debian-mirror-gitlab/spec/policies/project_policy_spec.rb

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

2974 lines
100 KiB
Ruby
Raw Normal View History

2019-12-26 22:10:19 +05:30
# frozen_string_literal: true
2016-09-29 09:46:39 +05:30
require 'spec_helper'
2020-07-28 23:09:34 +05:30
RSpec.describe ProjectPolicy do
2019-07-07 11:18:12 +05:30
include ExternalAuthorizationServiceHelpers
2021-09-30 23:02:18 +05:30
include AdminModeHelper
2019-07-07 11:18:12 +05:30
include_context 'ProjectPolicy context'
2016-11-03 12:29:30 +05:30
2020-11-24 15:15:51 +05:30
let(:project) { public_project }
2016-09-29 09:46:39 +05:30
2020-11-24 15:15:51 +05:30
subject { described_class.new(current_user, project) }
2016-09-29 09:46:39 +05:30
2017-09-10 17:25:29 +05:30
def expect_allowed(*permissions)
permissions.each { |p| is_expected.to be_allowed(p) }
end
def expect_disallowed(*permissions)
permissions.each { |p| is_expected.not_to be_allowed(p) }
end
2019-12-04 20:38:33 +05:30
context 'with no project feature' do
2020-11-24 15:15:51 +05:30
let(:current_user) { owner }
2019-12-04 20:38:33 +05:30
before do
2020-10-24 23:57:45 +05:30
project.project_feature.destroy!
2019-12-04 20:38:33 +05:30
project.reload
end
it 'returns false' do
is_expected.to be_disallowed(:read_build)
end
end
2022-07-23 23:45:48 +05:30
it 'does not include the read permissions when the issue author is not a member of the private project' do
2017-09-10 17:25:29 +05:30
project = create(:project, :private)
2018-03-17 18:26:18 +05:30
issue = create(:issue, project: project, author: create(:user))
2016-09-29 09:46:39 +05:30
user = issue.author
2017-09-10 17:25:29 +05:30
expect(project.team.member?(issue.author)).to be false
expect(Ability).not_to be_allowed(user, :read_issue, project)
2022-07-23 23:45:48 +05:30
expect(Ability).not_to be_allowed(user, :read_work_item, project)
2017-09-10 17:25:29 +05:30
end
2020-04-22 19:07:51 +05:30
it_behaves_like 'model with wiki policies' do
let(:container) { project }
2020-05-24 23:13:21 +05:30
let_it_be(:user) { owner }
2019-02-02 18:00:53 +05:30
2020-04-22 19:07:51 +05:30
def set_access_level(access_level)
project.project_feature.update_attribute(:wiki_access_level, access_level)
2019-10-12 21:52:04 +05:30
end
2017-09-10 17:25:29 +05:30
end
context 'issues feature' do
2020-11-24 15:15:51 +05:30
let(:current_user) { owner }
2017-09-10 17:25:29 +05:30
context 'when the feature is disabled' do
2019-03-13 22:55:13 +05:30
before do
2017-09-10 17:25:29 +05:30
project.issues_enabled = false
project.save!
2019-03-13 22:55:13 +05:30
end
2017-09-10 17:25:29 +05:30
2019-03-13 22:55:13 +05:30
it 'does not include the issues permissions' do
2022-07-23 23:45:48 +05:30
expect_disallowed :read_issue, :read_issue_iid, :create_issue, :update_issue, :admin_issue, :create_incident, :create_work_item, :create_task, :read_work_item
2017-09-10 17:25:29 +05:30
end
2016-09-29 09:46:39 +05:30
2019-03-13 22:55:13 +05:30
it 'disables boards and lists permissions' do
2021-04-17 20:07:23 +05:30
expect_disallowed :read_issue_board, :create_board, :update_board
expect_disallowed :read_issue_board_list, :create_list, :update_list, :admin_issue_board_list
2019-03-13 22:55:13 +05:30
end
2016-09-29 09:46:39 +05:30
2019-03-13 22:55:13 +05:30
context 'when external tracker configured' do
it 'does not include the issues permissions' do
2021-09-30 23:02:18 +05:30
create(:jira_integration, project: project)
2017-09-10 17:25:29 +05:30
2022-07-23 23:45:48 +05:30
expect_disallowed :read_issue, :read_issue_iid, :create_issue, :update_issue, :admin_issue, :create_incident, :create_work_item, :create_task, :read_work_item
2019-03-13 22:55:13 +05:30
end
2018-05-09 12:01:36 +05:30
end
end
end
context 'merge requests feature' do
2020-11-24 15:15:51 +05:30
let(:current_user) { owner }
2022-04-01 21:47:47 +05:30
let(:mr_permissions) do
[:create_merge_request_from, :read_merge_request, :update_merge_request,
:admin_merge_request, :create_merge_request_in]
end
2018-05-09 12:01:36 +05:30
it 'disallows all permissions when the feature is disabled' do
2020-06-04 15:10:26 +05:30
project.project_feature.update!(merge_requests_access_level: ProjectFeature::DISABLED)
2018-05-09 12:01:36 +05:30
expect_disallowed(*mr_permissions)
end
2022-04-01 21:47:47 +05:30
context 'for a guest in a private project' do
let(:current_user) { guest }
let(:project) { private_project }
it 'disallows the guest from all merge request permissions' do
expect_disallowed(*mr_permissions)
end
end
2018-05-09 12:01:36 +05:30
end
2022-11-25 23:54:43 +05:30
context 'when both issues and merge requests are disabled' do
let(:current_user) { owner }
before do
project.issues_enabled = false
project.merge_requests_enabled = false
project.save!
end
it 'does not include the issues permissions' do
expect_disallowed :read_cycle_analytics
end
end
2022-04-01 21:47:47 +05:30
context 'creating_merge_request_in' do
2022-06-21 17:19:12 +05:30
context 'when the current_user can download_code' do
before do
expect(subject).to receive(:allowed?).with(:download_code).and_return(true)
allow(subject).to receive(:allowed?).with(any_args).and_call_original
end
2022-04-01 21:47:47 +05:30
2022-06-21 17:19:12 +05:30
context 'when project is public' do
let(:project) { public_project }
2022-04-01 21:47:47 +05:30
2022-06-21 17:19:12 +05:30
context 'when the current_user is guest' do
let(:current_user) { guest }
it { is_expected.to be_allowed(:create_merge_request_in) }
end
2022-04-01 21:47:47 +05:30
end
2022-06-21 17:19:12 +05:30
context 'when project is internal' do
let(:project) { internal_project }
context 'when the current_user is guest' do
let(:current_user) { guest }
it { is_expected.to be_allowed(:create_merge_request_in) }
end
end
2022-04-01 21:47:47 +05:30
2022-06-21 17:19:12 +05:30
context 'when project is private' do
let(:project) { private_project }
2022-04-01 21:47:47 +05:30
2022-06-21 17:19:12 +05:30
context 'when the current_user is guest' do
let(:current_user) { guest }
it { is_expected.not_to be_allowed(:create_merge_request_in) }
end
context 'when the current_user is reporter or above' do
let(:current_user) { reporter }
it { is_expected.to be_allowed(:create_merge_request_in) }
end
2022-04-01 21:47:47 +05:30
end
end
2019-02-02 18:00:53 +05:30
2022-06-21 17:19:12 +05:30
context 'when the current_user can not download code' do
before do
expect(subject).to receive(:allowed?).with(:download_code).and_return(false)
allow(subject).to receive(:allowed?).with(any_args).and_call_original
end
context 'when project is public' do
let(:project) { public_project }
2022-04-01 21:47:47 +05:30
2022-06-21 17:19:12 +05:30
context 'when the current_user is guest' do
let(:current_user) { guest }
2022-04-01 21:47:47 +05:30
2022-06-21 17:19:12 +05:30
it { is_expected.not_to be_allowed(:create_merge_request_in) }
end
2022-04-01 21:47:47 +05:30
end
2022-06-21 17:19:12 +05:30
context 'when project is internal' do
let(:project) { internal_project }
context 'when the current_user is guest' do
let(:current_user) { guest }
it { is_expected.not_to be_allowed(:create_merge_request_in) }
end
end
context 'when project is private' do
let(:project) { private_project }
context 'when the current_user is guest' do
let(:current_user) { guest }
it { is_expected.not_to be_allowed(:create_merge_request_in) }
end
context 'when the current_user is reporter or above' do
let(:current_user) { reporter }
2022-04-01 21:47:47 +05:30
2022-06-21 17:19:12 +05:30
it { is_expected.not_to be_allowed(:create_merge_request_in) }
end
2022-04-01 21:47:47 +05:30
end
2019-02-02 18:00:53 +05:30
end
end
