2018-07-24 10:00:56 +00:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2016-08-16 20:08:14 +00:00
|
|
|
class ProjectSnippetPolicy < BasePolicy
|
2017-04-06 21:06:42 +00:00
|
|
|
delegate :project
|
|
|
|
|
|
|
|
desc "Snippet is public"
|
|
|
|
condition(:public_snippet, scope: :subject) { @subject.public? }
|
2018-12-18 16:18:09 +00:00
|
|
|
condition(:internal_snippet, scope: :subject) { @subject.internal? }
|
2017-04-06 21:06:42 +00:00
|
|
|
condition(:private_snippet, scope: :subject) { @subject.private? }
|
|
|
|
condition(:public_project, scope: :subject) { @subject.project.public? }
|
|
|
|
|
|
|
|
condition(:is_author) { @user && @subject.author == @user }
|
|
|
|
|
|
|
|
# We have to check both project feature visibility and a snippet visibility and take the stricter one
|
2019-09-18 14:02:45 +00:00
|
|
|
# This will be simplified - check https://gitlab.com/gitlab-org/gitlab-foss/issues/27573
|
2017-04-06 21:06:42 +00:00
|
|
|
rule { ~can?(:read_project) }.policy do
|
2020-01-23 12:08:38 +00:00
|
|
|
prevent :read_snippet
|
|
|
|
prevent :update_snippet
|
|
|
|
prevent :admin_snippet
|
2017-04-06 21:06:42 +00:00
|
|
|
end
|
|
|
|
|
2020-01-23 12:08:38 +00:00
|
|
|
# we have to use this complicated prevent because the delegated project
|
|
|
|
# policy is overly greedy in allowing :read_snippet, since it doesn't have
|
|
|
|
# any information about the snippet. However, :read_snippet on the *project*
|
|
|
|
# is used to hide/show various snippet-related controls, so we can't just
|
|
|
|
# move all of the handling here.
|
2017-04-06 21:06:42 +00:00
|
|
|
rule do
|
2018-12-18 16:18:09 +00:00
|
|
|
all?(private_snippet | (internal_snippet & external_user),
|
2017-04-06 21:06:42 +00:00
|
|
|
~project.guest,
|
2018-12-18 16:18:09 +00:00
|
|
|
~is_author,
|
2019-11-06 18:06:29 +00:00
|
|
|
~can?(:read_all_resources))
|
2020-01-23 12:08:38 +00:00
|
|
|
end.prevent :read_snippet
|
2017-04-06 21:06:42 +00:00
|
|
|
|
2020-02-25 00:09:12 +00:00
|
|
|
rule { internal_snippet & ~is_author & ~admin & ~project.maintainer }.policy do
|
2020-01-23 12:08:38 +00:00
|
|
|
prevent :update_snippet
|
|
|
|
prevent :admin_snippet
|
2017-04-06 21:06:42 +00:00
|
|
|
end
|
|
|
|
|
2020-01-23 12:08:38 +00:00
|
|
|
rule { public_snippet }.enable :read_snippet
|
2017-04-06 21:06:42 +00:00
|
|
|
|
2019-12-16 15:07:39 +00:00
|
|
|
rule { is_author & ~project.reporter & ~admin }.policy do
|
2020-01-23 12:08:38 +00:00
|
|
|
prevent :admin_snippet
|
2019-12-16 15:07:39 +00:00
|
|
|
end
|
|
|
|
|
2020-02-25 00:09:12 +00:00
|
|
|
rule { is_author | admin | project.maintainer }.policy do
|
2020-01-23 12:08:38 +00:00
|
|
|
enable :read_snippet
|
|
|
|
enable :update_snippet
|
|
|
|
enable :admin_snippet
|
2016-08-16 20:08:14 +00:00
|
|
|
end
|
2019-01-15 18:53:24 +00:00
|
|
|
|
2020-01-23 12:08:38 +00:00
|
|
|
rule { ~can?(:read_snippet) }.prevent :create_note
|
2016-08-16 20:08:14 +00:00
|
|
|
end
|
2019-09-13 13:26:31 +00:00
|
|
|
|
2021-05-11 21:10:21 +00:00
|
|
|
ProjectSnippetPolicy.prepend_mod_with('ProjectSnippetPolicy')
|