2018-07-25 09:30:33 +00:00
# frozen_string_literal: true
2014-01-27 21:34:05 +00:00
require 'carrierwave/orm/activerecord'
2012-11-22 18:34:16 +00:00
class Group < Namespace
2015-08-24 14:46:06 +00:00
include Gitlab :: ConfigHelper
2017-11-29 15:30:17 +00:00
include AfterCommitQueue
2016-04-18 16:53:32 +00:00
include AccessRequestable
2017-05-10 04:26:17 +00:00
include Avatarable
2015-05-03 03:11:21 +00:00
include Referable
2016-10-11 12:25:17 +00:00
include SelectForProjectAuthorization
2017-10-05 08:32:52 +00:00
include LoadedInGroupList
2017-09-19 11:11:09 +00:00
include GroupDescendant
2017-09-06 13:46:57 +00:00
include TokenAuthenticatable
2018-05-07 13:49:32 +00:00
include WithUploads
2018-05-28 18:43:46 +00:00
include Gitlab :: Utils :: StrongMemoize
2019-10-07 15:05:59 +00:00
include GroupAPICompatibility
2016-03-01 15:22:29 +00:00
2019-08-30 21:30:51 +00:00
ACCESS_REQUEST_APPROVERS_TO_BE_NOTIFIED_LIMIT = 10
2017-06-08 15:16:27 +00:00
has_many :group_members , - > { where ( requested_at : nil ) } , dependent : :destroy , as : :source # rubocop:disable Cop/ActiveRecordDependent
2015-11-11 15:42:27 +00:00
alias_method :members , :group_members
2018-04-18 13:41:42 +00:00
has_many :users , through : :group_members
2016-06-15 13:22:05 +00:00
has_many :owners ,
2018-04-18 13:41:42 +00:00
- > { where ( members : { access_level : Gitlab :: Access :: OWNER } ) } ,
2016-06-15 13:22:05 +00:00
through : :group_members ,
source : :user
2017-06-08 15:16:27 +00:00
has_many :requesters , - > { where . not ( requested_at : nil ) } , dependent : :destroy , as : :source , class_name : 'GroupMember' # rubocop:disable Cop/ActiveRecordDependent
2017-09-05 16:03:24 +00:00
has_many :members_and_requesters , as : :source , class_name : 'GroupMember'
2016-06-27 14:20:57 +00:00
2017-07-07 15:08:49 +00:00
has_many :milestones
2019-10-30 15:14:17 +00:00
has_many :shared_group_links , foreign_key : :shared_with_group_id , class_name : 'GroupGroupLink'
has_many :shared_with_group_links , foreign_key : :shared_group_id , class_name : 'GroupGroupLink'
has_many :shared_groups , through : :shared_group_links , source : :shared_group
has_many :shared_with_groups , through : :shared_with_group_links , source : :shared_with_group
2017-06-08 15:16:27 +00:00
has_many :project_group_links , dependent : :destroy # rubocop:disable Cop/ActiveRecordDependent
2018-04-18 13:41:42 +00:00
has_many :shared_projects , through : :project_group_links , source : :project
2018-05-28 18:43:46 +00:00
# Overridden on another method
# Left here just to be dependent: :destroy
2017-06-08 15:16:27 +00:00
has_many :notification_settings , dependent : :destroy , as : :source # rubocop:disable Cop/ActiveRecordDependent
2018-05-28 18:43:46 +00:00
2016-09-19 15:04:38 +00:00
has_many :labels , class_name : 'GroupLabel'
2017-05-03 18:51:55 +00:00
has_many :variables , class_name : 'Ci::GroupVariable'
2017-09-18 15:07:38 +00:00
has_many :custom_attributes , class_name : 'GroupCustomAttribute'
2013-04-02 22:28:12 +00:00
2018-02-19 19:06:16 +00:00
has_many :boards
2018-03-05 17:51:40 +00:00
has_many :badges , class_name : 'GroupBadge'
2018-02-19 19:06:16 +00:00
2018-10-14 20:42:29 +00:00
has_many :cluster_groups , class_name : 'Clusters::Group'
has_many :clusters , through : :cluster_groups , class_name : 'Clusters::Cluster'
2019-08-05 20:00:50 +00:00
has_many :container_repositories , through : :projects
2018-07-16 13:35:19 +00:00
