2018-07-25 09:30:33 +00:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2014-01-27 21:34:05 +00:00
|
|
|
require 'carrierwave/orm/activerecord'
|
|
|
|
|
2012-11-22 18:34:16 +00:00
|
|
|
class Group < Namespace
|
2015-08-24 14:46:06 +00:00
|
|
|
include Gitlab::ConfigHelper
|
2017-11-29 15:30:17 +00:00
|
|
|
include AfterCommitQueue
|
2016-04-18 16:53:32 +00:00
|
|
|
include AccessRequestable
|
2017-05-10 04:26:17 +00:00
|
|
|
include Avatarable
|
2015-05-03 03:11:21 +00:00
|
|
|
include Referable
|
2016-10-11 12:25:17 +00:00
|
|
|
include SelectForProjectAuthorization
|
2017-10-05 08:32:52 +00:00
|
|
|
include LoadedInGroupList
|
2017-09-19 11:11:09 +00:00
|
|
|
include GroupDescendant
|
2017-09-06 13:46:57 +00:00
|
|
|
include TokenAuthenticatable
|
2018-05-07 13:49:32 +00:00
|
|
|
include WithUploads
|
2018-05-28 18:43:46 +00:00
|
|
|
include Gitlab::Utils::StrongMemoize
|
2016-03-01 15:22:29 +00:00
|
|
|
|
2017-06-08 15:16:27 +00:00
|
|
|
has_many :group_members, -> { where(requested_at: nil) }, dependent: :destroy, as: :source # rubocop:disable Cop/ActiveRecordDependent
|
2015-11-11 15:42:27 +00:00
|
|
|
alias_method :members, :group_members
|
2018-04-18 13:41:42 +00:00
|
|
|
has_many :users, through: :group_members
|
2016-06-15 13:22:05 +00:00
|
|
|
has_many :owners,
|
2018-04-18 13:41:42 +00:00
|
|
|
-> { where(members: { access_level: Gitlab::Access::OWNER }) },
|
2016-06-15 13:22:05 +00:00
|
|
|
through: :group_members,
|
|
|
|
source: :user
|
|
|
|
|
2017-06-08 15:16:27 +00:00
|
|
|
has_many :requesters, -> { where.not(requested_at: nil) }, dependent: :destroy, as: :source, class_name: 'GroupMember' # rubocop:disable Cop/ActiveRecordDependent
|
2017-09-05 16:03:24 +00:00
|
|
|
has_many :members_and_requesters, as: :source, class_name: 'GroupMember'
|
2016-06-27 14:20:57 +00:00
|
|
|
|
2017-07-07 15:08:49 +00:00
|
|
|
has_many :milestones
|
2017-06-08 15:16:27 +00:00
|
|
|
has_many :project_group_links, dependent: :destroy # rubocop:disable Cop/ActiveRecordDependent
|
2018-04-18 13:41:42 +00:00
|
|
|
has_many :shared_projects, through: :project_group_links, source: :project
|
2018-05-28 18:43:46 +00:00
|
|
|
|
|
|
|
# Overridden on another method
|
|
|
|
# Left here just to be dependent: :destroy
|
2017-06-08 15:16:27 +00:00
|
|
|
has_many :notification_settings, dependent: :destroy, as: :source # rubocop:disable Cop/ActiveRecordDependent
|
2018-05-28 18:43:46 +00:00
|
|
|
|
2016-09-19 15:04:38 +00:00
|
|
|
has_many :labels, class_name: 'GroupLabel'
|
2017-05-03 18:51:55 +00:00
|
|
|
has_many :variables, class_name: 'Ci::GroupVariable'
|
2017-09-18 15:07:38 +00:00
|
|
|
has_many :custom_attributes, class_name: 'GroupCustomAttribute'
|
2013-04-02 22:28:12 +00:00
|
|
|
|
2018-02-19 19:06:16 +00:00
|
|
|
has_many :boards
|
2018-03-05 17:51:40 +00:00
|
|
|
has_many :badges, class_name: 'GroupBadge'
|
2018-02-19 19:06:16 +00:00
|
|
|
|
2018-07-16 13:35:19 +00:00
|
|
|
has_many :todos
|
|
|
|
|
2018-01-23 18:24:55 +00:00
|
|
|
accepts_nested_attributes_for :variables, allow_destroy: true
|
|
|
|
|
2016-03-18 12:28:16 +00:00
|
|
|
validate :visibility_level_allowed_by_projects
|
2017-08-29 05:49:01 +00:00
|
|
|
validate :visibility_level_allowed_by_sub_groups
|
2017-08-16 01:25:47 +00:00
|
|
|
validate :visibility_level_allowed_by_parent
|
2018-02-05 14:23:32 +00:00
|
|
|
validates :variables, variable_duplicates: true
|
2016-03-18 12:28:16 +00:00
|
|
|
|
2017-01-24 21:09:58 +00:00
|
|
|
validates :two_factor_grace_period, presence: true, numericality: { greater_than_or_equal_to: 0 }
|
|
|
|
|
2017-09-06 13:46:57 +00:00
|
|
|
add_authentication_token_field :runners_token
|
|
|
|
|
2014-08-21 10:53:32 +00:00
|
|
|
after_create :post_create_hook
|
|
|
|
after_destroy :post_destroy_hook
|
2017-01-24 21:09:58 +00:00
|
|
|
after_save :update_two_factor_requirement
|
2017-11-03 11:26:52 +00:00
|
|
|
after_update :path_changed_hook, if: :path_changed?
|
2014-08-21 10:53:32 +00:00
|
|
|
|
2015-02-06 03:15:05 +00:00
|
|
|
class << self
|
Use CTEs for nested groups and authorizations
This commit introduces the usage of Common Table Expressions (CTEs) to
efficiently retrieve nested group hierarchies, without having to rely on
the "routes" table (which is an _incredibly_ inefficient way of getting
the data). This requires a patch to ActiveRecord (found in the added
initializer) to work properly as ActiveRecord doesn't support WITH
statements properly out of the box.
Unfortunately MySQL provides no efficient way of getting nested groups.
For example, the old routes setup could easily take 5-10 seconds
depending on the amount of "routes" in a database. Providing vastly
different logic for both MySQL and PostgreSQL will negatively impact the
development process. Because of this the various nested groups related
methods return empty relations when used in combination with MySQL.
For project authorizations the logic is split up into two classes:
* Gitlab::ProjectAuthorizations::WithNestedGroups
* Gitlab::ProjectAuthorizations::WithoutNestedGroups
Both classes get the fresh project authorizations (= as they should be
in the "project_authorizations" table), including nested groups if
PostgreSQL is used. The logic of these two classes is quite different
apart from their public interface. This complicates development a bit,
but unfortunately there is no way around this.
This commit also introduces Gitlab::GroupHierarchy. This class can be
used to get the ancestors and descendants of a base relation, or both by
using a UNION. This in turn is used by methods such as:
* Namespace#ancestors
* Namespace#descendants
* User#all_expanded_groups
Again this class relies on CTEs and thus only works on PostgreSQL. The
Namespace methods will return an empty relation when MySQL is used,
while User#all_expanded_groups will return only the groups a user is a
direct member of.
Performance wise the impact is quite large. For example, on GitLab.com
Namespace#descendants used to take around 580 ms to retrieve data for a
particular user. Using CTEs we are able to reduce this down to roughly 1
millisecond, returning the exact same data.
== On The Fly Refreshing
Refreshing of authorizations on the fly (= when
users.authorized_projects_populated was not set) is removed with this
commit. This simplifies the code, and ensures any queries used for
authorizations are not mutated because they are executed in a Rails
scope (e.g. Project.visible_to_user).
This commit includes a migration to schedule refreshing authorizations
for all users, ensuring all of them have their authorizations in place.
Said migration schedules users in batches of 5000, with 5 minutes
between every batch to smear the load around a bit.
== Spec Changes
This commit also introduces some changes to various specs. For example,
some specs for ProjectTeam assumed that creating a personal project
would _not_ lead to the owner having access, which is incorrect. Because
we also no longer refresh authorizations on the fly for new users some
code had to be added to the "empty_project" factory. This chunk of code
ensures that the owner's permissions are refreshed after creating the
project, something that is normally done in Projects::CreateService.
2017-04-24 15:19:22 +00:00
|
|
|
def supports_nested_groups?
|
|
|
|
Gitlab::Database.postgresql?
|
|
|
|
end
|
|
|
|
|
2018-04-04 09:19:47 +00:00
|
|
|
def sort_by_attribute(method)
|
2016-11-22 16:58:10 +00:00
|
|
|
if method == 'storage_size_desc'
|
|
|
|
# storage_size is a virtual column so we need to
|
|
|
|
# pass a string to avoid AR adding the table name
|
|
|
|
reorder('storage_size DESC, namespaces.id DESC')
|
|
|
|
else
|
|
|
|
order_by(method)
|
|
|
|
end
|
2015-02-06 03:15:05 +00:00
|
|
|
end
|
2015-05-03 03:11:21 +00:00
|
|
|
|
|
|
|
def reference_prefix
|
2015-05-14 20:59:39 +00:00
|
|
|
User.reference_prefix
|
|
|
|
end
|
|
|
|
|
|
|
|
def reference_pattern
|
|
|
|
User.reference_pattern
|
2015-05-03 03:11:21 +00:00
|
|
|
end
|
2015-11-18 11:27:21 +00:00
|
|
|
|
2018-09-07 12:29:19 +00:00
|
|
|
# WARNING: This method should never be used on its own
|
|
|
|
# please do make sure the number of rows you are filtering is small
|
|
|
|
# enough for this query
|
|
|
|
def public_or_visible_to_user(user)
|
|
|
|
return public_to_user unless user
|
|
|
|
|
|
|
|
public_for_user = public_to_user_arel(user)
|
|
|
|
visible_for_user = visible_to_user_arel(user)
|
|
|
|
public_or_visible = public_for_user.or(visible_for_user)
|
|
|
|
|
|
|
|
where(public_or_visible)
|
2015-11-18 11:27:21 +00:00
|
|
|
end
|
2016-10-11 12:25:17 +00:00
|
|
|
|
|
|
|
def select_for_project_authorization
|
|
|
|
if current_scope.joins_values.include?(:shared_projects)
|
2016-11-21 13:33:58 +00:00
|
|
|
joins('INNER JOIN namespaces project_namespace ON project_namespace.id = projects.namespace_id')
|
|
|
|
.where('project_namespace.share_with_group_lock = ?', false)
|
Use CTEs for nested groups and authorizations
This commit introduces the usage of Common Table Expressions (CTEs) to
efficiently retrieve nested group hierarchies, without having to rely on
the "routes" table (which is an _incredibly_ inefficient way of getting
the data). This requires a patch to ActiveRecord (found in the added
initializer) to work properly as ActiveRecord doesn't support WITH
statements properly out of the box.
Unfortunately MySQL provides no efficient way of getting nested groups.
For example, the old routes setup could easily take 5-10 seconds
depending on the amount of "routes" in a database. Providing vastly
different logic for both MySQL and PostgreSQL will negatively impact the
development process. Because of this the various nested groups related
methods return empty relations when used in combination with MySQL.
For project authorizations the logic is split up into two classes:
* Gitlab::ProjectAuthorizations::WithNestedGroups
* Gitlab::ProjectAuthorizations::WithoutNestedGroups
Both classes get the fresh project authorizations (= as they should be
in the "project_authorizations" table), including nested groups if
PostgreSQL is used. The logic of these two classes is quite different
apart from their public interface. This complicates development a bit,
but unfortunately there is no way around this.
This commit also introduces Gitlab::GroupHierarchy. This class can be
used to get the ancestors and descendants of a base relation, or both by
using a UNION. This in turn is used by methods such as:
* Namespace#ancestors
* Namespace#descendants
* User#all_expanded_groups
Again this class relies on CTEs and thus only works on PostgreSQL. The
Namespace methods will return an empty relation when MySQL is used,
while User#all_expanded_groups will return only the groups a user is a
direct member of.
Performance wise the impact is quite large. For example, on GitLab.com
Namespace#descendants used to take around 580 ms to retrieve data for a
particular user. Using CTEs we are able to reduce this down to roughly 1
millisecond, returning the exact same data.
