com.cloudbees.plugins.credentials.common.StandardCredentials Java Examples

@RequirePOST
public ListBoxModel doFillCredentialsIdItems(@AncestorInPath ItemGroup context) {
    AccessControlled ac = (context instanceof AccessControlled ? (AccessControlled) context : Jenkins.getInstance());
    if (!ac.hasPermission(Jenkins.ADMINISTER)) {
        return new ListBoxModel();
    }

    List<StandardCredentials> credentials =
            CredentialsProvider.lookupCredentials(StandardCredentials.class,
                    context,
                    ACL.SYSTEM,
                    Collections.emptyList());

    return new CredentialsListBoxModel()
            .includeEmptyValue()
            .withMatching(CredentialsMatchers.always(), credentials);
}
 

@RequirePOST
public ListBoxModel doFillKubernetesCredentialsIdItems() {
    Jenkins.get().checkPermission(Jenkins.ADMINISTER);
    return new StandardListBoxModel().withEmptySelection()
            .withMatching(
                    CredentialsMatchers.anyOf(
                            CredentialsMatchers.instanceOf(StandardUsernamePasswordCredentials.class),
                            CredentialsMatchers.instanceOf(FileCredentials.class),
                            CredentialsMatchers.instanceOf(TokenProducer.class),
                            CredentialsMatchers.instanceOf(StandardCertificateCredentials.class),
                            CredentialsMatchers.instanceOf(StringCredentials.class)),
                    CredentialsProvider.lookupCredentials(StandardCredentials.class,
                            Jenkins.get(),
                            ACL.SYSTEM,
                            Collections.EMPTY_LIST
                    ));
}
 

protected Void run() throws Exception {
    FilePath ws = getContext().get(FilePath.class);
    TaskListener listener = this.getContext().get(TaskListener.class);
    EnvVars envVars = getContext().get(EnvVars.class);
    WorkflowJob job = getContext().get(WorkflowJob.class);
    GitOperations gitOperations = new GitOperations(ws, listener, envVars, url);
    StandardCredentials c = CredentialsMatchers.firstOrNull(
            CredentialsProvider.lookupCredentials(
                    StandardCredentials.class,
                    job,
                    Tasks.getAuthenticationOf((Queue.Task) job)),
            CredentialsMatchers.withId(credentialId));

    gitOperations.setUsernameAndPasswordCredential((StandardUsernameCredentials) c);
    gitOperations.setCurrentBranch(branch);
    gitOperations.push(true);
    return null;
}
 

/**
 * Looks up the {@link StandardCredentials} to use for auto-management of hooks.
 *
 * @return the credentials or {@code null}.
 */
@CheckForNull
public StandardCredentials credentials() {
    return StringUtils.isBlank(credentialsId) ? null : CredentialsMatchers.firstOrNull(
            CredentialsProvider.lookupCredentials(
                    StandardCredentials.class,
                    Jenkins.get(),
                    ACL.SYSTEM,
                    URIRequirementBuilder.fromUri(serverUrl).build()
            ),
            CredentialsMatchers.allOf(
                    AuthenticationTokens.matcher(GiteaAuth.class),
                    CredentialsMatchers.withId(credentialsId)
            )
    );
}
 

/** {@inheritDoc} */
@Override
public void prune(RemoteConfig repository) throws GitException, InterruptedException {
    String repoName = repository.getName();
    String repoUrl = getRemoteUrl(repoName);
    if (repoUrl != null && !repoUrl.isEmpty()) {
        ArgumentListBuilder args = new ArgumentListBuilder();
        args.add("remote", "prune", repoName);

        StandardCredentials cred = credentials.get(repoUrl);
        if (cred == null) cred = defaultCredentials;

        try {
            launchCommandWithCredentials(args, workspace, cred, new URIish(repoUrl));
        } catch (URISyntaxException ex) {
            throw new GitException("Invalid URL " + repoUrl, ex);
        }
    }
}
 

