Commit 8b2fe985 authored by Mayra Cabrera's avatar Mayra Cabrera

Restrict multiple clusters through API

Modifies authorize! method to accept a third param, and then use it in
combination with 'add_cluster' policy to appropriately restrict adding
multiple clusters

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/56110
parent a0f77090
---
title: Improves restriction of multiple Kubernetes clusters through API
merge_request: 24251
author:
type: fixed
......@@ -235,8 +235,8 @@ module API
forbidden! unless current_user.admin?
end
def authorize!(action, subject = :global)
forbidden! unless can?(current_user, action, subject)
def authorize!(action, subject = :global, reason = nil)
forbidden!(reason) unless can?(current_user, action, subject)
end
def authorize_push_project
......
......@@ -63,7 +63,7 @@ module API
use :create_params_ee
end
post ':id/clusters/user' do
authorize! :create_cluster, user_project
authorize! :add_cluster, user_project, 'Instance does not support multiple Kubernetes clusters'
user_cluster = ::Clusters::CreateService
.new(current_user, create_cluster_user_params)
......
......@@ -266,6 +266,23 @@ describe API::ProjectClusters do
end
end
end
context 'when user tries to add multiple clusters' do
before do
create(:cluster, :provided_by_gcp, :project,
projects: [project])
post api("/projects/#{project.id}/clusters/user", current_user), params: cluster_params
end
it 'should respond with 403' do
expect(response).to have_gitlab_http_status(403)
end
it 'should return an appropriate message' do
expect(json_response['message']).to include('Instance does not support multiple Kubernetes clusters')
end
end
end
describe 'PUT /projects/:id/clusters/:cluster_id' do
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment