Fix JWT token check when repository does not exist

Merged Valery Sizov requested to merge fix_jwt_auth_for_not_existing_repository into master

What does this MR do?

This MR fixes a bug introduced in as well as makes JWT token check more efficient

When secondary makes a request and the repository does not exist on primary we will have an exception:

undefined method `repository' for nil:NilClass
     # ./lib/gitlab/gl_repository.rb:8:in `block in <module:GlRepository>'
     # ./lib/gitlab/gl_repository/repo_type.rb:38:in `repository_for'
     # ./app/controllers/projects/git_http_client_controller.rb:92:in `repository'
     # ./ee/app/controllers/ee/projects/git_http_controller.rb:63:in `jwt_scope_valid?'
     # ./ee/app/controllers/ee/projects/git_http_controller.rb:52:in `authenticate_user'

Also, we don't have to instantiate a project AR object to check the full path as it's enough to check that requested project from URL match JWT scope.

This also adds a regression test.

I don't think it makes sense to add it to a patch release. Maybe a release candidate?

Does this MR meet the acceptance criteria?


Performance and testing


If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team
Edited by Michael Kozono