2014-05-15 08:17:13 +00:00
|
|
|
module Gitlab
|
2016-07-18 08:16:56 +00:00
|
|
|
class UserAccess
|
2017-07-18 09:48:48 +00:00
|
|
|
extend Gitlab::Cache::RequestCache
|
2017-07-04 09:48:45 +00:00
|
|
|
|
2017-07-18 10:04:20 +00:00
|
|
|
request_cache_key do
|
2017-07-04 09:48:45 +00:00
|
|
|
[user&.id, project&.id]
|
|
|
|
end
|
|
|
|
|
2018-02-02 15:27:30 +00:00
|
|
|
attr_reader :user
|
|
|
|
attr_accessor :project
|
2016-07-18 08:16:56 +00:00
|
|
|
|
|
|
|
def initialize(user, project: nil)
|
|
|
|
@user = user
|
|
|
|
@project = project
|
|
|
|
end
|
|
|
|
|
|
|
|
def can_do_action?(action)
|
2017-03-09 21:59:19 +00:00
|
|
|
return false unless can_access_git?
|
2016-11-16 14:07:04 +00:00
|
|
|
|
2018-01-09 17:30:04 +00:00
|
|
|
permission_cache[action] =
|
|
|
|
permission_cache.fetch(action) do
|
|
|
|
user.can?(action, project)
|
|
|
|
end
|
2016-07-18 08:16:56 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def cannot_do_action?(action)
|
|
|
|
!can_do_action?(action)
|
|
|
|
end
|
|
|
|
|
|
|
|
def allowed?
|
2017-03-09 21:59:19 +00:00
|
|
|
return false unless can_access_git?
|
2014-05-15 08:17:13 +00:00
|
|
|
|
2016-03-10 11:37:14 +00:00
|
|
|
if user.requires_ldap_check? && user.try_obtain_ldap_lease
|
2018-02-23 12:10:39 +00:00
|
|
|
return false unless Gitlab::Auth::LDAP::Access.allowed?(user)
|
2014-05-15 08:17:13 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
true
|
|
|
|
end
|
2016-07-18 08:16:56 +00:00
|
|
|
|
2017-07-18 10:04:20 +00:00
|
|
|
request_cache def can_create_tag?(ref)
|
2017-03-31 16:57:29 +00:00
|
|
|
return false unless can_access_git?
|
|
|
|
|
2017-07-19 11:12:11 +00:00
|
|
|
if protected?(ProtectedTag, project, ref)
|
|
|
|
protected_tag_accessible_to?(ref, action: :create)
|
2017-03-31 16:57:29 +00:00
|
|
|
else
|
|
|
|
user.can?(:push_code, project)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2017-07-18 10:04:20 +00:00
|
|
|
request_cache def can_delete_branch?(ref)
|
2017-05-08 07:41:58 +00:00
|
|
|
return false unless can_access_git?
|
|
|
|
|
2017-07-19 11:12:11 +00:00
|
|
|
if protected?(ProtectedBranch, project, ref)
|
2017-05-08 07:41:58 +00:00
|
|
|
user.can?(:delete_protected_branch, project)
|
|
|
|
else
|
|
|
|
user.can?(:push_code, project)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2017-07-18 13:56:28 +00:00
|
|
|
def can_update_branch?(ref)
|
2017-07-03 21:01:05 +00:00
|
|
|
can_push_to_branch?(ref) || can_merge_to_branch?(ref)
|
|
|
|
end
|
|
|
|
|
2017-07-18 10:04:20 +00:00
|
|
|
request_cache def can_push_to_branch?(ref)
|
2017-03-09 21:59:19 +00:00
|
|
|
return false unless can_access_git?
|
2016-07-18 08:16:56 +00:00
|
|
|
|
2017-07-19 11:12:11 +00:00
|
|
|
if protected?(ProtectedBranch, project, ref)
|
2017-12-11 14:21:06 +00:00
|
|
|
return true if project.user_can_push_to_empty_repo?(user)
|
2016-08-01 15:48:15 +00:00
|
|
|
|
2017-07-19 11:12:11 +00:00
|
|
|
protected_branch_accessible_to?(ref, action: :push)
|
2018-02-27 13:18:32 +00:00
|
|
|
elsif user.can?(:push_code, project)
|
|
|
|
true
|
2016-07-18 08:16:56 +00:00
|
|
|
else
|
2018-03-06 22:30:47 +00:00
|
|
|
project.branch_allows_maintainer_push?(user, ref)
|
2016-07-18 08:16:56 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2017-07-18 10:04:20 +00:00
|
|
|
request_cache def can_merge_to_branch?(ref)
|
2017-03-09 21:59:19 +00:00
|
|
|
return false unless can_access_git?
|
2016-07-18 08:16:56 +00:00
|
|
|
|
2017-07-19 11:12:11 +00:00
|
|
|
if protected?(ProtectedBranch, project, ref)
|
|
|
|
protected_branch_accessible_to?(ref, action: :merge)
|
2016-07-18 08:16:56 +00:00
|
|
|
else
|
|
|
|
user.can?(:push_code, project)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def can_read_project?
|
2017-03-09 21:59:19 +00:00
|
|
|
return false unless can_access_git?
|
2016-07-18 08:16:56 +00:00
|
|
|
|
|
|
|
user.can?(:read_project, project)
|
|
|
|
end
|
2016-11-16 14:07:04 +00:00
|
|
|
|
|
|
|
private
|
|
|
|
|
2018-01-09 17:30:04 +00:00
|
|
|
def permission_cache
|
|
|
|
@permission_cache ||= {}
|
|
|
|
end
|
|
|
|
|
2017-03-09 21:59:19 +00:00
|
|
|
def can_access_git?
|
|
|
|
user && user.can?(:access_git)
|
2016-11-16 14:07:04 +00:00
|
|
|
end
|
2017-07-19 11:12:11 +00:00
|
|
|
|
|
|
|
def protected_branch_accessible_to?(ref, action:)
|
|
|
|
ProtectedBranch.protected_ref_accessible_to?(
|
2017-07-19 14:37:38 +00:00
|
|
|
ref, user,
|
|
|
|
action: action,
|
2017-07-19 11:12:11 +00:00
|
|
|
protected_refs: project.protected_branches)
|
|
|
|
end
|
|
|
|
|
|
|
|
def protected_tag_accessible_to?(ref, action:)
|
|
|
|
ProtectedTag.protected_ref_accessible_to?(
|
2017-07-19 14:37:38 +00:00
|
|
|
ref, user,
|
|
|
|
action: action,
|
2017-07-19 11:12:11 +00:00
|
|
|
protected_refs: project.protected_tags)
|
|
|
|
end
|
|
|
|
|
|
|
|
request_cache def protected?(kind, project, ref)
|
|
|
|
kind.protected?(project, ref)
|
|
|
|
end
|
2014-05-15 08:17:13 +00:00
|
|
|
end
|
|
|
|
end
|