/**
 * Stapler form completion.
 *
 * @param serverUrl the server URL.
 * @param credentialsId the credentials Id
 * @return the available credentials.
 */
@Restricted(NoExternalUse.class) // stapler
@SuppressWarnings("unused")
public ListBoxModel doFillCredentialsIdItems(@QueryParameter String serverUrl,
    @QueryParameter String credentialsId) {
    Jenkins jenkins = Jenkins.get();
    if (!jenkins.hasPermission(Jenkins.ADMINISTER)) {
        return new StandardListBoxModel().includeCurrentValue(credentialsId);
    }
    return new StandardListBoxModel()
        .includeEmptyValue()
        .includeMatchingAs(ACL.SYSTEM,
            jenkins,
            StandardCredentials.class,
            fromUri(serverUrl).build(),
            CREDENTIALS_MATCHER
        );
}
 

/** {@inheritDoc} */
@Override
public ObjectId getHeadRev(String url, String branchSpec) throws GitException, InterruptedException {
    final String branchName = extractBranchNameFromBranchSpec(branchSpec);
    ArgumentListBuilder args = new ArgumentListBuilder("ls-remote");
    if(!branchName.startsWith("refs/tags/")) {
        args.add("-h");
    }

    StandardCredentials cred = credentials.get(url);
    if (cred == null) cred = defaultCredentials;

    addCheckedRemoteUrl(args, url);

    if (branchName.startsWith("refs/tags/")) {
        args.add(branchName+"^{}"); // JENKINS-23299 - tag SHA1 needs to be converted to commit SHA1
    } else {
        args.add(branchName);
    }
    String result = launchCommandWithCredentials(args, null, cred, url);
    return result.length()>=40 ? ObjectId.fromString(result.substring(0, 40)) : null;
}
 

/** {@inheritDoc} */
@Override
public Map<String, ObjectId> getHeadRev(String url) throws GitException, InterruptedException {
    ArgumentListBuilder args = new ArgumentListBuilder("ls-remote");
    args.add("-h");
    addCheckedRemoteUrl(args, url);

    StandardCredentials cred = credentials.get(url);
    if (cred == null) cred = defaultCredentials;

    String result = launchCommandWithCredentials(args, null, cred, url);

    Map<String, ObjectId> heads = new HashMap<>();
    String[] lines = result.split("\n");
    for (String line : lines) {
        if (line.length() >= 41) {
            heads.put(line.substring(41), ObjectId.fromString(line.substring(0, 40)));
        } else {
            listener.getLogger().println("Unexpected ls-remote output line '" + line + "'");
        }
    }
    return heads;
}
 

/**
 * Stapler form completion.
 *
 * @param serverUrl the server URL.
 * @return the available credentials.
 */
@Restricted(NoExternalUse.class) // stapler
@SuppressWarnings("unused")
public ListBoxModel doFillCredentialsIdItems(@QueryParameter String serverUrl) {
    Jenkins.get().checkPermission(Jenkins.ADMINISTER);
    StandardListBoxModel result = new StandardListBoxModel();
    serverUrl = GiteaServers.normalizeServerUrl(serverUrl);
    result.includeMatchingAs(
            ACL.SYSTEM,
            Jenkins.get(),
            StandardCredentials.class,
            URIRequirementBuilder.fromUri(serverUrl).build(),
            AuthenticationTokens.matcher(GiteaAuth.class)
    );
    return result;
}
 

private String getgApiKey() {
    StandardCredentials credentials = null;
    try {
        credentials = CredentialsMatchers.firstOrNull(
                lookupCredentials(StandardCredentials.class, (Item) null, ACL.SYSTEM, new ArrayList<DomainRequirement>()),
                CredentialsMatchers.withId(gApiKeyID));
    }
    catch (NullPointerException e) {
        throw new ConnectionException(SR.getString("api.key.not.set"));
    }
    if (credentials != null) {
        if (credentials instanceof StringCredentials) {
            return ((StringCredentials) credentials).getSecret().getPlainText();
        }
    }
    throw new IllegalStateException("Could not find Acunetix API Key ID: " + gApiKeyID);
}
 

