2016-07-18 04:16:56 -04:00
module Gitlab
module Checks
class ChangeAccess
2017-05-15 19:13:36 -04:00
ERROR_MESSAGES = {
push_code : 'You are not allowed to push code to this project.' ,
delete_default_branch : 'The default branch of a project cannot be deleted.' ,
force_push_protected_branch : 'You are not allowed to force push code to a protected branch on this project.' ,
non_master_delete_protected_branch : 'You are not allowed to delete protected branches from this project. Only a project master or owner can delete a protected branch.' ,
non_web_delete_protected_branch : 'You can only delete protected branches using the web interface.' ,
merge_protected_branch : 'You are not allowed to merge code into protected branches on this project.' ,
push_protected_branch : 'You are not allowed to push code to protected branches on this project.' ,
change_existing_tags : 'You are not allowed to change existing tags on this project.' ,
update_protected_tag : 'Protected tags cannot be updated.' ,
delete_protected_tag : 'Protected tags cannot be deleted.' ,
2017-08-24 21:30:12 -04:00
create_protected_tag : 'You are not allowed to create this tag as it is protected.' ,
lfs_objects_missing : 'LFS objects are missing. Ensure LFS is properly set up or try a manual "git lfs push --all".'
2017-05-15 19:13:36 -04:00
} . freeze
2018-01-23 11:12:44 -05:00
attr_reader :user_access , :project , :skip_authorization , :protocol , :oldrev , :newrev , :ref , :branch_name , :tag_name
2016-07-18 04:16:56 -04:00
2016-11-17 14:48:23 -05:00
def initialize (
2017-04-05 03:35:58 -04:00
change , user_access : , project : , skip_authorization : false ,
2017-03-13 07:31:27 -04:00
protocol :
)
2016-07-28 00:04:57 -04:00
@oldrev , @newrev , @ref = change . values_at ( :oldrev , :newrev , :ref )
@branch_name = Gitlab :: Git . branch_name ( @ref )
2017-03-31 12:57:29 -04:00
@tag_name = Gitlab :: Git . tag_name ( @ref )
2016-07-18 04:16:56 -04:00
@user_access = user_access
@project = project
2016-11-17 14:48:23 -05:00
@skip_authorization = skip_authorization
2017-03-13 07:31:27 -04:00
@protocol = protocol
2016-07-18 04:16:56 -04:00
end
def exec
2017-05-23 15:21:57 -04:00
return true if skip_authorization
2017-05-08 03:41:58 -04:00
2017-05-19 15:58:45 -04:00
push_checks
branch_checks
tag_checks
2017-08-24 21:30:12 -04:00
lfs_objects_exist_check
2016-07-18 04:16:56 -04:00
2017-05-23 15:21:57 -04:00
true
2016-07-18 04:16:56 -04:00
end
protected
2017-05-08 03:41:58 -04:00
def push_checks
if user_access . cannot_do_action? ( :push_code )
2017-05-19 15:58:45 -04:00
raise GitAccess :: UnauthorizedError , ERROR_MESSAGES [ :push_code ]
2017-05-08 03:41:58 -04:00
end
end
def branch_checks
2018-01-23 11:12:44 -05:00
return unless branch_name
2017-05-08 03:41:58 -04:00
2018-01-23 11:12:44 -05:00
if deletion? && branch_name == project . default_branch
2017-05-19 15:58:45 -04:00
raise GitAccess :: UnauthorizedError , ERROR_MESSAGES [ :delete_default_branch ]
2017-05-08 03:41:58 -04:00
end
protected_branch_checks
end
def protected_branch_checks
2018-01-23 11:12:44 -05:00
return unless ProtectedBranch . protected? ( project , branch_name )
2016-07-18 04:16:56 -04:00
2017-01-12 17:37:14 -05:00
if forced_push?
2017-05-19 15:58:45 -04:00
raise GitAccess :: UnauthorizedError , ERROR_MESSAGES [ :force_push_protected_branch ]
2016-07-18 04:16:56 -04:00
end
2017-05-08 03:41:58 -04:00
if deletion?
protected_branch_deletion_checks
else
protected_branch_push_checks
end
end
def protected_branch_deletion_checks
2018-01-23 11:12:44 -05:00
unless user_access . can_delete_branch? ( branch_name )
2017-05-19 15:58:45 -04:00
raise GitAccess :: UnauthorizedError , ERROR_MESSAGES [ :non_master_delete_protected_branch ]
2017-05-08 03:41:58 -04:00
end
2018-01-23 11:12:44 -05:00
unless updated_from_web?
