gitlab-org--gitlab-foss/app/models/ability.rb

444 lines
11 KiB
Ruby
Raw Normal View History

2011-10-08 17:36:38 -04:00
class Ability
2012-10-08 20:10:04 -04:00
class << self
2013-01-25 04:30:49 -05:00
def allowed(user, subject)
return anonymous_abilities(user, subject) if user.nil?
2015-11-17 10:24:02 -05:00
return [] unless user.is_a?(User)
return [] if user.blocked?
2013-01-25 04:30:49 -05:00
2016-02-04 08:43:52 -05:00
case subject
when CommitStatus then commit_status_abilities(user, subject)
when Project then project_abilities(user, subject)
when Issue then issue_abilities(user, subject)
when ExternalIssue then external_issue_abilities(user, subject)
2016-02-04 08:43:52 -05:00
when Note then note_abilities(user, subject)
when ProjectSnippet then project_snippet_abilities(user, subject)
when PersonalSnippet then personal_snippet_abilities(user, subject)
when MergeRequest then merge_request_abilities(user, subject)
when Group then group_abilities(user, subject)
when Namespace then namespace_abilities(user, subject)
when GroupMember then group_member_abilities(user, subject)
when ProjectMember then project_member_abilities(user, subject)
2015-11-12 03:43:30 -05:00
else []
2013-01-25 04:30:49 -05:00
end.concat(global_abilities(user))
end
# List of possible abilities for anonymous user
def anonymous_abilities(user, subject)
2015-11-17 10:24:02 -05:00
case true
when subject.is_a?(PersonalSnippet)
anonymous_personal_snippet_abilities(subject)
when subject.is_a?(CommitStatus)
2016-02-04 05:09:42 -05:00
anonymous_commit_status_abilities(subject)
2015-11-17 10:24:02 -05:00
when subject.is_a?(Project) || subject.respond_to?(:project)
anonymous_project_abilities(subject)
2015-11-17 10:24:02 -05:00
when subject.is_a?(Group) || subject.respond_to?(:group)
anonymous_group_abilities(subject)
2015-11-17 10:24:02 -05:00
else
[]
end
end
def anonymous_project_abilities(subject)
2015-11-17 10:24:02 -05:00
project = if subject.is_a?(Project)
subject
else
subject.project
end
if project && project.public?
rules = [
:read_project,
:read_wiki,
:read_issue,
:read_label,
:read_milestone,
:read_project_snippet,
:read_project_member,
:read_merge_request,
:read_note,
:read_commit_status,
:download_code
]
2016-02-04 05:09:42 -05:00
# Allow to read builds by anonymous user if guests are allowed
rules << :read_build if project.public_builds?
rules - project_disabled_features_rules(project)
else
[]
end
end
2016-02-04 05:09:42 -05:00
def anonymous_commit_status_abilities(subject)
rules = anonymous_project_abilities(subject.project)
# If subject is Ci::Build which inherits from CommitStatus filter the abilities
rules = filter_build_abilities(rules) if subject.is_a?(Ci::Build)
rules
end
def anonymous_group_abilities(subject)
2015-11-17 10:24:02 -05:00
group = if subject.is_a?(Group)
subject
else
subject.group
end
if group && group.projects.public_only.any?
[:read_group]
else
[]
end
end
def anonymous_personal_snippet_abilities(snippet)
if snippet.public?
[:read_personal_snippet]
else
[]
end
end
2013-01-25 04:30:49 -05:00
def global_abilities(user)
rules = []
rules << :create_group if user.can_create_group
rules
2011-10-08 17:36:38 -04:00
end
2012-10-08 20:10:04 -04:00
def project_abilities(user, project)
rules = []
2014-06-14 06:05:25 -04:00
key = "/user/#{user.id}/project/#{project.id}"
2014-06-14 06:05:25 -04:00
RequestStore.store[key] ||= begin
team = project.team
2011-10-08 17:36:38 -04:00
2014-06-14 06:05:25 -04:00
# Rules based on role in project
if team.master?(user)
2014-10-09 03:47:47 -04:00
rules.push(*project_master_rules)
2013-01-03 14:09:18 -05:00
2014-06-14 06:05:25 -04:00
elsif team.developer?(user)
2014-10-09 03:47:47 -04:00
rules.push(*project_dev_rules)
2014-06-14 06:05:25 -04:00
elsif team.reporter?(user)
2014-10-09 03:47:47 -04:00
rules.push(*project_report_rules)
2014-06-14 06:05:25 -04:00
elsif team.guest?(user)
2014-10-09 03:47:47 -04:00
rules.push(*project_guest_rules)
2014-06-14 06:05:25 -04:00
end
2014-06-14 06:05:25 -04:00
if project.public? || project.internal?