@SuppressFBWarnings("NP_NULL_PARAM_DEREF")
public static ListBoxModel doFillCredentialsIdItems(
    final Item item, final String credentialsId, final String uri) {
  final StandardListBoxModel result = new StandardListBoxModel();
  if (item == null) {
    if (!Jenkins.getInstance().hasPermission(Jenkins.ADMINISTER)) {
      return result.includeCurrentValue(credentialsId);
    }
  } else {
    if (!item.hasPermission(Item.EXTENDED_READ)
        && !item.hasPermission(CredentialsProvider.USE_ITEM)) {
      return result.includeCurrentValue(credentialsId);
    }
  }
  return result //
      .includeEmptyValue() //
      .includeMatchingAs(
          item instanceof Queue.Task ? Tasks.getAuthenticationOf((Queue.Task) item) : ACL.SYSTEM,
          item,
          StandardCredentials.class,
          URIRequirementBuilder.fromUri(uri).build(),
          CredentialsMatchers.anyOf(
              CredentialsMatchers.instanceOf(StandardUsernamePasswordCredentials.class),
              CredentialsMatchers.instanceOf(StringCredentials.class)))
      .includeCurrentValue(credentialsId);
}
 

public static Optional<StandardCredentials> findCredentials(
    final Item item, final String credentialsId, final String uri) {
  if (isNullOrEmpty(credentialsId)) {
    return absent();
  }
  return fromNullable(
      CredentialsMatchers.firstOrNull(
          CredentialsProvider.lookupCredentials(
              StandardCredentials.class,
              item,
              item instanceof Queue.Task
                  ? Tasks.getAuthenticationOf((Queue.Task) item)
                  : ACL.SYSTEM,
              URIRequirementBuilder.fromUri(uri).build()),
          CredentialsMatchers.allOf(
              CredentialsMatchers.withId(credentialsId),
              CredentialsMatchers.anyOf(
                  CredentialsMatchers.instanceOf(StandardUsernamePasswordCredentials.class),
                  CredentialsMatchers.instanceOf(StringCredentials.class)))));
}
 

protected StandardCredentials getCredentialForCurrentRequest() {
    final StaplerRequest request = getStaplerRequest();

    String credentialId = null;

    if (request.hasParameter("credentialId")) {
        credentialId = request.getParameter("credentialId");
    } else {
        if (!request.hasParameter("repositoryUrl")) {
            // No linked credential unless a specific repo
            return null;
        }

        String repositoryUrl = request.getParameter("repositoryUrl");
        credentialId = makeCredentialId(repositoryUrl);
    }

    if (credentialId == null) {
        return null;
    }

    return CredentialsUtils.findCredential(credentialId, StandardCredentials.class, new BlueOceanDomainRequirement());
}
 

@Override
protected List<Error> validate(String name, BlueScmConfig scmConfig) {
    List<Error> errors = Lists.newArrayList();
    if (scmConfig.getUri() == null) {
        errors.add(new ErrorMessage.Error("scmConfig.uri", ErrorMessage.Error.ErrorCodes.MISSING.toString(), "uri is required"));
    }else {
        StandardCredentials credentials = null;
        String credentialId = computeCredentialId(scmConfig);
        if(credentialId != null){
            credentials = GitUtils.getCredentials(Jenkins.getInstance(), scmConfig.getUri(), credentialId);
            if (credentials == null) {
                errors.add(new ErrorMessage.Error("scmConfig.credentialId",
                    ErrorMessage.Error.ErrorCodes.NOT_FOUND.toString(),
                    String.format("credentialId: %s not found", credentialId)));
            }
        }
        //validate credentials if no credential id (perhaps git repo doesn't need auth or credentials is present)
        if(credentialId == null || credentials != null) {
            errors.addAll(GitUtils.validateCredentials(scmConfig.getUri(), credentials));
        }
    }
    return errors;
}
 

@CheckForNull
StandardCredentials getCredential() {
    StandardCredentials credential = null;

    User user = User.current();
    if (user == null) {
        throw new ServiceException.UnauthorizedException("Not authenticated");
    }