== On The Fly Refreshing
Refreshing of authorizations on the fly (= when
users.authorized_projects_populated was not set) is removed with this
commit. This simplifies the code, and ensures any queries used for
authorizations are not mutated because they are executed in a Rails
scope (e.g. Project.visible_to_user).
This commit includes a migration to schedule refreshing authorizations
for all users, ensuring all of them have their authorizations in place.
Said migration schedules users in batches of 5000, with 5 minutes
between every batch to smear the load around a bit.
== Spec Changes
This commit also introduces some changes to various specs. For example,
some specs for ProjectTeam assumed that creating a personal project
would _not_ lead to the owner having access, which is incorrect. Because
we also no longer refresh authorizations on the fly for new users some
code had to be added to the "empty_project" factory. This chunk of code
ensures that the owner's permissions are refreshed after creating the
project, something that is normally done in Projects::CreateService.
2017-04-24 15:19:22 +00:00
|
|
|
.select("projects.id AS project_id, LEAST(project_group_links.group_access, members.access_level) AS access_level")
|
2016-10-11 12:25:17 +00:00
|
|
|
else
|
|
|
|
super
|
|
|
|
end
|
|
|
|
end
|
2018-09-07 12:29:19 +00:00
|
|
|
|
|
|
|
private
|
|
|
|
|
|
|
|
def public_to_user_arel(user)
|
|
|
|
self.arel_table[:visibility_level]
|
|
|
|
.in(Gitlab::VisibilityLevel.levels_for_user(user))
|
|
|
|
end
|
|
|
|
|
|
|
|
def visible_to_user_arel(user)
|
|
|
|
groups_table = self.arel_table
|
|
|
|
authorized_groups = user.authorized_groups.as('authorized')
|
|
|
|
|
|
|
|
groups_table.project(1)
|
|
|
|
.from(authorized_groups)
|
|
|
|
.where(authorized_groups[:id].eq(groups_table[:id]))
|
|
|
|
.exists
|
|
|
|
end
|
2015-05-03 03:11:21 +00:00
|
|
|
end
|
|
|
|
|
2018-05-28 18:43:46 +00:00
|
|
|
# Overrides notification_settings has_many association
|
|
|
|
# This allows to apply notification settings from parent groups
|
|
|
|
# to child groups and projects.
|
|
|
|
def notification_settings
|
|
|
|
source_type = self.class.base_class.name
|
|
|
|
|
|
|
|
NotificationSetting.where(source_type: source_type, source_id: self_and_ancestors_ids)
|
|
|
|
end
|
|
|
|
|
2017-11-22 13:20:35 +00:00
|
|
|
def to_reference(_from = nil, full: nil)
|
2017-02-13 11:26:33 +00:00
|
|
|
"#{self.class.reference_prefix}#{full_path}"
|
2015-02-06 03:15:05 +00:00
|
|
|
end
|
|
|
|
|
2016-06-02 14:14:02 +00:00
|
|
|
def web_url
|
2016-10-26 18:13:58 +00:00
|
|
|
Gitlab::Routing.url_helpers.group_canonical_url(self)
|
2016-06-02 14:14:02 +00:00
|
|
|
end
|
|
|
|
|
2012-11-23 04:11:09 +00:00
|
|
|
def human_name
|
2016-12-13 15:00:06 +00:00
|
|
|
full_name
|
2012-11-23 04:11:09 +00:00
|
|
|
end
|
2012-12-30 12:26:19 +00:00
|
|
|
|
2017-08-24 21:21:10 +00:00
|
|
|
def visibility_level_allowed_by_parent?(level = self.visibility_level)
|
2017-08-25 20:03:16 +00:00
|
|
|
return true unless parent_id && parent_id.nonzero?
|
2016-03-18 12:28:16 +00:00
|
|
|
|
2017-08-24 21:21:10 +00:00
|
|
|
level <= parent.visibility_level
|
|
|
|
end
|
2017-08-23 16:51:11 +00:00
|
|
|
|
2017-08-24 21:21:10 +00:00
|
|
|
def visibility_level_allowed_by_projects?(level = self.visibility_level)
|
2017-08-25 20:54:05 +00:00
|
|
|
!projects.where('visibility_level > ?', level).exists?
