Commit 97f966c4 authored by Tomasz Maczukin's avatar Tomasz Maczukin

Introduce :read_namespace access policy for namespace and group

parent dfbfd3c7
...@@ -34,6 +34,8 @@ class GroupPolicy < BasePolicy ...@@ -34,6 +34,8 @@ class GroupPolicy < BasePolicy
rule { admin } .enable :read_group rule { admin } .enable :read_group
rule { has_projects } .enable :read_group rule { has_projects } .enable :read_group
rule { has_access }.enable :read_namespace
rule { developer }.enable :admin_milestones rule { developer }.enable :admin_milestones
rule { reporter }.enable :admin_label rule { reporter }.enable :admin_label
......
...@@ -8,6 +8,7 @@ class NamespacePolicy < BasePolicy ...@@ -8,6 +8,7 @@ class NamespacePolicy < BasePolicy
rule { owner | admin }.policy do rule { owner | admin }.policy do
enable :create_projects enable :create_projects
enable :admin_namespace enable :admin_namespace
enable :read_namespace
end end
rule { personal_project & ~can_create_personal_project }.prevent :create_projects rule { personal_project & ~can_create_personal_project }.prevent :create_projects
......
...@@ -127,7 +127,7 @@ module API ...@@ -127,7 +127,7 @@ module API
def find_namespace!(id) def find_namespace!(id)
namespace = find_namespace(id) namespace = find_namespace(id)
if can?(current_user, :admin_namespace, namespace) if can?(current_user, :read_namespace, namespace)
namespace namespace
else else
not_found!('Namespace') not_found!('Namespace')
......
...@@ -94,6 +94,7 @@ describe API::Namespaces do ...@@ -94,6 +94,7 @@ describe API::Namespaces do
describe 'GET /namespaces/:id' do describe 'GET /namespaces/:id' do
let(:owned_group) { group1 } let(:owned_group) { group1 }
let(:user2) { create(:user) }
shared_examples 'can access namespace' do shared_examples 'can access namespace' do
it 'returns namespace details' do it 'returns namespace details' do
...@@ -116,16 +117,34 @@ describe API::Namespaces do ...@@ -116,16 +117,34 @@ describe API::Namespaces do
context 'when namespace exists' do context 'when namespace exists' do
context 'when requested by ID' do context 'when requested by ID' do
context 'when requesting group' do
let(:namespace_id) { owned_group.id } let(:namespace_id) { owned_group.id }
it_behaves_like 'can access namespace' it_behaves_like 'can access namespace'
end end
context 'when requesting personal namespace' do
let(:namespace_id) { request_actor.namespace.id }
let(:requested_namespace) { request_actor.namespace }
it_behaves_like 'can access namespace'
end
end
context 'when requested by path' do context 'when requested by path' do
context 'when requesting group' do
let(:namespace_id) { owned_group.path } let(:namespace_id) { owned_group.path }
it_behaves_like 'can access namespace' it_behaves_like 'can access namespace'
end end
context 'when requesting personal namespace' do
let(:namespace_id) { request_actor.namespace.path }
let(:requested_namespace) { request_actor.namespace }
it_behaves_like 'can access namespace'
end
end
end end
context "when namespace doesn't exist" do context "when namespace doesn't exist" do
...@@ -149,6 +168,7 @@ describe API::Namespaces do ...@@ -149,6 +168,7 @@ describe API::Namespaces do
let(:request_actor) { user } let(:request_actor) { user }
context 'when requested namespace is not owned by user' do context 'when requested namespace is not owned by user' do
context 'when requesting group' do
it 'returns not-found' do it 'returns not-found' do
get api("/namespaces/#{group2.id}", request_actor) get api("/namespaces/#{group2.id}", request_actor)
...@@ -156,6 +176,15 @@ describe API::Namespaces do ...@@ -156,6 +176,15 @@ describe API::Namespaces do
end end
end end
context 'when requesting personal namespace' do
it 'returns not-found' do
get api("/namespaces/#{user2.namespace.id}", request_actor)
expect(response).to have_gitlab_http_status(404)
end
end
end
context 'when requested namespace is owned by user' do context 'when requested namespace is owned by user' do
it_behaves_like 'namespace reader' it_behaves_like 'namespace reader'
end end
...@@ -165,12 +194,21 @@ describe API::Namespaces do ...@@ -165,12 +194,21 @@ describe API::Namespaces do
let(:request_actor) { admin } let(:request_actor) { admin }
context 'when requested namespace is not owned by user' do context 'when requested namespace is not owned by user' do
context 'when requesting group' do
let(:namespace_id) { group2.id } let(:namespace_id) { group2.id }
let(:requested_namespace) { group2 } let(:requested_namespace) { group2 }
it_behaves_like 'can access namespace' it_behaves_like 'can access namespace'
end end
context 'when requesting personal namespace' do
let(:namespace_id) { user2.namespace.id }
let(:requested_namespace) { user2.namespace }
it_behaves_like 'can access namespace'
end
end
context 'when requested namespace is owned by user' do context 'when requested namespace is owned by user' do
it_behaves_like 'namespace reader' it_behaves_like 'namespace reader'
end end
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment