2018-07-24 10:00:56 +00:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2016-08-16 23:29:19 +00:00
|
|
|
class GlobalPolicy < BasePolicy
|
2017-04-06 21:06:42 +00:00
|
|
|
desc "User is an internal user"
|
|
|
|
with_options scope: :user, score: 0
|
2018-05-09 10:55:31 +00:00
|
|
|
condition(:internal) { @user&.internal? }
|
2016-08-30 18:14:07 +00:00
|
|
|
|
2017-04-06 21:06:42 +00:00
|
|
|
desc "User's access has been locked"
|
|
|
|
with_options scope: :user, score: 0
|
2018-05-09 10:55:31 +00:00
|
|
|
condition(:access_locked) { @user&.access_locked? }
|
2017-02-28 21:09:23 +00:00
|
|
|
|
2018-05-09 10:55:31 +00:00
|
|
|
condition(:can_create_fork, scope: :user) { @user && @user.manageable_namespaces.any? { |namespace| @user.can?(:create_projects, namespace) } }
|
2017-09-29 11:14:39 +00:00
|
|
|
|
2018-05-08 13:07:55 +00:00
|
|
|
condition(:required_terms_not_accepted, scope: :user, score: 0) do
|
|
|
|
@user&.required_terms_not_accepted?
|
|
|
|
end
|
|
|
|
|
2018-07-23 13:30:11 +00:00
|
|
|
condition(:private_instance_statistics, score: 0) { Gitlab::CurrentSettings.instance_statistics_visibility_private? }
|
2018-07-25 15:36:08 +00:00
|
|
|
|
2020-04-21 15:21:10 +00:00
|
|
|
condition(:project_bot, scope: :user) { @user&.project_bot? }
|
2020-05-04 21:09:41 +00:00
|
|
|
condition(:migration_bot, scope: :user) { @user&.migration_bot? }
|
2020-04-21 15:21:10 +00:00
|
|
|
|
2018-07-25 15:36:08 +00:00
|
|
|
rule { admin | (~private_instance_statistics & ~anonymous) }
|
|
|
|
.enable :read_instance_statistics
|
2018-07-23 13:30:11 +00:00
|
|
|
|
2017-06-30 13:29:34 +00:00
|
|
|
rule { anonymous }.policy do
|
|
|
|
prevent :log_in
|
|
|
|
prevent :receive_notifications
|
|
|
|
prevent :use_quick_actions
|
|
|
|
prevent :create_group
|
|
|
|
end
|
2017-04-06 21:06:42 +00:00
|
|
|
|
|
|
|
rule { default }.policy do
|
|
|
|
enable :log_in
|
|
|
|
enable :access_api
|
|
|
|
enable :access_git
|
|
|
|
enable :receive_notifications
|
|
|
|
enable :use_quick_actions
|
2019-07-04 10:31:44 +00:00
|
|
|
enable :use_slash_commands
|
2017-04-06 21:06:42 +00:00
|
|
|
end
|
|
|
|
|
2020-01-30 21:08:47 +00:00
|
|
|
rule { inactive }.policy do
|
|
|
|
prevent :log_in
|
|
|
|
prevent :access_api
|
|
|
|
prevent :access_git
|
|
|
|
prevent :use_slash_commands
|
|
|
|
end
|
|
|
|
|
2017-04-06 21:06:42 +00:00
|
|
|
rule { blocked | internal }.policy do
|
|
|
|
prevent :log_in
|
|
|
|
prevent :access_api
|
|
|
|
prevent :receive_notifications
|
2019-07-04 10:31:44 +00:00
|
|
|
prevent :use_slash_commands
|
2017-04-06 21:06:42 +00:00
|
|
|
end
|
|
|
|
|
2020-05-04 21:09:41 +00:00
|
|
|
rule { blocked | (internal & ~migration_bot) }.policy do
|
|
|
|
prevent :access_git
|
|
|
|
end
|
|
|
|
|
2020-04-21 15:21:10 +00:00
|
|
|
rule { project_bot }.policy do
|
|
|
|
prevent :log_in
|
|
|
|
prevent :receive_notifications
|
|
|
|
end
|
|
|
|
|
2019-10-10 00:06:44 +00:00
|
|
|
rule { deactivated }.policy do
|
|
|
|
prevent :access_git
|
|
|
|
prevent :access_api
|
|
|
|
prevent :receive_notifications
|
2019-10-11 00:06:24 +00:00
|
|
|
prevent :use_slash_commands
|
2019-10-10 00:06:44 +00:00
|
|
|
end
|
|
|
|
|
2018-05-08 13:07:55 +00:00
|
|
|
rule { required_terms_not_accepted }.policy do
|
|
|
|
prevent :access_api
|
|
|
|
prevent :access_git
|
|
|
|
end
|
|
|
|
|
2017-04-06 21:06:42 +00:00
|
|
|
rule { can_create_group }.policy do
|
|
|
|
enable :create_group
|
|
|
|
end
|
|
|
|
|
2020-04-24 09:09:44 +00:00
|
|
|
rule { can?(:create_group) }.policy do
|
|
|
|
enable :create_group_with_default_branch_protection
|
|
|
|
end
|
|
|
|
|
2017-09-29 11:14:39 +00:00
|
|
|
rule { can_create_fork }.policy do
|
|
|
|
enable :create_fork
|
|
|
|
end
|
|
|
|
|
2017-04-06 21:06:42 +00:00
|
|
|
rule { access_locked }.policy do
|
|
|
|
prevent :log_in
|
2019-07-04 10:31:44 +00:00
|
|
|
prevent :use_slash_commands
|
2016-08-16 23:29:19 +00:00
|
|
|
end
|
2017-06-30 13:29:34 +00:00
|
|
|
|
2017-08-01 07:46:13 +00:00
|
|
|
rule { ~(anonymous & restricted_public_level) }.policy do
|
2017-06-30 13:29:34 +00:00
|
|
|
enable :read_users_list
|
2016-08-16 23:29:19 +00:00
|
|
|
end
|
2017-09-28 16:49:42 +00:00
|
|
|
|
2019-01-24 16:23:57 +00:00
|
|
|
rule { ~anonymous }.policy do
|
|
|
|
enable :read_instance_metadata
|
2020-01-23 12:08:38 +00:00
|
|
|
enable :create_snippet
|
2019-01-24 16:23:57 +00:00
|
|
|
end
|
|
|
|
|
2017-09-28 16:49:42 +00:00
|
|
|
rule { admin }.policy do
|
|
|
|
enable :read_custom_attribute
|
|
|
|
enable :update_custom_attribute
|
|
|
|
end
|
2019-11-29 21:06:13 +00:00
|
|
|
|
2020-06-19 21:08:32 +00:00
|
|
|
# We can't use `read_statistics` because the user may have different permissions for different projects
|
|
|
|
rule { admin }.enable :use_project_statistics_filters
|
|
|
|
|
2020-01-23 12:08:38 +00:00
|
|
|
rule { external_user }.prevent :create_snippet
|
2016-08-16 23:29:19 +00:00
|
|
|
end
|
2019-09-13 13:26:31 +00:00
|
|
|
|
|
|
|
GlobalPolicy.prepend_if_ee('EE::GlobalPolicy')
|