|
2017-08-24 21:21:10 +00:00
|
|
|
end
|
2016-03-18 12:28:16 +00:00
|
|
|
|
2017-08-24 21:21:10 +00:00
|
|
|
def visibility_level_allowed_by_sub_groups?(level = self.visibility_level)
|
2017-08-25 20:54:05 +00:00
|
|
|
!children.where('visibility_level > ?', level).exists?
|
2016-03-18 12:28:16 +00:00
|
|
|
end
|
|
|
|
|
2017-08-24 22:19:49 +00:00
|
|
|
def visibility_level_allowed?(level = self.visibility_level)
|
|
|
|
visibility_level_allowed_by_parent?(level) &&
|
|
|
|
visibility_level_allowed_by_projects?(level) &&
|
|
|
|
visibility_level_allowed_by_sub_groups?(level)
|
2016-03-18 12:28:16 +00:00
|
|
|
end
|
|
|
|
|
2016-09-01 23:49:48 +00:00
|
|
|
def lfs_enabled?
|
|
|
|
return false unless Gitlab.config.lfs.enabled
|
|
|
|
return Gitlab.config.lfs.enabled if self[:lfs_enabled].nil?
|
|
|
|
|
|
|
|
self[:lfs_enabled]
|
|
|
|
end
|
|
|
|
|
2018-04-23 15:48:26 +00:00
|
|
|
def owned_by?(user)
|
|
|
|
owners.include?(user)
|
|
|
|
end
|
|
|
|
|
2016-09-16 15:54:21 +00:00
|
|
|
def add_users(users, access_level, current_user: nil, expires_at: nil)
|
2017-04-21 14:07:42 +00:00
|
|
|
GroupMember.add_users(
|
2016-09-16 15:54:21 +00:00
|
|
|
self,
|
|
|
|
users,
|
|
|
|
access_level,
|
|
|
|
current_user: current_user,
|
|
|
|
expires_at: expires_at
|
|
|
|
)
|
2013-06-18 13:56:31 +00:00
|
|
|
end
|
|
|
|
|
2018-05-31 12:00:36 +00:00
|
|
|
def add_user(user, access_level, current_user: nil, expires_at: nil, ldap: false)
|
2016-09-16 15:54:21 +00:00
|
|
|
GroupMember.add_user(
|
|
|
|
self,
|
|
|
|
user,
|
|
|
|
access_level,
|
|
|
|
current_user: current_user,
|
2018-05-31 12:00:36 +00:00
|
|
|
expires_at: expires_at,
|
|
|
|
ldap: ldap
|
2016-09-16 15:54:21 +00:00
|
|
|
)
|
2013-09-25 11:05:35 +00:00
|
|
|
end
|
|
|
|
|
2015-08-07 04:20:02 +00:00
|
|
|
def add_guest(user, current_user = nil)
|
2016-09-16 15:54:21 +00:00
|
|
|
add_user(user, :guest, current_user: current_user)
|
2015-08-07 04:20:02 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def add_reporter(user, current_user = nil)
|
2016-09-16 15:54:21 +00:00
|
|
|
add_user(user, :reporter, current_user: current_user)
|
2015-08-07 04:20:02 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def add_developer(user, current_user = nil)
|
2016-09-16 15:54:21 +00:00
|
|
|
add_user(user, :developer, current_user: current_user)
|
2015-08-07 04:20:02 +00:00
|
|
|
end
|
|
|
|
|
2018-07-11 14:36:08 +00:00
|
|
|
def add_maintainer(user, current_user = nil)
|
|
|
|
add_user(user, :maintainer, current_user: current_user)
|
2015-08-07 04:20:02 +00:00
|
|
|
end
|
|
|
|
|
2018-07-11 14:36:08 +00:00
|
|
|
# @deprecated
|
|
|
|
alias_method :add_master, :add_maintainer
|
|
|
|
|
2015-11-17 14:49:37 +00:00
|
|
|
def add_owner(user, current_user = nil)
|
2016-09-16 15:54:21 +00:00
|
|
|
add_user(user, :owner, current_user: current_user)
|
2015-11-17 14:49:37 +00:00
|
|
|
end
|
|
|
|
|
2017-11-01 17:35:14 +00:00
|
|
|
def member?(user, min_access_level = Gitlab::Access::GUEST)
|
|
|
|
return false unless user
|
|
|
|
|
|
|
|
max_member_access_for_user(user) >= min_access_level
|
|
|
|
end
|
|
|
|
|
2015-11-17 14:49:37 +00:00
|
|
|
def has_owner?(user)
|
2017-07-24 10:35:54 +00:00
|
|
|
return false unless user
|
|
|
|
|
2016-12-13 18:59:39 +00:00
|
|
|
members_with_parents.owners.where(user_id: user).any?
