2018-07-25 05:30:33 -04:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2019-03-28 09:17:42 -04:00
|
|
|
class ProjectFeature < ApplicationRecord
|
2020-05-26 05:08:06 -04:00
|
|
|
include Featurable
|
2021-07-26 08:10:08 -04:00
|
|
|
extend Gitlab::ConfigHelper
|
2016-08-01 18:31:21 -04:00
|
|
|
|
2021-03-29 14:09:37 -04:00
|
|
|
# When updating this array, make sure to update rubocop/cop/gitlab/feature_available_usage.rb as well.
|
2021-03-08 07:09:01 -05:00
|
|
|
FEATURES = %i[
|
|
|
|
issues
|
|
|
|
forking
|
|
|
|
merge_requests
|
|
|
|
wiki
|
|
|
|
snippets
|
|
|
|
builds
|
|
|
|
repository
|
|
|
|
pages
|
|
|
|
metrics_dashboard
|
|
|
|
analytics
|
|
|
|
operations
|
|
|
|
security_and_compliance
|
|
|
|
container_registry
|
|
|
|
].freeze
|
|
|
|
|
2021-04-19 08:09:04 -04:00
|
|
|
EXPORTABLE_FEATURES = (FEATURES - [:security_and_compliance, :pages]).freeze
|
2020-05-26 05:08:06 -04:00
|
|
|
|
|
|
|
set_available_features(FEATURES)
|
|
|
|
|
2021-06-11 08:09:49 -04:00
|
|
|
PRIVATE_FEATURES_MIN_ACCESS_LEVEL = {
|
|
|
|
merge_requests: Gitlab::Access::REPORTER,
|
|
|
|
metrics_dashboard: Gitlab::Access::REPORTER,
|
|
|
|
container_registry: Gitlab::Access::REPORTER
|
|
|
|
}.freeze
|
2019-11-13 21:50:19 -05:00
|
|
|
PRIVATE_FEATURES_MIN_ACCESS_LEVEL_FOR_PRIVATE_PROJECT = { repository: Gitlab::Access::REPORTER }.freeze
|
2016-08-01 18:31:21 -04:00
|
|
|
|
2016-10-26 13:34:06 -04:00
|
|
|
class << self
|
2019-11-13 21:50:19 -05:00
|
|
|
def required_minimum_access_level(feature)
|
2019-10-22 09:05:33 -04:00
|
|
|
feature = ensure_feature!(feature)
|
|
|
|
|
2019-11-13 21:50:19 -05:00
|
|
|
PRIVATE_FEATURES_MIN_ACCESS_LEVEL.fetch(feature, Gitlab::Access::GUEST)
|
2019-10-22 09:05:33 -04:00
|
|
|
end
|
|
|
|
|
2019-11-13 21:50:19 -05:00
|
|
|
# Guest users can perform certain features on public and internal projects, but not private projects.
|
|
|
|
def required_minimum_access_level_for_private_project(feature)
|
2018-12-11 09:52:22 -05:00
|
|
|
feature = ensure_feature!(feature)
|
|
|
|
|
2019-11-13 21:50:19 -05:00
|
|
|
PRIVATE_FEATURES_MIN_ACCESS_LEVEL_FOR_PRIVATE_PROJECT.fetch(feature) do
|
|
|
|
required_minimum_access_level(feature)
|
|
|
|
end
|
2018-12-11 09:52:22 -05:00
|
|
|
end
|
2016-10-26 13:34:06 -04:00
|
|
|
end
|
|
|
|
|
2016-10-04 23:53:15 -04:00
|
|
|
# Default scopes force us to unscope here since a service may need to check
|
|
|
|
# permissions for a project in pending_delete
|
|
|
|
# http://stackoverflow.com/questions/1540645/how-to-disable-default-scope-for-a-belongs-to
|
|
|
|
belongs_to :project, -> { unscope(where: :pending_delete) }
|
2016-08-01 18:31:21 -04:00
|
|
|
|
2017-09-12 17:07:11 -04:00
|
|
|
validates :project, presence: true
|
|
|
|
|
2016-09-16 15:15:39 -04:00
|
|
|
validate :repository_children_level
|
2018-10-05 09:41:11 -04:00
|
|
|
validate :allowed_access_levels
|
2016-09-16 15:15:39 -04:00
|
|
|
|
2021-02-18 13:10:41 -05:00
|
|
|
default_value_for :builds_access_level, value: ENABLED, allows_nil: false
|
|
|
|
default_value_for :issues_access_level, value: ENABLED, allows_nil: false
|
|
|
|
default_value_for :forking_access_level, value: ENABLED, allows_nil: false
|
|
|
|
default_value_for :merge_requests_access_level, value: ENABLED, allows_nil: false
|
|
|
|
default_value_for :snippets_access_level, value: ENABLED, allows_nil: false
|
|
|
|
default_value_for :wiki_access_level, value: ENABLED, allows_nil: false
|
|
|
|
default_value_for :repository_access_level, value: ENABLED, allows_nil: false
|
|
|
|
default_value_for :analytics_access_level, value: ENABLED, allows_nil: false
|
2020-04-21 11:21:10 -04:00
|
|
|
default_value_for :metrics_dashboard_access_level, value: PRIVATE, allows_nil: false
|
2021-02-18 13:10:41 -05:00
|
|
|
default_value_for :operations_access_level, value: ENABLED, allows_nil: false
|
|
|
|
default_value_for :security_and_compliance_access_level, value: PRIVATE, allows_nil: false
|
2016-09-21 06:10:27 -04:00
|
|
|
|
2020-01-14 13:08:31 -05:00
|
|
|
default_value_for(:pages_access_level, allows_nil: false) do |feature|
|
|
|
|
if ::Gitlab::Pages.access_control_is_forced?
