pass gl_username through to hooks

Author: novalis

lib/gitlab_access_status.rb

@@ -1,12 +1,13 @@
 require 'json'
 
 class GitAccessStatus
- attr_reader :message, :gl_repository, :repository_path, :gitaly, :geo_node
+ attr_reader :message, :gl_repository, :gl_username, :repository_path, :gitaly, :geo_node
 
- def initialize(status, message, gl_repository, repository_path, gitaly, geo_node = false)
+ def initialize(status, message, gl_repository:, gl_username:, repository_path:, gitaly:, geo_node:)
  @status = status
  @message = message
  @gl_repository = gl_repository
+ @gl_username = gl_username
  @repository_path = repository_path
  @gitaly = gitaly
  @geo_node = geo_node
@@ -16,10 +17,11 @@ def self.create_from_json(json)
  values = JSON.parse(json)
  self.new(values["status"],
  values["message"],
- values["gl_repository"],
- values["repository_path"],
- values["gitaly"],
- values["geo_node"])
+ gl_repository: values["gl_repository"],
+ gl_username: values["gl_username"],
+ repository_path: values["repository_path"],
+ gitaly: values["gitaly"],
+ geo_node: values["geo_node"])
  end
 
  def allowed?

lib/gitlab_net.rb

@@ -40,7 +40,13 @@ def check_access(cmd, gl_repository, repo, actor, changes, protocol, env: {})
  if resp.code == '200'
  GitAccessStatus.create_from_json(resp.body)
  else
- GitAccessStatus.new(false, 'API is not accessible', nil, nil, nil)
+ GitAccessStatus.new(false,
+ 'API is not accessible',
+ gl_repository: nil,
+ gl_username: nil,
+ repository_path: nil,
+ gitaly: nil,
+ geo_node: false)
  end
  end
 

lib/gitlab_shell.rb

@@ -20,7 +20,7 @@ class InvalidRepositoryPathError < StandardError; end
  # to undo an already set parameter: https://www.spinics.net/lists/git/msg256772.html
  GIT_CONFIG_SHOW_ALL_REFS = "transfer.hideRefs=!refs".freeze
 
- attr_accessor :key_id, :gl_repository, :repo_name, :command, :git_access, :show_all_refs
+ attr_accessor :key_id, :gl_repository, :repo_name, :command, :git_access, :show_all_refs, :username
  attr_reader :repo_path
 
  def initialize(key_id)
@@ -113,6 +113,7 @@ def verify_access
  @gl_repository = status.gl_repository
  @gitaly = status.gitaly
  @show_all_refs = status.geo_node
+ @username = status.gl_username
  end
 
  def process_cmd(args)
@@ -139,7 +140,8 @@ def process_cmd(args)
  gitaly_request = {
  'repository' => @gitaly['repository'],
  'gl_repository' => @gl_repository,
- 'gl_id' => @key_id
+ 'gl_id' => @key_id,
+ 'gl_username' => @username
  }
 
  gitaly_request['git_config_options'] = [GIT_CONFIG_SHOW_ALL_REFS] if @show_all_refs
@@ -168,7 +170,8 @@ def exec_cmd(*args)
  'LANG' => ENV['LANG'],
  'GL_ID' => @key_id,
  'GL_PROTOCOL' => GL_PROTOCOL,
- 'GL_REPOSITORY' => @gl_repository
+ 'GL_REPOSITORY' => @gl_repository,
+ 'GL_USERNAME' => @username
  }
  if @gitaly && @gitaly.include?('token')
  env['GITALY_TOKEN'] = @gitaly['token']

spec/gitlab_access_spec.rb

@@ -7,7 +7,13 @@
  let(:repo_path) { File.join(repository_path, repo_name) + ".git" }
  let(:api) do
  double(GitlabNet).tap do |api|
- api.stub(check_access: GitAccessStatus.new(true, 'ok', 'project-1', '/home/git/repositories', nil))
+ api.stub(check_access: GitAccessStatus.new(true,
+ 'ok',
+ gl_repository: 'project-1',
+ gl_username: 'testuser',
+ repository_path: '/home/git/repositories',
+ gitaly: nil,
+ geo_node: nil))
  end
  end
  subject do
@@ -38,7 +44,15 @@
  context "access is denied" do
 
  before do
- api.stub(check_access: GitAccessStatus.new(false, 'denied', nil, nil, nil))
+ api.stub(check_access: GitAccessStatus.new(
+ false,
+ 'denied',
+ gl_repository: nil,
+ gl_username: nil,
+ repository_path: nil,
+ gitaly: nil,
+ geo_node: nil
+ ))
  end
 