    // Get committer info and credentials
    if (GitUtils.isSshUrl(gitSource.getRemote()) || GitUtils.isLocalUnixFileUrl(gitSource.getRemote())) {
        credential = UserSSHKeyManager.getOrCreate(user);
    } else {
        String credentialId = GitScm.makeCredentialId(gitSource.getRemote());

        if (credentialId != null) {
            credential = CredentialsUtils.findCredential(credentialId,
                                                         StandardCredentials.class,
                                                         new BlueOceanDomainRequirement());
        }
    }
    return credential;
}
 

@SuppressFBWarnings("NP_NULL_PARAM_DEREF")
public static ListBoxModel doFillCredentialsIdItems(
    final Item item, final String credentialsId, final String uri) {
  final StandardListBoxModel result = new StandardListBoxModel();
  if (item == null) {
    if (!Jenkins.getInstance().hasPermission(Jenkins.ADMINISTER)) {
      return result.includeCurrentValue(credentialsId);
    }
  } else {
    if (!item.hasPermission(Item.EXTENDED_READ)
        && !item.hasPermission(CredentialsProvider.USE_ITEM)) {
      return result.includeCurrentValue(credentialsId);
    }
  }
  return result //
      .includeEmptyValue() //
      .includeMatchingAs(
          item instanceof Queue.Task ? Tasks.getAuthenticationOf((Queue.Task) item) : ACL.SYSTEM,
          item,
          StandardCredentials.class,
          URIRequirementBuilder.fromUri(uri).build(),
          CredentialsMatchers.anyOf(
              CredentialsMatchers.instanceOf(StandardUsernamePasswordCredentials.class),
              CredentialsMatchers.instanceOf(StringCredentials.class)))
      .includeCurrentValue(credentialsId);
}
 

public static Optional<StandardCredentials> findCredentials(
    final Item item, final String credentialsId, final String uri) {
  if (isNullOrEmpty(credentialsId)) {
    return absent();
  }
  return fromNullable(
      CredentialsMatchers.firstOrNull(
          CredentialsProvider.lookupCredentials(
              StandardCredentials.class,
              item,
              item instanceof Queue.Task
                  ? Tasks.getAuthenticationOf((Queue.Task) item)
                  : ACL.SYSTEM,
              URIRequirementBuilder.fromUri(uri).build()),
          CredentialsMatchers.allOf(
              CredentialsMatchers.withId(credentialsId),
              CredentialsMatchers.anyOf(
                  CredentialsMatchers.instanceOf(StandardUsernamePasswordCredentials.class),
                  CredentialsMatchers.instanceOf(StringCredentials.class)))));
}
 

public static ListBoxModel doFillCredentialsIDItems(@AncestorInPath Jenkins context) {
    if (context == null || !context.hasPermission(Item.CONFIGURE)) {
        return new StandardListBoxModel();
    }

    List<DomainRequirement> domainRequirements = new ArrayList<DomainRequirement>();
    return new StandardListBoxModel()
            .withEmptySelection()
            .withMatching(
                    CredentialsMatchers.anyOf(
                            CredentialsMatchers.instanceOf(ConduitCredentials.class)),
                    CredentialsProvider.lookupCredentials(
                            StandardCredentials.class,
                            context,
                            ACL.SYSTEM,
                            domainRequirements));
}
 

@Restricted(NoExternalUse.class)
private String getApiToken(String apiTokenId, Item item) {
    ItemGroup<?> context = null != item ? item.getParent() : Jenkins.get();
    StandardCredentials credentials = CredentialsMatchers.firstOrNull(
        lookupCredentials(
                StandardCredentials.class,
                context, 
                ACL.SYSTEM,
                URIRequirementBuilder.fromUri(url).build()),
        CredentialsMatchers.withId(apiTokenId));
    if (credentials != null) {
        if (credentials instanceof GitLabApiToken) {
            return ((GitLabApiToken) credentials).getApiToken().getPlainText();
        }
        if (credentials instanceof StringCredentials) {
            return ((StringCredentials) credentials).getSecret().getPlainText();
        }
    }
    throw new IllegalStateException("No credentials found for credentialsId: " + apiTokenId);
}
 

