2018-07-25 05:30:33 -04:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2011-10-08 17:36:38 -04:00
|
|
|
class Ability
|
2012-10-08 20:10:04 -04:00
|
|
|
class << self
|
2016-08-23 20:29:40 -04:00
|
|
|
# Given a list of users and a project this method returns the users that can
|
|
|
|
# read the given project.
|
|
|
|
def users_that_can_read_project(users, project)
|
2017-04-06 17:07:27 -04:00
|
|
|
DeclarativePolicy.subject_scope do
|
|
|
|
users.select { |u| allowed?(u, :read_project, project) }
|
2016-08-23 20:29:40 -04:00
|
|
|
end
|
|
|
|
end
|
2016-08-08 13:07:15 -04:00
|
|
|
|
2018-04-26 15:53:13 -04:00
|
|
|
# Given a list of users and a group this method returns the users that can
|
|
|
|
# read the given group.
|
|
|
|
def users_that_can_read_group(users, group)
|
|
|
|
DeclarativePolicy.subject_scope do
|
|
|
|
users.select { |u| allowed?(u, :read_group, group) }
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2017-01-05 08:36:06 -05:00
|
|
|
# Given a list of users and a snippet this method returns the users that can
|
|
|
|
# read the given snippet.
|
|
|
|
def users_that_can_read_personal_snippet(users, snippet)
|
2017-04-06 17:07:27 -04:00
|
|
|
DeclarativePolicy.subject_scope do
|
2020-01-23 07:08:38 -05:00
|
|
|
users.select { |u| allowed?(u, :read_snippet, snippet) }
|
2017-01-05 08:36:06 -05:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2016-08-23 20:29:40 -04:00
|
|
|
# Returns an Array of Issues that can be read by the given user.
|
|
|
|
#
|
|
|
|
# issues - The issues to reduce down to those readable by the user.
|
|
|
|
# user - The User for which to check the issues
|
2017-12-11 09:21:06 -05:00
|
|
|
# filters - A hash of abilities and filters to apply if the user lacks this
|
|
|
|
# ability
|
|
|
|
def issues_readable_by_user(issues, user = nil, filters: {})
|
|
|
|
issues = apply_filters_if_needed(issues, user, filters)
|
|
|
|
|
2017-04-06 17:07:27 -04:00
|
|
|
DeclarativePolicy.user_scope do
|
|
|
|
issues.select { |issue| issue.visible_to_user?(user) }
|
|
|
|
end
|
2016-08-23 20:29:40 -04:00
|
|
|
end
|
|
|
|
|
2017-12-11 09:21:06 -05:00
|
|
|
# Returns an Array of MergeRequests that can be read by the given user.
|
|
|
|
#
|
2020-03-16 17:09:21 -04:00
|
|
|
# merge_requests - MRs out of which to collect MRs readable by the user.
|
2017-12-11 09:21:06 -05:00
|
|
|
# user - The User for which to check the merge_requests
|
|
|
|
# filters - A hash of abilities and filters to apply if the user lacks this
|
|
|
|
# ability
|
|
|
|
def merge_requests_readable_by_user(merge_requests, user = nil, filters: {})
|
|
|
|
merge_requests = apply_filters_if_needed(merge_requests, user, filters)
|
|
|
|
|
|
|
|
DeclarativePolicy.user_scope do
|
|
|
|
merge_requests.select { |mr| allowed?(user, :read_merge_request, mr) }
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2017-04-06 17:06:42 -04:00
|
|
|
def allowed?(user, action, subject = :global, opts = {})
|
|
|
|
if subject.is_a?(Hash)
|
2021-04-19 17:09:27 -04:00
|
|
|
opts = subject
|
|
|
|
subject = :global
|
2017-04-06 17:06:42 -04:00
|
|
|
end
|
2016-08-08 13:07:15 -04:00
|
|
|
|
2017-04-06 17:06:42 -04:00
|
|
|
policy = policy_for(user, subject)
|
2016-08-08 13:07:15 -04:00
|
|
|
|
2017-04-06 17:06:42 -04:00
|
|
|
case opts[:scope]
|
|
|
|
when :user
|
|
|
|
DeclarativePolicy.user_scope { policy.can?(action) }
|
|
|
|
when :subject
|
|
|
|
DeclarativePolicy.subject_scope { policy.can?(action) }
|
|
|
|
else
|
|
|
|
policy.can?(action)
|
|
|
|
end
|
2016-08-08 13:07:15 -04:00
|
|
|
end
|
|
|
|
|
2017-04-06 17:06:42 -04:00
|
|
|
def policy_for(user, subject = :global)
|
2018-09-20 18:40:15 -04:00
|
|
|
cache = Gitlab::SafeRequestStore.active? ? Gitlab::SafeRequestStore : {}
|
2017-04-06 17:06:42 -04:00
|
|
|
DeclarativePolicy.policy_for(user, subject, cache: cache)
|
2016-08-04 10:00:31 -04:00
|
|
|
end
|
2017-12-11 09:21:06 -05:00
|
|
|
|
|
|
|
private
|
|
|
|
|
|
|
|
def apply_filters_if_needed(elements, user, filters)
|
|
|
|
filters.each do |ability, filter|
|
|
|
|
elements = filter.call(elements) unless allowed?(user, ability)
|
|
|
|
end
|
|
|
|
|
|
|
|
elements
|
|
|
|
end
|
2011-10-17 06:39:03 -04:00
|
|
|
end
|
2011-10-08 17:36:38 -04:00
|
|
|
end
|