Skip to content

Commit d1b5498

Browse files
ethantkoeniglunny
ethantkoenig
authored and
lunny
committed
Use handlers for API authorization (#723)
1 parent 067ae5d commit d1b5498

File tree

5 files changed

+100
-131
lines changed

5 files changed

+100
-131
lines changed

‎routers/api/v1/admin/org_repo.go

Lines changed: 0 additions & 52 deletions
This file was deleted.

‎routers/api/v1/api.go

Lines changed: 26 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,11 @@ func reqOrgMembership() macaron.Handler {
132132
}
133133

134134
if !models.IsOrganizationMember(orgID, ctx.User.ID) {
135-
ctx.Error(403, "", "Must be an organization member")
135+
if ctx.Org.Organization != nil {
136+
ctx.Error(403, "", "Must be an organization member")
137+
} else {
138+
ctx.Status(404)
139+
}
136140
return
137141
}
138142
}
@@ -151,7 +155,11 @@ func reqOrgOwnership() macaron.Handler {
151155
}
152156

153157
if !models.IsOrganizationOwner(orgID, ctx.User.ID) {
154-
ctx.Error(403, "", "Must be an organization member")
158+
if ctx.Org.Organization != nil {
159+
ctx.Error(403, "", "Must be an organization owner")
160+
} else {
161+
ctx.Status(404)
162+
}
155163
return
156164
}
157165
}
@@ -394,18 +402,20 @@ func RegisterRoutes(m *macaron.Macaron) {
394402
m.Get("/user/orgs", reqToken(), org.ListMyOrgs)
395403
m.Get("/users/:username/orgs", org.ListUserOrgs)
396404
m.Group("/orgs/:orgname", func() {
397-
m.Combo("").Get(org.Get).Patch(bind(api.EditOrgOption{}), org.Edit)
405+
m.Combo("").Get(org.Get).
406+
Patch(reqOrgOwnership(), bind(api.EditOrgOption{}), org.Edit)
398407
m.Group("/members", func() {
399408
m.Get("", org.ListMembers)
400-
m.Combo("/:username").Get(org.IsMember).Delete(org.DeleteMember)
409+
m.Combo("/:username").Get(org.IsMember).
410+
Delete(reqOrgOwnership(), org.DeleteMember)
401411
})
402412
m.Group("/public_members", func() {
403413
m.Get("", org.ListPublicMembers)
404414
m.Combo("/:username").Get(org.IsPublicMember).
405-
Put(org.PublicizeMember).
406-
Delete(org.ConcealMember)
415+
Put(reqOrgMembership(), org.PublicizeMember).
416+
Delete(reqOrgMembership(), org.ConcealMember)
407417
})
408-
m.Combo("/teams").Get(org.ListTeams).
418+
m.Combo("/teams", reqOrgMembership()).Get(org.ListTeams).
409419
Post(bind(api.CreateTeamOption{}), org.CreateTeam)
410420
m.Group("/hooks", func() {
411421
m.Combo("").Get(org.ListHooks).
@@ -417,19 +427,21 @@ func RegisterRoutes(m *macaron.Macaron) {
417427
}, orgAssignment(true))
418428
m.Group("/teams/:teamid", func() {
419429
m.Combo("").Get(org.GetTeam).
420-
Patch(bind(api.EditTeamOption{}), org.EditTeam).
421-
Delete(org.DeleteTeam)
430+
Patch(reqOrgOwnership(), bind(api.EditTeamOption{}), org.EditTeam).
431+
Delete(reqOrgOwnership(), org.DeleteTeam)
422432
m.Group("/members", func() {
423433
m.Get("", org.GetTeamMembers)
424-
m.Combo("/:username").Put(org.AddTeamMember).
425-
Delete(org.RemoveTeamMember)
434+
m.Combo("/:username").
435+
Put(reqOrgOwnership(), org.AddTeamMember).
436+
Delete(reqOrgOwnership(), org.RemoveTeamMember)
426437
})
427438
m.Group("/repos", func() {
428439
m.Get("", org.GetTeamRepos)
429-
m.Combo("/:reponame").Put(admin.AddTeamRepository).
430-
Delete(admin.RemoveTeamRepository)
440+
m.Combo(":orgname/:reponame").
441+
Put(org.AddTeamRepository).
442+
Delete(org.RemoveTeamRepository)
431443
})
432-
}, orgAssignment(false, true))
444+
}, reqOrgMembership(), orgAssignment(false, true))
433445

434446
m.Any("/*", func(ctx *context.Context) {
435447
ctx.Error(404)

