2018-07-25 09:30:33 +00:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2019-03-28 13:17:42 +00:00
|
|
|
class ProjectFeature < ApplicationRecord
|
2020-05-26 09:08:06 +00:00
|
|
|
include Featurable
|
2021-07-26 12:10:08 +00:00
|
|
|
extend Gitlab::ConfigHelper
|
2022-04-07 12:10:21 +00:00
|
|
|
extend ::Gitlab::Utils::Override
|
2016-08-01 22:31:21 +00:00
|
|
|
|
2021-03-29 18:09:37 +00:00
|
|
|
# When updating this array, make sure to update rubocop/cop/gitlab/feature_available_usage.rb as well.
|
2021-03-08 12:09:01 +00:00
|
|
|
FEATURES = %i[
|
|
|
|
issues
|
|
|
|
forking
|
|
|
|
merge_requests
|
|
|
|
wiki
|
|
|
|
snippets
|
|
|
|
builds
|
|
|
|
repository
|
|
|
|
pages
|
|
|
|
metrics_dashboard
|
|
|
|
analytics
|
2022-09-15 00:14:10 +00:00
|
|
|
monitor
|
2021-03-08 12:09:01 +00:00
|
|
|
operations
|
|
|
|
security_and_compliance
|
|
|
|
container_registry
|
2022-05-30 15:08:03 +00:00
|
|
|
package_registry
|
2022-08-02 09:11:05 +00:00
|
|
|
environments
|
2022-08-11 18:11:57 +00:00
|
|
|
feature_flags
|
2022-08-15 06:12:42 +00:00
|
|
|
releases
|
2021-03-08 12:09:01 +00:00
|
|
|
].freeze
|
|
|
|
|
2021-04-19 12:09:04 +00:00
|
|
|
EXPORTABLE_FEATURES = (FEATURES - [:security_and_compliance, :pages]).freeze
|
2020-05-26 09:08:06 +00:00
|
|
|
|
|
|
|
set_available_features(FEATURES)
|
|
|
|
|
2021-06-11 12:09:49 +00:00
|
|
|
PRIVATE_FEATURES_MIN_ACCESS_LEVEL = {
|
|
|
|
merge_requests: Gitlab::Access::REPORTER,
|
|
|
|
metrics_dashboard: Gitlab::Access::REPORTER,
|
2022-05-30 15:08:03 +00:00
|
|
|
container_registry: Gitlab::Access::REPORTER,
|
|
|
|
package_registry: Gitlab::Access::REPORTER
|
2021-06-11 12:09:49 +00:00
|
|
|
}.freeze
|
2019-11-14 02:50:19 +00:00
|
|
|
PRIVATE_FEATURES_MIN_ACCESS_LEVEL_FOR_PRIVATE_PROJECT = { repository: Gitlab::Access::REPORTER }.freeze
|
2016-08-01 22:31:21 +00:00
|
|
|
|
2016-10-26 17:34:06 +00:00
|
|
|
class << self
|
2019-11-14 02:50:19 +00:00
|
|
|
def required_minimum_access_level(feature)
|
2019-10-22 13:05:33 +00:00
|
|
|
feature = ensure_feature!(feature)
|
|
|
|
|
2019-11-14 02:50:19 +00:00
|
|
|
PRIVATE_FEATURES_MIN_ACCESS_LEVEL.fetch(feature, Gitlab::Access::GUEST)