|
2015-11-17 14:49:37 +00:00
|
|
|
end
|
|
|
|
|
2018-07-11 14:36:08 +00:00
|
|
|
def has_maintainer?(user)
|
2017-07-24 10:35:54 +00:00
|
|
|
return false unless user
|
|
|
|
|
2018-07-11 14:36:08 +00:00
|
|
|
members_with_parents.maintainers.where(user_id: user).any?
|
2015-11-17 14:49:37 +00:00
|
|
|
end
|
|
|
|
|
2018-07-11 14:36:08 +00:00
|
|
|
# @deprecated
|
|
|
|
alias_method :has_master?, :has_maintainer?
|
|
|
|
|
2016-12-13 18:59:39 +00:00
|
|
|
# Check if user is a last owner of the group.
|
|
|
|
# Parent owners are ignored for nested groups.
|
2015-11-17 14:49:37 +00:00
|
|
|
def last_owner?(user)
|
2016-12-13 18:59:39 +00:00
|
|
|
owners.include?(user) && owners.size == 1
|
2015-11-17 14:49:37 +00:00
|
|
|
end
|
|
|
|
|
2018-05-31 12:00:36 +00:00
|
|
|
def ldap_synced?
|
|
|
|
false
|
|
|
|
end
|
|
|
|
|
2014-08-21 10:53:32 +00:00
|
|
|
def post_create_hook
|
2015-06-03 14:15:58 +00:00
|
|
|
Gitlab::AppLogger.info("Group \"#{name}\" was created")
|
|
|
|
|
2014-08-21 10:53:32 +00:00
|
|
|
system_hook_service.execute_hooks_for(self, :create)
|
|
|
|
end
|
|
|
|
|
|
|
|
def post_destroy_hook
|
2015-06-03 14:15:58 +00:00
|
|
|
Gitlab::AppLogger.info("Group \"#{name}\" was removed")
|
|
|
|
|
2014-08-21 10:53:32 +00:00
|
|
|
system_hook_service.execute_hooks_for(self, :destroy)
|
|
|
|
end
|
|
|
|
|
2018-08-27 15:31:01 +00:00
|
|
|
# rubocop: disable CodeReuse/ServiceClass
|
2014-08-21 10:53:32 +00:00
|
|
|
def system_hook_service
|
|
|
|
SystemHooksService.new
|
|
|
|
end
|
2018-08-27 15:31:01 +00:00
|
|
|
# rubocop: enable CodeReuse/ServiceClass
|
2016-10-11 12:25:17 +00:00
|
|
|
|
2018-08-27 15:31:01 +00:00
|
|
|
# rubocop: disable CodeReuse/ServiceClass
|
2017-08-23 14:28:16 +00:00
|
|
|
def refresh_members_authorized_projects(blocking: true)
|
2017-06-21 13:48:12 +00:00
|
|
|
UserProjectAccessChangedService.new(user_ids_for_project_authorizations)
|
2017-08-23 14:28:16 +00:00
|
|
|
.execute(blocking: blocking)
|
2017-02-07 13:55:42 +00:00
|
|
|
end
|
2018-08-27 15:31:01 +00:00
|
|
|
# rubocop: enable CodeReuse/ServiceClass
|
2017-02-07 13:55:42 +00:00
|
|
|
|
|
|
|
def user_ids_for_project_authorizations
|
2017-08-11 14:19:11 +00:00
|
|
|
members_with_parents.pluck(:user_id)
|
2016-12-13 18:59:39 +00:00
|
|
|
end
|
|
|
|
|
2018-05-28 18:43:46 +00:00
|
|
|
def self_and_ancestors_ids
|
|
|
|
strong_memoize(:self_and_ancestors_ids) do
|
|
|
|
self_and_ancestors.pluck(:id)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2016-12-13 18:59:39 +00:00
|
|
|
def members_with_parents
|
2017-08-11 14:19:11 +00:00
|
|
|
