delta/gitlab/gitlab-ce.git/lib/api/users.rb, branch docs/database-development

Include the `is_admin` field in the `GET /users/:id` API when current user is an admin

2017-08-11T13:14:32+00:00

Signed-off-by: Rémy Coutable

Update grape gem

2017-07-20T13:33:18+00:00

New version of the gem returns 200 status code on delete with content
instead of 204 so we explicitly set status code to keep existing
behavior

Signed-off-by: Dmitriy Zaporozhets

Return `is_admin` attribute in the GET /user endpoint for admins

2017-07-12T10:45:46+00:00

Signed-off-by: Rémy Coutable

fix specs

2017-07-07T14:09:30+00:00

add created at filter logic to users finder and API

2017-07-07T08:38:57+00:00

Merge branch 'master' into '33580-fix-api-scoping'

2017-07-04T15:00:01+00:00

# Conflicts:
#   lib/api/users.rb

Simplify authentication logic in the v4 users API for !12445.

2017-07-04T12:19:48+00:00

- Rather than using an explicit check to turn off authentication for the
  `/users` endpoint, simply call `authenticate_non_get!`.

- All `GET` endpoints we wish to restrict already call
  `authenticated_as_admin!`, and so remain inacessible to anonymous users.

- This _does_ open up the `/users/:id` endpoint to anonymous access. It contains
  the same access check that `/users` users, and so is safe for use here.

- More context: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/12445#note_34031323

Merge remote-tracking branch 'origin/master' into 34141-allow-unauthenticated-access-to-the-users-api

2017-06-30T13:45:51+00:00

- Modify policy code to work with the `DeclarativePolicy` refactor
  in 37c401433b76170f0150d70865f1f4584db01fa8.

Implement review comments for !12445 from @godfat and @rymai.

2017-06-30T13:06:03+00:00

- Use `GlobalPolicy` to authorize the users that a non-authenticated user can
  fetch from `/api/v4/users`. We allow access if the `Gitlab::VisibilityLevel::PUBLIC`
  visibility level is not restricted.

- Further, as before, `/api/v4/users` is only accessible to unauthenticated users if
  the `username` parameter is passed.

- Turn off `authenticate!` for the `/api/v4/users` endpoint by matching on the actual
  route + method, rather than the description.

- Change the type of `current_user` check in `UsersFinder` to be more
  compatible with EE.

Initial attempt at refactoring API scope declarations.

2017-06-28T07:17:13+00:00

- Declaring an endpoint's scopes in a `before` block has proved to be
  unreliable. For example, if we're accessing the `API::Users` endpoint - code
  in a `before` block in `API::API` wouldn't be able to see the scopes set in
  `API::Users` since the `API::API` `before` block runs first.

- This commit moves these declarations to the class level, since they don't need
  to change once set.