debian-mirror-gitlab/app/models/project_feature.rb

196 lines
5.8 KiB
Ruby
Raw Normal View History

2018-11-18 11:00:15 +05:30
# frozen_string_literal: true
2019-07-07 11:18:12 +05:30
class ProjectFeature < ApplicationRecord
2016-09-29 09:46:39 +05:30
# == Project features permissions
#
# Grants access level to project tools
#
# Tools can be enabled only for users, everyone or disabled
# Access control is made only for non private projects
#
# levels:
#
# Disabled: not enabled for anyone
# Private: enabled only for team members
# Enabled: enabled for everyone able to access the project
2018-12-05 23:21:45 +05:30
# Public: enabled for everyone (only allowed for pages)
2016-09-29 09:46:39 +05:30
#
2016-11-03 12:29:30 +05:30
# Permission levels
2016-09-29 09:46:39 +05:30
DISABLED = 0
PRIVATE = 10
ENABLED = 20
2018-12-05 23:21:45 +05:30
PUBLIC = 30
2016-09-29 09:46:39 +05:30
2018-12-05 23:21:45 +05:30
FEATURES = %i(issues merge_requests wiki snippets builds repository pages).freeze
2019-02-15 15:39:39 +05:30
PRIVATE_FEATURES_MIN_ACCESS_LEVEL = { merge_requests: Gitlab::Access::REPORTER }.freeze
2019-12-04 20:38:33 +05:30
PRIVATE_FEATURES_MIN_ACCESS_LEVEL_FOR_PRIVATE_PROJECT = { repository: Gitlab::Access::REPORTER }.freeze
2019-09-30 21:07:59 +05:30
STRING_OPTIONS = HashWithIndifferentAccess.new({
'disabled' => DISABLED,
'private' => PRIVATE,
'enabled' => ENABLED,
'public' => PUBLIC
}).freeze
2016-09-29 09:46:39 +05:30
2016-11-24 13:41:30 +05:30
class << self
def access_level_attribute(feature)
2019-02-15 15:39:39 +05:30
feature = ensure_feature!(feature)
2016-11-24 13:41:30 +05:30
"#{feature}_access_level".to_sym
end
2017-09-10 17:25:29 +05:30
def quoted_access_level_column(feature)
attribute = connection.quote_column_name(access_level_attribute(feature))
table = connection.quote_table_name(table_name)
"#{table}.#{attribute}"
end
2019-02-15 15:39:39 +05:30
def required_minimum_access_level(feature)
feature = ensure_feature!(feature)
PRIVATE_FEATURES_MIN_ACCESS_LEVEL.fetch(feature, Gitlab::Access::GUEST)
end
2019-12-04 20:38:33 +05:30
# Guest users can perform certain features on public and internal projects, but not private projects.
def required_minimum_access_level_for_private_project(feature)
feature = ensure_feature!(feature)
PRIVATE_FEATURES_MIN_ACCESS_LEVEL_FOR_PRIVATE_PROJECT.fetch(feature) do
required_minimum_access_level(feature)
end
end
2019-09-30 21:07:59 +05:30
def access_level_from_str(level)
STRING_OPTIONS.fetch(level)
end
def str_from_access_level(level)
STRING_OPTIONS.key(level)
end
2019-02-15 15:39:39 +05:30
private
def ensure_feature!(feature)
2019-10-03 12:08:05 +05:30
feature = feature.model_name.plural if feature.respond_to?(:model_name)
feature = feature.to_sym
2019-02-15 15:39:39 +05:30
raise ArgumentError, "invalid project feature: #{feature}" unless FEATURES.include?(feature)
feature
end
2016-11-24 13:41:30 +05:30
end
2016-11-03 12:29:30 +05:30
# Default scopes force us to unscope here since a service may need to check
# permissions for a project in pending_delete
# http://stackoverflow.com/questions/1540645/how-to-disable-default-scope-for-a-belongs-to
belongs_to :project, -> { unscope(where: :pending_delete) }
2018-03-17 18:26:18 +05:30
validates :project, presence: true
2016-11-03 12:29:30 +05:30
validate :repository_children_level
2018-12-05 23:21:45 +05:30
validate :allowed_access_levels
2016-09-29 09:46:39 +05:30
default_value_for :builds_access_level, value: ENABLED, allows_nil: false
default_value_for :issues_access_level, value: ENABLED, allows_nil: false
