debian-mirror-gitlab/app/models/member.rb

462 lines
13 KiB
Ruby
Raw Normal View History

2018-11-18 11:00:15 +05:30
# frozen_string_literal: true
2019-07-07 11:18:12 +05:30
class Member < ApplicationRecord
2018-03-17 18:26:18 +05:30
include AfterCommitQueue
2015-04-26 12:48:37 +05:30
include Sortable
2016-06-22 15:30:34 +05:30
include Importable
2016-09-13 17:45:13 +05:30
include Expirable
2015-04-26 12:48:37 +05:30
include Gitlab::Access
2018-03-17 18:26:18 +05:30
include Presentable
2019-02-15 15:39:39 +05:30
include Gitlab::Utils::StrongMemoize
2015-04-26 12:48:37 +05:30
attr_accessor :raw_invite_token
belongs_to :created_by, class_name: "User"
belongs_to :user
2017-09-10 17:25:29 +05:30
belongs_to :source, polymorphic: true # rubocop:disable Cop/PolymorphicAssociations
2015-04-26 12:48:37 +05:30
2017-08-17 22:00:37 +05:30
delegate :name, :username, :email, to: :user, prefix: true
2015-04-26 12:48:37 +05:30
validates :user, presence: true, unless: :invite?
validates :source, presence: true
2015-11-26 14:37:03 +05:30
validates :user_id, uniqueness: { scope: [:source_type, :source_id],
2015-04-26 12:48:37 +05:30
message: "already exists in source",
allow_nil: true }
validates :access_level, inclusion: { in: Gitlab::Access.all_values }, presence: true
2019-02-15 15:39:39 +05:30
validate :higher_access_level_than_group, unless: :importing?
2015-11-26 14:37:03 +05:30
validates :invite_email,
presence: {
if: :invite?
},
2019-07-07 11:18:12 +05:30
devise_email: {
2015-11-26 14:37:03 +05:30
allow_nil: true
},
uniqueness: {
scope: [:source_type, :source_id],
allow_nil: true
}
2015-04-26 12:48:37 +05:30
2016-09-29 09:46:39 +05:30
# This scope encapsulates (most of) the conditions a row in the member table
# must satisfy if it is a valid permission. Of particular note:
#
# * Access requests must be excluded
# * Blocked users must be excluded
# * Invitations take effect immediately
# * expires_at is not implemented. A background worker purges expired rows
scope :active, -> do
is_external_invite = arel_table[:user_id].eq(nil).and(arel_table[:invite_token].not_eq(nil))
user_is_active = User.arel_table[:state].eq(:active)
2017-09-10 17:25:29 +05:30
user_ok = Arel::Nodes::Grouping.new(is_external_invite).or(user_is_active)
left_join_users
.where(user_ok)
.where(requested_at: nil)
.reorder(nil)
end
# Like active, but without invites. For when a User is required.
2018-04-04 21:44:52 +05:30
scope :active_without_invites_and_requests, -> do
2017-09-10 17:25:29 +05:30
left_join_users
.where(users: { state: 'active' })
2018-03-27 19:54:05 +05:30
.non_request
2017-09-10 17:25:29 +05:30
.reorder(nil)
2016-09-29 09:46:39 +05:30
end
scope :invite, -> { where.not(invite_token: nil) }
scope :non_invite, -> { where(invite_token: nil) }
scope :request, -> { where.not(requested_at: nil) }
2017-08-17 22:00:37 +05:30
scope :non_request, -> { where(requested_at: nil) }
2016-09-29 09:46:39 +05:30
scope :has_access, -> { active.where('access_level > 0') }
scope :guests, -> { active.where(access_level: GUEST) }
scope :reporters, -> { active.where(access_level: REPORTER) }
scope :developers, -> { active.where(access_level: DEVELOPER) }
2018-11-18 11:00:15 +05:30
scope :maintainers, -> { active.where(access_level: MAINTAINER) }
scope :masters, -> { maintainers } # @deprecated
2016-09-29 09:46:39 +05:30
scope :owners, -> { active.where(access_level: OWNER) }
2019-03-02 22:35:43 +05:30
scope :owners_and_maintainers, -> { active.where(access_level: [OWNER, MAINTAINER]) }
2018-11-18 11:00:15 +05:30
scope :owners_and_masters, -> { owners_and_maintainers } # @deprecated
2019-01-03 12:48:30 +05:30
scope :with_user, -> (user) { where(user: user) }
2015-04-26 12:48:37 +05:30
2019-09-04 21:01:54 +05:30
scope :with_source_id, ->(source_id) { where(source_id: source_id) }
2017-08-17 22:00:37 +05:30
scope :order_name_asc, -> { left_join_users.reorder(Gitlab::Database.nulls_last_order('users.name', 'ASC')) }
scope :order_name_desc, -> { left_join_users.reorder(Gitlab::Database.nulls_last_order('users.name', 'DESC')) }
scope :order_recent_sign_in, -> { left_join_users.reorder(Gitlab::Database.nulls_last_order('users.last_sign_in_at', 'DESC')) }
scope :order_oldest_sign_in, -> { left_join_users.reorder(Gitlab::Database.nulls_last_order('users.last_sign_in_at', 'ASC')) }
2019-02-15 15:39:39 +05:30
scope :on_project_and_ancestors, ->(project) { where(source: [project] + project.ancestors) }
2019-02-02 18:00:53 +05:30
2015-04-26 12:48:37 +05:30
before_validation :generate_invite_token, on: :create, if: -> (member) { member.invite_email.present? }
2016-06-22 15:30:34 +05:30
after_create :send_invite, if: :invite?, unless: :importing?
