kotovalexarian-likes-gitlab/gitlab-org--gitlab-foss
1
0
Fork 0
Code Releases Activity

Use can? policies for lib/api/runners.rb

Browse source
This commit is contained in:
Dylan Griffith 2018-05-09 16:41:15 +02:00
parent 846f73b53b
commit 7320684c00
2 changed files with 9 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
app/policies/ci/runner_policy.rb
View file

@ -1,8 +1,5 @@
module Ci
class RunnerPolicy < BasePolicy
with_options scope: :subject, score: 0
condition(:shared) { @subject.is_shared? }
with_options scope: :subject, score: 0
condition(:locked, scope: :subject) { @subject.locked? }
@ -10,7 +7,10 @@ module Ci
rule { anonymous }.prevent_all
rule { admin | authorized_runner }.enable :assign_runner
rule { ~admin & shared }.prevent :assign_runner
rule { admin | authorized_runner }.enable :read_runner
rule { admin | authorized_runner }.enable :update_runner
rule { admin | authorized_runner }.enable :delete_runner
rule { admin | authorized_runner }.enable :list_runner_jobs
rule { ~admin & locked }.prevent :assign_runner
end
end

14
lib/api/runners.rb
View file

@ -184,14 +184,14 @@ module API
def authenticate_show_runner!(runner)
return if runner.is_shared || current_user.admin?
forbidden!("No access granted") unless user_can_access_runner?(runner)
forbidden!("No access granted") unless can?(current_user, :read_runner, runner)
end
def authenticate_update_runner!(runner)
return if current_user.admin?
forbidden!("Runner is shared") if runner.is_shared?
forbidden!("No access granted") unless user_can_access_runner?(runner)
forbidden!("No access granted") unless can?(current_user, :update_runner, runner)
end
def authenticate_delete_runner!(runner)
@ -199,7 +199,7 @@ module API
forbidden!("Runner is shared") if runner.is_shared?
forbidden!("Runner associated with more than one project") if runner.projects.count > 1
forbidden!("No access granted") unless user_can_access_runner?(runner)
forbidden!("No access granted") unless can?(current_user, :delete_runner, runner)
end
def authenticate_enable_runner!(runner)
@ -208,17 +208,13 @@ module API
forbidden!("Runner is a group runner") if runner.group_type?
return if current_user.admin?
forbidden!("No access granted") unless user_can_access_runner?(runner)
forbidden!("No access granted") unless can?(current_user, :assign_runner, runner)
end
def authenticate_list_runners_jobs!(runner)
return if current_user.admin?
forbidden!("No access granted") unless user_can_access_runner?(runner)
end
def user_can_access_runner?(runner)
current_user.ci_authorized_runners.exists?(runner.id)
forbidden!("No access granted") unless can?(current_user, :list_runner_jobs, runner)
end
end
end