|
2019-10-22 13:05:33 +00:00
|
|
|
end
|
|
|
|
|
2019-11-14 02:50:19 +00:00
|
|
|
# Guest users can perform certain features on public and internal projects, but not private projects.
|
|
|
|
def required_minimum_access_level_for_private_project(feature)
|
2018-12-11 14:52:22 +00:00
|
|
|
feature = ensure_feature!(feature)
|
|
|
|
|
2019-11-14 02:50:19 +00:00
|
|
|
PRIVATE_FEATURES_MIN_ACCESS_LEVEL_FOR_PRIVATE_PROJECT.fetch(feature) do
|
|
|
|
required_minimum_access_level(feature)
|
|
|
|
end
|
2018-12-11 14:52:22 +00:00
|
|
|
end
|
2016-10-26 17:34:06 +00:00
|
|
|
end
|
|
|
|
|
2021-08-16 12:09:17 +00:00
|
|
|
belongs_to :project
|
2016-08-01 22:31:21 +00:00
|
|
|
|
2017-09-12 21:07:11 +00:00
|
|
|
validates :project, presence: true
|
|
|
|
|
2016-09-16 19:15:39 +00:00
|
|
|
validate :repository_children_level
|
|
|
|
|
2021-02-18 18:10:41 +00:00
|
|
|
default_value_for :builds_access_level, value: ENABLED, allows_nil: false
|
|
|
|
default_value_for :issues_access_level, value: ENABLED, allows_nil: false
|
|
|
|
default_value_for :forking_access_level, value: ENABLED, allows_nil: false
|
|
|
|
default_value_for :merge_requests_access_level, value: ENABLED, allows_nil: false
|
|
|
|
default_value_for :snippets_access_level, value: ENABLED, allows_nil: false
|
|
|
|
default_value_for :wiki_access_level, value: ENABLED, allows_nil: false
|
|
|
|
default_value_for :repository_access_level, value: ENABLED, allows_nil: false
|
|
|
|
default_value_for :analytics_access_level, value: ENABLED, allows_nil: false
|
2020-04-21 15:21:10 +00:00
|
|
|
default_value_for :metrics_dashboard_access_level, value: PRIVATE, allows_nil: false
|
2021-02-18 18:10:41 +00:00
|
|
|
default_value_for :operations_access_level, value: ENABLED, allows_nil: false
|
|
|
|
default_value_for :security_and_compliance_access_level, value: PRIVATE, allows_nil: false
|
2022-06-28 03:09:38 +00:00
|
|
|
default_value_for :monitor_access_level, value: ENABLED, allows_nil: false
|
|
|
|
default_value_for :infrastructure_access_level, value: ENABLED, allows_nil: false
|
|
|
|
default_value_for :feature_flags_access_level, value: ENABLED, allows_nil: false
|
|
|
|
default_value_for :environments_access_level, value: ENABLED, allows_nil: false
|
|
|
|
default_value_for :releases_access_level, value: ENABLED, allows_nil: false
|
2016-09-21 10:10:27 +00:00
|
|
|
|
2020-01-14 18:08:31 +00:00
|
|
|
default_value_for(:pages_access_level, allows_nil: false) do |feature|
|
|
|
|
if ::Gitlab::Pages.access_control_is_forced?
|
|
|
|
PRIVATE
|
|
|
|
else
|
|
|
|
feature.project&.public? ? ENABLED : PRIVATE
|
|
|
|
end
|
|
|
|
end
|
2019-07-17 12:56:58 +00:00
|
|
|
|
2022-05-30 15:08:03 +00:00
|
|
|
default_value_for(:package_registry_access_level) do |feature|
|
|
|
|
if ::Gitlab.config.packages.enabled
|
|
|
|
ENABLED
|
|
|
|
else
|
|
|
|
DISABLED
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2021-08-04 21:09:04 +00:00
|
|
|
default_value_for(:container_registry_access_level) do |feature|
|
2021-07-26 12:10:08 +00:00
|
|
|
if gitlab_config_features.container_registry
|
|
|
|
ENABLED
|
|
|
|
else
|
|
|
|
DISABLED
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2021-12-02 18:11:52 +00:00
|
|
|
# "enabled" here means "not disabled". It includes private features!
|
|
|
|
scope :with_feature_enabled, ->(feature) {
|
|
|
|
feature_access_level_attribute = arel_table[access_level_attribute(feature)]
|
|
|
|
enabled_feature = feature_access_level_attribute.gt(DISABLED).or(feature_access_level_attribute.eq(nil))
|
|
|
|
|
|
|
|
where(enabled_feature)
|
|
|
|
}
|
|
|
|
|
|
|
|
# Picks a feature where the level is exactly that given.
|
|
|
|
scope :with_feature_access_level, ->(feature, level) {
|
|
|
|
feature_access_level_attribute = access_level_attribute(feature)
|
|
|
|
where(project_features: { feature_access_level_attribute => level })
