2016-08-23 23:19:36 +00:00
|
|
|
require 'spec_helper'
|
|
|
|
|
2017-07-10 14:24:02 +00:00
|
|
|
describe ProjectPolicy do
|
2016-08-23 23:19:36 +00:00
|
|
|
let(:guest) { create(:user) }
|
|
|
|
let(:reporter) { create(:user) }
|
|
|
|
let(:dev) { create(:user) }
|
|
|
|
let(:master) { create(:user) }
|
|
|
|
let(:owner) { create(:user) }
|
2016-10-17 15:23:51 +00:00
|
|
|
let(:admin) { create(:admin) }
|
2017-08-02 19:55:11 +00:00
|
|
|
let(:project) { create(:project, :public, namespace: owner.namespace) }
|
2016-08-23 23:19:36 +00:00
|
|
|
|
2016-09-21 05:09:31 +00:00
|
|
|
let(:guest_permissions) do
|
2017-02-06 23:19:37 +00:00
|
|
|
%i[
|
|
|
|
read_project read_board read_list read_wiki read_issue read_label
|
|
|
|
read_milestone read_project_snippet read_project_member
|
|
|
|
read_note create_project create_issue create_note
|
|
|
|
upload_file
|
2016-09-21 05:09:31 +00:00
|
|
|
]
|
2016-08-23 23:19:36 +00:00
|
|
|
end
|
|
|
|
|
2016-09-21 05:09:31 +00:00
|
|
|
let(:reporter_permissions) do
|
2017-02-06 23:19:37 +00:00
|
|
|
%i[
|
|
|
|
download_code fork_project create_project_snippet update_issue
|
|
|
|
admin_issue admin_label admin_list read_commit_status read_build
|
|
|
|
read_container_image read_pipeline read_environment read_deployment
|
|
|
|
read_merge_request download_wiki_code
|
2016-09-21 05:09:31 +00:00
|
|
|
]
|
|
|
|
end
|
|
|
|
|
|
|
|
let(:team_member_reporter_permissions) do
|
2017-02-06 23:19:37 +00:00
|
|
|
%i[build_download_code build_read_container_image]
|
2016-09-21 05:09:31 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
let(:developer_permissions) do
|
2017-02-06 23:19:37 +00:00
|
|
|
%i[
|
|
|
|
admin_merge_request update_merge_request create_commit_status
|
|
|
|
update_commit_status create_build update_build create_pipeline
|
|
|
|
update_pipeline create_merge_request create_wiki push_code
|
|
|
|
resolve_note create_container_image update_container_image
|
|
|
|
create_environment create_deployment
|
2016-09-21 05:09:31 +00:00
|
|
|
]
|
|
|
|
end
|
|
|
|
|
|
|
|
let(:master_permissions) do
|
2017-02-06 23:19:37 +00:00
|
|
|
%i[
|
2017-05-08 07:41:58 +00:00
|
|
|
delete_protected_branch update_project_snippet update_environment
|
2017-02-06 23:19:37 +00:00
|
|
|
update_deployment admin_milestone admin_project_snippet
|
|
|
|
admin_project_member admin_note admin_wiki admin_project
|
|
|
|
admin_commit_status admin_build admin_container_image
|
|
|
|
admin_pipeline admin_environment admin_deployment
|
2016-09-21 05:09:31 +00:00
|
|
|
]
|
|
|
|
end
|
|
|
|
|
|
|
|
let(:public_permissions) do
|
2017-02-06 23:19:37 +00:00
|
|
|
%i[
|
|
|
|
download_code fork_project read_commit_status read_pipeline
|
|
|
|
read_container_image build_download_code build_read_container_image
|
|
|
|
download_wiki_code
|
2016-09-21 05:09:31 +00:00
|
|
|
]
|
|
|
|
end
|
|
|
|
|
|
|
|
let(:owner_permissions) do
|
2017-02-06 23:19:37 +00:00
|
|
|
%i[
|
|
|
|
change_namespace change_visibility_level rename_project remove_project
|
|
|
|
archive_project remove_fork_project destroy_merge_request destroy_issue
|
2016-09-21 05:09:31 +00:00
|
|
|
]
|
2016-08-23 23:19:36 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
before do
|
|
|
|
project.team << [guest, :guest]
|
|
|
|
project.team << [master, :master]
|
|
|
|
project.team << [dev, :developer]
|
|
|
|
project.team << [reporter, :reporter]
|
|
|
|
end
|
2016-09-19 20:21:58 +00:00
|
|
|
|
2017-04-06 21:09:58 +00:00
|
|
|
def expect_allowed(*permissions)
|
|
|
|
permissions.each { |p| is_expected.to be_allowed(p) }
|
|
|
|
end
|
|
|
|
|
|
|
|
def expect_disallowed(*permissions)
|
|
|
|
permissions.each { |p| is_expected.not_to be_allowed(p) }
|
|
|
|
end
|
|
|
|
|
2016-09-19 20:21:58 +00:00
|
|
|
it 'does not include the read_issue permission when the issue author is not a member of the private project' do