after_create :send_request, if: :request?, unless: :importing?
after_create :create_notification_setting, unless: [:pending?, :importing?]
after_create :post_create_hook, unless: [:pending?, :importing?]
after_update :post_update_hook, unless: [:pending?, :importing?]
2018-03-27 19:54:05 +05:30
after_destroy :destroy_notification_setting
after_destroy :post_destroy_hook, unless: :pending?
2017-08-17 22:00:37 +05:30
after_commit :refresh_member_authorized_projects
2015-04-26 12:48:37 +05:30
2016-06-02 11:05:42 +05:30
default_value_for :notification_level, NotificationSetting.levels[:global]
2015-04-26 12:48:37 +05:30
class << self
2017-08-17 22:00:37 +05:30
def search(query)
joins(:user).merge(User.search(query))
end
2019-10-12 21:52:04 +05:30
def search_invite_email(query)
invite.where(['invite_email ILIKE ?', "%#{query}%"])
end
2018-11-08 19:23:39 +05:30
def filter_by_2fa(value)
case value
when 'enabled'
2018-11-20 20:47:30 +05:30
left_join_users.merge(User.with_two_factor)
2018-11-08 19:23:39 +05:30
when 'disabled'
left_join_users.merge(User.without_two_factor)
else
all
end
end
2018-05-09 12:01:36 +05:30
def sort_by_attribute(method)
2017-08-17 22:00:37 +05:30
case method.to_s
when 'access_level_asc' then reorder(access_level: :asc)
when 'access_level_desc' then reorder(access_level: :desc)
when 'recent_sign_in' then order_recent_sign_in
when 'oldest_sign_in' then order_oldest_sign_in
when 'last_joined' then order_created_desc
when 'oldest_joined' then order_created_asc
else
order_by(method)
end
end
def left_join_users
users = User.arel_table
members = Member.arel_table
2017-09-10 17:25:29 +05:30
member_users = members.join(users, Arel::Nodes::OuterJoin)
.on(members[:user_id].eq(users[:id]))
.join_sources
2017-08-17 22:00:37 +05:30
joins(member_users)
end
2016-09-13 17:45:13 +05:30
def access_for_user_ids(user_ids)
where(user_id: user_ids).has_access.pluck(:user_id, :access_level).to_h
end
2015-04-26 12:48:37 +05:30
def find_by_invite_token(invite_token)
invite_token = Devise.token_generator.digest(self, :invite_token, invite_token)
find_by(invite_token: invite_token)
end
2018-03-27 19:54:05 +05:30
def add_user(source, user, access_level, existing_members: nil, current_user: nil, expires_at: nil, ldap: false)
2018-12-05 23:21:45 +05:30
# rubocop: disable CodeReuse/ServiceClass
2018-03-17 18:26:18 +05:30
# `user` can be either a User object, User ID or an email to be invited
member = retrieve_member(source, user, existing_members)
2016-11-03 12:29:30 +05:30
access_level = retrieve_access_level(access_level)
2015-11-26 14:37:03 +05:30
2016-11-03 12:29:30 +05:30
return member unless can_update_member?(current_user, member)
2019-02-15 15:39:39 +05:30
set_member_attributes(
member,
access_level,
current_user: current_user,
expires_at: expires_at,
ldap: ldap
)
2016-11-03 12:29:30 +05:30
if member.request?