2019-12-26 22:10:19 +05:30
context 'pipeline feature' do
2021-12-11 22:18:48 +05:30
let(:project) { private_project }
let(:current_user) { developer }
let(:pipeline) { create(:ci_pipeline, project: project) }
2019-12-26 22:10:19 +05:30
2021-12-11 22:18:48 +05:30
describe 'for confirmed user' do
it 'allows modify pipelines' do
expect_allowed(:create_pipeline)
expect_allowed(:update_pipeline)
expect_allowed(:create_pipeline_schedule)
end
2021-04-17 20:07:23 +05:30
end
2019-12-26 22:10:19 +05:30
describe 'for unconfirmed user' do
2022-04-04 11:22:00 +05:30
let(:current_user) { project.first_owner.tap { |u| u.update!(confirmed_at: nil) } }
2019-12-26 22:10:19 +05:30
it 'disallows to modify pipelines' do
expect_disallowed(:create_pipeline)
expect_disallowed(:update_pipeline)
2021-12-11 22:18:48 +05:30
expect_disallowed(:destroy_pipeline)
2019-12-26 22:10:19 +05:30
expect_disallowed(:create_pipeline_schedule)
end
end
2021-12-11 22:18:48 +05:30
describe 'destroy permission' do
describe 'for developers' do
it 'prevents :destroy_pipeline' do
expect(current_user.can?(:destroy_pipeline, pipeline)).to be_falsey
end
end
2019-12-26 22:10:19 +05:30
2021-12-11 22:18:48 +05:30
describe 'for maintainers' do
let(:current_user) { maintainer }
it 'prevents :destroy_pipeline' do
project.add_maintainer(maintainer)
expect(current_user.can?(:destroy_pipeline, pipeline)).to be_falsey
end
end
describe 'for project owner' do
2022-04-04 11:22:00 +05:30
let(:current_user) { project.first_owner }
2021-12-11 22:18:48 +05:30
it 'allows :destroy_pipeline' do
expect(current_user.can?(:destroy_pipeline, pipeline)).to be_truthy
end
context 'on archived projects' do
before do
project.update!(archived: true)
end
it 'prevents :destroy_pipeline' do
expect(current_user.can?(:destroy_pipeline, pipeline)).to be_falsey
end
end
context 'on archived pending_delete projects' do
before do
project.update!(archived: true, pending_delete: true)
end
it 'allows :destroy_pipeline' do
expect(current_user.can?(:destroy_pipeline, pipeline)).to be_truthy
end
end
2019-12-26 22:10:19 +05:30
end
end
end
2018-11-08 19:23:39 +05:30
context 'builds feature' do
2019-02-02 18:00:53 +05:30
context 'when builds are disabled' do
2020-11-24 15:15:51 +05:30
let(:current_user) { owner }
2018-11-08 19:23:39 +05:30
2019-02-02 18:00:53 +05:30
before do
2020-06-04 15:10:26 +05:30
project.project_feature.update!(builds_access_level: ProjectFeature::DISABLED)
2019-02-02 18:00:53 +05:30
end
2020-06-23 00:09:42 +05:30
it 'disallows all permissions except pipeline when the feature is disabled' do
builds_permissions = [
:create_build, :read_build, :update_build, :admin_build, :destroy_build,
2020-11-05 12:06:23 +05:30
:create_pipeline_schedule, :read_pipeline_schedule_variables, :update_pipeline_schedule, :admin_pipeline_schedule, :destroy_pipeline_schedule,
2020-06-23 00:09:42 +05:30
:create_environment, :read_environment, :update_environment, :admin_environment, :destroy_environment,
:create_cluster, :read_cluster, :update_cluster, :admin_cluster, :destroy_cluster,
:create_deployment, :read_deployment, :update_deployment, :admin_deployment, :destroy_deployment
]
2020-05-24 23:13:21 +05:30
2020-06-23 00:09:42 +05:30
expect_disallowed(*builds_permissions)
2019-02-02 18:00:53 +05:30
end
end
context 'when builds are disabled only for some users' do
2020-11-24 15:15:51 +05:30
let(:current_user) { guest }
2019-02-02 18:00:53 +05:30
before do
2020-06-04 15:10:26 +05:30
project.project_feature.update!(builds_access_level: ProjectFeature::PRIVATE)
2019-02-02 18:00:53 +05:30
end
it 'disallows pipeline and commit_status permissions' do
builds_permissions = [
:create_pipeline, :update_pipeline, :admin_pipeline, :destroy_pipeline,
:create_commit_status, :update_commit_status, :admin_commit_status, :destroy_commit_status
]
expect_disallowed(*builds_permissions)
end
2018-11-08 19:23:39 +05:30
end
end
context 'repository feature' do
2020-06-04 15:10:26 +05:30
let(:repository_permissions) do
[
:create_pipeline, :update_pipeline, :admin_pipeline, :destroy_pipeline,
:create_build, :read_build, :update_build, :admin_build, :destroy_build,
:create_pipeline_schedule, :read_pipeline_schedule, :update_pipeline_schedule, :admin_pipeline_schedule, :destroy_pipeline_schedule,
:create_environment, :read_environment, :update_environment, :admin_environment, :destroy_environment,
:create_cluster, :read_cluster, :update_cluster, :admin_cluster,
:create_deployment, :read_deployment, :update_deployment, :admin_deployment, :destroy_deployment,
2023-01-13 00:05:48 +05:30
:download_code, :build_download_code
2020-06-04 15:10:26 +05:30
]
end
context 'when user is a project member' do
2020-11-24 15:15:51 +05:30
let(:current_user) { owner }
2018-11-08 19:23:39 +05:30
2020-06-04 15:10:26 +05:30
context 'when it is disabled' do
before do
project.project_feature.update!(
repository_access_level: ProjectFeature::DISABLED,
merge_requests_access_level: ProjectFeature::DISABLED,
builds_access_level: ProjectFeature::DISABLED,
forking_access_level: ProjectFeature::DISABLED
)
end
2018-11-08 19:23:39 +05:30
2020-06-23 00:09:42 +05:30
it 'disallows all permissions' do
expect_disallowed(*repository_permissions)
2020-06-04 15:10:26 +05:30
end
2020-05-24 23:13:21 +05:30
end
end
2020-11-24 15:15:51 +05:30
context 'when user is non-member' do
let(:current_user) { non_member }
2020-05-24 23:13:21 +05:30
2020-06-04 15:10:26 +05:30
context 'when access level is private' do
before do
project.project_feature.update!(
repository_access_level: ProjectFeature::PRIVATE,
merge_requests_access_level: ProjectFeature::PRIVATE,
builds_access_level: ProjectFeature::PRIVATE,
forking_access_level: ProjectFeature::PRIVATE
)
end
2020-05-24 23:13:21 +05:30
2020-06-04 15:10:26 +05:30
it 'disallows all permissions' do
expect_disallowed(*repository_permissions)
end
2020-05-24 23:13:21 +05:30
end
2018-11-08 19:23:39 +05:30
end
end
2018-03-17 18:26:18 +05:30
it_behaves_like 'project policies as anonymous'
it_behaves_like 'project policies as guest'
it_behaves_like 'project policies as reporter'
it_behaves_like 'project policies as developer'
2018-11-18 11:00:15 +05:30
it_behaves_like 'project policies as maintainer'
2018-03-17 18:26:18 +05:30
it_behaves_like 'project policies as owner'
2020-05-24 23:13:21 +05:30
it_behaves_like 'project policies as admin with admin mode'
it_behaves_like 'project policies as admin without admin mode'
2018-03-27 19:54:05 +05:30
context 'when a public project has merge requests allowing access' do
include ProjectForksHelper
2020-11-24 15:15:51 +05:30
let(:current_user) { create(:user) }
2018-03-27 19:54:05 +05:30
let(:target_project) { create(:project, :public) }
let(:project) { fork_project(target_project) }
let!(:merge_request) do
create(
:merge_request,
target_project: target_project,
source_project: project,
2018-11-08 19:23:39 +05:30
allow_collaboration: true
2018-03-27 19:54:05 +05:30
)
end
2020-10-24 23:57:45 +05:30
2018-03-27 19:54:05 +05:30
let(:maintainer_abilities) do
2018-11-08 19:23:39 +05:30
%w(create_build create_pipeline)
2018-03-27 19:54:05 +05:30
end
it 'does not allow pushing code' do
expect_disallowed(*maintainer_abilities)
end
it 'allows pushing if the user is a member with push access to the target project' do
2020-11-24 15:15:51 +05:30
target_project.add_developer(current_user)
2018-03-27 19:54:05 +05:30
expect_allowed(*maintainer_abilities)
end
2020-05-24 23:13:21 +05:30
it 'disallows abilities to a maintainer if the merge request was closed' do
2020-11-24 15:15:51 +05:30
target_project.add_developer(current_user)
2018-03-27 19:54:05 +05:30
merge_request.close!