2014-10-09 03:47:47 -04:00
rules.push(*public_project_rules)
2016-02-04 08:43:52 -05:00
# Allow to read builds for internal projects
rules << :read_build if project.public_builds?
2014-06-14 06:05:25 -04:00
end
2014-06-14 06:05:25 -04:00
if project.owner == user || user.admin?
2014-10-09 03:47:47 -04:00
rules.push(*project_admin_rules)
2014-06-14 06:05:25 -04:00
end
2014-06-14 06:05:25 -04:00
if project.group && project.group.has_owner?(user)
2014-10-09 03:47:47 -04:00
rules.push(*project_admin_rules)
2014-06-14 06:05:25 -04:00
end
2014-06-14 06:05:25 -04:00
if project.archived?
rules -= project_archived_rules
end
rules - project_disabled_features_rules(project)
end
end
def public_project_rules
@public_project_rules ||= project_guest_rules + [
:download_code,
:fork_project,
:read_commit_status,
]
end
def project_guest_rules
@project_guest_rules ||= [
2012-10-08 20:10:04 -04:00
:read_project,
:read_wiki,
:read_issue,
:read_label,
2012-10-08 20:10:04 -04:00
:read_milestone,
2013-03-25 03:20:14 -04:00
:read_project_snippet,
:read_project_member,
2012-10-08 20:10:04 -04:00
:read_merge_request,
:read_note,
:create_project,
:create_issue,
:create_note
]
end
2012-02-20 13:16:55 -05:00
def project_report_rules
@project_report_rules ||= project_guest_rules + [
2012-10-08 20:10:04 -04:00
:download_code,
2013-06-04 11:50:42 -04:00
:fork_project,
:create_project_snippet,
:update_issue,
:admin_issue,
:admin_label,
:read_commit_status,
:read_build,
]
end
2012-02-20 13:16:55 -05:00
def project_dev_rules
@project_dev_rules ||= project_report_rules + [
:admin_merge_request,
:update_merge_request,
:create_commit_status,
:update_commit_status,
:create_build,
:update_build,
:create_merge_request,
:create_wiki,
:push_code
]
end
def project_archived_rules
@project_archived_rules ||= [
:create_merge_request,
:push_code,
:push_code_to_protected_branches,
:update_merge_request,
:admin_merge_request
]
end
def project_master_rules
@project_master_rules ||= project_dev_rules + [
:push_code_to_protected_branches,
:update_project_snippet,
2012-10-08 20:10:04 -04:00
:admin_milestone,
2013-03-25 03:20:14 -04:00
:admin_project_snippet,
:admin_project_member,
2012-10-08 20:10:04 -04:00
:admin_merge_request,
:admin_note,
:admin_wiki,
:admin_project,
:admin_commit_status,
:admin_build
]
end
2011-10-08 17:36:38 -04:00
def project_admin_rules
@project_admin_rules ||= project_master_rules + [
:change_namespace,
:change_visibility_level,
:rename_project,
:remove_project,
:archive_project,
:remove_fork_project
]
2012-10-08 20:10:04 -04:00
end
2011-10-17 06:39:03 -04:00
def project_disabled_features_rules(project)
rules = []
unless project.issues_enabled
rules += named_abilities('issue')
end
unless project.merge_requests_enabled
rules += named_abilities('merge_request')
end
unless project.issues_enabled or project.merge_requests_enabled
rules += named_abilities('label')
rules += named_abilities('milestone')
end
unless project.snippets_enabled
rules += named_abilities('project_snippet')
end
unless project.wiki_enabled
rules += named_abilities('wiki')
end
unless project.builds_enabled
rules += named_abilities('build')
end
rules
end
def group_abilities(user, group)
rules = []
if user.admin? || group.users.include?(user) || ProjectsFinder.new.execute(user, group: group).any?
rules << :read_group
end
# Only group masters and group owners can create new projects in group
if group.has_master?(user) || group.has_owner?(user) || user.admin?
rules += [
:create_projects,
:admin_milestones
]
end
# Only group owner and administrators can admin group
if group.has_owner?(user) || user.admin?