‎routers/api/v1/org/member.go

Lines changed: 2 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -97,9 +97,6 @@ func PublicizeMember(ctx *context.APIContext) {
9797
if userToPublicize.ID != ctx.User.ID {
9898
ctx.Error(403, "", "Cannot publicize another member")
9999
return
100-
} else if !ctx.Org.Organization.IsOrgMember(userToPublicize.ID) {
101-
ctx.Error(403, "", "Must be a member of the organization")
102-
return
103100
}
104101
err := models.ChangeOrgUserStatus(ctx.Org.Organization.ID, userToPublicize.ID, true)
105102
if err != nil {
@@ -115,9 +112,6 @@ func ConcealMember(ctx *context.APIContext) {
115112
if userToConceal.ID != ctx.User.ID {
116113
ctx.Error(403, "", "Cannot conceal another member")
117114
return
118-
} else if !ctx.Org.Organization.IsOrgMember(userToConceal.ID) {
119-
ctx.Error(403, "", "Must be a member of the organization")
120-
return
121115
}
122116
err := models.ChangeOrgUserStatus(ctx.Org.Organization.ID, userToConceal.ID, false)
123117
if err != nil {
@@ -130,11 +124,8 @@ func ConcealMember(ctx *context.APIContext) {
130124
// DeleteMember remove a member from an organization
131125
func DeleteMember(ctx *context.APIContext) {
132126
org := ctx.Org.Organization
133-
if !org.IsOwnedBy(ctx.User.ID) {
134-
ctx.Error(403, "", "You must be an owner of the organization.")
135-
return
136-
}
137-
if err := org.RemoveMember(user.GetUserByParams(ctx).ID); err != nil {
127+
memberID := user.GetUserByParams(ctx).ID
128+
if err := org.RemoveMember(memberID); err != nil {
138129
ctx.Error(500, "RemoveMember", err)
139130
}
140131
ctx.Status(204)

‎routers/api/v1/org/org.go

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -52,11 +52,6 @@ func Get(ctx *context.APIContext) {
5252
// see https://github.com/gogits/go-gogs-client/wiki/Organizations#edit-an-organization
5353
func Edit(ctx *context.APIContext, form api.EditOrgOption) {
5454
org := ctx.Org.Organization
55-
if !org.IsOwnedBy(ctx.User.ID) {
56-
ctx.Status(403)
57-
return
58-
}
59-
6055
org.FullName = form.FullName
6156
org.Description = form.Description
6257
org.Website = form.Website

‎routers/api/v1/org/team.go

Lines changed: 72 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,6 @@ import (
1616
// ListTeams list all the teams of an organization
1717
func ListTeams(ctx *context.APIContext) {
1818
org := ctx.Org.Organization
19-
if !org.IsOrgMember(ctx.User.ID) {
20-
ctx.Error(403, "", "Must be a member of the organization")
21-
return
22-
}
2319
if err := org.GetTeams(); err != nil {
2420
ctx.Error(500, "GetTeams", err)
2521
return
@@ -34,40 +30,11 @@ func ListTeams(ctx *context.APIContext) {
3430

3531
// GetTeam api for get a team
3632
func GetTeam(ctx *context.APIContext) {
37-
if !models.IsOrganizationMember(ctx.Org.Team.OrgID, ctx.User.ID) {
38-
ctx.Status(404)
39-
return
40-
}
4133
ctx.JSON(200, convert.ToTeam(ctx.Org.Team))
4234
}
4335

44-
// GetTeamRepos api for get a team's repos
45-
func GetTeamRepos(ctx *context.APIContext) {
46-
team := ctx.Org.Team
47-
if !models.IsOrganizationMember(team.OrgID, ctx.User.ID) {
48-
ctx.Status(404)
49-
return
50-
}
51-
if err := team.GetRepositories(); err != nil {
52-
ctx.Error(500, "GetTeamRepos", err)
53-
}
54-
repos := make([]*api.Repository, len(team.Repos))
55-
for i, repo := range team.Repos {
56-
access, err := models.AccessLevel(ctx.User, repo)
57-
if err != nil {
58-
ctx.Error(500, "GetTeamRepos", err)
59-
return
60-
}
61-
repos[i] = repo.APIFormat(access)
62-
}
63-
ctx.JSON(200, repos)
64-
}
65-
6636
// CreateTeam api for create a team
6737
func CreateTeam(ctx *context.APIContext, form api.CreateTeamOption) {
68-
if !ctx.Org.Organization.IsOrgMember(ctx.User.ID) {
69-
ctx.Error(403, "", "Must be an organization member")
70-
}
7138
team := &models.Team{
7239
OrgID: ctx.Org.Organization.ID,
7340
Name: form.Name,
@@ -88,10 +55,6 @@ func CreateTeam(ctx *context.APIContext, form api.CreateTeamOption) {
8855

