debian-mirror-gitlab/lib/gitlab/checks/change_access.rb

189 lines
6.2 KiB
Ruby
Raw Normal View History

2016-08-24 12:49:21 +05:30
module Gitlab
module Checks
class ChangeAccess
2017-09-10 17:25:29 +05:30
ERROR_MESSAGES = {
push_code: 'You are not allowed to push code to this project.',
delete_default_branch: 'The default branch of a project cannot be deleted.',
force_push_protected_branch: 'You are not allowed to force push code to a protected branch on this project.',
non_master_delete_protected_branch: 'You are not allowed to delete protected branches from this project. Only a project master or owner can delete a protected branch.',
non_web_delete_protected_branch: 'You can only delete protected branches using the web interface.',
merge_protected_branch: 'You are not allowed to merge code into protected branches on this project.',
push_protected_branch: 'You are not allowed to push code to protected branches on this project.',
change_existing_tags: 'You are not allowed to change existing tags on this project.',
update_protected_tag: 'Protected tags cannot be updated.',
delete_protected_tag: 'Protected tags cannot be deleted.',
2018-03-17 18:26:18 +05:30
create_protected_tag: 'You are not allowed to create this tag as it is protected.',
lfs_objects_missing: 'LFS objects are missing. Ensure LFS is properly set up or try a manual "git lfs push --all".'
2017-09-10 17:25:29 +05:30
}.freeze
2018-03-17 18:26:18 +05:30
attr_reader :user_access, :project, :skip_authorization, :skip_lfs_integrity_check, :protocol, :oldrev, :newrev, :ref, :branch_name, :tag_name
2016-08-24 12:49:21 +05:30
2017-08-17 22:00:37 +05:30
def initialize(
change, user_access:, project:, skip_authorization: false,
2018-03-17 18:26:18 +05:30
skip_lfs_integrity_check: false, protocol:
2017-08-17 22:00:37 +05:30
)
2016-09-13 17:45:13 +05:30
@oldrev, @newrev, @ref = change.values_at(:oldrev, :newrev, :ref)
@branch_name = Gitlab::Git.branch_name(@ref)
2017-08-17 22:00:37 +05:30
@tag_name = Gitlab::Git.tag_name(@ref)
2016-08-24 12:49:21 +05:30
@user_access = user_access
@project = project
2017-08-17 22:00:37 +05:30
@skip_authorization = skip_authorization
2018-03-17 18:26:18 +05:30
@skip_lfs_integrity_check = skip_lfs_integrity_check
2017-08-17 22:00:37 +05:30
@protocol = protocol
2016-08-24 12:49:21 +05:30
end
2018-03-17 18:26:18 +05:30
def exec(skip_commits_check: false)
2017-09-10 17:25:29 +05:30
return true if skip_authorization
2016-08-24 12:49:21 +05:30
2017-09-10 17:25:29 +05:30
push_checks
branch_checks
tag_checks
2018-03-17 18:26:18 +05:30
lfs_objects_exist_check unless skip_lfs_integrity_check
commits_check unless skip_commits_check
2017-09-10 17:25:29 +05:30
true
2016-08-24 12:49:21 +05:30
end
protected
2017-09-10 17:25:29 +05:30
def push_checks
if user_access.cannot_do_action?(:push_code)
raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:push_code]
end
end
def branch_checks
2018-03-17 18:26:18 +05:30
return unless branch_name
2017-09-10 17:25:29 +05:30
2018-03-17 18:26:18 +05:30
if deletion? && branch_name == project.default_branch
2017-09-10 17:25:29 +05:30
raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:delete_default_branch]
end
protected_branch_checks
end
def protected_branch_checks
2018-03-17 18:26:18 +05:30
return unless ProtectedBranch.protected?(project, branch_name)
2016-08-24 12:49:21 +05:30
2017-08-17 22:00:37 +05:30
if forced_push?
2017-09-10 17:25:29 +05:30
raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:force_push_protected_branch]
2016-08-24 12:49:21 +05:30
end
2017-09-10 17:25:29 +05:30
if deletion?
protected_branch_deletion_checks
else
protected_branch_push_checks
end
end
def protected_branch_deletion_checks
2018-03-17 18:26:18 +05:30
unless user_access.can_delete_branch?(branch_name)
2017-09-10 17:25:29 +05:30
raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:non_master_delete_protected_branch]
end
2018-03-17 18:26:18 +05:30
unless updated_from_web?