expect_disallowed(*maintainer_abilities)
end
end
2019-02-15 15:39:39 +05:30
2022-06-02 21:05:25 +05:30
context 'importing members from another project' do
%w(maintainer owner).each do |role|
context "with #{role}" do
let(:current_user) { send(role) }
it { is_expected.to be_allowed(:import_project_members_from_another_project) }
end
end
%w(guest reporter developer anonymous).each do |role|
context "with #{role}" do
let(:current_user) { send(role) }
it { is_expected.to be_disallowed(:import_project_members_from_another_project) }
end
end
context 'with an admin' do
let(:current_user) { admin }
context 'when admin mode is enabled', :enable_admin_mode do
it { expect_allowed(:import_project_members_from_another_project) }
end
context 'when admin mode is disabled' do
it { expect_disallowed(:import_project_members_from_another_project) }
end
end
end
2022-06-21 17:19:12 +05:30
context 'reading usage quotas' do
%w(maintainer owner).each do |role|
context "with #{role}" do
let(:current_user) { send(role) }
it { is_expected.to be_allowed(:read_usage_quotas) }
end
end
%w(guest reporter developer anonymous).each do |role|
context "with #{role}" do
let(:current_user) { send(role) }
it { is_expected.to be_disallowed(:read_usage_quotas) }
end
end
context 'with an admin' do
let(:current_user) { admin }
context 'when admin mode is enabled', :enable_admin_mode do
it { expect_allowed(:read_usage_quotas) }
end
context 'when admin mode is disabled' do
it { expect_disallowed(:read_usage_quotas) }
end
end
end
2019-02-15 15:39:39 +05:30
it_behaves_like 'clusterable policies' do
2020-11-24 15:15:51 +05:30
let_it_be(:clusterable) { create(:project, :repository) }
let_it_be(:cluster) do
create(:cluster, :provided_by_gcp, :project, projects: [clusterable])
2019-02-15 15:39:39 +05:30
end
end
2019-07-07 11:18:12 +05:30
2022-07-23 23:45:48 +05:30
context 'owner access' do
2022-11-25 23:54:43 +05:30
let_it_be(:owner_user) { owner }
let_it_be(:owner_of_different_thing) { create(:user) }
2022-07-23 23:45:48 +05:30
context 'personal project' do
2022-11-25 23:54:43 +05:30
let_it_be(:project) { private_project }
let_it_be(:project2) { create(:project) }
2022-07-23 23:45:48 +05:30
2022-11-25 23:54:43 +05:30
before_all do
2022-07-23 23:45:48 +05:30
project.add_guest(guest)
project.add_reporter(reporter)
project.add_developer(developer)
project.add_maintainer(maintainer)
project2.add_owner(owner_of_different_thing)
end
it 'allows owner access', :aggregate_failures do
expect(described_class.new(owner_of_different_thing, project)).to be_disallowed(:owner_access)
2022-11-25 23:54:43 +05:30
expect(described_class.new(non_member, project)).to be_disallowed(:owner_access)
2022-07-23 23:45:48 +05:30
expect(described_class.new(guest, project)).to be_disallowed(:owner_access)
expect(described_class.new(reporter, project)).to be_disallowed(:owner_access)
expect(described_class.new(developer, project)).to be_disallowed(:owner_access)
expect(described_class.new(maintainer, project)).to be_disallowed(:owner_access)
expect(described_class.new(project.owner, project)).to be_allowed(:owner_access)
end
end
context 'group project' do
2022-11-25 23:54:43 +05:30
let_it_be(:project) { private_project_in_group }
let_it_be(:group2) { create(:group) }
let_it_be(:group) { project.group }
2022-07-23 23:45:48 +05:30
context 'group members' do
2022-11-25 23:54:43 +05:30
before_all do
2022-07-23 23:45:48 +05:30
group.add_guest(guest)
group.add_reporter(reporter)
group.add_developer(developer)
group.add_maintainer(maintainer)
group.add_owner(owner_user)
group2.add_owner(owner_of_different_thing)
end
it 'allows owner access', :aggregate_failures do
expect(described_class.new(owner_of_different_thing, project)).to be_disallowed(:owner_access)
2022-11-25 23:54:43 +05:30
expect(described_class.new(non_member, project)).to be_disallowed(:owner_access)
2022-07-23 23:45:48 +05:30
expect(described_class.new(guest, project)).to be_disallowed(:owner_access)
expect(described_class.new(reporter, project)).to be_disallowed(:owner_access)
expect(described_class.new(developer, project)).to be_disallowed(:owner_access)
expect(described_class.new(maintainer, project)).to be_disallowed(:owner_access)
expect(described_class.new(owner_user, project)).to be_allowed(:owner_access)
end
end
end
end
2023-01-13 00:05:48 +05:30
context 'with timeline event tags' do
context 'when user is member of the project' do
it 'allows access to timeline event tags' do
expect(described_class.new(owner, project)).to be_allowed(:read_incident_management_timeline_event_tag)
expect(described_class.new(developer, project)).to be_allowed(:read_incident_management_timeline_event_tag)
expect(described_class.new(guest, project)).to be_allowed(:read_incident_management_timeline_event_tag)
expect(described_class.new(admin, project)).to be_allowed(:read_incident_management_timeline_event_tag)
end
end
context 'when user is a maintainer/owner' do
it 'allows to create timeline event tags' do
expect(described_class.new(maintainer, project)).to be_allowed(:admin_incident_management_timeline_event_tag)
expect(described_class.new(owner, project)).to be_allowed(:admin_incident_management_timeline_event_tag)
end
end
context 'when user is a developer/guest/reporter' do
it 'disallows creation' do
expect(described_class.new(developer, project)).to be_disallowed(:admin_incident_management_timeline_event_tag)
expect(described_class.new(guest, project)).to be_disallowed(:admin_incident_management_timeline_event_tag)
expect(described_class.new(reporter, project)).to be_disallowed(:admin_incident_management_timeline_event_tag)
end
end
context 'when user is not a member of the project' do
let(:project) { private_project }
it 'disallows access to the timeline event tags' do
expect(described_class.new(non_member, project)).to be_disallowed(:read_incident_management_timeline_event_tag)
expect(described_class.new(non_member, project)).to be_disallowed(:admin_incident_management_timeline_event_tag)
end
end
end
2019-07-07 11:18:12 +05:30
context 'reading a project' do
it 'allows access when a user has read access to the repo' do
expect(described_class.new(owner, project)).to be_allowed(:read_project)
expect(described_class.new(developer, project)).to be_allowed(:read_project)
expect(described_class.new(admin, project)).to be_allowed(:read_project)
end
it 'never checks the external service' do
expect(::Gitlab::ExternalAuthorization).not_to receive(:access_allowed?)
expect(described_class.new(owner, project)).to be_allowed(:read_project)
end
context 'with an external authorization service' do
before do
enable_external_authorization_service_check
end
it 'allows access when the external service allows it' do
external_service_allow_access(owner, project)
external_service_allow_access(developer, project)
expect(described_class.new(owner, project)).to be_allowed(:read_project)
expect(described_class.new(developer, project)).to be_allowed(:read_project)
end
2020-05-24 23:13:21 +05:30
context 'with an admin' do
context 'when admin mode is enabled', :enable_admin_mode do
it 'does not check the external service and allows access' do
expect(::Gitlab::ExternalAuthorization).not_to receive(:access_allowed?)
2019-07-07 11:18:12 +05:30
2020-05-24 23:13:21 +05:30
expect(described_class.new(admin, project)).to be_allowed(:read_project)
end
end
context 'when admin mode is disabled' do
it 'checks the external service and allows access' do
external_service_allow_access(admin, project)
expect(::Gitlab::ExternalAuthorization).to receive(:access_allowed?)
expect(described_class.new(admin, project)).to be_allowed(:read_project)
end
end
2019-07-07 11:18:12 +05:30
end
it 'prevents all but seeing a public project in a list when access is denied' do
[developer, owner, build(:user), nil].each do |user|
external_service_deny_access(user, project)
policy = described_class.new(user, project)
expect(policy).not_to be_allowed(:read_project)
expect(policy).not_to be_allowed(:owner_access)
expect(policy).not_to be_allowed(:change_namespace)
end
end
it 'passes the full path to external authorization for logging purposes' do
expect(::Gitlab::ExternalAuthorization)
.to receive(:access_allowed?).with(owner, 'default_label', project.full_path).and_call_original
described_class.new(owner, project).allowed?(:read_project)
end
end
end
2019-12-21 20:55:43 +05:30
2020-03-13 15:44:24 +05:30
context 'forking a project' do
context 'anonymous user' do
2020-11-24 15:15:51 +05:30
let(:current_user) { anonymous }
2020-03-13 15:44:24 +05:30
it { is_expected.to be_disallowed(:fork_project) }
end
context 'project member' do
2020-11-24 15:15:51 +05:30
let(:project) { private_project }
2020-03-13 15:44:24 +05:30
context 'guest' do
let(:current_user) { guest }
it { is_expected.to be_disallowed(:fork_project) }
end
%w(reporter developer maintainer).each do |role|
context role do
let(:current_user) { send(role) }
it { is_expected.to be_allowed(:fork_project) }
end
end
end
end
2022-08-13 15:12:31 +05:30
describe 'create_task' do
context 'when user is member of the project' do
let(:current_user) { developer }
2023-01-13 00:05:48 +05:30
it { expect_allowed(:create_task) }
2022-08-13 15:12:31 +05:30
end
end
2023-01-10 11:22:00 +05:30
describe 'read_grafana', feature_category: :metrics do
using RSpec::Parameterized::TableSyntax
let(:policy) { :read_grafana }
where(:project_visibility, :role, :allowed) do
:public | :anonymous | false
:public | :guest | false
:public | :reporter | true