default_value_for :merge_requests_access_level, value: ENABLED, allows_nil: false
default_value_for :snippets_access_level, value: ENABLED, allows_nil: false
default_value_for :wiki_access_level, value: ENABLED, allows_nil: false
2016-11-03 12:29:30 +05:30
default_value_for :repository_access_level, value: ENABLED, allows_nil: false
2016-09-29 09:46:39 +05:30
2019-09-30 21:07:59 +05:30
default_value_for(:pages_access_level, allows_nil: false) { |feature| feature.project&.public? ? ENABLED : PRIVATE }
2016-09-29 09:46:39 +05:30
def feature_available?(feature, user)
2018-12-05 23:21:45 +05:30
# This feature might not be behind a feature flag at all, so default to true
return false unless ::Feature.enabled?(feature, user, default_enabled: true)
2019-03-13 22:55:13 +05:30
get_permission(user, feature)
2017-09-10 17:25:29 +05:30
end
def access_level(feature)
2018-03-17 18:26:18 +05:30
public_send(ProjectFeature.access_level_attribute(feature)) # rubocop:disable GitlabSecurity/PublicSend
2016-09-29 09:46:39 +05:30
end
2019-09-30 21:07:59 +05:30
def string_access_level(feature)
ProjectFeature.str_from_access_level(access_level(feature))
end
2016-09-29 09:46:39 +05:30
def builds_enabled?
builds_access_level > DISABLED
end
def wiki_enabled?
wiki_access_level > DISABLED
end
def merge_requests_enabled?
merge_requests_access_level > DISABLED
end
2017-08-17 22:00:37 +05:30
def issues_enabled?
issues_access_level > DISABLED
end
2018-12-05 23:21:45 +05:30
def pages_enabled?
pages_access_level > DISABLED
2018-11-18 11:00:15 +05:30
end
2018-12-05 23:21:45 +05:30
def public_pages?
return true unless Gitlab.config.pages.access_control
2018-11-18 11:00:15 +05:30
2018-12-05 23:21:45 +05:30
pages_access_level == PUBLIC || pages_access_level == ENABLED && project.public?
2018-11-18 11:00:15 +05:30
end
2019-12-04 20:38:33 +05:30
def private_pages?
!public_pages?
end
2018-12-05 23:21:45 +05:30
private
2016-11-03 12:29:30 +05:30
# Validates builds and merge requests access level
# which cannot be higher than repository access level
def repository_children_level
validator = lambda do |field|
2018-03-17 18:26:18 +05:30
level = public_send(field) || ProjectFeature::ENABLED # rubocop:disable GitlabSecurity/PublicSend
2016-11-03 12:29:30 +05:30
not_allowed = level > repository_access_level
self.errors.add(field, "cannot have higher visibility level than repository access level") if not_allowed
end
%i(merge_requests_access_level builds_access_level).each(&validator)
end
2018-12-05 23:21:45 +05:30
# Validates access level for other than pages cannot be PUBLIC
def allowed_access_levels
validator = lambda do |field|
level = public_send(field) || ProjectFeature::ENABLED # rubocop:disable GitlabSecurity/PublicSend
not_allowed = level > ProjectFeature::ENABLED
self.errors.add(field, "cannot have public visibility level") if not_allowed
end
(FEATURES - %i(pages)).each {|f| validator.call("#{f}_access_level")}
end
2019-03-13 22:55:13 +05:30
def get_permission(user, feature)
case access_level(feature)
2016-09-29 09:46:39 +05:30
when DISABLED
false
when PRIVATE
2019-03-13 22:55:13 +05:30
team_access?(user, feature)
2016-09-29 09:46:39 +05:30
when ENABLED
true
2018-12-05 23:21:45 +05:30
when PUBLIC
true
2016-09-29 09:46:39 +05:30
else
true
end
end
2019-03-13 22:55:13 +05:30
def team_access?(user, feature)
return unless user
return true if user.full_private_access?
project.team.member?(user, ProjectFeature.required_minimum_access_level(feature))
end
2016-09-29 09:46:39 +05:30
end
2019-12-04 20:38:33 +05:30
ProjectFeature.prepend_if_ee('EE::ProjectFeature')