Commit f21b15d5 authored by Tomasz Maczukin's avatar Tomasz Maczukin

Limit projects to user available projects if user is not an admin

parent b58744cd
...@@ -388,7 +388,13 @@ module API ...@@ -388,7 +388,13 @@ module API
expose :version, :revision, :platform, :architecture expose :version, :revision, :platform, :architecture
expose :contacted_at, as: :last_contact expose :contacted_at, as: :last_contact
expose :token, if: lambda { |runner, options| options[:user_is_admin] || !runner.is_shared? } expose :token, if: lambda { |runner, options| options[:user_is_admin] || !runner.is_shared? }
expose :projects, with: Entities::RunnerProjectDetails expose :projects, with: Entities::RunnerProjectDetails do |runner, options|
if options[:user_is_admin]
runner.projects
else
runner.projects.where(id: options[:available_projects_ids])
end
end
end end
class Build < Grape::Entity class Build < Grape::Entity
......
...@@ -33,7 +33,11 @@ module API ...@@ -33,7 +33,11 @@ module API
runner = get_runner(params[:id]) runner = get_runner(params[:id])
authenticate_show_runner!(runner) authenticate_show_runner!(runner)
present runner, with: Entities::RunnerDetails, user_is_admin: current_user.is_admin? available_projects_ids = runner.projects.select{ |p| can?(current_user, :read_project, p) }
.map(&:id) unless current_user.is_admin?
present runner, with: Entities::RunnerDetails, user_is_admin: current_user.is_admin?,
available_projects_ids: available_projects_ids
end end
# Update runner's details # Update runner's details
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment