Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
李少辉-开发者
gitlab-foss
提交
73b553a4
G
gitlab-foss
项目概览
李少辉-开发者
/
gitlab-foss
通知
15
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
G
gitlab-foss
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
前往新版Gitcode,体验更适合开发者的 AI 搜索 >>
提交
73b553a4
编写于
3月 27, 2019
作者:
F
Felipe Artur
提交者:
Nick Thomas
3月 27, 2019
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
Add API access check to Graphql
Check if user can access API on GraphqlController
上级
b78aa81f
变更
3
隐藏空白更改
内联
并排
Showing
3 changed file
with
55 addition
and
0 deletion
+55
-0
app/controllers/graphql_controller.rb
app/controllers/graphql_controller.rb
+5
-0
changelogs/unreleased/issue_58547.yml
changelogs/unreleased/issue_58547.yml
+5
-0
spec/controllers/graphql_controller_spec.rb
spec/controllers/graphql_controller_spec.rb
+45
-0
未找到文件。
app/controllers/graphql_controller.rb
浏览文件 @
73b553a4
...
...
@@ -12,6 +12,7 @@ class GraphqlController < ApplicationController
protect_from_forgery
with: :null_session
,
only: :execute
before_action
:check_graphql_feature_flag!
before_action
:authorize_access_api!
before_action
(
only:
[
:execute
])
{
authenticate_sessionless_user!
(
:api
)
}
def
execute
...
...
@@ -37,6 +38,10 @@ class GraphqlController < ApplicationController
private
def
authorize_access_api!
access_denied!
(
"API not accessible for user."
)
unless
can?
(
current_user
,
:access_api
)
end
# Overridden from the ApplicationController to make the response look like
# a GraphQL response. That is nicely picked up in Graphiql.
def
render_404
...
...
changelogs/unreleased/issue_58547.yml
0 → 100644
浏览文件 @
73b553a4
---
title
:
Add API access check to Graphql
merge_request
:
26570
author
:
type
:
other
spec/controllers/graphql_controller_spec.rb
0 → 100644
浏览文件 @
73b553a4
# frozen_string_literal: true
require
'spec_helper'
describe
GraphqlController
do
before
do
stub_feature_flags
(
graphql:
true
)
end
describe
'POST #execute'
do
context
'when user is logged in'
do
let
(
:user
)
{
create
(
:user
)
}
before
do
sign_in
(
user
)
end
it
'returns 200 when user can access API'
do
post
:execute
expect
(
response
).
to
have_gitlab_http_status
(
200
)
end
it
'returns access denied template when user cannot access API'
do
# User cannot access API in a couple of cases
# * When user is internal(like ghost users)
# * When user is blocked
expect
(
Ability
).
to
receive
(
:allowed?
).
with
(
user
,
:access_api
,
:global
).
and_return
(
false
)
post
:execute
expect
(
response
.
status
).
to
eq
(
403
)
expect
(
response
).
to
render_template
(
'errors/access_denied'
)
end
end
context
'when user is not logged in'
do
it
'returns 200'
do
post
:execute
expect
(
response
).
to
have_gitlab_http_status
(
200
)
end
end
end
end
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录