Commit 4c7b7a84 authored by Rémy Coutable's avatar Rémy Coutable

Make ProjectSnippetPolicy EE-ready

Signed-off-by: default avatarRémy Coutable <remy@rymai.me>
parent 549ee8ad
...@@ -7,6 +7,10 @@ class BasePolicy < DeclarativePolicy::Base ...@@ -7,6 +7,10 @@ class BasePolicy < DeclarativePolicy::Base
with_options scope: :user, score: 0 with_options scope: :user, score: 0
condition(:admin) { @user&.admin? } condition(:admin) { @user&.admin? }
desc "User has access to all private groups & projects"
with_options scope: :user, score: 0
condition(:full_private_access) { @user&.full_private_access? }
with_options scope: :user, score: 0 with_options scope: :user, score: 0
condition(:external_user) { @user.nil? || @user.external? } condition(:external_user) { @user.nil? || @user.external? }
......
...@@ -5,13 +5,12 @@ class ProjectSnippetPolicy < BasePolicy ...@@ -5,13 +5,12 @@ class ProjectSnippetPolicy < BasePolicy
desc "Snippet is public" desc "Snippet is public"
condition(:public_snippet, scope: :subject) { @subject.public? } condition(:public_snippet, scope: :subject) { @subject.public? }
condition(:internal_snippet, scope: :subject) { @subject.internal? }
condition(:private_snippet, scope: :subject) { @subject.private? } condition(:private_snippet, scope: :subject) { @subject.private? }
condition(:public_project, scope: :subject) { @subject.project.public? } condition(:public_project, scope: :subject) { @subject.project.public? }
condition(:is_author) { @user && @subject.author == @user } condition(:is_author) { @user && @subject.author == @user }
condition(:internal, scope: :subject) { @subject.internal? }
# We have to check both project feature visibility and a snippet visibility and take the stricter one # We have to check both project feature visibility and a snippet visibility and take the stricter one
# This will be simplified - check https://gitlab.com/gitlab-org/gitlab-ce/issues/27573 # This will be simplified - check https://gitlab.com/gitlab-org/gitlab-ce/issues/27573
rule { ~can?(:read_project) }.policy do rule { ~can?(:read_project) }.policy do
...@@ -26,13 +25,13 @@ class ProjectSnippetPolicy < BasePolicy ...@@ -26,13 +25,13 @@ class ProjectSnippetPolicy < BasePolicy
# is used to hide/show various snippet-related controls, so we can't just move # is used to hide/show various snippet-related controls, so we can't just move
# all of the handling here. # all of the handling here.
rule do rule do
all?(private_snippet | (internal & external_user), all?(private_snippet | (internal_snippet & external_user),
~project.guest, ~project.guest,
~admin, ~is_author,
~is_author) ~full_private_access)
end.prevent :read_project_snippet end.prevent :read_project_snippet
rule { internal & ~is_author & ~admin }.policy do rule { internal_snippet & ~is_author & ~admin }.policy do
prevent :update_project_snippet prevent :update_project_snippet
prevent :admin_project_snippet prevent :admin_project_snippet
end end
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment