Skip to content

Commit 674ec3a

Browse files
samrocketmansamrocketman
committed
Merge PR jenkinsci#45 Allow limited oauth scopes
2 parents 84a2628 + 6ed061a commit 674ec3a

File tree

2 files changed

+52
-23
lines changed

2 files changed

+52
-23
lines changed

‎src/main/java/org/jenkinsci/plugins/GithubAuthenticationToken.java

Lines changed: 29 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -26,27 +26,27 @@ of this software and associated documentation files (the "Software"), to deal
2626
*/
2727
package org.jenkinsci.plugins;
2828

29+
import com.google.common.cache.Cache;
30+
import com.google.common.cache.CacheBuilder;
31+
import hudson.security.SecurityRealm;
2932
import java.io.IOException;
3033
import java.util.ArrayList;
31-
import java.util.List;
32-
import java.util.Map;
33-
import java.util.Set;
34+
import java.util.Arrays;
35+
import java.util.Collection;
3436
import java.util.concurrent.Callable;
3537
import java.util.concurrent.ExecutionException;
3638
import java.util.concurrent.TimeUnit;
3739
import java.util.HashSet;
38-
import java.util.logging.Logger;
40+
import java.util.List;
3941
import java.util.logging.Level;
40-
41-
import com.google.common.cache.Cache;
42-
import com.google.common.cache.CacheBuilder;
43-
import hudson.security.SecurityRealm;
44-
import java.util.Collection;
45-
46-
import org.jenkinsci.plugins.GithubOAuthUserDetails;
42+
import java.util.logging.Logger;
43+
import java.util.Map;
44+
import java.util.Set;
45+
import jenkins.model.Jenkins;
4746
import org.acegisecurity.GrantedAuthority;
4847
import org.acegisecurity.GrantedAuthorityImpl;
4948
import org.acegisecurity.providers.AbstractAuthenticationToken;
49+
import org.jenkinsci.plugins.GithubOAuthUserDetails;
5050
import org.kohsuke.github.GHMyself;
5151
import org.kohsuke.github.GHOrganization;
5252
import org.kohsuke.github.GHPersonSet;
@@ -72,6 +72,7 @@ public class GithubAuthenticationToken extends AbstractAuthenticationToken {
7272
private final String userName;
7373
private final GitHub gh;
7474
private final GHMyself me;
75+
private GithubSecurityRealm myRealm = null;
7576

7677
/**
7778
* Cache for faster organization based security
@@ -103,13 +104,23 @@ public GithubAuthenticationToken(String accessToken, String githubServer) throws
103104

104105
this.userName = this.me.getLogin();
105106
authorities.add(SecurityRealm.AUTHENTICATED_AUTHORITY);
106-
Map<String, Set<GHTeam>> myTeams = gh.getMyTeams();
107-
for (String orgLogin : myTeams.keySet()) {
108-
LOGGER.log(Level.FINE, "Fetch teams for user " + userName + " in organization " + orgLogin);
109-
authorities.add(new GrantedAuthorityImpl(orgLogin));
110-
for (GHTeam team : myTeams.get(orgLogin)) {
111-
authorities.add(new GrantedAuthorityImpl(orgLogin + GithubOAuthGroupDetails.ORG_TEAM_SEPARATOR
112-
+ team.getName()));
107+
if(Jenkins.getInstance().getSecurityRealm() instanceof GithubSecurityRealm) {
108+
if(myRealm == null) {
109+
myRealm = (GithubSecurityRealm) Jenkins.getInstance().getSecurityRealm();
110+
}
111+
//Search for scopes that allow fetching team membership. This is documented online.
112+
//https://developer.github.com/v3/orgs/#list-your-organizations
113+
//https://developer.github.com/v3/orgs/teams/#list-user-teams
114+
if(myRealm.hasScope("read:org") || myRealm.hasScope("admin:org") || myRealm.hasScope("user") || myRealm.hasScope("repo")) {
115+
Map<String, Set<GHTeam>> myTeams = gh.getMyTeams();
116+
for (String orgLogin : myTeams.keySet()) {
117+
LOGGER.log(Level.FINE, "Fetch teams for user " + userName + " in organization " + orgLogin);
118+
authorities.add(new GrantedAuthorityImpl(orgLogin));
119+
for (GHTeam team : myTeams.get(orgLogin)) {
120+
authorities.add(new GrantedAuthorityImpl(orgLogin + GithubOAuthGroupDetails.ORG_TEAM_SEPARATOR
121+
+ team.getName()));
122+
}
123+
}
113124
}
114125
}
115126
}