|
2017-08-02 19:55:11 +00:00
|
|
|
project = create(:project, :private)
|
2016-09-19 20:21:58 +00:00
|
|
|
issue = create(:issue, project: project)
|
|
|
|
user = issue.author
|
|
|
|
|
2017-04-06 21:09:58 +00:00
|
|
|
expect(project.team.member?(issue.author)).to be false
|
2016-09-19 20:21:58 +00:00
|
|
|
|
2017-04-06 21:09:58 +00:00
|
|
|
expect(Ability).not_to be_allowed(user, :read_issue, project)
|
2016-09-19 20:21:58 +00:00
|
|
|
end
|
2016-09-21 05:09:31 +00:00
|
|
|
|
2017-04-06 21:09:58 +00:00
|
|
|
context 'when the feature is disabled' do
|
|
|
|
subject { described_class.new(owner, project) }
|
2016-11-29 19:30:14 +00:00
|
|
|
|
2017-04-06 21:09:58 +00:00
|
|
|
before do
|
|
|
|
project.project_feature.update_attribute(:wiki_access_level, ProjectFeature::DISABLED)
|
|
|
|
end
|
2016-11-29 19:30:14 +00:00
|
|
|
|
2017-04-06 21:09:58 +00:00
|
|
|
it 'does not include the wiki permissions' do
|
|
|
|
expect_disallowed :read_wiki, :create_wiki, :update_wiki, :admin_wiki, :download_wiki_code
|
|
|
|
end
|
2016-11-29 19:30:14 +00:00
|
|
|
end
|
|
|
|
|
2017-06-13 08:25:25 +00:00
|
|
|
context 'issues feature' do
|
|
|
|
subject { described_class.new(owner, project) }
|
|
|
|
|
|
|
|
context 'when the feature is disabled' do
|
|
|
|
it 'does not include the issues permissions' do
|
|
|
|
project.issues_enabled = false
|
|
|
|
project.save!
|
|
|
|
|
|
|
|
expect_disallowed :read_issue, :create_issue, :update_issue, :admin_issue
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when the feature is disabled and external tracker configured' do
|
|
|
|
it 'does not include the issues permissions' do
|
|
|
|
create(:jira_service, project: project)
|
|
|
|
|
|
|
|
project.issues_enabled = false
|
|
|
|
project.save!
|
|
|
|
|
|
|
|
expect_disallowed :read_issue, :create_issue, :update_issue, :admin_issue
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2017-07-24 10:35:54 +00:00
|
|
|
context 'when a project has pending invites, and the current user is anonymous' do
|
|
|
|
let(:group) { create(:group, :public) }
|
2017-08-02 19:55:11 +00:00
|
|
|
let(:project) { create(:project, :public, namespace: group) }
|
2017-07-24 10:35:54 +00:00
|
|
|
let(:user_permissions) { [:create_project, :create_issue, :create_note, :upload_file] }
|
|
|
|
let(:anonymous_permissions) { guest_permissions - user_permissions }
|
|
|
|
|
|
|
|
subject { described_class.new(nil, project) }
|
|
|
|
|
|
|
|
before do
|
|
|
|
create(:group_member, :invited, group: group)
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'does not grant owner access' do
|
|
|
|
expect_allowed(*anonymous_permissions)
|
|
|
|
expect_disallowed(*user_permissions)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2016-09-21 05:09:31 +00:00
|
|
|
context 'abilities for non-public projects' do
|
2017-08-02 19:55:11 +00:00
|
|
|
let(:project) { create(:project, namespace: owner.namespace) }
|
2016-09-21 05:09:31 +00:00
|
|
|
|
2017-04-06 21:09:58 +00:00
|
|
|
subject { described_class.new(current_user, project) }
|
2016-09-21 05:09:31 +00:00
|
|
|
|
|
|
|
context 'with no user' do
|
|
|
|
let(:current_user) { nil }
|
|
|
|
|
2017-04-06 21:09:58 +00:00
|
|
|
it { is_expected.to be_banned }
|
2016-09-21 05:09:31 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
context 'guests' do
|
|
|
|
let(:current_user) { guest }
|
|
|
|
|
2016-11-29 12:43:58 +00:00
|
|
|
let(:reporter_public_build_permissions) do
|
|
|
|
reporter_permissions - [:read_build, :read_pipeline]
|
|
|
|
end
|
|
|
|
|
|
|
|
it do
|
2017-04-06 21:09:58 +00:00
|
|
|
expect_allowed(*guest_permissions)
|
|
|
|
expect_disallowed(*reporter_public_build_permissions)
|
|
|
|
expect_disallowed(*team_member_reporter_permissions)
|
|
|
|
expect_disallowed(*developer_permissions)
