d801dd1774
The `access_git` and `access_api` were currently never checked for anonymous users. And they would also be allowed access: An anonymous user can clone and pull from a public repo An anonymous user can request public information from the API So the policy didn't actually reflect what we were enforcing. |
||
|---|---|---|
| .. | ||
| application_setting | ||
| ci | ||
| clusters | ||
| base_policy_spec.rb | ||
| deploy_key_policy_spec.rb | ||
| deploy_token_policy_spec.rb | ||
| environment_policy_spec.rb | ||
| global_policy_spec.rb | ||
| group_policy_spec.rb | ||
| issuable_policy_spec.rb | ||
| issue_policy_spec.rb | ||
| namespace_policy_spec.rb | ||
| note_policy_spec.rb | ||
| personal_snippet_policy_spec.rb | ||
| project_policy_spec.rb | ||
| project_snippet_policy_spec.rb | ||
| protected_branch_policy_spec.rb | ||
| user_policy_spec.rb | ||