2018-07-24 10:00:56 +00:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2017-06-29 18:57:59 +00:00
|
|
|
require_dependency 'declarative_policy'
|
2016-08-16 19:55:44 +00:00
|
|
|
|
2017-04-06 21:06:42 +00:00
|
|
|
class BasePolicy < DeclarativePolicy::Base
|
|
|
|
desc "User is an instance admin"
|
|
|
|
with_options scope: :user, score: 0
|
2019-09-26 12:06:00 +00:00
|
|
|
condition(:admin) do
|
|
|
|
if Feature.enabled?(:user_mode_in_session)
|
|
|
|
Gitlab::Auth::CurrentUserMode.new(@user).admin_mode?
|
|
|
|
else
|
|
|
|
@user&.admin?
|
|
|
|
end
|
|
|
|
end
|
2016-08-11 22:12:52 +00:00
|
|
|
|
2019-04-11 15:21:18 +00:00
|
|
|
desc "User is blocked"
|
|
|
|
with_options scope: :user, score: 0
|
|
|
|
condition(:blocked) { @user&.blocked? }
|
|
|
|
|
2018-12-18 16:18:09 +00:00
|
|
|
desc "User has access to all private groups & projects"
|
|
|
|
with_options scope: :user, score: 0
|
|
|
|
condition(:full_private_access) { @user&.full_private_access? }
|
|
|
|
|
2017-04-06 21:06:42 +00:00
|
|
|
with_options scope: :user, score: 0
|
|
|
|
condition(:external_user) { @user.nil? || @user.external? }
|
2016-08-12 18:36:16 +00:00
|
|
|
|
2017-04-06 21:06:42 +00:00
|
|
|
with_options scope: :user, score: 0
|
|
|
|
condition(:can_create_group) { @user&.can_create_group }
|
2017-06-29 07:43:41 +00:00
|
|
|
|
2017-06-30 13:29:34 +00:00
|
|
|
desc "The application is restricted from public visibility"
|
|
|
|
condition(:restricted_public_level, scope: :global) do
|
2017-08-31 09:47:03 +00:00
|
|
|
Gitlab::CurrentSettings.current_application_settings.restricted_visibility_levels.include?(Gitlab::VisibilityLevel::PUBLIC)
|
2017-06-29 07:43:41 +00:00
|
|
|
end
|
2017-12-11 14:21:06 +00:00
|
|
|
|
2019-04-09 15:38:58 +00:00
|
|
|
condition(:external_authorization_enabled, scope: :global, score: 0) do
|
|
|
|
::Gitlab::ExternalAuthorization.perform_check?
|
|
|
|
end
|
|
|
|
|
|
|
|
rule { external_authorization_enabled & ~full_private_access }.policy do
|
|
|
|
prevent :read_cross_project
|
|
|
|
end
|
|
|
|
|
2017-12-11 14:21:06 +00:00
|
|
|
rule { default }.enable :read_cross_project
|
2016-08-11 22:12:52 +00:00
|
|
|
end
|
2019-09-13 13:26:31 +00:00
|
|
|
|
|
|
|
BasePolicy.prepend_if_ee('EE::BasePolicy')
|