<commit_before>require_relative 'shell_env'
require 'omniauth-ldap'

module Grack
  class Auth < Rack::Auth::Basic
    attr_accessor :user, :project

    def call(env)
      @env = env
      @request = Rack::Request.new(env)
      @auth = Request.new(env)

      # Need this patch due to the rails mount
      @env['PATH_INFO'] = @request.path
      @env['SCRIPT_NAME'] = ""

      return render_not_found unless project
      return unauthorized unless project.public || @auth.provided?
      return bad_request if @auth.provided? && !@auth.basic?

      if valid?
        if @auth.provided?
          @env['REMOTE_USER'] = @auth.username
        end
        return @app.call(env)
      else
        unauthorized
      end
    end

    def valid?
      if @auth.provided?
        # Authentication with username and password
        login, password = @auth.credentials
        self.user = User.find_by_email(login) || User.find_by_username(login)

        # If the provided login was not a known email or username
        # then user is nil
        if user.nil? 
          # Second chance - try LDAP authentication
          return false unless Gitlab.config.ldap.enabled         
          ldap_auth(login,password)
          return false unless !user.nil?
        else
          return false unless user.valid_password?(password)
        end
           
        Gitlab::ShellEnv.set_env(user)
      end

      # Git upload and receive
      if @request.get?
        validate_get_request
      elsif @request.post?
        validate_post_request
      else
        false
      end
    end

    def ldap_auth(login, password)
      # Check user against LDAP backend if user is not authenticated
      # Only check with valid login and password to prevent anonymous bind results
      gl = Gitlab.config
      if gl.ldap.enabled && !login.blank? && !password.blank?
        ldap = OmniAuth::LDAP::Adaptor.new(gl.ldap)
        ldap_user = ldap.bind_as(
          filter: Net::LDAP::Filter.eq(ldap.uid, login),
          size: 1,
          password: password
        )
        if ldap_user
          self.user = User.find_by_extern_uid_and_provider(ldap_user.dn, 'ldap')
        end
      end
    end

    def validate_get_request
      project.public || can?(user, :download_code, project)
    end

    def validate_post_request
      if @request.path_info.end_with?('git-upload-pack')
        project.public || can?(user, :download_code, project)
      elsif @request.path_info.end_with?('git-receive-pack')
        action = if project.protected_branch?(current_ref)
                   :push_code_to_protected_branches
                 else
                   :push_code
                 end

        can?(user, action, project)
      else
        false
      end
    end

    def can?(object, action, subject)
      abilities.allowed?(object, action, subject)
    end

    def current_ref
      if @env["HTTP_CONTENT_ENCODING"] =~ /gzip/
        input = Zlib::GzipReader.new(@request.body).read<commit_msg>fix http push 401<commit_after>require_relative 'shell_env'
require 'omniauth-ldap'

module Grack
  class Auth < Rack::Auth::Basic
    attr_accessor :user, :project

    def call(env)
      @env = env
      @request = Rack::Request.new(env)
      @auth = Request.new(env)

      # Need this patch due to the rails mount
      @env['PATH_INFO'] = @request.path
      @env['SCRIPT_NAME'] = ""

      return render_not_found unless project
      return unauthorized unless project.public || @auth.provided?
      return bad_request if @auth.provided? && !@auth.basic?

      if valid?
        if @auth.provided?
          @env['REMOTE_USER'] = @auth.username
        end
        return @app.call(env)
      else
        unauthorized
      end
    end

    def valid?
      if @auth.provided?
        # Authentication with username and password
        login, password = @auth.credentials
        self.user = User.find_by_email(login) || User.find_by_username(login)

        # If the provided login was not a known email or username
        # then user is nil
        if user.nil? 
          # Second chance - try LDAP authentication
          return false unless Gitlab.config.ldap.enabled         
          ldap_auth(login,password)
          return false unless !user.nil?
        else
          return false unless user.valid_password?(password)
        end
           
        Gitlab::ShellEnv.set_env(user)
      end

      # Git upload and receive
      if @request.get?
        validate_get_request
      elsif @request.post?
        validate_post_request
      else
        false
      end
    end

    def ldap_auth(login, password)
      # Check user against LDAP backend if user is not authenticated
      # Only check with valid login and password to prevent anonymous bind results
      gl = Gitlab.config
      if gl.ldap.enabled && !login.blank? && !password.blank?
        ldap = OmniAuth::LDAP::Adaptor.new(gl.ldap)
        ldap_user = ldap.bind_as(
          filter: Net::LDAP::Filter.eq(ldap.uid, login),
          size: 1,
          password: password
        )
        if ldap_user
          self.user = User.find_by_extern_uid_and_provider(ldap_user.dn, 'ldap')
        end
      end
    end

    def validate_get_request
      validate_request(@request.params['service'])
    end

    def validate_post_request
      validate_request(File.basename(@request.path))
    end

    def validate_request(service)
      if service == 'git-upload-pack'
        project.public || can?(user, :download_code, project)
      elsif service == 'git-receive-pack'
        action = if project.protected_branch?(current_ref)
                   :push_code_to_protected_branches
                 else
                   :push_code
                 end

        can?(user, action, project)
      else
        false
      end
    end

    def can?(object, action, subject)
      abilities.allowed?(object, action, subject)
    end

    def current_ref
      if @env["HTTP_CONTENT_ENCODING"] =~ /gzip/
        input = Zlib::GzipReader.new(@request.body).read
{'fraction_non_alphanumeric': 0.08708560118753092, 'fraction_numerical': 0.0008246742536698004, 'mean_word_length': 2.0891492613346916, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 3, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '341913', 'n_tokens_mistral': 1802, 'n_tokens_neox': 1746, 'n_words': 449}