Gitlab oauth login

README.md

@@ -116,6 +116,8 @@ secret=""
 
 [gitlab]
 url=""
+client=""
+secret=""
 skip_verify=false
 
 [gogs]
@@ -178,6 +180,8 @@ export DRONE_BITBUCKET_SECRET=""
 
 # gitlab configuration
 export DRONE_GITLAB_URL=""
+export DRONE_GITLAB_CLIENT=""
+export DRONE_GITLAB_SECRET=""
 export DRONE_GITLAB_SKIP_VERIFY=false
 
 # email configuration

packaging/root/etc/drone/drone.toml

@@ -44,6 +44,8 @@ datasource="/var/lib/drone/drone.sqlite"
 
 # [gitlab]
 # url=""
+# client=""
+# secret=""
 # skip_verify=false
 # open=false
 

plugin/remote/gitlab/gitlab.go

@@ -1,12 +1,15 @@
 package gitlab
 
 import (
+	"fmt"
 	"io/ioutil"
 	"net/http"
 	"net/url"
 	"strconv"
 
 	"github.com/Bugagazavr/go-gitlab-client"
+	"github.com/drone/drone/plugin/remote/github/oauth"
+	"github.com/drone/drone/shared/httputil"
 	"github.com/drone/drone/shared/model"
 )
 
@@ -14,34 +17,66 @@ type Gitlab struct {
 	url        string
 	SkipVerify bool
 	Open       bool
+	Client     string
+	Secret     string
 }
 
-func New(url string, skipVerify, open bool) *Gitlab {
+func New(url string, skipVerify, open bool, client, secret string) *Gitlab {
 	return &Gitlab{
 		url:        url,
 		SkipVerify: skipVerify,
 		Open:       open,
+		Client:     client,
+		Secret:     secret,
 	}
 }
 
 // Authorize handles authentication with thrid party remote systems,
 // such as github or bitbucket, and returns user data.
 func (r *Gitlab) Authorize(res http.ResponseWriter, req *http.Request) (*model.Login, error) {
-	var username = req.FormValue("username")
-	var password = req.FormValue("password")
+	var config = &oauth.Config{
+		ClientId:     r.Client,
+		ClientSecret: r.Secret,
+		Scope:        "api",
+		AuthURL:      fmt.Sprintf("%s/oauth/authorize", r.url),
+		TokenURL:     fmt.Sprintf("%s/oauth/token", r.url),
+		RedirectURL:  fmt.Sprintf("%s/api/auth/%s", httputil.GetURL(req), r.GetKind()),
+	}
 
-	var client = NewClient(r.url, "", r.SkipVerify)
-	var session, err = client.GetSession(username, password)
+	var code = req.FormValue("code")
+	var state = req.FormValue("state")
+
+	if len(code) == 0 {
+		var random = GetRandom()
+		httputil.SetCookie(res, req, "gitlab_state", random)
+		http.Redirect(res, req, config.AuthCodeURL(random), http.StatusSeeOther)
+		return nil, nil
+	}
+
+	cookieState := httputil.GetCookie(req, "gitlab_state")
+	httputil.DelCookie(res, req, "gitlab_state")
+	if cookieState != state {
+		return nil, fmt.Errorf("Error matching state in OAuth2 redirect")
+	}
+
+	var trans = &oauth.Transport{Config: config}
+	var token, err = trans.Exchange(code)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("Error exchanging token. %s", err)
+	}
+
+	var client = NewClient(r.url, token.AccessToken, r.SkipVerify)
+
+	var user, errr = client.CurrentUser()
+	if errr != nil {
+		return nil, fmt.Errorf("Error retrieving current user. %s", errr)
 	}
 
 	var login = new(model.Login)
-	login.ID = int64(session.Id)
-	login.Access = session.PrivateToken
-	login.Login = session.UserName
-	login.Name = session.Name
-	login.Email = session.Email
+	login.ID = int64(user.Id)
+	login.Access = token.AccessToken
+	login.Login = user.Username
+	login.Email = user.Email
 	return login, nil
 }
 

plugin/remote/gitlab/gitlab_test.go

@@ -1,7 +1,9 @@
 package gitlab
 
 import (
+	"fmt"
 	"net/http"
+	"net/http/httptest"
 	"testing"
 
 	"github.com/drone/drone/plugin/remote/gitlab/testdata"
@@ -14,7 +16,7 @@ func Test_Github(t *testing.T) {
 	var server = testdata.NewServer()
 	defer server.Close()
 
-	var gitlab = New(server.URL, false, false)
+	var gitlab = New(server.URL, false, false, "", "")
 	var user = model.User{
 		Access: "e3b0c44298fc1c149afbf4c8996fb",
 	}
@@ -31,17 +33,6 @@ func Test_Github(t *testing.T) {
 	g := goblin.Goblin(t)
 	g.Describe("Gitlab Plugin", func() {
 
-		g.It("Should authorize user", func() {
-			var req, _ = http.NewRequest("GET", "/login/gitlab", nil)
-			var login, err = gitlab.Authorize(nil, req)
-			g.Assert(err == nil).IsTrue()
-			g.Assert(login.Email).Equal("john@example.com")
-			g.Assert(login.Name).Equal("John Smith")
-			g.Assert(login.Login).Equal("john_smith")
-			g.Assert(login.Access).Equal("dd34asd13as")
-			g.Assert(login.ID).Equal(int64(1))
-		})
-
 		g.It("Should get the repo list", func() {
 			var repos, err = gitlab.GetRepos(&user)
 			g.Assert(err == nil).IsTrue()
@@ -55,6 +46,23 @@ func Test_Github(t *testing.T) {
 			g.Assert(repos[0].Role.Read).Equal(true)
 			g.Assert(repos[0].Role.Write).Equal(true)
 		})
+
+		g.Describe("Authorize", func() {
+			var resp = httptest.NewRecorder()
+			var state = "validstate"
+			var req, _ = http.NewRequest(
+				"GET",
+				fmt.Sprintf("%s/?code=sekret&state=%s", server.URL, state),
+				nil,
+			)
+			req.AddCookie(&http.Cookie{Name: "gitlab_state", Value: state})
+
+			g.It("Should authorize a valid user", func() {
+				var login, err = gitlab.Authorize(resp, req)
+				g.Assert(err == nil).IsTrue()
+				g.Assert(login == nil).IsFalse()
+			})
+		})
 		/*
 			g.It("Should get the build script", func() {
 				var script, err = github.GetScript(&user, &repo, &commit)