:internal | :anonymous | false
:internal | :guest | true
:internal | :reporter | true
:private | :anonymous | false
:private | :guest | true
:private | :reporter | true
end
with_them do
let(:current_user) { public_send(role) }
let(:project) { public_send("#{project_visibility}_project") }
if params[:allowed]
it { is_expected.to be_allowed(policy) }
else
it { is_expected.not_to be_allowed(policy) }
end
end
end
2019-12-21 20:55:43 +05:30
describe 'update_max_artifacts_size' do
context 'when no user' do
2020-11-24 15:15:51 +05:30
let(:current_user) { anonymous }
2019-12-21 20:55:43 +05:30
it { expect_disallowed(:update_max_artifacts_size) }
end
context 'admin' do
let(:current_user) { admin }
2020-05-24 23:13:21 +05:30
context 'when admin mode is enabled', :enable_admin_mode do
it { expect_allowed(:update_max_artifacts_size) }
end
context 'when admin mode is disabled' do
it { expect_disallowed(:update_max_artifacts_size) }
end
2019-12-21 20:55:43 +05:30
end
%w(guest reporter developer maintainer owner).each do |role|
context role do
let(:current_user) { send(role) }
it { expect_disallowed(:update_max_artifacts_size) }
end
end
end
2020-03-13 15:44:24 +05:30
2021-06-08 01:23:25 +05:30
describe 'read_storage_disk_path' do
context 'when no user' do
let(:current_user) { anonymous }
it { expect_disallowed(:read_storage_disk_path) }
end
context 'admin' do
let(:current_user) { admin }
context 'when admin mode is enabled', :enable_admin_mode do
it { expect_allowed(:read_storage_disk_path) }
end
context 'when admin mode is disabled' do
it { expect_disallowed(:read_storage_disk_path) }
end
end
%w(guest reporter developer maintainer owner).each do |role|
context role do
let(:current_user) { send(role) }
it { expect_disallowed(:read_storage_disk_path) }
end
end
end
2020-03-13 15:44:24 +05:30
context 'alert bot' do
let(:current_user) { User.alert_bot }
it { is_expected.to be_allowed(:reporter_access) }
context 'within a private project' do
2020-11-24 15:15:51 +05:30
let(:project) { private_project }
2020-03-13 15:44:24 +05:30
it { is_expected.to be_allowed(:admin_issue) }
end
end
2020-04-22 19:07:51 +05:30
2021-03-08 18:12:59 +05:30
describe 'set_pipeline_variables' do
context 'when user is developer' do
let(:current_user) { developer }
context 'when project allows user defined variables' do
before do
project.update!(restrict_user_defined_variables: false)
end
it { is_expected.to be_allowed(:set_pipeline_variables) }
end
context 'when project restricts use of user defined variables' do
before do
project.update!(restrict_user_defined_variables: true)
end
it { is_expected.not_to be_allowed(:set_pipeline_variables) }
end
end
context 'when user is maintainer' do
let(:current_user) { maintainer }
context 'when project allows user defined variables' do
before do
project.update!(restrict_user_defined_variables: false)
end
it { is_expected.to be_allowed(:set_pipeline_variables) }
end
context 'when project restricts use of user defined variables' do
before do
project.update!(restrict_user_defined_variables: true)
end
it { is_expected.to be_allowed(:set_pipeline_variables) }
end
end
end
2020-07-28 23:09:34 +05:30
context 'support bot' do
let(:current_user) { User.support_bot }
context 'with service desk disabled' do
2021-09-04 01:27:46 +05:30
it { expect_allowed(:public_access) }
it { expect_disallowed(:guest_access, :create_note, :read_project) }
2020-07-28 23:09:34 +05:30
end
context 'with service desk enabled' do
before do
allow(project).to receive(:service_desk_enabled?).and_return(true)
end
2022-07-23 23:45:48 +05:30
it { expect_allowed(:reporter_access, :create_note, :read_issue, :read_work_item) }
2020-07-28 23:09:34 +05:30
context 'when issues are protected members only' do
before do
project.project_feature.update!(issues_access_level: ProjectFeature::PRIVATE)
end
2022-07-23 23:45:48 +05:30
it { expect_allowed(:reporter_access, :create_note, :read_issue, :read_work_item) }
2020-07-28 23:09:34 +05:30
end
end
end
2021-03-11 19:13:27 +05:30
context "project bots" do
let(:project_bot) { create(:user, :project_bot) }
let(:user) { create(:user) }
context "project_bot_access" do
context "when regular user and part of the project" do
let(:current_user) { user }
before do
project.add_developer(user)
end
2022-10-11 01:57:18 +05:30
it { is_expected.not_to be_allowed(:project_bot_access) }
2021-03-11 19:13:27 +05:30
end
context "when project bot and not part of the project" do
let(:current_user) { project_bot }
2022-10-11 01:57:18 +05:30
it { is_expected.not_to be_allowed(:project_bot_access) }
2021-03-11 19:13:27 +05:30
end
context "when project bot and part of the project" do
let(:current_user) { project_bot }
before do
project.add_developer(project_bot)
end
2022-10-11 01:57:18 +05:30
it { is_expected.to be_allowed(:project_bot_access) }
2021-03-11 19:13:27 +05:30
end
end
context 'with resource access tokens' do
let(:current_user) { project_bot }
before do
project.add_maintainer(project_bot)
end
2022-10-11 01:57:18 +05:30
it { is_expected.not_to be_allowed(:create_resource_access_tokens) }
2021-03-11 19:13:27 +05:30
end
end
2020-04-22 19:07:51 +05:30
describe 'read_prometheus_alerts' do
context 'with admin' do
let(:current_user) { admin }
2020-05-24 23:13:21 +05:30
context 'when admin mode is enabled', :enable_admin_mode do
it { is_expected.to be_allowed(:read_prometheus_alerts) }
end
context 'when admin mode is disabled' do
it { is_expected.to be_disallowed(:read_prometheus_alerts) }
end
2020-04-22 19:07:51 +05:30
end
context 'with owner' do
let(:current_user) { owner }
it { is_expected.to be_allowed(:read_prometheus_alerts) }
end
context 'with maintainer' do
let(:current_user) { maintainer }
it { is_expected.to be_allowed(:read_prometheus_alerts) }
end
context 'with developer' do
let(:current_user) { developer }
it { is_expected.to be_disallowed(:read_prometheus_alerts) }
end
context 'with reporter' do
let(:current_user) { reporter }
it { is_expected.to be_disallowed(:read_prometheus_alerts) }
end
context 'with guest' do
let(:current_user) { guest }
it { is_expected.to be_disallowed(:read_prometheus_alerts) }
end
context 'with anonymous' do
2020-11-24 15:15:51 +05:30
let(:current_user) { anonymous }
2020-04-22 19:07:51 +05:30
it { is_expected.to be_disallowed(:read_prometheus_alerts) }
end
end
2020-05-24 23:13:21 +05:30
describe 'metrics_dashboard feature' do
context 'public project' do
2020-11-24 15:15:51 +05:30
let(:project) { public_project }
2020-05-24 23:13:21 +05:30
context 'feature private' do
context 'with reporter' do
let(:current_user) { reporter }
it { is_expected.to be_allowed(:metrics_dashboard) }
it { is_expected.to be_allowed(:read_prometheus) }
it { is_expected.to be_allowed(:read_deployment) }
it { is_expected.to be_allowed(:read_metrics_user_starred_dashboard) }
it { is_expected.to be_allowed(:create_metrics_user_starred_dashboard) }
end
context 'with guest' do
let(:current_user) { guest }
it { is_expected.to be_disallowed(:metrics_dashboard) }
end
context 'with anonymous' do
2020-11-24 15:15:51 +05:30
let(:current_user) { anonymous }
2020-05-24 23:13:21 +05:30
it { is_expected.to be_disallowed(:metrics_dashboard) }
end
end
context 'feature enabled' do
before do
2020-06-04 15:10:26 +05:30
project.project_feature.update!(metrics_dashboard_access_level: ProjectFeature::ENABLED)
2020-05-24 23:13:21 +05:30
end
context 'with reporter' do
let(:current_user) { reporter }
it { is_expected.to be_allowed(:metrics_dashboard) }
it { is_expected.to be_allowed(:read_prometheus) }
it { is_expected.to be_allowed(:read_deployment) }
it { is_expected.to be_allowed(:read_metrics_user_starred_dashboard) }
it { is_expected.to be_allowed(:create_metrics_user_starred_dashboard) }
end
context 'with guest' do
let(:current_user) { guest }
it { is_expected.to be_allowed(:metrics_dashboard) }
it { is_expected.to be_allowed(:read_prometheus) }
it { is_expected.to be_allowed(:read_deployment) }
it { is_expected.to be_allowed(:read_metrics_user_starred_dashboard) }
it { is_expected.to be_allowed(:create_metrics_user_starred_dashboard) }
end
context 'with anonymous' do
2020-11-24 15:15:51 +05:30
let(:current_user) { anonymous }
2020-05-24 23:13:21 +05:30
it { is_expected.to be_allowed(:metrics_dashboard) }
it { is_expected.to be_allowed(:read_prometheus) }
it { is_expected.to be_allowed(:read_deployment) }
it { is_expected.to be_disallowed(:read_metrics_user_starred_dashboard) }
it { is_expected.to be_disallowed(:create_metrics_user_starred_dashboard) }
end
end
end
context 'internal project' do
2020-11-24 15:15:51 +05:30
let(:project) { internal_project }
2020-05-24 23:13:21 +05:30
context 'feature private' do
context 'with reporter' do
let(:current_user) { reporter }
it { is_expected.to be_allowed(:metrics_dashboard) }
it { is_expected.to be_allowed(:read_prometheus) }
it { is_expected.to be_allowed(:read_deployment) }
it { is_expected.to be_allowed(:read_metrics_user_starred_dashboard) }
it { is_expected.to be_allowed(:create_metrics_user_starred_dashboard) }
end
context 'with guest' do
let(:current_user) { guest }
it { is_expected.to be_disallowed(:metrics_dashboard) }
end
context 'with anonymous' do
2020-11-24 15:15:51 +05:30
let(:current_user) { anonymous }
2020-05-24 23:13:21 +05:30
2022-10-11 01:57:18 +05:30
it { is_expected.to be_disallowed(:metrics_dashboard) }
2020-05-24 23:13:21 +05:30
end
end
context 'feature enabled' do
before do
2020-06-04 15:10:26 +05:30
project.project_feature.update!(metrics_dashboard_access_level: ProjectFeature::ENABLED)