‎src/test/java/org/jenkinsci/plugins/GithubRequireOrganizationMembershipACLTest.java

Lines changed: 23 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@ of this software and associated documentation files (the "Software"), to deal
3434
import hudson.plugins.git.GitSCM;
3535
import hudson.plugins.git.UserRemoteConfig;
3636
import hudson.scm.NullSCM;
37+
import hudson.security.Permission;
38+
import hudson.security.PermissionScope;
3739
import java.io.IOException;
3840
import java.util.ArrayList;
3941
import java.util.Arrays;
@@ -42,16 +44,15 @@ of this software and associated documentation files (the "Software"), to deal
4244
import java.util.List;
4345
import java.util.Map;
4446
import java.util.Set;
45-
46-
import hudson.security.Permission;
47-
import hudson.security.PermissionScope;
47+
import jenkins.model.Jenkins;
4848
import junit.framework.TestCase;
4949
import org.acegisecurity.Authentication;
5050
import org.acegisecurity.GrantedAuthority;
5151
import org.acegisecurity.GrantedAuthorityImpl;
5252
import org.acegisecurity.providers.anonymous.AnonymousAuthenticationToken;
53-
import org.junit.Test;
53+
import org.junit.Before;
5454
import org.junit.runner.RunWith;
55+
import org.junit.Test;
5556
import org.kohsuke.github.GHMyself;
5657
import org.kohsuke.github.GHOrganization;
5758
import org.kohsuke.github.GHPerson;
@@ -60,18 +61,35 @@ of this software and associated documentation files (the "Software"), to deal
6061
import org.kohsuke.github.GHUser;
6162
import org.kohsuke.github.GitHub;
6263
import org.kohsuke.github.PagedIterable;
64+
import org.mockito.Mock;
6365
import org.powermock.api.mockito.PowerMockito;
6466
import org.powermock.core.classloader.annotations.PrepareForTest;
6567
import org.powermock.modules.junit4.PowerMockRunner;
68+
import static org.mockito.Matchers.anyObject;
6669

6770
/**
6871
*
6972
* @author alex
7073
*/
7174
@RunWith(PowerMockRunner.class)
72-
@PrepareForTest( GitHub.class )
75+
@PrepareForTest({GitHub.class, Jenkins.class, GithubSecurityRealm.class})
7376
public class GithubRequireOrganizationMembershipACLTest extends TestCase {
7477

78+
@Mock
79+
private Jenkins jenkins;
80+
81+
@Mock
82+
private GithubSecurityRealm securityRealm;
83+
84+
@Before
85+
public void setUp() throws Exception {
86+
//GithubSecurityRealm myRealm = PowerMockito.mock(GithubSecurityRealm.class);
87+
PowerMockito.mockStatic(Jenkins.class);
88+
PowerMockito.when(Jenkins.getInstance()).thenReturn(jenkins);
89+
PowerMockito.when(jenkins.getSecurityRealm()).thenReturn(securityRealm);
90+
PowerMockito.when(securityRealm.getOauthScopes()).thenReturn("read:org");
91+
}
92+
7593
private final Permission VIEW_JOBSTATUS_PERMISSION = new Permission(Item.PERMISSIONS,
7694
"ViewStatus",
7795
Messages._Item_READ_description(),

0 commit comments

Comments
 (0)