plugin/remote/gitlab/helper.go

@@ -1,16 +1,20 @@
 package gitlab
 
 import (
+	"encoding/base32"
 	"fmt"
 	"net/url"
 
 	"github.com/Bugagazavr/go-gitlab-client"
+	"github.com/gorilla/securecookie"
 )
 
 // NewClient is a helper function that returns a new GitHub
 // client using the provided OAuth token.
 func NewClient(uri, token string, skipVerify bool) *gogitlab.Gitlab {
-	return gogitlab.NewGitlabCert(uri, "/api/v3", token, skipVerify)
+	client := gogitlab.NewGitlabCert(uri, "/api/v3", token, skipVerify)
+	client.Bearer = true
+	return client
 }
 
 // IsRead is a helper function that returns true if the
@@ -76,3 +80,9 @@ func GetKeyTitle(rawurl string) (string, error) {
 func ns(owner, name string) string {
 	return fmt.Sprintf("%s%%2F%s", owner, name)
 }
+
+// GetRandom is a helper function that generates a 32-bit random
+// key, base32 encoded as a string value.
+func GetRandom() string {
+	return base32.StdEncoding.EncodeToString(securecookie.GenerateRandomKey(32))
+}

plugin/remote/gitlab/register.go

@@ -9,6 +9,9 @@ var (
 	gitlabURL        = config.String("gitlab-url", "")
 	gitlabSkipVerify = config.Bool("gitlab-skip-verify", false)
 	gitlabOpen       = config.Bool("gitlab-open", false)
+
+	gitlabClient = config.String("gitlab-client", "")
+	gitlabSecret = config.String("gitlab-secret", "")
 )
 
 // Registers the Gitlab plugin using the default
@@ -23,6 +26,8 @@ func Register() {
 			*gitlabURL,
 			*gitlabSkipVerify,
 			*gitlabOpen,
+			*gitlabClient,
+			*gitlabSecret,
 		),
 	)
 }

plugin/remote/gitlab/testdata/testdata.go

@@ -27,6 +27,12 @@ func NewServer() *httptest.Server {
 		case "/api/v3/session":
 			w.Write(sessionPayload)
 			return
+		case "/oauth/token":
+			w.Write(accessTokenPayload)
+			return
+		case "/api/v3/user":
+			w.Write(currentUserPayload)
+			return
 		}
 
 		// else return a 404
@@ -231,3 +237,28 @@ var droneYamlPayload = []byte(`
 	"content":  "aW1hZ2U6IGdv"
 }
 `)
+
+var accessTokenPayload = []byte(`access_token=sekret&scope=api&token_type=bearer`)
+
+var currentUserPayload = []byte(`
+{
+  "id": 1,
+  "username": "john_smith",
+  "email": "john@example.com",
+  "name": "John Smith",
+  "private_token": "dd34asd13as",
+  "state": "active",
+  "created_at": "2012-05-23T08:00:58Z",
+  "bio": null,
+  "skype": "",
+  "linkedin": "",
+  "twitter": "",
+  "website_url": "",
+  "theme_id": 1,
+  "color_scheme_id": 2,
+  "is_admin": false,
+  "can_create_group": true,
+  "can_create_project": true,
+  "projects_limit": 100
+}
+`)

server/app/views/login.html

@@ -11,10 +11,7 @@ minor modifications to the style that only apply to this view
 <article id="loginpage">
 	<div class="pure-g">
 		<div class="pure-u-1" ng-if="state == 1 && remotes.length != 0" ng-repeat="remote in remotes">
-			<a ng-href="/api/auth/{{ remote.type }}" target="_self" ng-if="remote.type != 'gitlab.com' && remote.type != 'gogs' ">
-				<i class="fa {{ remote.type | remoteIcon }}"></i> {{ remote.type | remoteName }}
-			</a>
-			<a ng-href="/gitlab" ng-if="remote.type == 'gitlab.com' ">
+			<a ng-href="/api/auth/{{ remote.type }}" target="_self" ng-if="remote.type != 'gogs' ">
 				<i class="fa {{ remote.type | remoteIcon }}"></i> {{ remote.type | remoteName }}
 			</a>
 			<a ng-href="/gogs" ng-if="remote.type == 'gogs' ">

server/app/views/login_gitlab.html

@@ -1,24 +0,0 @@
-<!-- 
-minor modifications to the style that only apply to this view
--->
-<style>
-#container { padding-top: 155px; }
-#header { height: 150px; }
-#header .user { display:none; }
-#header .brand { margin-top:55px ; }
-</style>
-
-<article id="loginpage">
-	<form class="pure-g" method="POST" action="/api/auth/gitlab.com">
-		<div class="pure-u-1">
-			<input type="text" name="username" placeholder="Email Address" />
-		</div>
-		<div class="pure-u-1">
-			<input type="password" name="password" placeholder="Password" />
-		</div>
-
-		<div class="pure-u-1">
-			<input type="submit" value="Gitlab Login" />
-		</div>
-	</form>
-</article>