47 lines
1.6 KiB
Ruby
47 lines
1.6 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
module Gitlab
|
|
module Checks
|
|
class TagCheck < BaseSingleChecker
|
|
ERROR_MESSAGES = {
|
|
change_existing_tags: 'You are not allowed to change existing tags on this project.',
|
|
update_protected_tag: 'Protected tags cannot be updated.',
|
|
delete_protected_tag: 'Protected tags cannot be deleted.',
|
|
create_protected_tag: 'You are not allowed to create this tag as it is protected.'
|
|
}.freeze
|
|
|
|
LOG_MESSAGES = {
|
|
tag_checks: "Checking if you are allowed to change existing tags...",
|
|
protected_tag_checks: "Checking if you are creating, updating or deleting a protected tag..."
|
|
}.freeze
|
|
|
|
def validate!
|
|
return unless tag_name
|
|
|
|
logger.log_timed(LOG_MESSAGES[:tag_checks]) do
|
|
if tag_exists? && user_access.cannot_do_action?(:admin_tag)
|
|
raise GitAccess::ForbiddenError, ERROR_MESSAGES[:change_existing_tags]
|
|
end
|
|
end
|
|
|
|
protected_tag_checks
|
|
end
|
|
|
|
private
|
|
|
|
def protected_tag_checks
|
|
logger.log_timed(LOG_MESSAGES[__method__]) do
|
|
return unless ProtectedTag.protected?(project, tag_name) # rubocop:disable Cop/AvoidReturnFromBlocks
|
|
|
|
raise(GitAccess::ForbiddenError, ERROR_MESSAGES[:update_protected_tag]) if update?
|
|
raise(GitAccess::ForbiddenError, ERROR_MESSAGES[:delete_protected_tag]) if deletion?
|
|
|
|
unless user_access.can_create_tag?(tag_name)
|
|
raise GitAccess::ForbiddenError, ERROR_MESSAGES[:create_protected_tag]
|
|
end
|
|
end
|
|
end
|
|
end
|
|
end
|
|
end
|