has_many :todos
2019-11-11 21:06:20 +00:00
has_one :import_export_upload
2018-01-23 18:24:55 +00:00
accepts_nested_attributes_for :variables , allow_destroy : true
2016-03-18 12:28:16 +00:00
validate :visibility_level_allowed_by_projects
2017-08-29 05:49:01 +00:00
validate :visibility_level_allowed_by_sub_groups
2017-08-16 01:25:47 +00:00
validate :visibility_level_allowed_by_parent
2018-02-05 14:23:32 +00:00
validates :variables , variable_duplicates : true
2016-03-18 12:28:16 +00:00
2017-01-24 21:09:58 +00:00
validates :two_factor_grace_period , presence : true , numericality : { greater_than_or_equal_to : 0 }
2019-03-15 14:32:15 +00:00
add_authentication_token_field :runners_token , encrypted : - > { Feature . enabled? ( :groups_tokens_optional_encryption , default_enabled : true ) ? :optional : :required }
2017-09-06 13:46:57 +00:00
2014-08-21 10:53:32 +00:00
after_create :post_create_hook
after_destroy :post_destroy_hook
2017-01-24 21:09:58 +00:00
after_save :update_two_factor_requirement
2019-01-15 21:05:36 +00:00
after_update :path_changed_hook , if : :saved_change_to_path?
2014-08-21 10:53:32 +00:00
2019-07-04 09:13:50 +00:00
scope :with_users , - > { includes ( :users ) }
2015-02-06 03:15:05 +00:00
class << self
2018-04-04 09:19:47 +00:00
def sort_by_attribute ( method )
2016-11-22 16:58:10 +00:00
if method == 'storage_size_desc'
# storage_size is a virtual column so we need to
# pass a string to avoid AR adding the table name
reorder ( 'storage_size DESC, namespaces.id DESC' )
else
order_by ( method )
end
2015-02-06 03:15:05 +00:00
end
2015-05-03 03:11:21 +00:00
def reference_prefix
2015-05-14 20:59:39 +00:00
User . reference_prefix
end
def reference_pattern
User . reference_pattern
2015-05-03 03:11:21 +00:00
end
2015-11-18 11:27:21 +00:00
2018-09-07 12:29:19 +00:00
# WARNING: This method should never be used on its own
# please do make sure the number of rows you are filtering is small
# enough for this query
def public_or_visible_to_user ( user )
return public_to_user unless user
public_for_user = public_to_user_arel ( user )
visible_for_user = visible_to_user_arel ( user )
public_or_visible = public_for_user . or ( visible_for_user )
where ( public_or_visible )
2015-11-18 11:27:21 +00:00
end
2016-10-11 12:25:17 +00:00
def select_for_project_authorization
if current_scope . joins_values . include? ( :shared_projects )
2016-11-21 13:33:58 +00:00
joins ( 'INNER JOIN namespaces project_namespace ON project_namespace.id = projects.namespace_id' )
2019-01-16 12:09:29 +00:00
. where ( 'project_namespace.share_with_group_lock = ?' , false )
Use CTEs for nested groups and authorizations
This commit introduces the usage of Common Table Expressions (CTEs) to
efficiently retrieve nested group hierarchies, without having to rely on
the "routes" table (which is an _incredibly_ inefficient way of getting
the data). This requires a patch to ActiveRecord (found in the added
initializer) to work properly as ActiveRecord doesn't support WITH
statements properly out of the box.
Unfortunately MySQL provides no efficient way of getting nested groups.
For example, the old routes setup could easily take 5-10 seconds
depending on the amount of "routes" in a database. Providing vastly
different logic for both MySQL and PostgreSQL will negatively impact the
development process. Because of this the various nested groups related
methods return empty relations when used in combination with MySQL.