# Avoids an unnecessary SELECT when the group has no parents
|
|
|
|
source_ids =
|
|
|
|
if parent_id
|
|
|
|
self_and_ancestors.reorder(nil).select(:id)
|
|
|
|
else
|
|
|
|
id
|
|
|
|
end
|
|
|
|
|
|
|
|
GroupMember
|
2018-03-21 16:14:32 +00:00
|
|
|
.active_without_invites_and_requests
|
2017-08-11 14:19:11 +00:00
|
|
|
.where(source_id: source_ids)
|
|
|
|
end
|
|
|
|
|
|
|
|
def members_with_descendants
|
|
|
|
GroupMember
|
2018-03-21 16:14:32 +00:00
|
|
|
.active_without_invites_and_requests
|
2017-08-11 14:19:11 +00:00
|
|
|
.where(source_id: self_and_descendants.reorder(nil).select(:id))
|
2016-12-13 18:59:39 +00:00
|
|
|
end
|
|
|
|
|
2018-04-26 19:53:13 +00:00
|
|
|
# Returns all members that are part of the group, it's subgroups, and ancestor groups
|
|
|
|
def direct_and_indirect_members
|
|
|
|
GroupMember
|
|
|
|
.active_without_invites_and_requests
|
|
|
|
.where(source_id: self_and_hierarchy.reorder(nil).select(:id))
|
|
|
|
end
|
|
|
|
|
2016-12-13 18:59:39 +00:00
|
|
|
def users_with_parents
|
2017-08-11 14:19:11 +00:00
|
|
|
User
|
|
|
|
.where(id: members_with_parents.select(:user_id))
|
|
|
|
.reorder(nil)
|
2016-10-11 12:25:17 +00:00
|
|
|
end
|
2017-03-01 19:34:29 +00:00
|
|
|
|
2017-06-27 20:35:35 +00:00
|
|
|
def users_with_descendants
|
2017-08-11 14:19:11 +00:00
|
|
|
User
|
|
|
|
.where(id: members_with_descendants.select(:user_id))
|
|
|
|
.reorder(nil)
|
2017-06-27 20:35:35 +00:00
|
|
|
end
|
|
|
|
|
2018-04-26 19:53:13 +00:00
|
|
|
# Returns all users that are members of the group because:
|
|
|
|
# 1. They belong to the group
|
|
|
|
# 2. They belong to a project that belongs to the group
|
|
|
|
# 3. They belong to a sub-group or project in such sub-group
|
|
|
|
# 4. They belong to an ancestor group
|
|
|
|
def direct_and_indirect_users
|
2018-09-11 15:31:34 +00:00
|
|
|
User.from_union([
|
2018-04-26 19:53:13 +00:00
|
|
|
User
|
|
|
|
.where(id: direct_and_indirect_members.select(:user_id))
|
|
|
|
.reorder(nil),
|
|
|
|
project_users_with_descendants
|
|
|
|
])
|
|
|
|
end
|
|
|
|
|
|
|
|
# Returns all users that are members of projects
|
|
|
|
# belonging to the current group or sub-groups
|
|
|
|
def project_users_with_descendants
|
|
|
|
User
|
|
|
|
.joins(projects: :group)
|
|
|
|
.where(namespaces: { id: self_and_descendants.select(:id) })
|
|
|
|
end
|
|
|
|
|
2017-06-02 14:13:10 +00:00
|
|
|
def max_member_access_for_user(user)
|
|
|
|
return GroupMember::OWNER if user.admin?
|
|
|
|
|
2017-06-21 13:48:12 +00:00
|
|
|
members_with_parents
|
|
|
|
.where(user_id: user)
|
|
|
|
.reorder(access_level: :desc)
|
|
|
|
.first&.
