Commit graph

12 commits

Author SHA1 Message Date
Yorick Peterse
9606dbbb03
Whitelist existing destroy_all offenses
This whitelists all existing places where we use "destroy_all".
2018-08-16 17:29:37 +02:00
Nick Thomas
93ea3234df
Use the DatabaseCleaner 'deletion' strategy instead of 'truncation' 2018-01-24 17:25:55 +00:00
Jacopo
0ce6785851 Replaces tag: true into :tag in the specs
Replaces all the explicit include metadata syntax in the specs (tag:
true) into the implicit one (:tag).
Added a cop to prevent future errors and handle autocorrection.
2017-10-07 13:57:54 +02:00
Robert Speicher
72a7b30c9f Change all :empty_project to :project 2017-08-02 17:47:31 -04:00
Robert Speicher
9513bd18c4 Ensure all project factories use :repository trait or :empty_project 2017-08-01 14:51:52 -04:00
Rémy Coutable
1b0c6ffd51 Disable RSpec/BeforeAfterAll and enable RSpec/ImplicitExpect cops
Signed-off-by: Rémy Coutable <remy@rymai.me>
2017-06-30 17:52:27 +02:00
Yorick Peterse
ac382b5682
Use CTEs for nested groups and authorizations
This commit introduces the usage of Common Table Expressions (CTEs) to
efficiently retrieve nested group hierarchies, without having to rely on
the "routes" table (which is an _incredibly_ inefficient way of getting
the data). This requires a patch to ActiveRecord (found in the added
initializer) to work properly as ActiveRecord doesn't support WITH
statements properly out of the box.

Unfortunately MySQL provides no efficient way of getting nested groups.
For example, the old routes setup could easily take 5-10 seconds
depending on the amount of "routes" in a database. Providing vastly
different logic for both MySQL and PostgreSQL will negatively impact the
development process. Because of this the various nested groups related
methods return empty relations when used in combination with MySQL.

For project authorizations the logic is split up into two classes:

* Gitlab::ProjectAuthorizations::WithNestedGroups
* Gitlab::ProjectAuthorizations::WithoutNestedGroups

Both classes get the fresh project authorizations (= as they should be
in the "project_authorizations" table), including nested groups if
PostgreSQL is used. The logic of these two classes is quite different
apart from their public interface. This complicates development a bit,
but unfortunately there is no way around this.

This commit also introduces Gitlab::GroupHierarchy. This class can be
used to get the ancestors and descendants of a base relation, or both by
using a UNION. This in turn is used by methods such as:

* Namespace#ancestors
* Namespace#descendants
* User#all_expanded_groups

Again this class relies on CTEs and thus only works on PostgreSQL. The
Namespace methods will return an empty relation when MySQL is used,
while User#all_expanded_groups will return only the groups a user is a
direct member of.

Performance wise the impact is quite large. For example, on GitLab.com
Namespace#descendants used to take around 580 ms to retrieve data for a
particular user. Using CTEs we are able to reduce this down to roughly 1
millisecond, returning the exact same data.

== On The Fly Refreshing

Refreshing of authorizations on the fly (= when
users.authorized_projects_populated was not set) is removed with this
commit. This simplifies the code, and ensures any queries used for
authorizations are not mutated because they are executed in a Rails
scope (e.g. Project.visible_to_user).

This commit includes a migration to schedule refreshing authorizations
for all users, ensuring all of them have their authorizations in place.
Said migration schedules users in batches of 5000, with 5 minutes
between every batch to smear the load around a bit.

== Spec Changes

This commit also introduces some changes to various specs. For example,
some specs for ProjectTeam assumed that creating a personal project
would _not_ lead to the owner having access, which is incorrect. Because
we also no longer refresh authorizations on the fly for new users some
code had to be added to the "empty_project" factory. This chunk of code
ensures that the owner's permissions are refreshed after creating the
project, something that is normally done in Projects::CreateService.
2017-05-17 16:51:08 +02:00
Douwe Maan
68faad16bd Don't allow a project to be shared with an ancestor of the group it is in 2017-02-28 15:11:21 +02:00
Robert Speicher
fcb37542e7 Use :empty_project where possible in model specs 2017-01-26 17:44:59 -05:00
Ahmad Sherif
fd05e26618 Precalculate user's authorized projects in database
Closes #23150
2016-11-18 20:25:45 +02:00
Rémy Coutable
670b2eb5c0
Merge branch 'api-fix-project-group-sharing' into 'security'
API: Share projects only with groups current_user can access

Aims to address the issues here: https://gitlab.com/gitlab-org/gitlab-ce/issues/23004

* Projects can be shared with non-existent groups
* Projects can be shared with groups that the current user does not have access to read

Concerns:

The new implementation of the API endpoint allows projects to be shared with a larger range of groups than can be done via the web UI.

The form for sharing a project with a group uses the following API endpoint to index the available groups: 494269fc92/lib/api/groups.rb (L17). The groups indexed in the web form will only be those groups that the user is currently a member of.

The new implementation allows projects to be shared with any group that the authenticated user has access to view. This widens the range of groups to those that are public and internal.

See merge request !2005

Signed-off-by: Rémy Coutable <remy@rymai.me>
2016-10-11 20:36:26 +02:00
Dmitriy Zaporozhets
ea5f4cae53
Bring ProjectGroupLink model and migrations from EE
Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
2016-03-11 17:47:05 +01:00