:57:22 +02:00
Douwe Maan b6c5a73c0b Make sure API responds with 401 when invalid authentication info is provided 2017-09-28 14:17:52 +02:00
Lin Jen-Shin 6a4ee9aa71 Allow simple ivar ||= form. Update accordingly 2017-09-19 01:29:32 +08:00
Lin Jen-Shin 9ae92b8caa Add cop to make sure we don't use ivar in a module 2017-09-18 21:23:45 +08:00
Ruben Davila 62bb6235c2 Make Members with Owner and Master roles always able to create subgroups 2017-09-07 13:47:58 -05:00
Grzegorz Bizon 8ed0a05107 Merge branch 'wiki_api' into 'master'
Add API support for wiki pages

Closes #12747

See merge request !13372
2017-09-07 10:38:03 +00:00
blackst0ne 2915bb2707 Add API support for wiki pages 2017-09-07 09:21:52 +11:00
Grzegorz Bizon c922fb4b68 Respond with a bad request if artifact path is invalid 2017-09-06 11:31:08 +02:00
Grzegorz Bizon 80b3dcc777 Extract job artifacts API code to a separate file 2017-09-06 11:20:12 +02:00
Grzegorz Bizon dfb8fcbb65 Use API helper to send artifact file through Workhorse 2017-09-05 11:16:49 +02:00
Sean McGivern b9d8946395 Don't use public_send in destroy_conditionally! helper
As we only override in two places, we could just ask for the value rather than
the method name.
2017-08-30 14:32:02 +01:00
Robert Schilling dcd4ea473c Update remaining endpoints 2017-08-28 17:10:30 +02:00
Robert Schilling e80313f9ee Conditionally destroy a ressource 2017-08-28 16:40:25 +02:00
Robert Schilling 998afa5f74 API: Respect the 'If-Unmodified-Since' for delete endpoints 2017-08-28 16:40:25 +02:00
Zeger-Jan van de Weg dc8e1676cd
Upgrade grape to 1.0
Main feature was the deprication of the Hashie stuff, so the access by
calling keys as method is gone now.
2017-08-16 22:06:31 +02:00
Lin Jen-Shin 4f0fa13eb8 Show error message for API 500 error in tests, and
document have_gitlab_http_status
2017-08-11 20:50:35 +08:00
Douwe Maan 14644d40e0 Do not validate CSRF token in API unless needed 2017-08-02 18:20:31 +02:00
Douwe Maan dcf4a2e83c Rescue only from ActionController::InvalidAuthenticityToken 2017-07-26 11:25:10 +02:00
blackst0ne cc3a82bc8b Add `rescue false`. 2017-07-26 11:05:44 +02:00
blackst0ne 8ce8b21f67 Refactor CSRF protection 2017-07-26 11:05:44 +02:00
blackst0ne 2902235099 Add CSRF token verification to API 2017-07-26 11:05:44 +02:00
Felipe Artur c5c9dce270 Add group milestones API endpoint 2017-07-21 11:00:00 -03:00
vanadium23 8d44d5142a Add user projects API 2017-07-06 08:04:54 +03:00
Timothy Andrew 4dbfa14e16 Implement review comments from @dbalexandre for !12300. 2017-06-28 07:17:13 +00:00
Timothy Andrew d774825f98 When verifying scopes, manually include scopes from `API::API`.
- They are not included automatically since `API::Users` does not inherit from
  `API::API`, as I initially assumed.

- Scopes declared in `API::API` are considered global (to the API), and need to
  be included in all cases.
2017-06-28 07:17:13 +00:00
Timothy Andrew 80c1ebaa83 Allow API scope declarations to be applied conditionally.
- Scope declarations of the form:

    allow_access_with_scope :read_user, if: -> (request) { request.get? }

  will only apply for `GET` requests

- Add a negative test to a `POST` endpoint in the `users` API to test this. Also
  test for this case in the `AccessTokenValidationService` unit tests.
2017-06-28 07:17:13 +00:00
Timothy Andrew 6f1922500b Initial attempt at refactoring API scope declarations.
- Declaring an endpoint's scopes in a `before` block has proved to be
  unreliable. For example, if we're accessing the `API::Users` endpoint - code
  in a `before` block in `API::API` wouldn't be able to see the scopes set in
  `API::Users` since the `API::API` `before` block runs first.

