Module: SessionlessAuthentication
- Included in:
- ApplicationController
- Defined in:
- app/controllers/concerns/sessionless_authentication.rb
Overview
SessionlessAuthentication
Controller concern to handle PAT, RSS, and static objects token authentication methods
Instance Method Summary collapse
-
#authenticate_sessionless_user!(request_format) ⇒ Object
This filter handles personal access tokens, atom requests with rss tokens, and static object tokens.
- #request_authenticator ⇒ Object
- #sessionless_bypass_admin_mode!(&block) ⇒ Object
- #sessionless_sign_in(user) ⇒ Object
- #sessionless_user? ⇒ Boolean
Instance Method Details
#authenticate_sessionless_user!(request_format) ⇒ Object
This filter handles personal access tokens, atom requests with rss tokens, and static object tokens
9 10 11 12 |
# File 'app/controllers/concerns/sessionless_authentication.rb', line 9 def authenticate_sessionless_user!(request_format) user = request_authenticator.find_sessionless_user(request_format) sessionless_sign_in(user) if user end |
#request_authenticator ⇒ Object
14 15 16 |
# File 'app/controllers/concerns/sessionless_authentication.rb', line 14 def request_authenticator @request_authenticator ||= Gitlab::Auth::RequestAuthenticator.new(request) end |
#sessionless_bypass_admin_mode!(&block) ⇒ Object
40 41 42 43 44 |
# File 'app/controllers/concerns/sessionless_authentication.rb', line 40 def sessionless_bypass_admin_mode!(&block) return yield unless Gitlab::CurrentSettings.admin_mode Gitlab::Auth::CurrentUserMode.bypass_session!(current_user.id, &block) end |
#sessionless_sign_in(user) ⇒ Object
22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 |
# File 'app/controllers/concerns/sessionless_authentication.rb', line 22 def sessionless_sign_in(user) signed_in_user = if user.can_log_in_with_non_expired_password? # Notice we are passing store false, so the user is not # actually stored in the session and a token is needed # for every request. If you want the token to work as a # sign in token, you can simply remove store: false. sign_in(user, store: false, message: :sessionless_sign_in) elsif request_authenticator.can_sign_in_bot?(user) # we suppress callbacks to avoid redirecting the bot sign_in(user, store: false, message: :sessionless_sign_in, run_callbacks: false) end reset_auth_user! if respond_to?(:reset_auth_user!, true) signed_in_user end |
#sessionless_user? ⇒ Boolean
18 19 20 |
# File 'app/controllers/concerns/sessionless_authentication.rb', line 18 def sessionless_user? current_user && !session.key?('warden.user.user.key') end |