For project authorizations the logic is split up into two classes:
* Gitlab::ProjectAuthorizations::WithNestedGroups
* Gitlab::ProjectAuthorizations::WithoutNestedGroups
Both classes get the fresh project authorizations (= as they should be
in the "project_authorizations" table), including nested groups if
PostgreSQL is used. The logic of these two classes is quite different
apart from their public interface. This complicates development a bit,
but unfortunately there is no way around this.
This commit also introduces Gitlab::GroupHierarchy. This class can be
used to get the ancestors and descendants of a base relation, or both by
using a UNION. This in turn is used by methods such as:
* Namespace#ancestors
* Namespace#descendants
* User#all_expanded_groups
Again this class relies on CTEs and thus only works on PostgreSQL. The
Namespace methods will return an empty relation when MySQL is used,
while User#all_expanded_groups will return only the groups a user is a
direct member of.
Performance wise the impact is quite large. For example, on GitLab.com
Namespace#descendants used to take around 580 ms to retrieve data for a
particular user. Using CTEs we are able to reduce this down to roughly 1
millisecond, returning the exact same data.
== On The Fly Refreshing
Refreshing of authorizations on the fly (= when
users.authorized_projects_populated was not set) is removed with this
commit. This simplifies the code, and ensures any queries used for
authorizations are not mutated because they are executed in a Rails
scope (e.g. Project.visible_to_user).
This commit includes a migration to schedule refreshing authorizations
for all users, ensuring all of them have their authorizations in place.
Said migration schedules users in batches of 5000, with 5 minutes
between every batch to smear the load around a bit.
== Spec Changes
This commit also introduces some changes to various specs. For example,
some specs for ProjectTeam assumed that creating a personal project
would _not_ lead to the owner having access, which is incorrect. Because
we also no longer refresh authorizations on the fly for new users some
code had to be added to the "empty_project" factory. This chunk of code
ensures that the owner's permissions are refreshed after creating the
project, something that is normally done in Projects::CreateService.
2017-04-24 15:19:22 +00:00
. select ( " projects.id AS project_id, LEAST(project_group_links.group_access, members.access_level) AS access_level " )
2016-10-11 12:25:17 +00:00
else
super
end
end
2018-09-07 12:29:19 +00:00
private
def public_to_user_arel ( user )
self . arel_table [ :visibility_level ]
. in ( Gitlab :: VisibilityLevel . levels_for_user ( user ) )
end
def visible_to_user_arel ( user )
groups_table = self . arel_table
2019-11-12 15:06:26 +00:00
authorized_groups = user . authorized_groups . arel . as ( 'authorized' )
2018-09-07 12:29:19 +00:00
groups_table . project ( 1 )
. from ( authorized_groups )
. where ( authorized_groups [ :id ] . eq ( groups_table [ :id ] ) )
. exists
end
2015-05-03 03:11:21 +00:00
end
2018-05-28 18:43:46 +00:00
# Overrides notification_settings has_many association
# This allows to apply notification settings from parent groups
# to child groups and projects.
2019-04-26 15:17:06 +00:00
def notification_settings ( hierarchy_order : nil )
2018-05-28 18:43:46 +00:00
source_type = self . class . base_class . name
2019-04-26 15:17:06 +00:00
settings = NotificationSetting . where ( source_type : source_type , source_id : self_and_ancestors_ids )
2018-05-28 18:43:46 +00:00
2019-04-26 15:17:06 +00:00
return settings unless hierarchy_order && self_and_ancestors_ids . length > 1
settings
. joins ( " LEFT JOIN ( #{ self_and_ancestors ( hierarchy_order : hierarchy_order ) . to_sql } ) AS ordered_groups ON notification_settings.source_id = ordered_groups.id " )
. select ( 'notification_settings.*, ordered_groups.depth AS depth' )
. order ( " ordered_groups.depth #{ hierarchy_order } " )
2018-05-28 18:43:46 +00:00
end
2019-05-13 20:52:57 +00:00
def notification_settings_for ( user , hierarchy_order : nil )
notification_settings ( hierarchy_order : hierarchy_order ) . where ( user : user )
end
2019-07-18 17:04:43 +00:00
def notification_email_for ( user )
# Finds the closest notification_setting with a `notification_email`
notification_settings = notification_settings_for ( user , hierarchy_order : :asc )
notification_settings . find { | n | n . notification_email . present? } & . notification_email
end
2017-11-22 13:20:35 +00:00
def to_reference ( _from = nil , full : nil )
2017-02-13 11:26:33 +00:00
" #{ self . class . reference_prefix } #{ full_path } "
2015-02-06 03:15:05 +00:00
end
2016-06-02 14:14:02 +00:00
def web_url
2016-10-26 18:13:58 +00:00
Gitlab :: Routing . url_helpers . group_canonical_url ( self )
2016-06-02 14:14:02 +00:00
end
2012-11-23 04:11:09 +00:00
def human_name
2016-12-13 15:00:06 +00:00
full_name
2012-11-23 04:11:09 +00:00
end
2012-12-30 12:26:19 +00:00
2017-08-24 21:21:10 +00:00
def visibility_level_allowed_by_parent? ( level = self . visibility_level )
2017-08-25 20:03:16 +00:00
return true unless parent_id && parent_id . nonzero?