- This commit moves these declarations to the class level, since they don't need
  to change once set.
2017-06-28 07:17:13 +00:00
Rémy Coutable 4cfa5ce4a9
Enable the Style/PreferredHashMethods cop
Signed-off-by: Rémy Coutable <remy@rymai.me>
2017-06-02 19:11:26 +02:00
Kamil Trzcinski 6185d12c18 Add missing specs 2017-06-01 16:34:48 +02:00
Toon Claes db679788e4 Add :owned param to ProjectFinder
And use it in the API.
2017-05-30 22:45:59 +02:00
Toon Claes 0f0b9a8466 Use helper to construct Finder params
The ProjectsFinder and GroupFinder both support the same set of params. And the
`/api/v4/projects` and `/api/v4/group/:id/projects` also support the same set of
params. But they do not match the Finder params. So use a helper method to
transform them.
2017-05-30 22:45:59 +02:00
Toon Claes a1deed629e Use ProjectFinder to filter the projects
Instead of trying to do the heavy lifting in the API itself, use the existing
features of the ProjectFinder.
2017-05-30 22:45:59 +02:00
Toon Claes 07fc79e7c5 Handle `membership` in ProjectFinder
The ProjectFinder supports the `non_public` parameter. This can be used to find
only projects the user is member of.
2017-05-30 22:45:59 +02:00
Robert Speicher cb2f739d48 Merge branch '27144-enforce-rubocop-trailing_commas-no_comma-style' into 'master'
Resolve "Use consistent style for trailing commas"

Closes #27144

See merge request !11063
2017-05-10 21:43:34 +00:00
Rémy Coutable 3db37e0562 Enable the Style/TrailingCommaInArguments cop
Use the EnforcedStyleForMultiline: no_comma option.

Signed-off-by: Rémy Coutable <remy@rymai.me>
2017-05-10 18:25:45 +02:00
Bob Van Landuyt ebd8b7f60f Use new SnippetsFinder signature in API 2017-05-10 16:48:18 +02:00
Timothy Andrew 4dfdef2ddf Allow admins to sudo to blocked users.
- Currently, (for example) admins can't delete snippets for blocked users, which
  is an unexpected limitation.

- We modify `authenticate!` to conduct the `access_api` policy check against the
  `initial_current_user`, instead of the user being impersonated.

- Update CHANGELOG for !10842
2017-04-26 08:00:19 +00:00
blackst0ne 11aff97d88 Remove the User#is_admin? method 2017-04-09 13:20:57 +11:00
Toon Claes add5cd996f API: Make the /notes endpoint work with noteable iid instead of id
In API V4 all endpoints were changed so Merge Requests and Issues
should be referred by iid, instead of id. Except the /notes endpoint
was forgotten. So change the endpoints from:

- /projects/:id/issues/:issue_id/notes
- /projects/:id/merge_requests/:merge_request_id/notes

To:

- /projects/:id/issues/:issue_iid/notes
- /projects/:id/merge_requests/:merge_request_iid/notes