/**
 * {@inheritDoc}
 */
@Override
public void afterSave(@NonNull SCMNavigatorOwner owner) {
    GitHubWebHook.get().registerHookFor(owner);
    try {
        // FIXME MINOR HACK ALERT
        StandardCredentials credentials = Connector.lookupScanCredentials((Item)owner, getApiUri(), credentialsId);
        GitHub hub = Connector.connect(getApiUri(), credentials);
        try {
            GitHubOrgWebHook.register(hub, repoOwner);
        } finally {
            Connector.release(hub);
        }
    } catch (IOException e) {
        DescriptorImpl.LOGGER.log(Level.WARNING, e.getMessage(), e);
    }
}
 

/** {@inheritDoc} */
@Override
public synchronized boolean supports(CredentialItem... credentialItems) {
    items:
    for (CredentialItem item : credentialItems) {
        if (supports(defaultCredentials, item)) {
            continue;
        }
        for (StandardCredentials c : specificCredentials.values()) {
            if (supports(c, item)) {
                continue items;
            }
        }
        return false;
    }
    return true;
}
 

/**
 * Resolves the specified scan credentials in the specified context for use against the specified API endpoint.
 *
 * @param context           the context.
 * @param apiUri            the API endpoint.
 * @param scanCredentialsId the credentials to resolve.
 * @return the {@link StandardCredentials} or {@code null}
 */
@CheckForNull
public static StandardCredentials lookupScanCredentials(@CheckForNull Item context,
                                                        @CheckForNull String apiUri,
                                                        @CheckForNull String scanCredentialsId) {
    if (Util.fixEmpty(scanCredentialsId) == null) {
        return null;
    } else {
        return CredentialsMatchers.firstOrNull(
            CredentialsProvider.lookupCredentials(
                StandardUsernameCredentials.class,
                context,
                context instanceof Queue.Task
                        ? ((Queue.Task) context).getDefaultAuthentication()
                        : ACL.SYSTEM,
                githubDomainRequirements(apiUri)
            ),
            CredentialsMatchers.allOf(CredentialsMatchers.withId(scanCredentialsId), githubScanCredentialsMatcher())
        );
    }
}
 

public static void checkApiUrlValidity(@Nonnull GitHub gitHub, @CheckForNull StandardCredentials credentials) throws IOException {
    String hash;
    if (credentials == null) {
        hash = "anonymous";
    } else if (credentials instanceof StandardUsernamePasswordCredentials) {
        StandardUsernamePasswordCredentials c = (StandardUsernamePasswordCredentials) credentials;
        hash = Util.getDigestOf(c.getPassword().getPlainText() + SALT);
    } else {
        // TODO OAuth support
        throw new IOException("Unsupported credential type: " + credentials.getClass().getName());
    }
    String key = gitHub.getApiUrl() + "::" + hash;
    synchronized (apiUrlValid) {
        Long last = apiUrlValid.get(key);
        if (last != null && last > System.currentTimeMillis() - API_URL_REVALIDATE_MILLIS) {
            return;
        }
        gitHub.checkApiUrlValidity();
        apiUrlValid.put(key, System.currentTimeMillis());
    }
}
 

public ListBoxModel doFillCredentialsIdItems(@AncestorInPath Item item) {
    if (item == null && !Jenkins.getActiveInstance().hasPermission(Jenkins.ADMINISTER) ||
        item != null && !item.hasPermission(Item.EXTENDED_READ)) {
        return new StandardListBoxModel();
    }
    // TODO may also need to specify a specific authentication and domain requirements
    return new StandardListBoxModel()
            .withEmptySelection()
            .withMatching(AuthenticationTokens.matcher(DockerRegistryToken.class),
                    CredentialsProvider.lookupCredentials(
                            StandardCredentials.class,
                            item,
                            null,
                            Collections.<DomainRequirement>emptyList()
                    )
            );
}
 