2020-05-24 23:13:21 +05:30
end
context 'with reporter' do
let(:current_user) { reporter }
it { is_expected.to be_allowed(:metrics_dashboard) }
it { is_expected.to be_allowed(:read_prometheus) }
it { is_expected.to be_allowed(:read_deployment) }
it { is_expected.to be_allowed(:read_metrics_user_starred_dashboard) }
it { is_expected.to be_allowed(:create_metrics_user_starred_dashboard) }
end
context 'with guest' do
let(:current_user) { guest }
it { is_expected.to be_allowed(:metrics_dashboard) }
it { is_expected.to be_allowed(:read_prometheus) }
it { is_expected.to be_allowed(:read_deployment) }
it { is_expected.to be_allowed(:read_metrics_user_starred_dashboard) }
it { is_expected.to be_allowed(:create_metrics_user_starred_dashboard) }
end
context 'with anonymous' do
2020-11-24 15:15:51 +05:30
let(:current_user) { anonymous }
2020-05-24 23:13:21 +05:30
it { is_expected.to be_disallowed(:metrics_dashboard) }
end
end
end
context 'private project' do
2020-11-24 15:15:51 +05:30
let(:project) { private_project }
2020-05-24 23:13:21 +05:30
context 'feature private' do
context 'with reporter' do
let(:current_user) { reporter }
it { is_expected.to be_allowed(:metrics_dashboard) }
it { is_expected.to be_allowed(:read_prometheus) }
it { is_expected.to be_allowed(:read_deployment) }
it { is_expected.to be_allowed(:read_metrics_user_starred_dashboard) }
it { is_expected.to be_allowed(:create_metrics_user_starred_dashboard) }
end
context 'with guest' do
let(:current_user) { guest }
it { is_expected.to be_disallowed(:metrics_dashboard) }
end
context 'with anonymous' do
2020-11-24 15:15:51 +05:30
let(:current_user) { anonymous }
2020-05-24 23:13:21 +05:30
it { is_expected.to be_disallowed(:metrics_dashboard) }
end
end
context 'feature enabled' do
context 'with reporter' do
let(:current_user) { reporter }
it { is_expected.to be_allowed(:metrics_dashboard) }
it { is_expected.to be_allowed(:read_prometheus) }
it { is_expected.to be_allowed(:read_deployment) }
it { is_expected.to be_allowed(:read_metrics_user_starred_dashboard) }
it { is_expected.to be_allowed(:create_metrics_user_starred_dashboard) }
end
context 'with guest' do
let(:current_user) { guest }
it { is_expected.to be_disallowed(:metrics_dashboard) }
end
context 'with anonymous' do
2020-11-24 15:15:51 +05:30
let(:current_user) { anonymous }
2020-05-24 23:13:21 +05:30
it { is_expected.to be_disallowed(:metrics_dashboard) }
end
end
end
context 'feature disabled' do
before do
2020-06-04 15:10:26 +05:30
project.project_feature.update!(metrics_dashboard_access_level: ProjectFeature::DISABLED)
2020-05-24 23:13:21 +05:30
end
context 'with reporter' do
let(:current_user) { reporter }
it { is_expected.to be_disallowed(:metrics_dashboard) }
end
context 'with guest' do
let(:current_user) { guest }
it { is_expected.to be_disallowed(:metrics_dashboard) }
end
context 'with anonymous' do
2020-11-24 15:15:51 +05:30
let(:current_user) { anonymous }
2020-05-24 23:13:21 +05:30
it { is_expected.to be_disallowed(:metrics_dashboard) }
end
end
end
2021-09-04 01:27:46 +05:30
context 'deploy key access' do
context 'private project' do
let(:project) { private_project }
let!(:deploy_key) { create(:deploy_key, user: owner) }
subject { described_class.new(deploy_key, project) }
context 'when a read deploy key is enabled in the project' do
let!(:deploy_keys_project) { create(:deploy_keys_project, project: project, deploy_key: deploy_key) }
it { is_expected.to be_allowed(:download_code) }
it { is_expected.to be_disallowed(:push_code) }
it { is_expected.to be_disallowed(:read_project) }
end
context 'when a write deploy key is enabled in the project' do
let!(:deploy_keys_project) { create(:deploy_keys_project, :write_access, project: project, deploy_key: deploy_key) }
it { is_expected.to be_allowed(:download_code) }
it { is_expected.to be_allowed(:push_code) }
it { is_expected.to be_disallowed(:read_project) }
end
context 'when the deploy key is not enabled in the project' do
it { is_expected.to be_disallowed(:download_code) }
it { is_expected.to be_disallowed(:push_code) }
it { is_expected.to be_disallowed(:read_project) }
end
end
end
2020-05-24 23:13:21 +05:30
context 'deploy token access' do
let!(:project_deploy_token) do
create(:project_deploy_token, project: project, deploy_token: deploy_token)
end
subject { described_class.new(deploy_token, project) }
2022-07-01 11:34:44 +05:30
context 'private project' do
let(:project) { private_project }
2020-05-24 23:13:21 +05:30
2022-07-01 11:34:44 +05:30
context 'a deploy token with read_registry scope' do
let(:deploy_token) { create(:deploy_token, read_registry: true, write_registry: false) }
2021-10-27 15:23:28 +05:30
2022-07-01 11:34:44 +05:30
it { is_expected.to be_allowed(:read_container_image) }
it { is_expected.to be_disallowed(:create_container_image) }
context 'with registry disabled' do
include_context 'registry disabled via project features'
it { is_expected.to be_disallowed(:read_container_image) }
it { is_expected.to be_disallowed(:create_container_image) }
end
end
context 'a deploy token with write_registry scope' do
let(:deploy_token) { create(:deploy_token, read_registry: false, write_registry: true) }
it { is_expected.to be_disallowed(:read_container_image) }
it { is_expected.to be_allowed(:create_container_image) }
context 'with registry disabled' do
include_context 'registry disabled via project features'
it { is_expected.to be_disallowed(:read_container_image) }
it { is_expected.to be_disallowed(:create_container_image) }
end
end
context 'a deploy token with no registry scope' do
let(:deploy_token) { create(:deploy_token, read_registry: false, write_registry: false) }
it { is_expected.to be_disallowed(:read_container_image) }
it { is_expected.to be_disallowed(:create_container_image) }
end
context 'a deploy token with read_package_registry scope' do
let(:deploy_token) { create(:deploy_token, read_repository: false, read_registry: false, read_package_registry: true) }
it { is_expected.to be_allowed(:read_project) }
it { is_expected.to be_allowed(:read_package) }
it { is_expected.to be_disallowed(:create_package) }
it_behaves_like 'package access with repository disabled'
end
context 'a deploy token with write_package_registry scope' do
let(:deploy_token) { create(:deploy_token, read_repository: false, read_registry: false, write_package_registry: true) }
it { is_expected.to be_allowed(:create_package) }
it { is_expected.to be_allowed(:read_package) }
it { is_expected.to be_allowed(:read_project) }
it { is_expected.to be_disallowed(:destroy_package) }
it_behaves_like 'package access with repository disabled'
end
2020-05-24 23:13:21 +05:30
end
2022-07-01 11:34:44 +05:30
context 'public project' do
let(:project) { public_project }
2020-05-24 23:13:21 +05:30
2022-07-01 11:34:44 +05:30
context 'a deploy token with read_registry scope' do
let(:deploy_token) { create(:deploy_token, read_registry: true, write_registry: false) }
2021-10-27 15:23:28 +05:30
2022-07-01 11:34:44 +05:30
it { is_expected.to be_allowed(:read_container_image) }
it { is_expected.to be_disallowed(:create_container_image) }
context 'with registry disabled' do
include_context 'registry disabled via project features'
it { is_expected.to be_disallowed(:read_container_image) }
it { is_expected.to be_disallowed(:create_container_image) }
end
context 'with registry private' do
include_context 'registry set to private via project features'
it { is_expected.to be_allowed(:read_container_image) }
it { is_expected.to be_disallowed(:create_container_image) }
end
end
context 'a deploy token with write_registry scope' do
let(:deploy_token) { create(:deploy_token, read_registry: false, write_registry: true) }
it { is_expected.to be_allowed(:read_container_image) }
it { is_expected.to be_allowed(:create_container_image) }
context 'with registry disabled' do
include_context 'registry disabled via project features'
it { is_expected.to be_disallowed(:read_container_image) }
it { is_expected.to be_disallowed(:create_container_image) }
end
context 'with registry private' do
include_context 'registry set to private via project features'
it { is_expected.to be_allowed(:read_container_image) }
it { is_expected.to be_allowed(:create_container_image) }
end
end
context 'a deploy token with no registry scope' do
let(:deploy_token) { create(:deploy_token, read_registry: false, write_registry: false) }
it { is_expected.to be_disallowed(:read_container_image) }
it { is_expected.to be_disallowed(:create_container_image) }
end
2020-05-24 23:13:21 +05:30
end
end
2020-06-23 00:09:42 +05:30
describe 'create_web_ide_terminal' do
context 'with admin' do
let(:current_user) { admin }
context 'when admin mode enabled', :enable_admin_mode do
it { is_expected.to be_allowed(:create_web_ide_terminal) }
end
context 'when admin mode disabled' do
it { is_expected.to be_disallowed(:create_web_ide_terminal) }
end
end
context 'with owner' do
let(:current_user) { owner }
it { is_expected.to be_allowed(:create_web_ide_terminal) }
end
context 'with maintainer' do
let(:current_user) { maintainer }
it { is_expected.to be_allowed(:create_web_ide_terminal) }
end
context 'with developer' do
let(:current_user) { developer }
it { is_expected.to be_disallowed(:create_web_ide_terminal) }
end
context 'with reporter' do
let(:current_user) { reporter }
it { is_expected.to be_disallowed(:create_web_ide_terminal) }
end
context 'with guest' do
let(:current_user) { guest }