2016-03-18 12:28:16 +00:00
2017-08-24 21:21:10 +00:00
level < = parent . visibility_level
end
2017-08-23 16:51:11 +00:00
2017-08-24 21:21:10 +00:00
def visibility_level_allowed_by_projects? ( level = self . visibility_level )
2017-08-25 20:54:05 +00:00
! projects . where ( 'visibility_level > ?' , level ) . exists?
2017-08-24 21:21:10 +00:00
end
2016-03-18 12:28:16 +00:00
2017-08-24 21:21:10 +00:00
def visibility_level_allowed_by_sub_groups? ( level = self . visibility_level )
2017-08-25 20:54:05 +00:00
! children . where ( 'visibility_level > ?' , level ) . exists?
2016-03-18 12:28:16 +00:00
end
2017-08-24 22:19:49 +00:00
def visibility_level_allowed? ( level = self . visibility_level )
visibility_level_allowed_by_parent? ( level ) &&
visibility_level_allowed_by_projects? ( level ) &&
visibility_level_allowed_by_sub_groups? ( level )
2016-03-18 12:28:16 +00:00
end
2016-09-01 23:49:48 +00:00
def lfs_enabled?
return false unless Gitlab . config . lfs . enabled
return Gitlab . config . lfs . enabled if self [ :lfs_enabled ] . nil?
self [ :lfs_enabled ]
end
2018-04-23 15:48:26 +00:00
def owned_by? ( user )
owners . include? ( user )
end
2016-09-16 15:54:21 +00:00
def add_users ( users , access_level , current_user : nil , expires_at : nil )
2017-04-21 14:07:42 +00:00
GroupMember . add_users (
2016-09-16 15:54:21 +00:00
self ,
users ,
access_level ,
current_user : current_user ,
expires_at : expires_at
)
2013-06-18 13:56:31 +00:00
end
2018-05-31 12:00:36 +00:00
def add_user ( user , access_level , current_user : nil , expires_at : nil , ldap : false )
2016-09-16 15:54:21 +00:00
GroupMember . add_user (
self ,
user ,
access_level ,
current_user : current_user ,
2018-05-31 12:00:36 +00:00
expires_at : expires_at ,
ldap : ldap
2016-09-16 15:54:21 +00:00
)
2013-09-25 11:05:35 +00:00
end
2015-08-07 04:20:02 +00:00
def add_guest ( user , current_user = nil )
2016-09-16 15:54:21 +00:00
add_user ( user , :guest , current_user : current_user )
2015-08-07 04:20:02 +00:00
end
def add_reporter ( user , current_user = nil )
2016-09-16 15:54:21 +00:00
add_user ( user , :reporter , current_user : current_user )
2015-08-07 04:20:02 +00:00
end
def add_developer ( user , current_user = nil )
2016-09-16 15:54:21 +00:00
add_user ( user , :developer , current_user : current_user )
2015-08-07 04:20:02 +00:00
end
2018-07-11 14:36:08 +00:00
def add_maintainer ( user , current_user = nil )
add_user ( user , :maintainer , current_user : current_user )
2015-08-07 04:20:02 +00:00
end
2018-07-11 14:36:08 +00:00
# @deprecated
alias_method :add_master , :add_maintainer
2015-11-17 14:49:37 +00:00
def add_owner ( user , current_user = nil )
2016-09-16 15:54:21 +00:00
add_user ( user , :owner , current_user : current_user )
2015-11-17 14:49:37 +00:00
end
2017-11-01 17:35:14 +00:00
def member? ( user , min_access_level = Gitlab :: Access :: GUEST )
return false unless user
max_member_access_for_user ( user ) > = min_access_level
end
2015-11-17 14:49:37 +00:00
def has_owner? ( user )
2017-07-24 10:35:54 +00:00
return false unless user
2019-04-04 14:19:57 +00:00
members_with_parents . owners . exists? ( user_id : user )