@RequirePOST
@SuppressWarnings("unused") // used by jelly
public ListBoxModel doFillCredentialsIdItems(@AncestorInPath ItemGroup context, @QueryParameter String serverUrl) {
    Jenkins.get().checkPermission(Jenkins.ADMINISTER);
    StandardListBoxModel result = new StandardListBoxModel();
    result.includeEmptyValue();
    result.includeMatchingAs(
        ACL.SYSTEM,
        context,
        StandardCredentials.class,
        serverUrl != null ? URIRequirementBuilder.fromUri(serverUrl).build()
                    : Collections.EMPTY_LIST,
        CredentialsMatchers.anyOf(
            AuthenticationTokens.matcher(KubernetesAuth.class)
        )
    );
    return result;
}
 

@CheckForNull
private static StandardCredentials resolveCredentials(@CheckForNull String credentialsId) {
    if (credentialsId == null) {
        return null;
    }
    return CredentialsMatchers.firstOrNull(
            CredentialsProvider.lookupCredentials(
                    StandardCredentials.class,
                    Jenkins.get(),
                    ACL.SYSTEM,
                    Collections.emptyList()
            ),
            CredentialsMatchers.allOf(
                    AuthenticationTokens.matcher(KubernetesAuth.class),
                    CredentialsMatchers.withId(credentialsId)
            )
    );
}
 

public static void fetch(final Repository repo, final StandardCredentials credential) {
    try (org.eclipse.jgit.api.Git git = new org.eclipse.jgit.api.Git(repo)) {
        FetchCommand fetchCommand = git.fetch();

        addCredential(repo, fetchCommand, credential);

        fetchCommand.setRemote("origin")
            .setRemoveDeletedRefs(true)
            .setRefSpecs(new RefSpec("+refs/heads/*:refs/remotes/origin/*"))
            .call();
    } catch (GitAPIException ex) {
        if (ex.getMessage().contains("Auth fail")) {
            throw new ServiceException.UnauthorizedException("Not authorized", ex);
        }
        throw new RuntimeException(ex);
    }
}
 

public LazyContributorNames(GitHubSCMSourceRequest request,
                            TaskListener listener, GitHub github, GHRepository repo,
                            StandardCredentials credentials) {
    this.request = request;
    this.listener = listener;
    this.github = github;
    this.repo = repo;
    this.credentials = credentials;
}
 

@Override
public GHPermissionType fetch(String username) throws IOException, InterruptedException {
    if (repo == null) {
        listener.getLogger().format("Connecting to %s to check permissions of obtain list of %s for %s/%s%n",
                apiUri, username, repoOwner, repository);
        StandardCredentials credentials = Connector.lookupScanCredentials(
                (Item) getOwner(), apiUri, credentialsId
        );
        github = Connector.connect(apiUri, credentials);
        String fullName = repoOwner + "/" + repository;
        repo = github.getRepository(fullName);
    }
    return repo.getPermission(username);
}
 

public FormValidation doCheckCredentialsId(@AncestorInPath SCMSourceOwner context,
                                           @QueryParameter String serverUrl,
                                           @QueryParameter String value)
        throws IOException, InterruptedException {
    if (context == null) {
        if (!Jenkins.get().hasPermission(Jenkins.ADMINISTER)) {
            return FormValidation.ok();
        }
    } else {
        if (!context.hasPermission(Item.EXTENDED_READ)
                && !context.hasPermission(CredentialsProvider.USE_ITEM)) {
            return FormValidation.ok();
        }
    }
    GiteaServer server = GiteaServers.get().findServer(serverUrl);
    if (server == null) {
        return FormValidation.ok();
    }
    if (StringUtils.isBlank(value)) {
        return FormValidation.ok();
    }
    if (CredentialsProvider.listCredentials(
            StandardCredentials.class,
            context,
            context instanceof Queue.Task ?
                    ((Queue.Task) context).getDefaultAuthentication()
                    : ACL.SYSTEM,
            URIRequirementBuilder.fromUri(serverUrl).build(),
            CredentialsMatchers.allOf(
                    CredentialsMatchers.withId(value),
                    AuthenticationTokens.matcher(GiteaAuth.class)

            )).isEmpty()) {
        return FormValidation.error(Messages.GiteaSCMNavigator_selectedCredentialsMissing());
    }
    return FormValidation.ok();
}