it { is_expected.to be_disallowed(:create_web_ide_terminal) }
end
context 'with non member' do
2020-11-24 15:15:51 +05:30
let(:current_user) { non_member }
2020-06-23 00:09:42 +05:30
it { is_expected.to be_disallowed(:create_web_ide_terminal) }
end
context 'with anonymous' do
2020-11-24 15:15:51 +05:30
let(:current_user) { anonymous }
2020-06-23 00:09:42 +05:30
it { is_expected.to be_disallowed(:create_web_ide_terminal) }
end
end
describe 'read_repository_graphs' do
2020-11-24 15:15:51 +05:30
let(:current_user) { guest }
2020-06-23 00:09:42 +05:30
before do
allow(subject).to receive(:allowed?).with(:read_repository_graphs).and_call_original
allow(subject).to receive(:allowed?).with(:download_code).and_return(can_download_code)
end
context 'when user can download_code' do
let(:can_download_code) { true }
it { is_expected.to be_allowed(:read_repository_graphs) }
end
context 'when user cannot download_code' do
let(:can_download_code) { false }
it { is_expected.to be_disallowed(:read_repository_graphs) }
end
end
2021-03-11 19:13:27 +05:30
context 'security configuration feature' do
%w(guest reporter).each do |role|
context role do
let(:current_user) { send(role) }
it 'prevents reading security configuration' do
expect_disallowed(:read_security_configuration)
end
end
end
%w(developer maintainer owner).each do |role|
context role do
let(:current_user) { send(role) }
it 'allows reading security configuration' do
expect_allowed(:read_security_configuration)
end
end
end
end
2021-12-11 22:18:48 +05:30
context 'infrastructure google cloud feature' do
%w(guest reporter developer).each do |role|
context role do
let(:current_user) { send(role) }
it 'disallows managing google cloud' do
expect_disallowed(:admin_project_google_cloud)
end
end
end
%w(maintainer owner).each do |role|
context role do
let(:current_user) { send(role) }
it 'allows managing google cloud' do
expect_allowed(:admin_project_google_cloud)
end
end
end
end
2020-07-28 23:09:34 +05:30
describe 'design permissions' do
2021-06-08 01:23:25 +05:30
include DesignManagementTestHelpers
2020-11-24 15:15:51 +05:30
let(:current_user) { guest }
2020-07-28 23:09:34 +05:30
let(:design_permissions) do
%i[read_design_activity read_design]
end
context 'when design management is not available' do
2021-06-08 01:23:25 +05:30
before do
enable_design_management(false)
end
2020-07-28 23:09:34 +05:30
it { is_expected.not_to be_allowed(*design_permissions) }
end
context 'when design management is available' do
before do
enable_design_management
end
it { is_expected.to be_allowed(*design_permissions) }
end
end
2020-06-23 00:09:42 +05:30
describe 'read_build_report_results' do
2020-11-24 15:15:51 +05:30
let(:current_user) { guest }
2020-06-23 00:09:42 +05:30
before do
allow(subject).to receive(:allowed?).with(:read_build_report_results).and_call_original
allow(subject).to receive(:allowed?).with(:read_build).and_return(can_read_build)
allow(subject).to receive(:allowed?).with(:read_pipeline).and_return(can_read_pipeline)
end
context 'when user can read_build and read_pipeline' do
let(:can_read_build) { true }
let(:can_read_pipeline) { true }
it { is_expected.to be_allowed(:read_build_report_results) }
end
context 'when user can read_build but cannot read_pipeline' do
let(:can_read_build) { true }
let(:can_read_pipeline) { false }
it { is_expected.to be_disallowed(:read_build_report_results) }
end
context 'when user cannot read_build but can read_pipeline' do
let(:can_read_build) { false }
let(:can_read_pipeline) { true }
it { is_expected.to be_disallowed(:read_build_report_results) }
end
context 'when user cannot read_build and cannot read_pipeline' do
let(:can_read_build) { false }
let(:can_read_pipeline) { false }
it { is_expected.to be_disallowed(:read_build_report_results) }
end
end
2020-07-28 23:09:34 +05:30
describe 'read_package' do
context 'with admin' do
let(:current_user) { admin }
it { is_expected.to be_allowed(:read_package) }
2021-10-27 15:23:28 +05:30
it_behaves_like 'package access with repository disabled'
2020-07-28 23:09:34 +05:30
end
context 'with owner' do
let(:current_user) { owner }
it { is_expected.to be_allowed(:read_package) }
end
context 'with maintainer' do
let(:current_user) { maintainer }
it { is_expected.to be_allowed(:read_package) }
end
context 'with developer' do
let(:current_user) { developer }
it { is_expected.to be_allowed(:read_package) }
end
context 'with reporter' do
let(:current_user) { reporter }
it { is_expected.to be_allowed(:read_package) }
end
context 'with guest' do
let(:current_user) { guest }
it { is_expected.to be_allowed(:read_package) }
end
context 'with non member' do
2020-11-24 15:15:51 +05:30
let(:current_user) { non_member }
2020-07-28 23:09:34 +05:30
it { is_expected.to be_allowed(:read_package) }
end
context 'with anonymous' do
2020-11-24 15:15:51 +05:30
let(:current_user) { anonymous }
2020-07-28 23:09:34 +05:30
it { is_expected.to be_allowed(:read_package) }
end
end
2020-11-24 15:15:51 +05:30
2022-07-23 23:45:48 +05:30
describe 'admin_package' do
context 'with admin' do
let(:current_user) { admin }
context 'when admin mode enabled', :enable_admin_mode do
it { is_expected.to be_allowed(:admin_package) }
end
context 'when admin mode disabled' do
it { is_expected.to be_disallowed(:admin_package) }
end
end
%i[owner maintainer].each do |role|
context "with #{role}" do
let(:current_user) { public_send(role) }
it { is_expected.to be_allowed(:admin_package) }
end
end
%i[developer reporter guest non_member anonymous].each do |role|
context "with #{role}" do
let(:current_user) { public_send(role) }
it { is_expected.to be_disallowed(:admin_package) }
end
end
end
describe 'view_package_registry_project_settings' do
2022-08-13 15:12:31 +05:30
context 'with packages disabled and' do
2022-07-23 23:45:48 +05:30
before do
2022-08-13 15:12:31 +05:30
stub_config(packages: { enabled: false })
2022-07-23 23:45:48 +05:30
end
2022-08-13 15:12:31 +05:30
context 'with registry enabled' do
before do
stub_config(registry: { enabled: true })
end
2022-07-23 23:45:48 +05:30
2022-08-13 15:12:31 +05:30
context 'with an admin user' do
let(:current_user) { admin }
context 'when admin mode enabled', :enable_admin_mode do
it { is_expected.to be_allowed(:view_package_registry_project_settings) }
end
context 'when admin mode disabled' do
it { is_expected.to be_disallowed(:view_package_registry_project_settings) }
end
2022-07-23 23:45:48 +05:30
end
2022-08-13 15:12:31 +05:30
%i[owner maintainer].each do |role|
context "with #{role}" do
let(:current_user) { public_send(role) }
it { is_expected.to be_allowed(:view_package_registry_project_settings) }
end
end
%i[developer reporter guest non_member anonymous].each do |role|
context "with #{role}" do
let(:current_user) { public_send(role) }
it { is_expected.to be_disallowed(:view_package_registry_project_settings) }
end
2022-07-23 23:45:48 +05:30
end
end
2022-08-13 15:12:31 +05:30
context 'with registry disabled' do
before do
stub_config(registry: { enabled: false })
end
context 'with admin user' do
let(:current_user) { admin }
context 'when admin mode enabled', :enable_admin_mode do
it { is_expected.to be_disallowed(:view_package_registry_project_settings) }
end
2022-07-23 23:45:48 +05:30
2022-08-13 15:12:31 +05:30
context 'when admin mode disabled' do
it { is_expected.to be_disallowed(:view_package_registry_project_settings) }
end
end
%i[owner maintainer developer reporter guest non_member anonymous].each do |role|
context "with #{role}" do
let(:current_user) { public_send(role) }
it { is_expected.to be_disallowed(:view_package_registry_project_settings) }
end
2022-07-23 23:45:48 +05:30
end
end
2022-08-13 15:12:31 +05:30
end
2022-07-23 23:45:48 +05:30
2022-08-13 15:12:31 +05:30
context 'with registry disabled and' do
before do
stub_config(registry: { enabled: false })
end
2022-07-23 23:45:48 +05:30
2022-08-13 15:12:31 +05:30
context 'with packages enabled' do
before do
stub_config(packages: { enabled: true })
end
context 'with an admin user' do
let(:current_user) { admin }
context 'when admin mode enabled', :enable_admin_mode do
it { is_expected.to be_allowed(:view_package_registry_project_settings) }
end
context 'when admin mode disabled' do
it { is_expected.to be_disallowed(:view_package_registry_project_settings) }
end
end
%i[owner maintainer].each do |role|
context "with #{role}" do
let(:current_user) { public_send(role) }
it { is_expected.to be_allowed(:view_package_registry_project_settings) }
end
end
%i[developer reporter guest non_member anonymous].each do |role|
context "with #{role}" do
let(:current_user) { public_send(role) }
it { is_expected.to be_disallowed(:view_package_registry_project_settings) }
end
end
end
context 'with packages disabled' do
before do
stub_config(packages: { enabled: false })
end
context 'with admin user' do
let(:current_user) { admin }
context 'when admin mode enabled', :enable_admin_mode do
it { is_expected.to be_disallowed(:view_package_registry_project_settings) }
end
context 'when admin mode disabled' do
it { is_expected.to be_disallowed(:view_package_registry_project_settings) }
end
end
%i[owner maintainer developer reporter guest non_member anonymous].each do |role|
context "with #{role}" do
let(:current_user) { public_send(role) }
it { is_expected.to be_disallowed(:view_package_registry_project_settings) }
end
2022-07-23 23:45:48 +05:30
end
end
end
2022-08-13 15:12:31 +05:30
context 'with registry & packages both disabled' do
2022-07-23 23:45:48 +05:30