2015-11-17 14:49:37 +00:00
end
2018-07-11 14:36:08 +00:00
def has_maintainer? ( user )
2017-07-24 10:35:54 +00:00
return false unless user
2019-04-04 14:19:57 +00:00
members_with_parents . maintainers . exists? ( user_id : user )
2015-11-17 14:49:37 +00:00
end
2019-11-08 09:06:07 +00:00
def has_container_repository_including_subgroups?
:: ContainerRepository . for_group_and_its_subgroups ( self ) . exists?
2019-10-16 09:07:51 +00:00
end
2018-07-11 14:36:08 +00:00
# @deprecated
alias_method :has_master? , :has_maintainer?
2016-12-13 18:59:39 +00:00
# Check if user is a last owner of the group.
2015-11-17 14:49:37 +00:00
def last_owner? ( user )
2019-04-04 14:19:57 +00:00
has_owner? ( user ) && members_with_parents . owners . size == 1
2015-11-17 14:49:37 +00:00
end
2018-05-31 12:00:36 +00:00
def ldap_synced?
false
end
2014-08-21 10:53:32 +00:00
def post_create_hook
2015-06-03 14:15:58 +00:00
Gitlab :: AppLogger . info ( " Group \" #{ name } \" was created " )
2014-08-21 10:53:32 +00:00
system_hook_service . execute_hooks_for ( self , :create )
end
def post_destroy_hook
2015-06-03 14:15:58 +00:00
Gitlab :: AppLogger . info ( " Group \" #{ name } \" was removed " )
2014-08-21 10:53:32 +00:00
system_hook_service . execute_hooks_for ( self , :destroy )
end
2018-08-27 15:31:01 +00:00
# rubocop: disable CodeReuse/ServiceClass
2014-08-21 10:53:32 +00:00
def system_hook_service
SystemHooksService . new
end
2018-08-27 15:31:01 +00:00
# rubocop: enable CodeReuse/ServiceClass
2016-10-11 12:25:17 +00:00
2018-08-27 15:31:01 +00:00
# rubocop: disable CodeReuse/ServiceClass
2017-08-23 14:28:16 +00:00
def refresh_members_authorized_projects ( blocking : true )
2017-06-21 13:48:12 +00:00
UserProjectAccessChangedService . new ( user_ids_for_project_authorizations )
2017-08-23 14:28:16 +00:00
. execute ( blocking : blocking )
2017-02-07 13:55:42 +00:00
end
2018-08-27 15:31:01 +00:00
# rubocop: enable CodeReuse/ServiceClass
2017-02-07 13:55:42 +00:00
def user_ids_for_project_authorizations
2017-08-11 14:19:11 +00:00
members_with_parents . pluck ( :user_id )
2016-12-13 18:59:39 +00:00
end
2018-05-28 18:43:46 +00:00
def self_and_ancestors_ids
strong_memoize ( :self_and_ancestors_ids ) do
self_and_ancestors . pluck ( :id )
end
end
2016-12-13 18:59:39 +00:00
def members_with_parents
2017-08-11 14:19:11 +00:00
# Avoids an unnecessary SELECT when the group has no parents
source_ids =
if parent_id
self_and_ancestors . reorder ( nil ) . select ( :id )
else
id
end
GroupMember
2018-03-21 16:14:32 +00:00
. active_without_invites_and_requests
2017-08-11 14:19:11 +00:00
. where ( source_id : source_ids )
end
def members_with_descendants
GroupMember
2018-03-21 16:14:32 +00:00
. active_without_invites_and_requests
2017-08-11 14:19:11 +00:00
. where ( source_id : self_and_descendants . reorder ( nil ) . select ( :id ) )
2016-12-13 18:59:39 +00:00
end
2018-04-26 19:53:13 +00:00
# Returns all members that are part of the group, it's subgroups, and ancestor groups
def direct_and_indirect_members
GroupMember
. active_without_invites_and_requests
. where ( source_id : self_and_hierarchy . reorder ( nil ) . select ( :id ) )