::Members::ApproveAccessRequestService.new(
current_user,
access_level: access_level
2018-03-27 19:54:05 +05:30
).execute(
member,
skip_authorization: ldap,
skip_log_audit_event: ldap
)
2015-04-26 12:48:37 +05:30
else
2016-11-03 12:29:30 +05:30
member.save
2015-04-26 12:48:37 +05:30
end
2016-11-03 12:29:30 +05:30
member
2018-12-05 23:21:45 +05:30
# rubocop: enable CodeReuse/ServiceClass
2016-11-03 12:29:30 +05:30
end
2015-11-26 14:37:03 +05:30
2019-02-15 15:39:39 +05:30
# Populates the attributes of a member.
#
# This logic resides in a separate method so that EE can extend this logic,
# without having to patch the `add_user` method directly.
def set_member_attributes(member, access_level, current_user: nil, expires_at: nil, ldap: false)
member.attributes = {
created_by: member.created_by || current_user,
access_level: access_level,
expires_at: expires_at
}
end
2017-08-17 22:00:37 +05:30
def add_users(source, users, access_level, current_user: nil, expires_at: nil)
return [] unless users.present?
2018-03-17 18:26:18 +05:30
emails, users, existing_members = parse_users_list(source, users)
2017-08-17 22:00:37 +05:30
self.transaction do
2018-03-17 18:26:18 +05:30
(emails + users).map! do |user|
2017-08-17 22:00:37 +05:30
add_user(
source,
user,
access_level,
2018-03-17 18:26:18 +05:30
existing_members: existing_members,
2017-08-17 22:00:37 +05:30
current_user: current_user,
expires_at: expires_at
)
end
end
end
2016-11-03 12:29:30 +05:30
def access_levels
Gitlab::Access.sym_options
2015-11-26 14:37:03 +05:30
end
private
2015-04-26 12:48:37 +05:30
2018-03-17 18:26:18 +05:30
def parse_users_list(source, list)
emails, user_ids, users = [], [], []
existing_members = {}
list.each do |item|
case item
when User
users << item
when Integer
user_ids << item
when /\A\d+\Z/
user_ids << item.to_i
when Devise.email_regexp
emails << item
end
end
if user_ids.present?
users.concat(User.where(id: user_ids))
existing_members = source.members_and_requesters.where(user_id: user_ids).index_by(&:user_id)
end
[emails, users, existing_members]
end
2016-11-03 12:29:30 +05:30
# This method is used to find users that have been entered into the "Add members" field.
# These can be the User objects directly, their IDs, their emails, or new emails to be invited.
def retrieve_user(user)
return user if user.is_a?(User)
User.find_by(id: user) || User.find_by(email: user) || user
end
2018-03-17 18:26:18 +05:30
def retrieve_member(source, user, existing_members)
user = retrieve_user(user)
if user.is_a?(User)
if existing_members
existing_members[user.id] || source.members.build(user_id: user.id)
else
source.members_and_requesters.find_or_initialize_by(user_id: user.id)
end
else
source.members.build(invite_email: user)
end
end
2016-11-03 12:29:30 +05:30
def retrieve_access_level(access_level)
access_levels.fetch(access_level) { access_level.to_i }
end
2015-11-26 14:37:03 +05:30
def can_update_member?(current_user, member)
# There is no current user for bulk actions, in which case anything is allowed
2016-11-03 12:29:30 +05:30
!current_user || current_user.can?(:"update_#{member.type.underscore}", member)
2015-04-26 12:48:37 +05:30
end
end
def real_source_type
source_type
end
2017-09-10 17:25:29 +05:30
def access_field
access_level
end
2015-04-26 12:48:37 +05:30
def invite?
self.invite_token.present?
end
def request?
requested_at.present?
end
def pending?
invite? || request?
end
def accept_request
return false unless request?
updated = self.update(requested_at: nil)
after_accept_request if updated
updated
end
2015-04-26 12:48:37 +05:30
def accept_invite!(new_user)
return false unless invite?
