2018-07-25 05:30:33 -04:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2019-03-28 09:17:42 -04:00
|
|
|
class ProjectFeature < ApplicationRecord
|
2016-08-01 18:31:21 -04:00
|
|
|
# == Project features permissions
|
|
|
|
#
|
|
|
|
# Grants access level to project tools
|
|
|
|
#
|
|
|
|
# Tools can be enabled only for users, everyone or disabled
|
|
|
|
# Access control is made only for non private projects
|
|
|
|
#
|
|
|
|
# levels:
|
|
|
|
#
|
|
|
|
# Disabled: not enabled for anyone
|
|
|
|
# Private: enabled only for team members
|
|
|
|
# Enabled: enabled for everyone able to access the project
|
2018-10-05 09:41:11 -04:00
|
|
|
# Public: enabled for everyone (only allowed for pages)
|
2016-08-01 18:31:21 -04:00
|
|
|
#
|
|
|
|
|
2016-09-16 15:15:39 -04:00
|
|
|
# Permission levels
|
2016-08-01 18:31:21 -04:00
|
|
|
DISABLED = 0
|
|
|
|
PRIVATE = 10
|
|
|
|
ENABLED = 20
|
2018-10-05 09:41:11 -04:00
|
|
|
PUBLIC = 30
|
2016-08-01 18:31:21 -04:00
|
|
|
|
2018-10-05 09:41:11 -04:00
|
|
|
FEATURES = %i(issues merge_requests wiki snippets builds repository pages).freeze
|
2018-12-11 09:52:22 -05:00
|
|
|
PRIVATE_FEATURES_MIN_ACCESS_LEVEL = { merge_requests: Gitlab::Access::REPORTER }.freeze
|
2019-05-15 07:19:16 -04:00
|
|
|
STRING_OPTIONS = HashWithIndifferentAccess.new({
|
|
|
|
'disabled' => DISABLED,
|
|
|
|
'private' => PRIVATE,
|
|
|
|
'enabled' => ENABLED,
|
|
|
|
'public' => PUBLIC
|
|
|
|
}).freeze
|
2016-08-01 18:31:21 -04:00
|
|
|
|
2016-10-26 13:34:06 -04:00
|
|
|
class << self
|
|
|
|
def access_level_attribute(feature)
|
2018-12-11 09:52:22 -05:00
|
|
|
feature = ensure_feature!(feature)
|
2016-10-26 13:34:06 -04:00
|
|
|
|
|
|
|
"#{feature}_access_level".to_sym
|
|
|
|
end
|
2017-06-14 08:31:20 -04:00
|
|
|
|
|
|
|
def quoted_access_level_column(feature)
|
|
|
|
attribute = connection.quote_column_name(access_level_attribute(feature))
|
|
|
|
table = connection.quote_table_name(table_name)
|
|
|
|
|
|
|
|
"#{table}.#{attribute}"
|
|
|
|
end
|
2018-12-11 09:52:22 -05:00
|
|
|
|
|
|
|
def required_minimum_access_level(feature)
|
|
|
|
feature = ensure_feature!(feature)
|
|
|
|
|
|
|
|
PRIVATE_FEATURES_MIN_ACCESS_LEVEL.fetch(feature, Gitlab::Access::GUEST)
|
|
|
|
end
|
|
|
|
|
2019-05-15 07:19:16 -04:00
|
|
|
def access_level_from_str(level)
|
|
|
|
STRING_OPTIONS.fetch(level)
|
|
|
|
end
|
|
|
|
|
|
|
|
def str_from_access_level(level)
|
|
|
|
STRING_OPTIONS.key(level)
|
|
|
|
end
|
|
|
|
|
2018-12-11 09:52:22 -05:00
|
|
|
private
|
|
|
|
|
|
|
|
def ensure_feature!(feature)
|
|
|
|
feature = feature.model_name.plural.to_sym if feature.respond_to?(:model_name)
|
|
|
|
raise ArgumentError, "invalid project feature: #{feature}" unless FEATURES.include?(feature)
|
|
|
|
|
|
|
|
feature
|
|
|
|
end
|
2016-10-26 13:34:06 -04:00
|
|
|
end
|
|
|
|
|
2016-10-04 23:53:15 -04:00
|
|
|
# Default scopes force us to unscope here since a service may need to check
|
|
|
|
# permissions for a project in pending_delete
|
|
|
|
# http://stackoverflow.com/questions/1540645/how-to-disable-default-scope-for-a-belongs-to
|
|
|
|
belongs_to :project, -> { unscope(where: :pending_delete) }
|
2016-08-01 18:31:21 -04:00
|
|
|
|
2017-09-12 17:07:11 -04:00
|
|
|
validates :project, presence: true
|
|
|
|
|
2016-09-16 15:15:39 -04:00
|
|
|
validate :repository_children_level
|
2018-10-05 09:41:11 -04:00
|
|
|
validate :allowed_access_levels
|
2016-09-16 15:15:39 -04:00
|
|
|
|
2016-09-21 06:10:27 -04:00
|
|
|
default_value_for :builds_access_level, value: ENABLED, allows_nil: false
|
|
|
|
default_value_for :issues_access_level, value: ENABLED, allows_nil: false
|
|
|
|
default_value_for :merge_requests_access_level, value: ENABLED, allows_nil: false
|
|
|
|
default_value_for :snippets_access_level, value: ENABLED, allows_nil: false
|
|
|
|
default_value_for :wiki_access_level, value: ENABLED, allows_nil: false
|
2016-09-16 15:15:39 -04:00
|
|
|
default_value_for :repository_access_level, value: ENABLED, allows_nil: false
|
2016-09-21 06:10:27 -04:00
|
|
|
|
2016-08-01 18:31:21 -04:00
|
|
|
def feature_available?(feature, user)
|
2018-09-21 16:43:24 -04:00
|
|
|
# This feature might not be behind a feature flag at all, so default to true
|
|
|
|
return false unless ::Feature.enabled?(feature, user, default_enabled: true)
|
|
|
|
|
2019-03-05 10:15:22 -05:00
|
|
|
get_permission(user, feature)
|
2017-04-06 17:06:42 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
def access_level(feature)
|
2017-08-03 22:20:34 -04:00
|
|
|
public_send(ProjectFeature.access_level_attribute(feature)) # rubocop:disable GitlabSecurity/PublicSend
|
2016-08-01 18:31:21 -04:00
|
|
|
end
|
|
|
|
|
2019-05-15 07:19:16 -04:00
|
|
|
def string_access_level(feature)
|
|
|
|
ProjectFeature.str_from_access_level(access_level(feature))
|
|
|
|
end
|
|
|
|
|
2016-08-01 18:31:21 -04:00
|
|
|
def builds_enabled?