8956
// EditTeam api for edit a team
9057
func EditTeam(ctx *context.APIContext, form api.EditTeamOption) {
91-
if !ctx.User.IsUserOrgOwner(ctx.Org.Team.OrgID) {
92-
ctx.Error(403, "", "Must be an organization owner")
93-
return
94-
}
9558
team := &models.Team{
9659
ID: ctx.Org.Team.ID,
9760
OrgID: ctx.Org.Team.OrgID,
@@ -108,10 +71,6 @@ func EditTeam(ctx *context.APIContext, form api.EditTeamOption) {
10871

10972
// DeleteTeam api for delete a team
11073
func DeleteTeam(ctx *context.APIContext) {
111-
if !ctx.User.IsUserOrgOwner(ctx.Org.Team.OrgID) {
112-
ctx.Error(403, "", "Must be an organization owner")
113-
return
114-
}
11574
if err := models.DeleteTeam(ctx.Org.Team); err != nil {
11675
ctx.Error(500, "DeleteTeam", err)
11776
return
@@ -139,10 +98,6 @@ func GetTeamMembers(ctx *context.APIContext) {
13998

14099
// AddTeamMember api for add a member to a team
141100
func AddTeamMember(ctx *context.APIContext) {
142-
if !ctx.User.IsUserOrgOwner(ctx.Org.Team.OrgID) {
143-
ctx.Error(403, "", "Must be an organization owner")
144-
return
145-
}
146101
u := user.GetUserByParams(ctx)
147102
if ctx.Written() {
148103
return
@@ -156,10 +111,6 @@ func AddTeamMember(ctx *context.APIContext) {
156111

157112
// RemoveTeamMember api for remove one member from a team
158113
func RemoveTeamMember(ctx *context.APIContext) {
159-
if !ctx.User.IsUserOrgOwner(ctx.Org.Team.OrgID) {
160-
ctx.Error(403, "", "Must be an organization owner")
161-
return
162-
}
163114
u := user.GetUserByParams(ctx)
164115
if ctx.Written() {
165116
return
@@ -171,3 +122,75 @@ func RemoveTeamMember(ctx *context.APIContext) {
171122
}
172123
ctx.Status(204)
173124
}
125+
126+
// GetTeamRepos api for get a team's repos
127+
func GetTeamRepos(ctx *context.APIContext) {
128+
team := ctx.Org.Team
129+
if err := team.GetRepositories(); err != nil {
130+
ctx.Error(500, "GetTeamRepos", err)
131+
}
132+
repos := make([]*api.Repository, len(team.Repos))
133+
for i, repo := range team.Repos {
134+
access, err := models.AccessLevel(ctx.User, repo)
135+
if err != nil {
136+
ctx.Error(500, "GetTeamRepos", err)
137+
return
138+
}
139+
repos[i] = repo.APIFormat(access)
140+
}
141+
ctx.JSON(200, repos)
142+
}
143+
144+
// getRepositoryByParams get repository by a team's organization ID and repo name
145+
func getRepositoryByParams(ctx *context.APIContext) *models.Repository {
146+
repo, err := models.GetRepositoryByName(ctx.Org.Team.OrgID, ctx.Params(":reponame"))
147+
if err != nil {
148+
if models.IsErrRepoNotExist(err) {
149+
ctx.Status(404)
150+
} else {
151+
ctx.Error(500, "GetRepositoryByName", err)
152+
}
153+
return nil
154+
}
155+
return repo
156+
}
157+
158+
// AddTeamRepository api for adding a repository to a team
159+
func AddTeamRepository(ctx *context.APIContext) {
160+
repo := getRepositoryByParams(ctx)
161+
if ctx.Written() {
162+
return
163+
}
164+
if access, err := models.AccessLevel(ctx.User, repo); err != nil {
165+
ctx.Error(500, "AccessLevel", err)
166+
return
167+
} else if access < models.AccessModeAdmin {
168+
ctx.Error(403, "", "Must have admin-level access to the repository")
169+
return
170+
}
171+
if err := ctx.Org.Team.AddRepository(repo); err != nil {
172+
ctx.Error(500, "AddRepository", err)
173+
return
174+
}
175+
ctx.Status(204)
176+
}
177+
178+
// RemoveTeamRepository api for removing a repository from a team
179+
func RemoveTeamRepository(ctx *context.APIContext) {
180+
repo := getRepositoryByParams(ctx)
181+
if ctx.Written() {
182+
return
183+
}
184+
if access, err := models.AccessLevel(ctx.User, repo); err != nil {
185+
ctx.Error(500, "AccessLevel", err)
186+
return
187+
} else if access < models.AccessModeAdmin {
188+
ctx.Error(403, "", "Must have admin-level access to the repository")
189+
return
190+
}
191+
if err := ctx.Org.Team.RemoveRepository(repo.ID); err != nil {
192+
ctx.Error(500, "RemoveRepository", err)
193+
return
194+
}
195+
ctx.Status(204)
196+
}

0 commit comments

Comments
 (0)