2017-05-19 15:58:45 -04:00
raise GitAccess :: UnauthorizedError , ERROR_MESSAGES [ :non_web_delete_protected_branch ]
2017-05-08 03:41:58 -04:00
end
end
def protected_branch_push_checks
2016-07-18 04:16:56 -04:00
if matching_merge_request?
2018-01-23 11:12:44 -05:00
unless user_access . can_merge_to_branch? ( branch_name ) || user_access . can_push_to_branch? ( branch_name )
2017-05-19 15:58:45 -04:00
raise GitAccess :: UnauthorizedError , ERROR_MESSAGES [ :merge_protected_branch ]
2016-07-18 04:16:56 -04:00
end
else
2018-01-23 11:12:44 -05:00
unless user_access . can_push_to_branch? ( branch_name )
2017-05-19 15:58:45 -04:00
raise GitAccess :: UnauthorizedError , ERROR_MESSAGES [ :push_protected_branch ]
2016-07-18 04:16:56 -04:00
end
end
end
def tag_checks
2018-01-23 11:12:44 -05:00
return unless tag_name
2016-07-18 04:16:56 -04:00
2017-03-31 12:57:29 -04:00
if tag_exists? && user_access . cannot_do_action? ( :admin_project )
2017-05-19 15:58:45 -04:00
raise GitAccess :: UnauthorizedError , ERROR_MESSAGES [ :change_existing_tags ]
2016-07-18 04:16:56 -04:00
end
2017-03-31 12:57:29 -04:00
protected_tag_checks
end
def protected_tag_checks
2018-01-23 11:12:44 -05:00
return unless ProtectedTag . protected? ( project , tag_name )
2017-05-08 03:41:58 -04:00
2017-05-19 15:58:45 -04:00
raise ( GitAccess :: UnauthorizedError , ERROR_MESSAGES [ :update_protected_tag ] ) if update?
raise ( GitAccess :: UnauthorizedError , ERROR_MESSAGES [ :delete_protected_tag ] ) if deletion?
2017-03-31 12:57:29 -04:00
2018-01-23 11:12:44 -05:00
unless user_access . can_create_tag? ( tag_name )
2017-05-19 15:58:45 -04:00
raise GitAccess :: UnauthorizedError , ERROR_MESSAGES [ :create_protected_tag ]
2017-03-31 12:57:29 -04:00
end
end
2016-07-18 04:16:56 -04:00
private
2018-01-23 11:12:44 -05:00
def updated_from_web?
protocol == 'web'
end
2017-03-31 12:57:29 -04:00
def tag_exists?
2018-01-23 11:12:44 -05:00
project . repository . tag_exists? ( tag_name )
2016-07-18 04:16:56 -04:00
end
def forced_push?
2018-01-23 11:12:44 -05:00
Gitlab :: Checks :: ForcePush . force_push? ( project , oldrev , newrev )
2016-07-18 04:16:56 -04:00
end
2017-04-03 19:05:51 -04:00
def update?
2018-01-23 11:12:44 -05:00
! Gitlab :: Git . blank_ref? ( oldrev ) && ! deletion?
2017-04-03 19:05:51 -04:00
end
def deletion?
2018-01-23 11:12:44 -05:00
Gitlab :: Git . blank_ref? ( newrev )
2017-03-31 12:57:29 -04:00
end
2016-07-18 04:16:56 -04:00
def matching_merge_request?
2018-01-23 11:12:44 -05:00
Checks :: MatchingMergeRequest . new ( newrev , branch_name , project ) . match?
2016-07-18 04:16:56 -04:00
end
2017-08-24 21:30:12 -04:00
def lfs_objects_exist_check
2018-01-23 11:12:44 -05:00
lfs_check = Checks :: LfsIntegrity . new ( project , newrev )
2017-08-24 21:30:12 -04:00
if lfs_check . objects_missing?
raise GitAccess :: UnauthorizedError , ERROR_MESSAGES [ :lfs_objects_missing ]
end
end
2016-07-18 04:16:56 -04:00
end
end
end