|
|
|
|
PRIVATE
|
|
|
|
else
|
|
|
|
feature.project&.public? ? ENABLED : PRIVATE
|
|
|
|
end
|
|
|
|
end
|
2019-07-17 08:56:58 -04:00
|
|
|
|
2021-07-26 08:10:08 -04:00
|
|
|
default_value_for(:container_registry_access_level, allows_nil: false) do |feature|
|
|
|
|
if gitlab_config_features.container_registry
|
|
|
|
ENABLED
|
|
|
|
else
|
|
|
|
DISABLED
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2018-10-05 09:41:11 -04:00
|
|
|
def public_pages?
|
|
|
|
return true unless Gitlab.config.pages.access_control
|
|
|
|
|
2020-01-14 13:08:31 -05:00
|
|
|
return false if ::Gitlab::Pages.access_control_is_forced?
|
|
|
|
|
2018-10-05 09:41:11 -04:00
|
|
|
pages_access_level == PUBLIC || pages_access_level == ENABLED && project.public?
|
|
|
|
end
|
|
|
|
|
2019-09-06 01:20:05 -04:00
|
|
|
def private_pages?
|
|
|
|
!public_pages?
|
|
|
|
end
|
|
|
|
|
2016-08-01 18:31:21 -04:00
|
|
|
private
|
|
|
|
|
2016-09-16 15:15:39 -04:00
|
|
|
# Validates builds and merge requests access level
|
|
|
|
# which cannot be higher than repository access level
|
|
|
|
def repository_children_level
|
|
|
|
validator = lambda do |field|
|
2020-05-26 05:08:06 -04:00
|
|
|
level = public_send(field) || ENABLED # rubocop:disable GitlabSecurity/PublicSend
|
2016-09-16 15:15:39 -04:00
|
|
|
not_allowed = level > repository_access_level
|
|
|
|
self.errors.add(field, "cannot have higher visibility level than repository access level") if not_allowed
|
|
|
|
end
|
|
|
|
|
|
|
|
%i(merge_requests_access_level builds_access_level).each(&validator)
|
|
|
|
end
|
|
|
|
|
2018-10-05 09:41:11 -04:00
|
|
|
# Validates access level for other than pages cannot be PUBLIC
|
|
|
|
def allowed_access_levels
|
|
|
|
validator = lambda do |field|
|
2020-05-26 05:08:06 -04:00
|
|
|
level = public_send(field) || ENABLED # rubocop:disable GitlabSecurity/PublicSend
|
|
|
|
not_allowed = level > ENABLED
|
2018-10-05 09:41:11 -04:00
|
|
|
self.errors.add(field, "cannot have public visibility level") if not_allowed
|
|
|
|
end
|
|
|
|
|
|
|
|
(FEATURES - %i(pages)).each {|f| validator.call("#{f}_access_level")}
|
|
|
|
end
|
|
|
|
|
2019-03-05 10:15:22 -05:00
|
|
|
def get_permission(user, feature)
|
|
|
|
case access_level(feature)
|
2016-08-01 18:31:21 -04:00
|
|
|
when DISABLED
|
|
|
|
false
|
|
|
|
when PRIVATE
|
2019-03-05 10:15:22 -05:00
|
|
|
team_access?(user, feature)
|
2016-08-01 18:31:21 -04:00
|
|
|
when ENABLED
|
|
|
|
true
|
2018-10-05 09:41:11 -04:00
|
|
|
when PUBLIC
|
|
|
|
true
|
2016-08-01 18:31:21 -04:00
|
|
|
else
|
|
|
|
true
|
|
|
|
end
|
|
|
|
end
|
2019-03-05 10:15:22 -05:00
|
|
|
|
|
|
|
def team_access?(user, feature)
|
|
|
|
return unless user
|
2019-12-17 04:07:48 -05:00
|
|
|
return true if user.can_read_all_resources?
|
2019-03-05 10:15:22 -05:00
|
|
|
|
|
|
|
project.team.member?(user, ProjectFeature.required_minimum_access_level(feature))
|
|
|
|
end
|
2016-08-01 18:31:21 -04:00
|
|
|
end
|
2019-09-13 09:26:31 -04:00
|
|
|
|
2021-05-11 17:10:21 -04:00
|
|
|
ProjectFeature.prepend_mod_with('ProjectFeature')
|