|
|
|
|
builds_access_level > DISABLED
|
|
|
|
end
|
|
|
|
|
|
|
|
def wiki_enabled?
|
|
|
|
wiki_access_level > DISABLED
|
|
|
|
end
|
|
|
|
|
|
|
|
def merge_requests_enabled?
|
|
|
|
merge_requests_access_level > DISABLED
|
|
|
|
end
|
|
|
|
|
2016-11-12 05:17:24 -05:00
|
|
|
def issues_enabled?
|
|
|
|
issues_access_level > DISABLED
|
|
|
|
end
|
|
|
|
|
2018-10-05 09:41:11 -04:00
|
|
|
def pages_enabled?
|
|
|
|
pages_access_level > DISABLED
|
|
|
|
end
|
|
|
|
|
|
|
|
def public_pages?
|
|
|
|
return true unless Gitlab.config.pages.access_control
|
|
|
|
|
|
|
|
pages_access_level == PUBLIC || pages_access_level == ENABLED && project.public?
|
|
|
|
end
|
|
|
|
|
2016-08-01 18:31:21 -04:00
|
|
|
private
|
|
|
|
|
2016-09-16 15:15:39 -04:00
|
|
|
# Validates builds and merge requests access level
|
|
|
|
# which cannot be higher than repository access level
|
|
|
|
def repository_children_level
|
|
|
|
validator = lambda do |field|
|
2017-08-03 22:20:34 -04:00
|
|
|
level = public_send(field) || ProjectFeature::ENABLED # rubocop:disable GitlabSecurity/PublicSend
|
2016-09-16 15:15:39 -04:00
|
|
|
not_allowed = level > repository_access_level
|
|
|
|
self.errors.add(field, "cannot have higher visibility level than repository access level") if not_allowed
|
|
|
|
end
|
|
|
|
|
|
|
|
%i(merge_requests_access_level builds_access_level).each(&validator)
|
|
|
|
end
|
|
|
|
|
2018-10-05 09:41:11 -04:00
|
|
|
# Validates access level for other than pages cannot be PUBLIC
|
|
|
|
def allowed_access_levels
|
|
|
|
validator = lambda do |field|
|
|
|
|
level = public_send(field) || ProjectFeature::ENABLED # rubocop:disable GitlabSecurity/PublicSend
|
|
|
|
not_allowed = level > ProjectFeature::ENABLED
|
|
|
|
self.errors.add(field, "cannot have public visibility level") if not_allowed
|
|
|
|
end
|
|
|
|
|
|
|
|
(FEATURES - %i(pages)).each {|f| validator.call("#{f}_access_level")}
|
|
|
|
end
|
|
|
|
|
2019-03-05 10:15:22 -05:00
|
|
|
def get_permission(user, feature)
|
|
|
|
case access_level(feature)
|
2016-08-01 18:31:21 -04:00
|
|
|
when DISABLED
|
|
|
|
false
|
|
|
|
when PRIVATE
|
2019-03-05 10:15:22 -05:00
|
|
|
team_access?(user, feature)
|
2016-08-01 18:31:21 -04:00
|
|
|
when ENABLED
|
|
|
|
true
|
2018-10-05 09:41:11 -04:00
|
|
|
when PUBLIC
|
|
|
|
true
|
2016-08-01 18:31:21 -04:00
|
|
|
else
|
|
|
|
true
|
|
|
|
end
|
|
|
|
end
|
2019-03-05 10:15:22 -05:00
|
|
|
|
|
|
|
def team_access?(user, feature)
|
|
|
|
return unless user
|
|
|
|
return true if user.full_private_access?
|
|
|
|
|
|
|
|
project.team.member?(user, ProjectFeature.required_minimum_access_level(feature))
|
|
|
|
end
|
2016-08-01 18:31:21 -04:00
|
|
|
end
|