Refactor common protected ref check
This commit is contained in:
parent
87118872c9
commit
ad37329553
|
@ -2,16 +2,18 @@ module Ci
|
|||
class PipelinePolicy < BasePolicy
|
||||
delegate { @subject.project }
|
||||
|
||||
condition(:protected_ref) do
|
||||
access = ::Gitlab::UserAccess.new(@user, project: @subject.project)
|
||||
|
||||
if @subject.tag?
|
||||
!access.can_create_tag?(@subject.ref)
|
||||
else
|
||||
!access.can_update_branch?(@subject.ref)
|
||||
end
|
||||
end
|
||||
condition(:protected_ref) { ref_protected?(@user, @subject.project, @subject.tag?, @subject.ref) }
|
||||
|
||||
rule { protected_ref }.prevent :update_pipeline
|
||||
|
||||
def ref_protected?(user, project, tag, ref)
|
||||
access = ::Gitlab::UserAccess.new(user, project: project)
|
||||
|
||||
if tag
|
||||
!access.can_create_tag?(ref)
|
||||
else
|
||||
!access.can_update_branch?(ref)
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
@ -3,15 +3,7 @@ module Ci
|
|||
alias_method :pipeline_schedule, :subject
|
||||
|
||||
condition(:protected_ref) do
|
||||
access = ::Gitlab::UserAccess.new(@user, project: @subject.project)
|
||||
|
||||
if @subject.project.repository.branch_exists?(@subject.ref)
|
||||
!access.can_update_branch?(@subject.ref)
|
||||
elsif @subject.project.repository.tag_exists?(@subject.ref)
|
||||
!access.can_create_tag?(@subject.ref)
|
||||
else
|
||||
false
|
||||
end
|
||||
ref_protected?(@user, @subject.project, @subject.project.repository.tag_exists?(@subject.ref), @subject.ref)
|
||||
end
|
||||
|
||||
condition(:owner_of_schedule) do
|
||||
|
|
|
@ -0,0 +1,92 @@
|
|||
require 'spec_helper'
|
||||
|
||||
describe Ci::PipelineSchedulePolicy, :models do
|
||||
set(:user) { create(:user) }
|
||||
set(:project) { create(:project, :repository) }
|
||||
set(:pipeline_schedule) { create(:ci_pipeline_schedule, :nightly, project: project) }
|
||||
|
||||
let(:policy) do
|
||||
described_class.new(user, pipeline_schedule)
|
||||
end
|
||||
|
||||
describe 'rules' do
|
||||
describe 'rules for protected ref' do
|
||||
before do
|
||||
project.add_developer(user)
|
||||
end
|
||||
|
||||
context 'when no one can push or merge to the branch' do
|
||||
before do
|
||||
create(:protected_branch, :no_one_can_push,
|
||||
name: pipeline_schedule.ref, project: project)
|
||||
end
|
||||
|
||||
it 'does not include ability to play pipeline schedule' do
|
||||
expect(policy).to be_disallowed :play_pipeline_schedule
|
||||
end
|
||||
end
|
||||
|
||||
context 'when developers can push to the branch' do
|
||||
before do
|
||||
create(:protected_branch, :developers_can_merge,
|
||||
name: pipeline_schedule.ref, project: project)
|
||||
end
|
||||
|
||||
it 'includes ability to update pipeline' do
|
||||
expect(policy).to be_allowed :play_pipeline_schedule
|
||||
end
|
||||
end
|
||||
|
||||
context 'when no one can create the tag' do
|
||||
let(:tag) { 'v1.0.0' }
|
||||
|
||||
before do
|
||||
pipeline_schedule.update(ref: tag)
|
||||
|
||||
create(:protected_tag, :no_one_can_create,
|
||||
name: pipeline_schedule.ref, project: project)
|
||||
end
|
||||
|
||||
it 'does not include ability to play pipeline schedule' do
|
||||
expect(policy).to be_disallowed :play_pipeline_schedule
|
||||
end
|
||||
end
|
||||
|
||||
context 'when no one can create the tag but it is not a tag' do
|
||||
before do
|
||||
create(:protected_tag, :no_one_can_create,
|
||||
name: pipeline_schedule.ref, project: project)
|
||||
end
|
||||
|
||||
it 'includes ability to play pipeline schedule' do
|
||||
expect(policy).to be_allowed :play_pipeline_schedule
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
describe 'rules for owner of schedule' do
|
||||
before do
|
||||
project.add_developer(user)
|
||||
pipeline_schedule.update(owner: user)
|
||||
end
|
||||
|
||||
it 'includes abilities to do do all operations on pipeline schedule' do
|
||||
expect(policy).to be_allowed :play_pipeline_schedule
|
||||
expect(policy).to be_allowed :update_pipeline_schedule
|
||||
expect(policy).to be_allowed :admin_pipeline_schedule
|
||||
end
|
||||
end
|
||||
|
||||
describe 'rules for a master' do
|
||||
before do
|
||||
project.add_master(user)
|
||||
end
|
||||
|
||||
it 'includes abilities to do do all operations on pipeline schedule' do
|
||||
expect(policy).to be_allowed :play_pipeline_schedule
|
||||
expect(policy).to be_allowed :update_pipeline_schedule
|
||||
expect(policy).to be_allowed :admin_pipeline_schedule
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
Loading…
Reference in New Issue