before do
stub_config(registry: { enabled: false })
2022-08-13 15:12:31 +05:30
stub_config(packages: { enabled: false })
2022-07-23 23:45:48 +05:30
end
context 'with admin user' do
let(:current_user) { admin }
context 'when admin mode enabled', :enable_admin_mode do
it { is_expected.to be_disallowed(:view_package_registry_project_settings) }
end
context 'when admin mode disabled' do
it { is_expected.to be_disallowed(:view_package_registry_project_settings) }
end
end
%i[owner maintainer developer reporter guest non_member anonymous].each do |role|
context "with #{role}" do
let(:current_user) { public_send(role) }
it { is_expected.to be_disallowed(:view_package_registry_project_settings) }
end
end
end
end
2020-11-24 15:15:51 +05:30
describe 'read_feature_flag' do
subject { described_class.new(current_user, project) }
context 'with maintainer' do
let(:current_user) { maintainer }
context 'when repository is available' do
it { is_expected.to be_allowed(:read_feature_flag) }
end
context 'when repository is disabled' do
before do
project.project_feature.update!(
merge_requests_access_level: ProjectFeature::DISABLED,
builds_access_level: ProjectFeature::DISABLED,
repository_access_level: ProjectFeature::DISABLED
)
end
it { is_expected.to be_disallowed(:read_feature_flag) }
end
end
context 'with developer' do
let(:current_user) { developer }
context 'when repository is available' do
it { is_expected.to be_allowed(:read_feature_flag) }
end
end
context 'with reporter' do
let(:current_user) { reporter }
context 'when repository is available' do
it { is_expected.to be_disallowed(:read_feature_flag) }
end
end
end
2021-01-03 14:25:43 +05:30
2021-02-22 17:27:13 +05:30
describe 'read_analytics' do
context 'anonymous user' do
let(:current_user) { anonymous }
it { is_expected.to be_allowed(:read_analytics) }
end
context 'with various analytics features' do
let_it_be(:project_with_analytics_disabled) { create(:project, :analytics_disabled) }
let_it_be(:project_with_analytics_private) { create(:project, :analytics_private) }
let_it_be(:project_with_analytics_enabled) { create(:project, :analytics_enabled) }
2022-11-25 23:54:43 +05:30
before_all do
2021-08-04 16:29:09 +05:30
project_with_analytics_disabled.add_guest(guest)
project_with_analytics_private.add_guest(guest)
project_with_analytics_enabled.add_guest(guest)
project_with_analytics_disabled.add_reporter(reporter)
project_with_analytics_private.add_reporter(reporter)
project_with_analytics_enabled.add_reporter(reporter)
2021-02-22 17:27:13 +05:30
project_with_analytics_disabled.add_developer(developer)
project_with_analytics_private.add_developer(developer)
project_with_analytics_enabled.add_developer(developer)
end
2021-08-04 16:29:09 +05:30
context 'when analytics is disabled for the project' do
2021-02-22 17:27:13 +05:30
let(:project) { project_with_analytics_disabled }
context 'for guest user' do
let(:current_user) { guest }
it { is_expected.to be_disallowed(:read_cycle_analytics) }
it { is_expected.to be_disallowed(:read_insights) }
it { is_expected.to be_disallowed(:read_repository_graphs) }
2021-08-04 16:29:09 +05:30
it { is_expected.to be_disallowed(:read_ci_cd_analytics) }
end
context 'for reporter user' do
let(:current_user) { reporter }
it { is_expected.to be_disallowed(:read_cycle_analytics) }
it { is_expected.to be_disallowed(:read_insights) }
it { is_expected.to be_disallowed(:read_repository_graphs) }
it { is_expected.to be_disallowed(:read_ci_cd_analytics) }
2021-02-22 17:27:13 +05:30
end
context 'for developer' do
let(:current_user) { developer }
it { is_expected.to be_disallowed(:read_cycle_analytics) }
it { is_expected.to be_disallowed(:read_insights) }
it { is_expected.to be_disallowed(:read_repository_graphs) }
2021-08-04 16:29:09 +05:30
it { is_expected.to be_disallowed(:read_ci_cd_analytics) }
2021-02-22 17:27:13 +05:30
end
end
context 'when analytics is private for the project' do
let(:project) { project_with_analytics_private }
context 'for guest user' do
let(:current_user) { guest }
2021-08-04 16:29:09 +05:30
it { is_expected.to be_allowed(:read_cycle_analytics) }
it { is_expected.to be_allowed(:read_insights) }
2021-02-22 17:27:13 +05:30
it { is_expected.to be_disallowed(:read_repository_graphs) }
2021-08-04 16:29:09 +05:30
it { is_expected.to be_disallowed(:read_ci_cd_analytics) }
end
context 'for reporter user' do
let(:current_user) { reporter }
it { is_expected.to be_allowed(:read_cycle_analytics) }
it { is_expected.to be_allowed(:read_insights) }
it { is_expected.to be_allowed(:read_repository_graphs) }
it { is_expected.to be_allowed(:read_ci_cd_analytics) }
2021-02-22 17:27:13 +05:30
end
context 'for developer' do
let(:current_user) { developer }
it { is_expected.to be_allowed(:read_cycle_analytics) }
it { is_expected.to be_allowed(:read_insights) }
it { is_expected.to be_allowed(:read_repository_graphs) }
2021-08-04 16:29:09 +05:30
it { is_expected.to be_allowed(:read_ci_cd_analytics) }
2021-02-22 17:27:13 +05:30
end
end
context 'when analytics is enabled for the project' do
2021-08-04 16:29:09 +05:30
let(:project) { project_with_analytics_enabled }
2021-02-22 17:27:13 +05:30
context 'for guest user' do
let(:current_user) { guest }
2021-08-04 16:29:09 +05:30
it { is_expected.to be_allowed(:read_cycle_analytics) }
it { is_expected.to be_allowed(:read_insights) }
2021-02-22 17:27:13 +05:30
it { is_expected.to be_disallowed(:read_repository_graphs) }
2021-08-04 16:29:09 +05:30
it { is_expected.to be_disallowed(:read_ci_cd_analytics) }
end
context 'for reporter user' do
let(:current_user) { reporter }
it { is_expected.to be_allowed(:read_cycle_analytics) }
it { is_expected.to be_allowed(:read_insights) }
it { is_expected.to be_allowed(:read_repository_graphs) }
it { is_expected.to be_allowed(:read_ci_cd_analytics) }
2021-02-22 17:27:13 +05:30
end
context 'for developer' do
let(:current_user) { developer }
it { is_expected.to be_allowed(:read_cycle_analytics) }
it { is_expected.to be_allowed(:read_insights) }
it { is_expected.to be_allowed(:read_repository_graphs) }
2021-08-04 16:29:09 +05:30
it { is_expected.to be_allowed(:read_ci_cd_analytics) }
2021-02-22 17:27:13 +05:30
end
end
end
context 'project member' do
let(:project) { private_project }
%w(guest reporter developer maintainer).each do |role|
context role do
let(:current_user) { send(role) }
it { is_expected.to be_allowed(:read_analytics) }
context "without access to Analytics" do
before do
project.project_feature.update!(analytics_access_level: ProjectFeature::DISABLED)
end
it { is_expected.to be_disallowed(:read_analytics) }
end
end
end
end
end
2022-04-01 21:47:47 +05:30
describe 'read_ci_cd_analytics' do
context 'public project' do
let(:project) { create(:project, :public, :analytics_enabled) }
let(:current_user) { create(:user) }
context 'when public pipelines are disabled for the project' do
before do
project.update!(public_builds: false)
end
context 'project member' do
%w(guest reporter developer maintainer).each do |role|
context role do
before do
2022-08-13 15:12:31 +05:30
project.add_member(current_user, role.to_sym)
2022-04-01 21:47:47 +05:30
end
if role == 'guest'
it { is_expected.to be_disallowed(:read_ci_cd_analytics) }
else
it { is_expected.to be_allowed(:read_ci_cd_analytics) }
end
end
end
end
context 'non member' do
let(:current_user) { non_member }
it { is_expected.to be_disallowed(:read_ci_cd_analytics) }
end
context 'anonymous' do
let(:current_user) { anonymous }
it { is_expected.to be_disallowed(:read_ci_cd_analytics) }
end
end
context 'when public pipelines are enabled for the project' do
before do
project.update!(public_builds: true)
end
context 'project member' do
%w(guest reporter developer maintainer).each do |role|
context role do
before do
2022-08-13 15:12:31 +05:30
project.add_member(current_user, role.to_sym)
2022-04-01 21:47:47 +05:30
end
it { is_expected.to be_allowed(:read_ci_cd_analytics) }
end
end
end
context 'non member' do
let(:current_user) { non_member }
it { is_expected.to be_allowed(:read_ci_cd_analytics) }
end
context 'anonymous' do
let(:current_user) { anonymous }
it { is_expected.to be_allowed(:read_ci_cd_analytics) }
end
end
end
context 'private project' do
let(:project) { create(:project, :private, :analytics_enabled) }
let(:current_user) { create(:user) }
context 'project member' do
%w(guest reporter developer maintainer).each do |role|
context role do
before do
2022-08-13 15:12:31 +05:30
project.add_member(current_user, role.to_sym)
2022-04-01 21:47:47 +05:30
end
if role == 'guest'
it { is_expected.to be_disallowed(:read_ci_cd_analytics) }
else
it { is_expected.to be_allowed(:read_ci_cd_analytics) }
end
end
end
end
context 'non member' do
let(:current_user) { non_member }
it { is_expected.to be_disallowed(:read_ci_cd_analytics) }
end
context 'anonymous' do
let(:current_user) { anonymous }
it { is_expected.to be_disallowed(:read_ci_cd_analytics) }
end
end
end
2021-01-03 14:25:43 +05:30
it_behaves_like 'Self-managed Core resource access tokens'
2021-02-22 17:27:13 +05:30
describe 'operations feature' do
using RSpec::Parameterized::TableSyntax
2022-10-11 01:57:18 +05:30
let(:guest_permissions) { [:read_environment, :read_deployment] }
2022-08-27 11:52:29 +05:30
2022-10-11 01:57:18 +05:30
let(:developer_permissions) do
guest_permissions + [
2021-02-22 17:27:13 +05:30
:read_feature_flag, :read_sentry_issue, :read_alert_management_alert, :read_terraform_state,
:metrics_dashboard, :read_pod_logs, :read_prometheus, :create_feature_flag,