end
2016-12-13 18:59:39 +00:00
def users_with_parents
2017-08-11 14:19:11 +00:00
User
. where ( id : members_with_parents . select ( :user_id ) )
. reorder ( nil )
2016-10-11 12:25:17 +00:00
end
2017-03-01 19:34:29 +00:00
2017-06-27 20:35:35 +00:00
def users_with_descendants
2017-08-11 14:19:11 +00:00
User
. where ( id : members_with_descendants . select ( :user_id ) )
. reorder ( nil )
2017-06-27 20:35:35 +00:00
end
2018-04-26 19:53:13 +00:00
# Returns all users that are members of the group because:
# 1. They belong to the group
# 2. They belong to a project that belongs to the group
# 3. They belong to a sub-group or project in such sub-group
# 4. They belong to an ancestor group
def direct_and_indirect_users
2018-09-11 15:31:34 +00:00
User . from_union ( [
2018-04-26 19:53:13 +00:00
User
. where ( id : direct_and_indirect_members . select ( :user_id ) )
. reorder ( nil ) ,
project_users_with_descendants
] )
end
# Returns all users that are members of projects
# belonging to the current group or sub-groups
def project_users_with_descendants
User
. joins ( projects : :group )
. where ( namespaces : { id : self_and_descendants . select ( :id ) } )
end
2017-06-02 14:13:10 +00:00
def max_member_access_for_user ( user )
2019-08-28 10:09:45 +00:00
return GroupMember :: NO_ACCESS unless user
2017-06-02 14:13:10 +00:00
return GroupMember :: OWNER if user . admin?
2019-10-30 15:14:17 +00:00
max_member_access = members_with_parents . where ( user_id : user )
. reorder ( access_level : :desc )
. first
& . access_level
max_member_access || max_member_access_for_user_from_shared_groups ( user ) || GroupMember :: NO_ACCESS
2017-06-02 14:13:10 +00:00
end
2017-03-01 19:34:29 +00:00
def mattermost_team_params
max_length = 59
{
name : path [ 0 .. max_length ] ,
display_name : name [ 0 .. max_length ] ,
type : public ? ? 'O' : 'I' # Open vs Invite-only
}
end
2017-01-24 21:09:58 +00:00
2018-10-30 08:49:26 +00:00
def ci_variables_for ( ref , project )
2017-07-05 15:13:01 +00:00
list_of_ids = [ self ] + ancestors
variables = Ci :: GroupVariable . where ( group : list_of_ids )
variables = variables . unprotected unless project . protected_for? ( ref )
variables = variables . group_by ( & :group_id )
2019-07-26 10:44:13 +00:00
list_of_ids . reverse . flat_map { | group | variables [ group . id ] } . compact
2017-05-03 18:51:55 +00:00
end
2017-11-30 11:52:38 +00:00
def group_member ( user )
if group_members . loaded?
group_members . find { | gm | gm . user_id == user . id }
else
group_members . find_by ( user_id : user )
end
end
2019-01-15 17:57:17 +00:00
def highest_group_member ( user )
GroupMember . where ( source_id : self_and_ancestors_ids , user_id : user . id ) . order ( :access_level ) . last
end
2017-12-06 11:36:11 +00:00
def hashed_storage? ( _feature )
false
end
2018-04-06 15:23:49 +00:00
def refresh_project_authorizations
refresh_members_authorized_projects ( blocking : false )
end
2017-10-04 11:57:50 +00:00
# each existing group needs to have a `runners_token`.
# we do this on read since migrating all existing groups is not a feasible
# solution.
def runners_token
ensure_runners_token!