2015-11-17 09:49:37 -05:00
rules += [
:admin_group,
:admin_namespace,
:admin_group_member
]
end
rules.flatten
end
def namespace_abilities(user, namespace)
2013-06-21 15:44:40 -04:00
rules = []
# Only namespace owner and administrators can admin it
2013-06-21 15:44:40 -04:00
if namespace.owner == user || user.admin?
2015-11-17 09:49:37 -05:00
rules += [
:create_projects,
:admin_namespace
]
2013-06-21 15:44:40 -04:00
end
rules.flatten
end
[:issue, :merge_request].each do |name|
2011-10-17 06:39:03 -04:00
define_method "#{name}_abilities" do |user, subject|
rules = []
if subject.author == user || (subject.respond_to?(:assignee) && subject.assignee == user)
rules += [
2011-10-17 06:39:03 -04:00
:"read_#{name}",
:"update_#{name}",
2011-10-17 06:39:03 -04:00
]
end
rules += project_abilities(user, subject.project)
rules
end
end
[:note, :project_snippet].each do |name|
define_method "#{name}_abilities" do |user, subject|
rules = []
if subject.author == user
rules += [
:"read_#{name}",
:"update_#{name}",
:"admin_#{name}"
]
2011-10-17 06:39:03 -04:00
end
if subject.respond_to?(:project) && subject.project
rules += project_abilities(user, subject.project)
end
rules
2011-10-17 06:39:03 -04:00
end
end
2014-02-07 11:59:55 -05:00
def personal_snippet_abilities(user, snippet)
rules = []
if snippet.author == user
rules += [
:read_personal_snippet,
:update_personal_snippet,
:admin_personal_snippet
]
end
if snippet.public? || snippet.internal?
rules << :read_personal_snippet
end
rules
end
def group_member_abilities(user, subject)
2014-02-07 11:59:55 -05:00
rules = []
target_user = subject.user
group = subject.group
2015-11-17 09:49:37 -05:00
unless group.last_owner?(target_user)
can_manage = group_abilities(user, group).include?(:admin_group_member)
if can_manage
2015-11-17 09:49:37 -05:00
rules << :update_group_member
rules << :destroy_group_member
elsif user == target_user
2015-11-17 09:49:37 -05:00
rules << :destroy_group_member
end
2014-02-07 11:59:55 -05:00
end
2014-02-07 11:59:55 -05:00
rules
end
def project_member_abilities(user, subject)
rules = []
target_user = subject.user
project = subject.project
2015-11-17 09:49:37 -05:00
unless target_user == project.owner
can_manage = project_abilities(user, project).include?(:admin_project_member)
if can_manage
2015-11-17 09:49:37 -05:00
rules << :update_project_member
rules << :destroy_project_member
elsif user == target_user
2015-11-17 09:49:37 -05:00
rules << :destroy_project_member
end
end
2015-11-17 09:49:37 -05:00
rules
end
2016-02-04 05:09:42 -05:00
def commit_status_abilities(user, subject)
rules = project_abilities(user, subject.project)
# If subject is Ci::Build which inherits from CommitStatus filter the abilities
rules = filter_build_abilities(rules) if subject.is_a?(Ci::Build)
rules
end
def filter_build_abilities(rules)
# If we can't read build we should also not have that
# ability when looking at this in context of commit_status
2016-02-04 08:43:52 -05:00
%w(read create update admin).each do |rule|
rules.delete(:"#{rule}_commit_status") unless rules.include?(:"#{rule}_build")
end
rules
end
def abilities
@abilities ||= begin
abilities = Six.new
abilities << self
abilities
end
end
def external_issue_abilities(user, subject)
project_abilities(user, subject.project)
end
private
def named_abilities(name)
[
:"read_#{name}",
:"create_#{name}",
:"update_#{name}",
:"admin_#{name}"
]
end
2011-10-17 06:39:03 -04:00
end
2011-10-08 17:36:38 -04:00
end