|
|
|
|
expect_disallowed(*master_permissions)
|
|
|
|
expect_disallowed(*owner_permissions)
|
2016-11-29 12:43:58 +00:00
|
|
|
end
|
2016-10-13 07:38:03 +00:00
|
|
|
|
2016-11-29 12:43:58 +00:00
|
|
|
context 'public builds enabled' do
|
2016-10-13 07:38:03 +00:00
|
|
|
it do
|
2017-04-06 21:09:58 +00:00
|
|
|
expect_allowed(*guest_permissions)
|
|
|
|
expect_allowed(:read_build, :read_pipeline)
|
2016-10-13 07:38:03 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'public builds disabled' do
|
|
|
|
before do
|
2016-11-29 12:43:58 +00:00
|
|
|
project.update(public_builds: false)
|
2016-10-13 07:38:03 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
it do
|
2017-04-06 21:09:58 +00:00
|
|
|
expect_allowed(*guest_permissions)
|
|
|
|
expect_disallowed(:read_build, :read_pipeline)
|
2016-10-13 07:38:03 +00:00
|
|
|
end
|
2016-09-21 05:09:31 +00:00
|
|
|
end
|
2017-06-07 10:32:16 +00:00
|
|
|
|
|
|
|
context 'when builds are disabled' do
|
|
|
|
before do
|
|
|
|
project.project_feature.update(
|
|
|
|
builds_access_level: ProjectFeature::DISABLED)
|
|
|
|
end
|
|
|
|
|
|
|
|
it do
|
2017-04-06 21:06:42 +00:00
|
|
|
expect_disallowed(:read_build)
|
|
|
|
expect_allowed(:read_pipeline)
|
2017-06-07 10:32:16 +00:00
|
|
|
end
|
|
|
|
end
|
2016-09-21 05:09:31 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
context 'reporter' do
|
|
|
|
let(:current_user) { reporter }
|
|
|
|
|
|
|
|
it do
|
2017-04-06 21:09:58 +00:00
|
|
|
expect_allowed(*guest_permissions)
|
|
|
|
expect_allowed(*reporter_permissions)
|
|
|
|
expect_allowed(*reporter_permissions)
|
|
|
|
expect_allowed(*team_member_reporter_permissions)
|
|
|
|
expect_disallowed(*developer_permissions)
|
|
|
|
expect_disallowed(*master_permissions)
|
|
|
|
expect_disallowed(*owner_permissions)
|
2016-09-21 05:09:31 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'developer' do
|
|
|
|
let(:current_user) { dev }
|
|
|
|
|
|
|
|
it do
|
2017-04-06 21:09:58 +00:00
|
|
|
expect_allowed(*guest_permissions)
|
|
|
|
expect_allowed(*reporter_permissions)
|
|
|
|
expect_allowed(*team_member_reporter_permissions)
|
|
|
|
expect_allowed(*developer_permissions)
|
|
|
|
expect_disallowed(*master_permissions)
|
|
|
|
expect_disallowed(*owner_permissions)
|
2016-09-21 05:09:31 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'master' do
|
|
|
|
let(:current_user) { master }
|
|
|
|
|
|
|
|
it do
|
2017-04-06 21:09:58 +00:00
|
|
|
expect_allowed(*guest_permissions)
|
|
|
|
expect_allowed(*reporter_permissions)
|
|
|
|
expect_allowed(*team_member_reporter_permissions)
|
|
|
|
expect_allowed(*developer_permissions)
|
|
|
|
expect_allowed(*master_permissions)
|
|
|
|
expect_disallowed(*owner_permissions)
|
2016-09-21 05:09:31 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'owner' do
|
|
|
|
let(:current_user) { owner }
|
|
|
|
|
2016-10-17 15:23:51 +00:00
|
|
|
it do
|
2017-04-06 21:09:58 +00:00
|
|
|
expect_allowed(*guest_permissions)
|
|
|
|
expect_allowed(*reporter_permissions)
|
|
|
|
expect_allowed(*team_member_reporter_permissions)
|
|
|
|
expect_allowed(*developer_permissions)
|
|
|
|
expect_allowed(*master_permissions)
|
|
|
|
expect_allowed(*owner_permissions)
|
2016-10-17 15:23:51 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'admin' do
|
|
|
|
let(:current_user) { admin }
|
|
|
|
|
2016-09-21 05:09:31 +00:00
|
|
|
it do
|
2017-04-06 21:09:58 +00:00
|
|
|
expect_allowed(*guest_permissions)
|
|
|
|
expect_allowed(*reporter_permissions)
|
|
|
|
expect_disallowed(*team_member_reporter_permissions)
|
|
|
|
expect_allowed(*developer_permissions)
|
|
|
|
expect_allowed(*master_permissions)
|
|
|
|
expect_allowed(*owner_permissions)
|
2016-09-21 05:09:31 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
2016-08-23 23:19:36 +00:00
|
|
|
end
|