end
2019-04-05 18:49:46 +00:00
def project_creation_level
super || :: Gitlab :: CurrentSettings . default_project_creation
end
2019-07-01 20:41:32 +00:00
def subgroup_creation_level
2019-07-10 19:27:12 +00:00
super || :: Gitlab :: Access :: OWNER_SUBGROUP_ACCESS
2019-07-01 20:41:32 +00:00
end
2019-08-30 21:30:51 +00:00
def access_request_approvers_to_be_notified
members . owners . order_recent_sign_in . limit ( ACCESS_REQUEST_APPROVERS_TO_BE_NOTIFIED_LIMIT )
end
2019-10-11 06:06:27 +00:00
def supports_events?
false
end
2019-11-14 12:06:30 +00:00
def export_file_exists?
export_file & . file
end
def export_file
import_export_upload & . export_file
end
2017-08-29 05:49:01 +00:00
private
2017-01-24 21:09:58 +00:00
def update_two_factor_requirement
2019-01-15 21:05:36 +00:00
return unless saved_change_to_require_two_factor_authentication? || saved_change_to_two_factor_grace_period?
2017-01-24 21:09:58 +00:00
2019-06-13 12:36:54 +00:00
members_with_descendants . find_each ( & :update_two_factor_requirement )
2017-01-24 21:09:58 +00:00
end
2017-08-29 05:49:01 +00:00
2017-11-03 11:26:52 +00:00
def path_changed_hook
system_hook_service . execute_hooks_for ( self , :rename )
end
2017-08-29 05:49:01 +00:00
def visibility_level_allowed_by_parent
return if visibility_level_allowed_by_parent?
2017-08-30 19:37:08 +00:00
errors . add ( :visibility_level , " #{ visibility } is not allowed since the parent group has a #{ parent . visibility } visibility. " )
2017-08-29 05:49:01 +00:00
end
def visibility_level_allowed_by_projects
return if visibility_level_allowed_by_projects?
2017-08-30 19:37:08 +00:00
errors . add ( :visibility_level , " #{ visibility } is not allowed since this group contains projects with higher visibility. " )
2017-08-29 05:49:01 +00:00
end
def visibility_level_allowed_by_sub_groups
return if visibility_level_allowed_by_sub_groups?
2017-08-30 19:37:08 +00:00
errors . add ( :visibility_level , " #{ visibility } is not allowed since there are sub-groups with higher visibility. " )
2017-08-29 05:49:01 +00:00
end
2019-10-17 15:06:17 +00:00
2019-10-30 15:14:17 +00:00
def max_member_access_for_user_from_shared_groups ( user )
return unless Feature . enabled? ( :share_group_with_group )
group_group_link_table = GroupGroupLink . arel_table
group_member_table = GroupMember . arel_table
group_group_links_query = GroupGroupLink . where ( shared_group_id : self_and_ancestors_ids )
cte = Gitlab :: SQL :: CTE . new ( :group_group_links_cte , group_group_links_query )
link = GroupGroupLink
. with ( cte . to_arel )
. from ( [ group_member_table , cte . alias_to ( group_group_link_table ) ] )
. where ( group_member_table [ :user_id ] . eq ( user . id ) )
. where ( group_member_table [ :source_id ] . eq ( group_group_link_table [ :shared_with_group_id ] ) )
. reorder ( Arel :: Nodes :: Descending . new ( group_group_link_table [ :group_access ] ) )
. first
link & . group_access
end
2019-10-17 15:06:17 +00:00
def self . groups_including_descendants_by ( group_ids )
Gitlab :: ObjectHierarchy
. new ( Group . where ( id : group_ids ) )
. base_and_descendants
end
2012-10-02 15:17:12 +00:00
end
2019-09-13 13:26:31 +00:00
Group . prepend_if_ee ( 'EE::Group' )