2016-07-18 04:16:56 -04:00
|
|
|
module Gitlab
|
|
|
|
module Checks
|
|
|
|
class ChangeAccess
|
2017-03-13 07:31:27 -04:00
|
|
|
attr_reader :user_access, :project, :skip_authorization, :protocol
|
2016-07-18 04:16:56 -04:00
|
|
|
|
2016-11-17 14:48:23 -05:00
|
|
|
def initialize(
|
2017-04-05 03:35:58 -04:00
|
|
|
change, user_access:, project:, skip_authorization: false,
|
2017-03-13 07:31:27 -04:00
|
|
|
protocol:
|
|
|
|
)
|
2016-07-28 00:04:57 -04:00
|
|
|
@oldrev, @newrev, @ref = change.values_at(:oldrev, :newrev, :ref)
|
|
|
|
@branch_name = Gitlab::Git.branch_name(@ref)
|
2017-03-31 12:57:29 -04:00
|
|
|
@tag_name = Gitlab::Git.tag_name(@ref)
|
2016-07-18 04:16:56 -04:00
|
|
|
@user_access = user_access
|
|
|
|
@project = project
|
2016-11-17 14:48:23 -05:00
|
|
|
@skip_authorization = skip_authorization
|
2017-03-13 07:31:27 -04:00
|
|
|
@protocol = protocol
|
2016-07-18 04:16:56 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
def exec
|
2017-05-08 03:41:58 -04:00
|
|
|
return GitAccessStatus.new(true) if skip_authorization
|
|
|
|
|
|
|
|
error = push_checks || branch_checks || tag_checks
|
2016-07-18 04:16:56 -04:00
|
|
|
|
|
|
|
if error
|
|
|
|
GitAccessStatus.new(false, error)
|
|
|
|
else
|
|
|
|
GitAccessStatus.new(true)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
protected
|
|
|
|
|
2017-05-08 03:41:58 -04:00
|
|
|
def push_checks
|
|
|
|
if user_access.cannot_do_action?(:push_code)
|
|
|
|
"You are not allowed to push code to this project."
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def branch_checks
|
2016-09-13 05:43:41 -04:00
|
|
|
return unless @branch_name
|
2017-05-08 03:41:58 -04:00
|
|
|
|
|
|
|
if deletion? && @branch_name == project.default_branch
|
|
|
|
return "The default branch of a project cannot be deleted."
|
|
|
|
end
|
|
|
|
|
|
|
|
protected_branch_checks
|
|
|
|
end
|
|
|
|
|
|
|
|
def protected_branch_checks
|
2017-04-03 13:59:58 -04:00
|
|
|
return unless ProtectedBranch.protected?(project, @branch_name)
|
2016-07-18 04:16:56 -04:00
|
|
|
|
2017-01-12 17:37:14 -05:00
|
|
|
if forced_push?
|
2016-07-18 04:16:56 -04:00
|
|
|
return "You are not allowed to force push code to a protected branch on this project."
|
|
|
|
end
|
|
|
|
|
2017-05-08 03:41:58 -04:00
|
|
|
if deletion?
|
|
|
|
protected_branch_deletion_checks
|
|
|
|
else
|
|
|
|
protected_branch_push_checks
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def protected_branch_deletion_checks
|
|
|
|
unless user_access.can_delete_branch?(@branch_name)
|
|
|
|
return 'You are not allowed to delete protected branches from this project. Only a project master or owner can delete a protected branch.'
|
|
|
|
end
|
|
|
|
|
|
|
|
unless protocol == 'web'
|
|
|
|
'You can only delete protected branches using the web interface.'
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def protected_branch_push_checks
|
2016-07-18 04:16:56 -04:00
|
|
|
if matching_merge_request?
|
2017-05-08 03:41:58 -04:00
|
|
|
unless user_access.can_merge_to_branch?(@branch_name) || user_access.can_push_to_branch?(@branch_name)
|
2016-07-18 04:16:56 -04:00
|
|
|
"You are not allowed to merge code into protected branches on this project."
|
|
|
|
end
|
|
|
|
else
|
2017-05-08 03:41:58 -04:00
|
|
|
unless user_access.can_push_to_branch?(@branch_name)
|
2016-07-18 04:16:56 -04:00
|
|
|
"You are not allowed to push code to protected branches on this project."
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def tag_checks
|
2017-03-31 12:57:29 -04:00
|
|
|
return unless @tag_name
|
2016-07-18 04:16:56 -04:00
|
|
|
|
2017-03-31 12:57:29 -04:00
|
|
|
if tag_exists? && user_access.cannot_do_action?(:admin_project)
|
2017-04-03 19:05:51 -04:00
|
|
|
return "You are not allowed to change existing tags on this project."
|
2016-07-18 04:16:56 -04:00
|
|
|
end
|
2017-03-31 12:57:29 -04:00
|
|
|
|
|
|
|
protected_tag_checks
|
|
|
|
end
|
|
|
|
|
|
|
|
def protected_tag_checks
|
2017-05-08 03:41:58 -04:00
|
|
|
return unless ProtectedTag.protected?(project, @tag_name)
|
|
|
|
|
2017-04-05 13:59:46 -04:00
|
|
|
return "Protected tags cannot be updated." if update?
|
|
|
|
return "Protected tags cannot be deleted." if deletion?
|
2017-03-31 12:57:29 -04:00
|
|
|
|
2017-04-03 21:05:42 -04:00
|
|
|
unless user_access.can_create_tag?(@tag_name)
|
2017-03-31 14:30:33 -04:00
|
|
|
return "You are not allowed to create this tag as it is protected."
|
2017-03-31 12:57:29 -04:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2016-07-18 04:16:56 -04:00
|
|
|
private
|
|
|
|
|
2017-03-31 12:57:29 -04:00
|
|
|
def tag_exists?
|
|
|
|
project.repository.tag_exists?(@tag_name)
|
2016-07-18 04:16:56 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
def forced_push?
|
2017-04-05 03:35:58 -04:00
|
|
|
Gitlab::Checks::ForcePush.force_push?(@project, @oldrev, @newrev)
|
2016-07-18 04:16:56 -04:00
|
|
|
end
|
|
|
|
|
2017-04-03 19:05:51 -04:00
|
|
|
def update?
|
|
|
|
!Gitlab::Git.blank_ref?(@oldrev) && !deletion?
|
|
|
|
end
|
|
|
|
|
|
|
|
def deletion?
|
2017-03-31 12:57:29 -04:00
|
|
|
Gitlab::Git.blank_ref?(@newrev)
|
|
|
|
end
|
|
|
|
|
2016-07-18 04:16:56 -04:00
|
|
|
def matching_merge_request?
|
|
|
|
Checks::MatchingMergeRequest.new(@newrev, @branch_name, @project).match?
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|