2016-07-18 08:16:56 +00:00
module Gitlab
module Checks
class ChangeAccess
2017-05-15 23:13:36 +00:00
ERROR_MESSAGES = {
push_code : 'You are not allowed to push code to this project.' ,
delete_default_branch : 'The default branch of a project cannot be deleted.' ,
force_push_protected_branch : 'You are not allowed to force push code to a protected branch on this project.' ,
2018-06-04 01:25:38 +00:00
non_master_delete_protected_branch : 'You are not allowed to delete protected branches from this project. Only a project maintainer or owner can delete a protected branch.' ,
2017-05-15 23:13:36 +00:00
non_web_delete_protected_branch : 'You can only delete protected branches using the web interface.' ,
merge_protected_branch : 'You are not allowed to merge code into protected branches on this project.' ,
push_protected_branch : 'You are not allowed to push code to protected branches on this project.' ,
change_existing_tags : 'You are not allowed to change existing tags on this project.' ,
update_protected_tag : 'Protected tags cannot be updated.' ,
delete_protected_tag : 'Protected tags cannot be deleted.' ,
2017-08-25 01:30:12 +00:00
create_protected_tag : 'You are not allowed to create this tag as it is protected.' ,
lfs_objects_missing : 'LFS objects are missing. Ensure LFS is properly set up or try a manual "git lfs push --all".'
2017-05-15 23:13:36 +00:00
} . freeze
2018-02-13 19:33:13 +00:00
attr_reader :user_access , :project , :skip_authorization , :skip_lfs_integrity_check , :protocol , :oldrev , :newrev , :ref , :branch_name , :tag_name
2016-07-18 08:16:56 +00:00
2016-11-17 19:48:23 +00:00
def initialize (
2017-04-05 07:35:58 +00:00
change , user_access : , project : , skip_authorization : false ,
2018-02-13 19:33:13 +00:00
skip_lfs_integrity_check : false , protocol :
2017-03-13 11:31:27 +00:00
)
2016-07-28 04:04:57 +00:00
@oldrev , @newrev , @ref = change . values_at ( :oldrev , :newrev , :ref )
@branch_name = Gitlab :: Git . branch_name ( @ref )
2017-03-31 16:57:29 +00:00
@tag_name = Gitlab :: Git . tag_name ( @ref )
2016-07-18 08:16:56 +00:00
@user_access = user_access
@project = project
2016-11-17 19:48:23 +00:00
@skip_authorization = skip_authorization
2018-02-13 19:33:13 +00:00
@skip_lfs_integrity_check = skip_lfs_integrity_check
2017-03-13 11:31:27 +00:00
@protocol = protocol
2016-07-18 08:16:56 +00:00
end
2018-02-07 13:00:53 +00:00
def exec ( skip_commits_check : false )
2017-05-23 19:21:57 +00:00
return true if skip_authorization
2017-05-08 07:41:58 +00:00
2017-05-19 19:58:45 +00:00
push_checks
branch_checks
tag_checks
2018-02-13 19:33:13 +00:00
lfs_objects_exist_check unless skip_lfs_integrity_check
2018-02-07 13:00:53 +00:00
commits_check unless skip_commits_check
2016-07-18 08:16:56 +00:00
2017-05-23 19:21:57 +00:00
true
2016-07-18 08:16:56 +00:00
end
protected
2017-05-08 07:41:58 +00:00
def push_checks
2018-03-06 22:30:47 +00:00
unless can_push?
2017-05-19 19:58:45 +00:00
raise GitAccess :: UnauthorizedError , ERROR_MESSAGES [ :push_code ]
2017-05-08 07:41:58 +00:00
end
end
def branch_checks
2018-01-23 16:12:44 +00:00
return unless branch_name
2017-05-08 07:41:58 +00:00
2018-01-23 16:12:44 +00:00
if deletion? && branch_name == project . default_branch
2017-05-19 19:58:45 +00:00
raise GitAccess :: UnauthorizedError , ERROR_MESSAGES [ :delete_default_branch ]
2017-05-08 07:41:58 +00:00
end
protected_branch_checks
end
def protected_branch_checks
2018-01-23 16:12:44 +00:00
return unless ProtectedBranch . protected? ( project , branch_name )
2016-07-18 08:16:56 +00:00
2017-01-12 22:37:14 +00:00
if forced_push?
2017-05-19 19:58:45 +00:00
raise GitAccess :: UnauthorizedError , ERROR_MESSAGES [ :force_push_protected_branch ]
2016-07-18 08:16:56 +00:00
end
2017-05-08 07:41:58 +00:00
if deletion?
protected_branch_deletion_checks
else
protected_branch_push_checks
end
end
def protected_branch_deletion_checks
2018-01-23 16:12:44 +00:00
unless user_access . can_delete_branch? ( branch_name )
2017-05-19 19:58:45 +00:00
raise GitAccess :: UnauthorizedError , ERROR_MESSAGES [ :non_master_delete_protected_branch ]
2017-05-08 07:41:58 +00:00
end
2018-01-23 16:12:44 +00:00
unless updated_from_web?