For Project Snippets nothing changes.
2017-03-27 15:29:37 +02:00
http://jneen.net/ 0ea04cc5bf use the policy stack to protect logins 2017-03-09 11:49:52 -08:00
http://jneen.net/ 846e581732 use a magic default :global symbol instead of nil
to make sure we mean the global permissions
2017-03-09 11:49:52 -08:00
Timothy Andrew 719327112c
API routes referencing a specific merge request should use the MR `iid`
- As opposed to the `id` that was previously being used.
- This brings the API routes closer to the web interface's routes.
- This is specific to API v4.
2017-03-07 13:06:42 +05:30
Timothy Andrew dd99622347
API routes referencing a specific issue should use the issue `iid`
- As opposed to the issue `id` that was previously being used.
- This brings the API routes closer to the web interface's routes.
- This is specific to API v4.
2017-03-07 13:06:42 +05:30
Pawel Chojnacki 8993801f0c Test various login scenarios if the limit gets enforced 2017-03-06 15:41:25 +01:00
Adam Niedzielski c727d4328f Remove "subscribed" field from API responses returning list of issues or merge requests 2017-03-06 14:17:07 +01:00
Toon Claes 6357635686 Rename query parameter to `membership`
The query parameter `membership` should be more self-explaining.
2017-03-03 13:42:39 +01:00
Oswaldo Ferreira 06e96907ee Add filter param for authorized projects for current_user for V4 2017-03-03 12:02:41 +01:00
Mark Fletcher 61baf3528d Enable filtering milestones by search criteria in the API
- Also remove a redundant test
2017-03-02 10:07:57 +05:30
Oswaldo 2b001d9e7a Return 202 with JSON body on async removals on V4 API 2017-02-23 19:55:13 -03:00
Douwe Maan b7d8df503c Enable Style/MutableConstant 2017-02-23 09:31:56 -06:00
Sean McGivern 7e8a6a63af Merge branch '28093-snippet-and-issue-spam-check-on-edit' into 'master'
Spam check and reCAPTCHA improvements

Closes #28093

See merge request !9248
2017-02-22 10:13:20 +00:00
Douwe Maan f40716f48a No more and/or 2017-02-21 16:31:14 -06:00
Oswaldo Ferreira 2ace39f242 Spam check and reCAPTCHA improvements 2017-02-21 13:32:49 -03:00
Robert Schilling 612e61f4c4 Use grape validation for dates 2017-02-20 14:24:09 +01:00
Toon Claes 4e9e29d295 API: Consolidate /projects endpoint
It consolidates these endpoints:
 - /projects
 - /projects/owned
 - /projects/visible
 - /projects/starred
 - /projects/all

Into the /projects endpoint using query parameters.
2017-02-14 16:41:57 +01:00
Robert Schilling 6e1d675de9 API: Fix file downloading 2017-02-03 12:42:11 +01:00
Adam Pahlevi a0586dbc16 replace `find_with_namespace` with `find_by_full_path`
add complete changelog for !8949
2017-02-03 07:14:04 +07:00
Robert Speicher 3a5df1d8fc Merge branch 'fix-api-mr-permissions' into 'security'
Ensure that only privileged users can access merge requests in the API

See merge request !2053
2017-01-23 13:54:35 -05:00
Kamil Trzcinski d8e440c8e0
Fix specs 2017-01-19 23:41:12 +01:00
Kamil Trzcinski 31af6be076
Fix specs 2017-01-19 23:31:03 +01:00
Kamil Trzcinski 8171a1932b
Merge remote-tracking branch 'origin/master' into 21698-redis-runner-last-build 2017-01-19 15:31:04 +01:00
Sean McGivern cc1e43da39 Merge branch 'time-tracking-api' into 'master'
Time tracking API

Closes #25861

See merge request !8483
2017-01-18 18:18:13 +00:00
Ruben Davila 0f3c9355c1 Add some API endpoints for time tracking.
New endpoints are:

POST :project_id/(issues|merge_requests)/(:issue_id|:merge_request_id)/time_estimate"

POST :project_id/(issues|merge_requests)/(:issue_id|:merge_request_id)/reset_time_estimate"

POST :project_id/(issues|merge_requests)/(:issue_id|:merge_request_id)/add_spent_time"

POST :project_id/(issues|merge_requests)/(:issue_id|:merge_request_id)/reset_spent_time"

GET  :project_id/(issues|merge_requests)/(:issue_id|:merge_request_id)/time_stats"
2017-01-18 10:48:16 -06:00
Robert Schilling 1cccb37831 Fix a API deprecation warning 2017-01-16 00:38:25 +01:00
Lin Jen-Shin 8c9a4ed373 WIP: Add tests and make sure that headers are set
* We realized that headers were not set whenever we give 204
  because `render_api_error!` doesn't preserve the headers.