2015-11-26 14:37:03 +05:30
2015-04-26 12:48:37 +05:30
self.invite_token = nil
self.invite_accepted_at = Time.now.utc
self.user = new_user
saved = self.save
after_accept_invite if saved
saved
end
def decline_invite!
return false unless invite?
destroyed = self.destroy
after_decline_invite if destroyed
destroyed
end
def generate_invite_token
raw, enc = Devise.token_generator.generate(self.class, :invite_token)
@raw_invite_token = raw
self.invite_token = enc
end
def generate_invite_token!
generate_invite_token && save(validate: false)
end
def resend_invite
return unless invite?
generate_invite_token! unless @raw_invite_token
send_invite
end
2016-06-02 11:05:42 +05:30
def create_notification_setting
user.notification_settings.find_or_create_for(source)
end
2018-03-27 19:54:05 +05:30
def destroy_notification_setting
notification_setting&.destroy
end
2016-06-02 11:05:42 +05:30
def notification_setting
2018-03-27 19:54:05 +05:30
@notification_setting ||= user&.notification_settings_for(source)
2016-06-02 11:05:42 +05:30
end
2018-12-05 23:21:45 +05:30
# rubocop: disable CodeReuse/ServiceClass
2018-03-17 18:26:18 +05:30
def notifiable?(type, opts = {})
# always notify when there isn't a user yet
return true if user.blank?
NotificationRecipientService.notifiable?(user, type, notifiable_options.merge(opts))
end
2018-12-05 23:21:45 +05:30
# rubocop: enable CodeReuse/ServiceClass
2018-03-17 18:26:18 +05:30
2019-02-15 15:39:39 +05:30
# Find the user's group member with a highest access level
def highest_group_member
strong_memoize(:highest_group_member) do
next unless user_id && source&.ancestors&.any?
GroupMember.where(source: source.ancestors, user_id: user_id).order(:access_level).last
end
end
2015-04-26 12:48:37 +05:30
private
def send_invite
# override in subclass
end
def send_request
2016-08-24 12:49:21 +05:30
notification_service.new_access_request(self)
end
2015-04-26 12:48:37 +05:30
def post_create_hook
system_hook_service.execute_hooks_for(self, :create)
end
def post_update_hook
2017-08-17 22:00:37 +05:30
# override in sub class
2015-04-26 12:48:37 +05:30
end
def post_destroy_hook
system_hook_service.execute_hooks_for(self, :destroy)
end
2017-08-17 22:00:37 +05:30
# Refreshes authorizations of the current member.
#
# This method schedules a job using Sidekiq and as such **must not** be called
# in a transaction. Doing so can lead to the job running before the
# transaction has been committed, resulting in the job either throwing an
# error or not doing any meaningful work.
2018-12-05 23:21:45 +05:30
# rubocop: disable CodeReuse/ServiceClass
2017-08-17 22:00:37 +05:30
def refresh_member_authorized_projects
# If user/source is being destroyed, project access are going to be
# destroyed eventually because of DB foreign keys, so we shouldn't bother
# with refreshing after each member is destroyed through association
return if destroyed_by_association.present?
UserProjectAccessChangedService.new(user_id).execute
end
2018-12-05 23:21:45 +05:30
# rubocop: enable CodeReuse/ServiceClass
2017-08-17 22:00:37 +05:30
2015-04-26 12:48:37 +05:30
def after_accept_invite
post_create_hook
end
def after_decline_invite
# override in subclass
end
def after_accept_request
post_create_hook
end
2018-12-05 23:21:45 +05:30
# rubocop: disable CodeReuse/ServiceClass
2015-04-26 12:48:37 +05:30
def system_hook_service
SystemHooksService.new
end
2018-12-05 23:21:45 +05:30
# rubocop: enable CodeReuse/ServiceClass
2015-04-26 12:48:37 +05:30
2018-12-05 23:21:45 +05:30
# rubocop: disable CodeReuse/ServiceClass
2015-04-26 12:48:37 +05:30
def notification_service
NotificationService.new
end
2018-12-05 23:21:45 +05:30
# rubocop: enable CodeReuse/ServiceClass
2018-03-17 18:26:18 +05:30
def notifiable_options
{}
end
2019-02-15 15:39:39 +05:30
def higher_access_level_than_group
2019-07-07 11:18:12 +05:30
if highest_group_member && highest_group_member.access_level > access_level
2019-02-15 15:39:39 +05:30
error_parameters = { access: highest_group_member.human_access, group_name: highest_group_member.group.name }
2019-07-07 11:18:12 +05:30
errors.add(:access_level, s_("should be greater than or equal to %{access} inherited membership from group %{group_name}") % error_parameters)
2019-02-15 15:39:39 +05:30
end
end
2015-04-26 12:48:37 +05:30
end