2017-05-19 19:58:45 +00:00
raise GitAccess :: UnauthorizedError , ERROR_MESSAGES [ :non_web_delete_protected_branch ]
2017-05-08 07:41:58 +00:00
end
end
def protected_branch_push_checks
2016-07-18 08:16:56 +00:00
if matching_merge_request?
2018-01-23 16:12:44 +00:00
unless user_access . can_merge_to_branch? ( branch_name ) || user_access . can_push_to_branch? ( branch_name )
2017-05-19 19:58:45 +00:00
raise GitAccess :: UnauthorizedError , ERROR_MESSAGES [ :merge_protected_branch ]
2016-07-18 08:16:56 +00:00
end
else
2018-01-23 16:12:44 +00:00
unless user_access . can_push_to_branch? ( branch_name )
2017-05-19 19:58:45 +00:00
raise GitAccess :: UnauthorizedError , ERROR_MESSAGES [ :push_protected_branch ]
2016-07-18 08:16:56 +00:00
end
end
end
def tag_checks
2018-01-23 16:12:44 +00:00
return unless tag_name
2016-07-18 08:16:56 +00:00
2017-03-31 16:57:29 +00:00
if tag_exists? && user_access . cannot_do_action? ( :admin_project )
2017-05-19 19:58:45 +00:00
raise GitAccess :: UnauthorizedError , ERROR_MESSAGES [ :change_existing_tags ]
2016-07-18 08:16:56 +00:00
end
2017-03-31 16:57:29 +00:00
protected_tag_checks
end
def protected_tag_checks
2018-01-23 16:12:44 +00:00
return unless ProtectedTag . protected? ( project , tag_name )
2017-05-08 07:41:58 +00:00
2017-05-19 19:58:45 +00:00
raise ( GitAccess :: UnauthorizedError , ERROR_MESSAGES [ :update_protected_tag ] ) if update?
raise ( GitAccess :: UnauthorizedError , ERROR_MESSAGES [ :delete_protected_tag ] ) if deletion?
2017-03-31 16:57:29 +00:00
2018-01-23 16:12:44 +00:00
unless user_access . can_create_tag? ( tag_name )
2017-05-19 19:58:45 +00:00
raise GitAccess :: UnauthorizedError , ERROR_MESSAGES [ :create_protected_tag ]
2017-03-31 16:57:29 +00:00
end
end
2018-02-07 13:00:53 +00:00
def commits_check
return if deletion? || newrev . nil?
2018-02-15 05:21:17 +00:00
return unless should_run_commit_validations?
2018-02-07 13:00:53 +00:00
# n+1: https://gitlab.com/gitlab-org/gitlab-ee/issues/3593
:: Gitlab :: GitalyClient . allow_n_plus_1_calls do
commits . each do | commit |
commit_check . validate ( commit , validations_for_commit ( commit ) )
end
end
commit_check . validate_file_paths
end
# Method overwritten in EE to inject custom validations
def validations_for_commit ( _ )
[ ]
end
2016-07-18 08:16:56 +00:00
private
2018-02-15 05:21:17 +00:00
def should_run_commit_validations?
commit_check . validate_lfs_file_locks?
end
2018-01-23 16:12:44 +00:00
def updated_from_web?
protocol == 'web'
end
2017-03-31 16:57:29 +00:00
def tag_exists?
2018-01-23 16:12:44 +00:00
project . repository . tag_exists? ( tag_name )
2016-07-18 08:16:56 +00:00
end
def forced_push?
2018-01-23 16:12:44 +00:00
Gitlab :: Checks :: ForcePush . force_push? ( project , oldrev , newrev )
2016-07-18 08:16:56 +00:00
end
2017-04-03 23:05:51 +00:00
def update?
2018-01-23 16:12:44 +00:00
! Gitlab :: Git . blank_ref? ( oldrev ) && ! deletion?
2017-04-03 23:05:51 +00:00
end
def deletion?
2018-01-23 16:12:44 +00:00
Gitlab :: Git . blank_ref? ( newrev )
2017-03-31 16:57:29 +00:00
end
2016-07-18 08:16:56 +00:00
def matching_merge_request?
2018-01-23 16:12:44 +00:00
Checks :: MatchingMergeRequest . new ( newrev , branch_name , project ) . match?
2016-07-18 08:16:56 +00:00
end
2017-08-25 01:30:12 +00:00
def lfs_objects_exist_check
2018-01-23 16:12:44 +00:00
lfs_check = Checks :: LfsIntegrity . new ( project , newrev )
2017-08-25 01:30:12 +00:00
if lfs_check . objects_missing?
raise GitAccess :: UnauthorizedError , ERROR_MESSAGES [ :lfs_objects_missing ]
end
end
2018-02-07 13:00:53 +00:00
def commit_check
@commit_check || = Gitlab :: Checks :: CommitCheck . new ( project , user_access . user , newrev , oldrev )
end
def commits
2018-02-15 05:21:17 +00:00
@commits || = project . repository . new_commits ( newrev )
2018-02-07 13:00:53 +00:00
end
2018-03-06 22:30:47 +00:00
def can_push?
user_access . can_do_action? ( :push_code ) ||
user_access . can_push_to_branch? ( branch_name )
end
2016-07-18 08:16:56 +00:00
end
end
end