* We also realized that `update_runner_info` would be called in
  POST /builds/register every time therefore runner is updated
  every time, ticking the queue, making this last_update didn't
  work very well, and the test would be failing due to that.
2017-01-04 17:46:56 +08:00
Regis 0a074f2e09 fix pipelines/index.html.haml merge conflict 2017-01-02 16:24:37 -07:00
Robert Schilling 465700ddc2 Merge branch 'fix-api-deprecation' into 'master'
Fix a Grape deprecation, use `#request_method` instead of `#route_method`

See merge request !8297
2016-12-28 11:36:28 +00:00
Rémy Coutable 1b109c99a4
Fix a Grape deprecation, use `#request_method` instead of `#route_method`
Signed-off-by: Rémy Coutable <remy@rymai.me>
2016-12-23 19:07:23 +01:00
Markus Koller 3ef4f74b1a
Add more storage statistics
This adds counters for build artifacts and LFS objects, and moves
the preexisting repository_size and commit_count from the projects
table into a new project_statistics table.

The counters are displayed in the administration area for projects
and groups, and also available through the API for admins (on */all)
and normal users (on */owned)

The statistics are updated through ProjectCacheWorker, which can now
do more granular updates with the new :statistics argument.
2016-12-21 16:39:49 +01:00
Grzegorz Bizon 468b47d47c Remove redundant pagination helpers after a bad merge
[ci skip]
2016-12-21 15:19:00 +01:00
Grzegorz Bizon 3deaf1342e Merge branch 'master' into auto-pipelines-vue
* master: (367 commits)
  Set “Remove branch” button to default size
  remove unused helper method
  reduce common code even further to satisfy rake flay
  remove button class size alteration from revert and cherry pick links
  factor out common code to satisfy rake flay
  homogenize revert and cherry-pick button styles generated by commits_helper
  apply margin on alert banners only when there is one or more alerts
  Rename MattermostNotificationService back to MattermostService
  Rename SlackNotificationService back to SlackService
  Fix stage and pipeline specs and rubocop offenses
  Added QueryRecorder to test N+1 fix on Milestone#show
  Use gitlab-workhorse 1.2.1
  Make 'unmarked as WIP' message more consistent
  Improve specs for Files API
  Allow unauthenticated access to Repositories Files API GET endpoints
  Add isolated view spec for pipeline stage partial
  Move test for HTML stage endpoint to controller specs
  Fix sizing of avatar circles; add border
  Fix broken test
  Fix broken test Changes after review
  ...

Conflicts:
	app/assets/stylesheets/pages/pipelines.scss
	app/controllers/projects/pipelines_controller.rb
	app/views/projects/pipelines/index.html.haml
	spec/features/projects/pipelines/pipelines_spec.rb
2016-12-21 12:09:06 +01:00
Timothy Andrew 7fa06ed55d Calls to the API are checked for scope.
- Move the `Oauth2::AccessTokenValidationService` class to
  `AccessTokenValidationService`, since it is now being used for
  personal access token validation as well.

- Each API endpoint declares the scopes it accepts (if any). Currently,
  the top level API module declares the `api` scope, and the `Users` API
  module declares the `read_user` scope (for GET requests).

- Move the `find_user_by_private_token` from the API `Helpers` module to
  the `APIGuard` module, to avoid littering `Helpers` with more
  auth-related methods to support `find_user_by_private_token`
2016-12-16 16:29:31 +05:30