|
|
|
|
}
|
|
|
|
|
|
|
|
# project features may be "disabled", "internal", "enabled" or "public". If "internal",
|
|
|
|
# they are only available to team members. This scope returns features where
|
|
|
|
# the feature is either public, enabled, or internal with permission for the user.
|
|
|
|
# Note: this scope doesn't enforce that the user has access to the projects, it just checks
|
|
|
|
# that the user has access to the feature. It's important to use this scope with others
|
|
|
|
# that checks project authorizations first (e.g. `filter_by_feature_visibility`).
|
|
|
|
#
|
2022-05-03 00:08:25 +00:00
|
|
|
# This method uses an optimized version of `with_feature_access_level` for
|
2021-12-02 18:11:52 +00:00
|
|
|
# logged in users to more efficiently get private projects with the given
|
|
|
|
# feature.
|
|
|
|
def self.with_feature_available_for_user(feature, user)
|
|
|
|
visible = [ENABLED, PUBLIC]
|
|
|
|
|
|
|
|
if user&.can_read_all_resources?
|
|
|
|
with_feature_enabled(feature)
|
|
|
|
elsif user
|
|
|
|
min_access_level = required_minimum_access_level(feature)
|
|
|
|
column = quoted_access_level_column(feature)
|
|
|
|
|
|
|
|
where("#{column} IS NULL OR #{column} IN (:public_visible) OR (#{column} = :private_visible AND EXISTS (:authorizations))",
|
|
|
|
{
|
|
|
|
public_visible: visible,
|
|
|
|
private_visible: PRIVATE,
|
|
|
|
authorizations: user.authorizations_for_projects(min_access_level: min_access_level, related_project_column: 'project_features.project_id')
|
|
|
|
})
|
|
|
|
else
|
|
|
|
# This has to be added to include features whose value is nil in the db
|
|
|
|
visible << nil
|
|
|
|
with_feature_access_level(feature, visible)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2018-10-05 13:41:11 +00:00
|
|
|
def public_pages?
|
|
|
|
return true unless Gitlab.config.pages.access_control
|
|
|
|
|
2020-01-14 18:08:31 +00:00
|
|
|
return false if ::Gitlab::Pages.access_control_is_forced?
|
|
|
|
|
2018-10-05 13:41:11 +00:00
|
|
|
pages_access_level == PUBLIC || pages_access_level == ENABLED && project.public?
|
|
|
|
end
|
|
|
|
|
2019-09-06 05:20:05 +00:00
|
|
|
def private_pages?
|
|
|
|
!public_pages?
|
|
|
|
end
|
|
|
|
|
2022-05-30 15:08:03 +00:00
|
|
|
def package_registry_access_level=(value)
|
|
|
|
super(value).tap do
|
|
|
|
project.packages_enabled = self.package_registry_access_level != DISABLED if project
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2016-08-01 22:31:21 +00:00
|
|
|
private
|
|
|
|
|
2016-09-16 19:15:39 +00:00
|
|
|
# Validates builds and merge requests access level
|
|
|
|
# which cannot be higher than repository access level
|
|
|
|
def repository_children_level
|
|
|
|
validator = lambda do |field|
|
2020-05-26 09:08:06 +00:00
|
|
|
level = public_send(field) || ENABLED # rubocop:disable GitlabSecurity/PublicSend
|
2016-09-16 19:15:39 +00:00
|
|
|
not_allowed = level > repository_access_level
|
|
|
|
self.errors.add(field, "cannot have higher visibility level than repository access level") if not_allowed
|
|
|
|
end
|
|
|
|
|
|
|
|
%i(merge_requests_access_level builds_access_level).each(&validator)
|
|
|
|
end
|
|
|
|
|
2022-04-07 12:10:21 +00:00
|
|
|
def feature_validation_exclusion
|
2022-05-30 15:08:03 +00:00
|
|
|
%i(pages package_registry)
|
2016-08-01 22:31:21 +00:00
|
|
|
end
|
2019-03-05 15:15:22 +00:00
|
|
|
|
2022-04-07 12:10:21 +00:00
|
|
|
override :resource_member?
|
|
|
|
def resource_member?(user, feature)
|
2019-03-05 15:15:22 +00:00
|
|
|
project.team.member?(user, ProjectFeature.required_minimum_access_level(feature))
|
|
|
|
end
|
2016-08-01 22:31:21 +00:00
|
|
|
end
|
2019-09-13 13:26:31 +00:00
|
|
|
|
2021-05-11 21:10:21 +00:00
|
|
|
ProjectFeature.prepend_mod_with('ProjectFeature')
|