  it "returns false" do

spec/gitlab_shell_spec.rb

@@ -19,12 +19,28 @@
  end
  end
 
- let(:gitaly_check_access) { GitAccessStatus.new(true, 'ok', gl_repository, repo_path, { 'repository' => { 'relative_path' => repo_name, 'storage_name' => 'default'} , 'address' => 'unix:gitaly.socket' }) }
+ let(:gitaly_check_access) { GitAccessStatus.new(
+ true,
+ 'ok',
+ gl_repository: gl_repository,
+ gl_username: gl_username,
+ repository_path: repo_path,
+ gitaly: { 'repository' => { 'relative_path' => repo_name, 'storage_name' => 'default'} , 'address' => 'unix:gitaly.socket' },
+ geo_node: false
+ )
+ }
 
  let(:api) do
  double(GitlabNet).tap do |api|
  api.stub(discover: { 'name' => 'John Doe' })
- api.stub(check_access: GitAccessStatus.new(true, 'ok', gl_repository, repo_path, nil))
+ api.stub(check_access: GitAccessStatus.new(
+ true,
+ 'ok',
+ gl_repository: gl_repository,
+ gl_username: gl_username,
+ repository_path: repo_path,
+ gitaly: nil,
+ geo_node: nil))
  api.stub(two_factor_recovery_codes: {
  'success' => true,
  'recovery_codes' => ['f67c514de60c4953', '41278385fc00c1e0']
@@ -39,6 +55,7 @@
  let(:repo_name) { 'gitlab-ci.git' }
  let(:repo_path) { File.join(tmp_repos_path, repo_name) }
  let(:gl_repository) { 'project-1' }
+ let(:gl_username) { 'testuser' }
 
  before do
  GitlabConfig.any_instance.stub(audit_usernames: false)
@@ -130,7 +147,7 @@
  end
 
  describe :exec do
- let(:gitaly_message) { JSON.dump({ 'repository' => { 'relative_path' => repo_name, 'storage_name' => 'default' }, 'gl_repository' => gl_repository , 'gl_id' => key_id}) }
+ let(:gitaly_message) { JSON.dump({ 'repository' => { 'relative_path' => repo_name, 'storage_name' => 'default' }, 'gl_repository' => gl_repository, 'gl_id' => key_id, 'gl_username' => gl_username}) }
 
  shared_examples_for 'upload-pack' do |command|
  let(:ssh_cmd) { "#{command} gitlab-ci.git" }
@@ -167,8 +184,15 @@
 
  context 'gitaly-upload-pack with GeoNode' do
  let(:ssh_cmd) { "git-upload-pack gitlab-ci.git" }
- let(:gitaly_check_access_with_geo) { GitAccessStatus.new(true, 'ok', gl_repository, repo_path, { 'repository' => { 'relative_path' => repo_name, 'storage_name' => 'default'} , 'address' => 'unix:gitaly.socket' }, true) }
- let(:gitaly_message_with_all_refs) { JSON.dump({ 'repository' => { 'relative_path' => repo_name, 'storage_name' => 'default' }, 'gl_repository' => gl_repository , 'gl_id' => key_id, 'git_config_options' => [GitlabShell::GIT_CONFIG_SHOW_ALL_REFS]}) }
+ let(:gitaly_check_access_with_geo) { GitAccessStatus.new(
+ true,
+ 'ok',
+ gl_repository: gl_repository,
+ gl_username: gl_username,
+ repository_path: repo_path,
+ gitaly: { 'repository' => { 'relative_path' => repo_name, 'storage_name' => 'default'} , 'address' => 'unix:gitaly.socket' },
+ geo_node: true) }
+ let(:gitaly_message_with_all_refs) { JSON.dump({ 'repository' => { 'relative_path' => repo_name, 'storage_name' => 'default' }, 'gl_repository' => gl_repository , 'gl_id' => key_id, 'gl_username' => gl_username, 'git_config_options' => [GitlabShell::GIT_CONFIG_SHOW_ALL_REFS]}) }
  before { api.stub(check_access: gitaly_check_access_with_geo) }
  after { subject.exec(ssh_cmd) }
 
@@ -346,7 +370,14 @@
  end
 
  it "should disallow access and log the attempt if check_access returns false status" do
- api.stub(check_access: GitAccessStatus.new(false, 'denied', nil, nil, nil))
+ api.stub(check_access: GitAccessStatus.new(
+ false,
+ 'denied',
+ gl_repository: nil,
+ gl_username: nil,
+ repository_path: nil,
+ gitaly: nil,
+ geo_node: nil))
  message = "gitlab-shell: Access denied for git command <git-upload-pack gitlab-ci.git> "
  message << "by user with key #{key_id}."
  $logger.should_receive(:warn).with(message)
@@ -383,13 +414,15 @@
  'LANG' => ENV['LANG'],
  'GL_ID' => key_id,
  'GL_PROTOCOL' => 'ssh',
- 'GL_REPOSITORY' => gl_repository
+ 'GL_REPOSITORY' => gl_repository,
+ 'GL_USERNAME' => 'testuser'
  }
  end
  let(:exec_options) { { unsetenv_others: true, chdir: ROOT_PATH } }
  before do
  Kernel.stub(:exec)
  shell.gl_repository = gl_repository
+ shell.username = gl_username
  end
 
  it "uses Kernel::exec method" do