2017-09-10 17:25:29 +05:30
raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:non_web_delete_protected_branch]
end
end
def protected_branch_push_checks
2016-08-24 12:49:21 +05:30
if matching_merge_request?
2018-03-17 18:26:18 +05:30
unless user_access.can_merge_to_branch?(branch_name) || user_access.can_push_to_branch?(branch_name)
2017-09-10 17:25:29 +05:30
raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:merge_protected_branch]
2016-08-24 12:49:21 +05:30
end
else
2018-03-17 18:26:18 +05:30
unless user_access.can_push_to_branch?(branch_name)
2017-09-10 17:25:29 +05:30
raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:push_protected_branch]
2016-08-24 12:49:21 +05:30
end
end
end
def tag_checks
2018-03-17 18:26:18 +05:30
return unless tag_name
2017-08-17 22:00:37 +05:30
if tag_exists? && user_access.cannot_do_action?(:admin_project)
2017-09-10 17:25:29 +05:30
raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:change_existing_tags]
2016-08-24 12:49:21 +05:30
end
2017-08-17 22:00:37 +05:30
protected_tag_checks
end
def protected_tag_checks
2018-03-17 18:26:18 +05:30
return unless ProtectedTag.protected?(project, tag_name)
2017-08-17 22:00:37 +05:30
2017-09-10 17:25:29 +05:30
raise(GitAccess::UnauthorizedError, ERROR_MESSAGES[:update_protected_tag]) if update?
raise(GitAccess::UnauthorizedError, ERROR_MESSAGES[:delete_protected_tag]) if deletion?
2016-08-24 12:49:21 +05:30
2018-03-17 18:26:18 +05:30
unless user_access.can_create_tag?(tag_name)
2017-09-10 17:25:29 +05:30
raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:create_protected_tag]
2016-08-24 12:49:21 +05:30
end
end
2018-03-17 18:26:18 +05:30
def commits_check
return if deletion? || newrev.nil?
return unless should_run_commit_validations?
# n+1: https://gitlab.com/gitlab-org/gitlab-ee/issues/3593
::Gitlab::GitalyClient.allow_n_plus_1_calls do
commits.each do |commit|
commit_check.validate(commit, validations_for_commit(commit))
end
end
commit_check.validate_file_paths
end
# Method overwritten in EE to inject custom validations
def validations_for_commit(_)
[]
end
2016-08-24 12:49:21 +05:30
private
2018-03-17 18:26:18 +05:30
def should_run_commit_validations?
commit_check.validate_lfs_file_locks?
end
def updated_from_web?
protocol == 'web'
end
2017-08-17 22:00:37 +05:30
def tag_exists?
2018-03-17 18:26:18 +05:30
project.repository.tag_exists?(tag_name)
2016-08-24 12:49:21 +05:30
end
def forced_push?
2018-03-17 18:26:18 +05:30
Gitlab::Checks::ForcePush.force_push?(project, oldrev, newrev)
2016-08-24 12:49:21 +05:30
end
2017-08-17 22:00:37 +05:30
def update?
2018-03-17 18:26:18 +05:30
!Gitlab::Git.blank_ref?(oldrev) && !deletion?
2017-08-17 22:00:37 +05:30
end
def deletion?
2018-03-17 18:26:18 +05:30
Gitlab::Git.blank_ref?(newrev)
2017-08-17 22:00:37 +05:30
end
2016-08-24 12:49:21 +05:30
def matching_merge_request?
2018-03-17 18:26:18 +05:30
Checks::MatchingMergeRequest.new(newrev, branch_name, project).match?
end
def lfs_objects_exist_check
lfs_check = Checks::LfsIntegrity.new(project, newrev)
if lfs_check.objects_missing?
raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:lfs_objects_missing]
end
end
def commit_check
@commit_check ||= Gitlab::Checks::CommitCheck.new(project, user_access.user, newrev, oldrev)
end
def commits
@commits ||= project.repository.new_commits(newrev)
2016-08-24 12:49:21 +05:30
end
end
end
end