2016-07-18 08:16:56 +00:00
module Gitlab
module Checks
class ChangeAccess
2017-05-15 23:13:36 +00:00
ERROR_MESSAGES = {
push_code : 'You are not allowed to push code to this project.' ,
delete_default_branch : 'The default branch of a project cannot be deleted.' ,
force_push_protected_branch : 'You are not allowed to force push code to a protected branch on this project.' ,
non_master_delete_protected_branch : 'You are not allowed to delete protected branches from this project. Only a project master or owner can delete a protected branch.' ,
non_web_delete_protected_branch : 'You can only delete protected branches using the web interface.' ,
merge_protected_branch : 'You are not allowed to merge code into protected branches on this project.' ,
push_protected_branch : 'You are not allowed to push code to protected branches on this project.' ,
change_existing_tags : 'You are not allowed to change existing tags on this project.' ,
update_protected_tag : 'Protected tags cannot be updated.' ,
delete_protected_tag : 'Protected tags cannot be deleted.' ,
create_protected_tag : 'You are not allowed to create this tag as it is protected.'
} . freeze
2017-03-13 11:31:27 +00:00
attr_reader :user_access , :project , :skip_authorization , :protocol
2016-07-18 08:16:56 +00:00
2016-11-17 19:48:23 +00:00
def initialize (
2017-04-05 07:35:58 +00:00
change , user_access : , project : , skip_authorization : false ,
2017-03-13 11:31:27 +00:00
protocol :
)
2016-07-28 04:04:57 +00:00
@oldrev , @newrev , @ref = change . values_at ( :oldrev , :newrev , :ref )
@branch_name = Gitlab :: Git . branch_name ( @ref )
2017-03-31 16:57:29 +00:00
@tag_name = Gitlab :: Git . tag_name ( @ref )
2016-07-18 08:16:56 +00:00
@user_access = user_access
@project = project
2016-11-17 19:48:23 +00:00
@skip_authorization = skip_authorization
2017-03-13 11:31:27 +00:00
@protocol = protocol
2016-07-18 08:16:56 +00:00
end
def exec
2017-05-08 07:41:58 +00:00
return GitAccessStatus . new ( true ) if skip_authorization
error = push_checks || branch_checks || tag_checks
2016-07-18 08:16:56 +00:00
if error
GitAccessStatus . new ( false , error )
else
GitAccessStatus . new ( true )
end
end
protected
2017-05-08 07:41:58 +00:00
def push_checks
if user_access . cannot_do_action? ( :push_code )
2017-05-15 23:13:36 +00:00
ERROR_MESSAGES [ :push_code ]
2017-05-08 07:41:58 +00:00
end
end
def branch_checks
2016-09-13 09:43:41 +00:00
return unless @branch_name
2017-05-08 07:41:58 +00:00
if deletion? && @branch_name == project . default_branch
2017-05-15 23:13:36 +00:00
return ERROR_MESSAGES [ :delete_default_branch ]
2017-05-08 07:41:58 +00:00
end
protected_branch_checks
end
def protected_branch_checks
2017-04-03 17:59:58 +00:00
return unless ProtectedBranch . protected? ( project , @branch_name )
2016-07-18 08:16:56 +00:00
2017-01-12 22:37:14 +00:00
if forced_push?
2017-05-15 23:13:36 +00:00
return ERROR_MESSAGES [ :force_push_protected_branch ]
2016-07-18 08:16:56 +00:00
end
2017-05-08 07:41:58 +00:00
if deletion?
protected_branch_deletion_checks
else
protected_branch_push_checks
end
end
def protected_branch_deletion_checks
unless user_access . can_delete_branch? ( @branch_name )
2017-05-15 23:13:36 +00:00
return ERROR_MESSAGES [ :non_master_delete_protected_branch ]
2017-05-08 07:41:58 +00:00
end
unless protocol == 'web'
2017-05-15 23:13:36 +00:00
ERROR_MESSAGES [ :non_web_delete_protected_branch ]
2017-05-08 07:41:58 +00:00
end
end
def protected_branch_push_checks
2016-07-18 08:16:56 +00:00
if matching_merge_request?
2017-05-08 07:41:58 +00:00
unless user_access . can_merge_to_branch? ( @branch_name ) || user_access . can_push_to_branch? ( @branch_name )
2017-05-15 23:13:36 +00:00
ERROR_MESSAGES [ :merge_protected_branch ]
2016-07-18 08:16:56 +00:00
end
else
2017-05-08 07:41:58 +00:00
unless user_access . can_push_to_branch? ( @branch_name )
2017-05-15 23:13:36 +00:00
ERROR_MESSAGES [ :push_protected_branch ]
2016-07-18 08:16:56 +00:00
end
end
end
def tag_checks
2017-03-31 16:57:29 +00:00
return unless @tag_name
2016-07-18 08:16:56 +00:00
2017-03-31 16:57:29 +00:00
if tag_exists? && user_access . cannot_do_action? ( :admin_project )
2017-05-15 23:13:36 +00:00
return ERROR_MESSAGES [ :change_existing_tags ]
2016-07-18 08:16:56 +00:00
end
2017-03-31 16:57:29 +00:00
protected_tag_checks
end
def protected_tag_checks
2017-05-08 07:41:58 +00:00
return unless ProtectedTag . protected? ( project , @tag_name )
2017-05-15 23:13:36 +00:00
return ERROR_MESSAGES [ :update_protected_tag ] if update?
return ERROR_MESSAGES [ :delete_protected_tag ] if deletion?
2017-03-31 16:57:29 +00:00
2017-04-04 01:05:42 +00:00
unless user_access . can_create_tag? ( @tag_name )
2017-05-15 23:13:36 +00:00
return ERROR_MESSAGES [ :create_protected_tag ]
2017-03-31 16:57:29 +00:00
end
end
2016-07-18 08:16:56 +00:00
private
2017-03-31 16:57:29 +00:00
def tag_exists?
project . repository . tag_exists? ( @tag_name )
2016-07-18 08:16:56 +00:00
end
def forced_push?
2017-04-05 07:35:58 +00:00
Gitlab :: Checks :: ForcePush . force_push? ( @project , @oldrev , @newrev )
2016-07-18 08:16:56 +00:00
end
2017-04-03 23:05:51 +00:00
def update?
! Gitlab :: Git . blank_ref? ( @oldrev ) && ! deletion?
end
def deletion?
2017-03-31 16:57:29 +00:00
Gitlab :: Git . blank_ref? ( @newrev )
end
2016-07-18 08:16:56 +00:00
def matching_merge_request?
Checks :: MatchingMergeRequest . new ( @newrev , @branch_name , @project ) . match?
end
end
end
end