Add latest changes from gitlab-org/gitlab@13-9-stable-ee

app/models/concerns/protected_ref.rb

@@ -40,26 +40,20 @@ module ProtectedRef
     end
 
     def protected_ref_accessible_to?(ref, user, project:, action:, protected_refs: nil)
-      all_matching_rules_allow?(ref, action: action, protected_refs: protected_refs) do |access_level|
+      access_levels_for_ref(ref, action: action, protected_refs: protected_refs).any? do |access_level|
         access_level.check_access(user)
       end
     end
 
     def developers_can?(action, ref, protected_refs: nil)
-      all_matching_rules_allow?(ref, action: action, protected_refs: protected_refs) do |access_level|
+      access_levels_for_ref(ref, action: action, protected_refs: protected_refs).any? do |access_level|
         access_level.access_level == Gitlab::Access::DEVELOPER
       end
     end
 
-    def all_matching_rules_allow?(ref, action:, protected_refs: nil, &block)
-      access_levels_groups =
-        self.matching(ref, protected_refs: protected_refs).map(&:"#{action}_access_levels")
-
-      return false if access_levels_groups.blank?
-
-      access_levels_groups.all? do |access_levels|
-        access_levels.any?(&block)
-      end
+    def access_levels_for_ref(ref, action:, protected_refs: nil)
+      self.matching(ref, protected_refs: protected_refs)
+        .flat_map(&:"#{action}_access_levels")
     end
 
     # Returns all protected refs that match the given ref name.

changelogs/unreleased/id-restrict-protected-rules.yml

----
-title: Most restrictive protected branch rule takes precedence
-merge_request: 52319
-author:
-type: fixed

spec/models/concerns/protected_ref_spec.rb

-# frozen_string_literal: true
-
-require 'spec_helper'
-
-RSpec.describe ProtectedRef do
-  using RSpec::Parameterized::TableSyntax
-
-  let_it_be(:project) { create(:project, :repository) }
-  let_it_be(:user) { create(:user, maintainer_projects: [project]) }
-
-  where(:klass, :factory, :action) do
-    ProtectedBranch | :protected_branch | :push
-    ProtectedTag    | :protected_tag | :create
-  end
-
-  with_them do
-    describe '#protected_ref_accessible_to?' do
-      subject do
-        klass.protected_ref_accessible_to?('release', user, project: project, action: action)
-      end
-
-      it 'user cannot do action if rules do not exist' do
-        is_expected.to be_falsy
-      end
-
-      context 'the ref is protected' do
-        let!(:default_rule) { create(factory, :"developers_can_#{action}", project: project, name: 'release') }
-
-        context 'all rules permit action' do
-          let!(:maintainers_can) { create(factory, :"maintainers_can_#{action}", project: project, name: 'release*') }
-
-          it 'user can do action' do
-            is_expected.to be_truthy
-          end
-        end
-
-        context 'one of the rules forbids action' do
-          let!(:no_one_can) { create(factory, :"no_one_can_#{action}", project: project, name: 'release*') }
-
-          it 'user cannot do action' do
-            is_expected.to be_falsy
-          end
-        end
-      end
-    end
-
-    describe '#developers_can?' do
-      subject do
-        klass.developers_can?(action, 'release')
-      end
-
-      it 'developers cannot do action if rules do not exist' do
-        is_expected.to be_falsy
-      end
-
-      context 'the ref is protected' do
-        let!(:default_rule) { create(factory, :"developers_can_#{action}", project: project, name: 'release') }
-
-        context 'all rules permit developers to do action' do
-          let!(:developers_can) { create(factory, :"developers_can_#{action}", project: project, name: 'release*') }
-
-          it 'developers can do action' do
-            is_expected.to be_truthy
-          end
-        end
-
-        context 'one of the rules forbids developers to do action' do
-          let!(:maintainers_can) { create(factory, :"maintainers_can_#{action}", project: project, name: 'release*') }
-
-          it 'developers cannot do action' do
-            is_expected.to be_falsy
-          end
-        end
-      end
-    end
-  end
-end