|
2017-06-02 14:13:10 +00:00
|
|
|
access_level || GroupMember::NO_ACCESS
|
|
|
|
end
|
|
|
|
|
2017-03-01 19:34:29 +00:00
|
|
|
def mattermost_team_params
|
|
|
|
max_length = 59
|
|
|
|
|
|
|
|
{
|
|
|
|
name: path[0..max_length],
|
|
|
|
display_name: name[0..max_length],
|
|
|
|
type: public? ? 'O' : 'I' # Open vs Invite-only
|
|
|
|
}
|
|
|
|
end
|
2017-01-24 21:09:58 +00:00
|
|
|
|
2017-05-03 18:51:55 +00:00
|
|
|
def secret_variables_for(ref, project)
|
2017-07-05 15:13:01 +00:00
|
|
|
list_of_ids = [self] + ancestors
|
|
|
|
variables = Ci::GroupVariable.where(group: list_of_ids)
|
|
|
|
variables = variables.unprotected unless project.protected_for?(ref)
|
|
|
|
variables = variables.group_by(&:group_id)
|
|
|
|
list_of_ids.reverse.map { |group| variables[group.id] }.compact.flatten
|
2017-05-03 18:51:55 +00:00
|
|
|
end
|
|
|
|
|
2017-11-30 11:52:38 +00:00
|
|
|
def group_member(user)
|
|
|
|
if group_members.loaded?
|
|
|
|
group_members.find { |gm| gm.user_id == user.id }
|
|
|
|
else
|
|
|
|
group_members.find_by(user_id: user)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2017-12-06 11:36:11 +00:00
|
|
|
def hashed_storage?(_feature)
|
|
|
|
false
|
|
|
|
end
|
|
|
|
|
2018-04-06 15:23:49 +00:00
|
|
|
def refresh_project_authorizations
|
|
|
|
refresh_members_authorized_projects(blocking: false)
|
|
|
|
end
|
|
|
|
|
2017-10-04 11:57:50 +00:00
|
|
|
# each existing group needs to have a `runners_token`.
|
|
|
|
# we do this on read since migrating all existing groups is not a feasible
|
|
|
|
# solution.
|
|
|
|
def runners_token
|
|
|
|
ensure_runners_token!
|
|
|
|
end
|
|
|
|
|
2017-08-29 05:49:01 +00:00
|
|
|
private
|
2017-01-24 21:09:58 +00:00
|
|
|
|
|
|
|
def update_two_factor_requirement
|
|
|
|
return unless require_two_factor_authentication_changed? || two_factor_grace_period_changed?
|
|
|
|
|
|
|
|
users.find_each(&:update_two_factor_requirement)
|
|
|
|
end
|
2017-08-29 05:49:01 +00:00
|
|
|
|
2017-11-03 11:26:52 +00:00
|
|
|
def path_changed_hook
|
|
|
|
system_hook_service.execute_hooks_for(self, :rename)
|
|
|
|
end
|
|
|
|
|
2017-08-29 05:49:01 +00:00
|
|
|
def visibility_level_allowed_by_parent
|
|
|
|
return if visibility_level_allowed_by_parent?
|
|
|
|
|
2017-08-30 19:37:08 +00:00
|
|
|
errors.add(:visibility_level, "#{visibility} is not allowed since the parent group has a #{parent.visibility} visibility.")
|
2017-08-29 05:49:01 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def visibility_level_allowed_by_projects
|
|
|
|
return if visibility_level_allowed_by_projects?
|
|
|
|
|
2017-08-30 19:37:08 +00:00
|
|
|
errors.add(:visibility_level, "#{visibility} is not allowed since this group contains projects with higher visibility.")
|
2017-08-29 05:49:01 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def visibility_level_allowed_by_sub_groups
|
|
|
|
return if visibility_level_allowed_by_sub_groups?
|
|
|
|
|
2017-08-30 19:37:08 +00:00
|
|
|
errors.add(:visibility_level, "#{visibility} is not allowed since there are sub-groups with higher visibility.")
|
2017-08-29 05:49:01 +00:00
|
|
|
end
|
2012-10-02 15:17:12 +00:00
|
|
|
end
|