:create_environment, :create_deployment, :update_feature_flag, :update_environment,
:update_sentry_issue, :update_alert_management_alert, :update_deployment,
:destroy_feature_flag, :destroy_environment, :admin_feature_flag
]
end
2022-10-11 01:57:18 +05:30
let(:maintainer_permissions) do
developer_permissions + [
2021-02-22 17:27:13 +05:30
:read_cluster, :create_cluster, :update_cluster, :admin_environment,
:admin_cluster, :admin_terraform_state, :admin_deployment
]
end
2022-10-11 01:57:18 +05:30
before do
stub_feature_flags(split_operations_visibility_permissions: false)
end
2021-02-22 17:27:13 +05:30
where(:project_visibility, :access_level, :role, :allowed) do
:public | ProjectFeature::ENABLED | :maintainer | true
:public | ProjectFeature::ENABLED | :developer | true
:public | ProjectFeature::ENABLED | :guest | true
:public | ProjectFeature::ENABLED | :anonymous | true
:public | ProjectFeature::PRIVATE | :maintainer | true
:public | ProjectFeature::PRIVATE | :developer | true
:public | ProjectFeature::PRIVATE | :guest | true
:public | ProjectFeature::PRIVATE | :anonymous | false
:public | ProjectFeature::DISABLED | :maintainer | false
:public | ProjectFeature::DISABLED | :developer | false
:public | ProjectFeature::DISABLED | :guest | false
:public | ProjectFeature::DISABLED | :anonymous | false
:internal | ProjectFeature::ENABLED | :maintainer | true
:internal | ProjectFeature::ENABLED | :developer | true
:internal | ProjectFeature::ENABLED | :guest | true
:internal | ProjectFeature::ENABLED | :anonymous | false
:internal | ProjectFeature::PRIVATE | :maintainer | true
:internal | ProjectFeature::PRIVATE | :developer | true
:internal | ProjectFeature::PRIVATE | :guest | true
:internal | ProjectFeature::PRIVATE | :anonymous | false
:internal | ProjectFeature::DISABLED | :maintainer | false
:internal | ProjectFeature::DISABLED | :developer | false
:internal | ProjectFeature::DISABLED | :guest | false
:internal | ProjectFeature::DISABLED | :anonymous | false
:private | ProjectFeature::ENABLED | :maintainer | true
:private | ProjectFeature::ENABLED | :developer | true
:private | ProjectFeature::ENABLED | :guest | false
:private | ProjectFeature::ENABLED | :anonymous | false
:private | ProjectFeature::PRIVATE | :maintainer | true
:private | ProjectFeature::PRIVATE | :developer | true
:private | ProjectFeature::PRIVATE | :guest | false
:private | ProjectFeature::PRIVATE | :anonymous | false
:private | ProjectFeature::DISABLED | :maintainer | false
:private | ProjectFeature::DISABLED | :developer | false
:private | ProjectFeature::DISABLED | :guest | false
:private | ProjectFeature::DISABLED | :anonymous | false
end
with_them do
let(:current_user) { user_subject(role) }
let(:project) { project_subject(project_visibility) }
it 'allows/disallows the abilities based on the operation feature access level' do
project.project_feature.update!(operations_access_level: access_level)
if allowed
expect_allowed(*permissions_abilities(role))
else
expect_disallowed(*permissions_abilities(role))
end
end
2022-08-27 11:52:29 +05:30
end
end
2021-02-22 17:27:13 +05:30
2022-08-27 11:52:29 +05:30
describe 'environments feature' do
using RSpec::Parameterized::TableSyntax
2022-10-11 01:57:18 +05:30
let(:guest_permissions) { [:read_environment, :read_deployment] }
2022-08-27 11:52:29 +05:30
2022-10-11 01:57:18 +05:30
let(:developer_permissions) do
guest_permissions + [
2022-08-27 11:52:29 +05:30
:create_environment, :create_deployment, :update_environment, :update_deployment, :destroy_environment
]
end
2022-10-11 01:57:18 +05:30
let(:maintainer_permissions) do
developer_permissions + [:admin_environment, :admin_deployment]
2022-08-27 11:52:29 +05:30
end
where(:project_visibility, :access_level, :role, :allowed) do
:public | ProjectFeature::ENABLED | :maintainer | true
:public | ProjectFeature::ENABLED | :developer | true
:public | ProjectFeature::ENABLED | :guest | true
:public | ProjectFeature::ENABLED | :anonymous | true
:public | ProjectFeature::PRIVATE | :maintainer | true
:public | ProjectFeature::PRIVATE | :developer | true
:public | ProjectFeature::PRIVATE | :guest | true
:public | ProjectFeature::PRIVATE | :anonymous | false
:public | ProjectFeature::DISABLED | :maintainer | false
:public | ProjectFeature::DISABLED | :developer | false
:public | ProjectFeature::DISABLED | :guest | false
:public | ProjectFeature::DISABLED | :anonymous | false
:internal | ProjectFeature::ENABLED | :maintainer | true
:internal | ProjectFeature::ENABLED | :developer | true
:internal | ProjectFeature::ENABLED | :guest | true
:internal | ProjectFeature::ENABLED | :anonymous | false
:internal | ProjectFeature::PRIVATE | :maintainer | true
:internal | ProjectFeature::PRIVATE | :developer | true
:internal | ProjectFeature::PRIVATE | :guest | true
:internal | ProjectFeature::PRIVATE | :anonymous | false
:internal | ProjectFeature::DISABLED | :maintainer | false
:internal | ProjectFeature::DISABLED | :developer | false
:internal | ProjectFeature::DISABLED | :guest | false
:internal | ProjectFeature::DISABLED | :anonymous | false
:private | ProjectFeature::ENABLED | :maintainer | true
:private | ProjectFeature::ENABLED | :developer | true
:private | ProjectFeature::ENABLED | :guest | false
:private | ProjectFeature::ENABLED | :anonymous | false
:private | ProjectFeature::PRIVATE | :maintainer | true
:private | ProjectFeature::PRIVATE | :developer | true
:private | ProjectFeature::PRIVATE | :guest | false
:private | ProjectFeature::PRIVATE | :anonymous | false
:private | ProjectFeature::DISABLED | :maintainer | false
:private | ProjectFeature::DISABLED | :developer | false
:private | ProjectFeature::DISABLED | :guest | false
:private | ProjectFeature::DISABLED | :anonymous | false
end
with_them do
let(:current_user) { user_subject(role) }
let(:project) { project_subject(project_visibility) }
it 'allows/disallows the abilities based on the environments feature access level' do
project.project_feature.update!(environments_access_level: access_level)
if allowed
expect_allowed(*permissions_abilities(role))
else
expect_disallowed(*permissions_abilities(role))
2021-02-22 17:27:13 +05:30
end
end
2022-10-11 01:57:18 +05:30
end
end
2021-02-22 17:27:13 +05:30
2022-10-11 01:57:18 +05:30
describe 'monitor feature' do
using RSpec::Parameterized::TableSyntax
let(:guest_permissions) { [] }
let(:developer_permissions) do
guest_permissions + [
:read_sentry_issue, :read_alert_management_alert, :metrics_dashboard,
:update_sentry_issue, :update_alert_management_alert
]
end
let(:maintainer_permissions) { developer_permissions }
where(:project_visibility, :access_level, :role, :allowed) do
:public | ProjectFeature::ENABLED | :maintainer | true
:public | ProjectFeature::ENABLED | :developer | true
:public | ProjectFeature::ENABLED | :guest | true
:public | ProjectFeature::ENABLED | :anonymous | true
:public | ProjectFeature::PRIVATE | :maintainer | true
:public | ProjectFeature::PRIVATE | :developer | true
:public | ProjectFeature::PRIVATE | :guest | true
:public | ProjectFeature::PRIVATE | :anonymous | false
:public | ProjectFeature::DISABLED | :maintainer | false
:public | ProjectFeature::DISABLED | :developer | false
:public | ProjectFeature::DISABLED | :guest | false
:public | ProjectFeature::DISABLED | :anonymous | false
:internal | ProjectFeature::ENABLED | :maintainer | true
:internal | ProjectFeature::ENABLED | :developer | true
:internal | ProjectFeature::ENABLED | :guest | true
:internal | ProjectFeature::ENABLED | :anonymous | false
:internal | ProjectFeature::PRIVATE | :maintainer | true
:internal | ProjectFeature::PRIVATE | :developer | true
:internal | ProjectFeature::PRIVATE | :guest | true
:internal | ProjectFeature::PRIVATE | :anonymous | false
:internal | ProjectFeature::DISABLED | :maintainer | false
:internal | ProjectFeature::DISABLED | :developer | false
:internal | ProjectFeature::DISABLED | :guest | false
:internal | ProjectFeature::DISABLED | :anonymous | false
:private | ProjectFeature::ENABLED | :maintainer | true
:private | ProjectFeature::ENABLED | :developer | true
:private | ProjectFeature::ENABLED | :guest | false
:private | ProjectFeature::ENABLED | :anonymous | false
:private | ProjectFeature::PRIVATE | :maintainer | true
:private | ProjectFeature::PRIVATE | :developer | true
:private | ProjectFeature::PRIVATE | :guest | false
:private | ProjectFeature::PRIVATE | :anonymous | false
:private | ProjectFeature::DISABLED | :maintainer | false
:private | ProjectFeature::DISABLED | :developer | false
:private | ProjectFeature::DISABLED | :guest | false
:private | ProjectFeature::DISABLED | :anonymous | false
end
with_them do
let(:current_user) { user_subject(role) }
let(:project) { project_subject(project_visibility) }
it 'allows/disallows the abilities based on the monitor feature access level' do
project.project_feature.update!(monitor_access_level: access_level)
if allowed
expect_allowed(*permissions_abilities(role))
2021-02-22 17:27:13 +05:30
else
2022-10-11 01:57:18 +05:30
expect_disallowed(*permissions_abilities(role))
2022-08-27 11:52:29 +05:30
end
end
end
end
describe 'feature flags feature' do
using RSpec::Parameterized::TableSyntax
let(:guest_permissions) { [] }
let(:developer_permissions) do
guest_permissions + [
:read_feature_flag, :create_feature_flag, :update_feature_flag, :destroy_feature_flag, :admin_feature_flag,
:admin_feature_flags_user_lists
]
end
let(:maintainer_permissions) do
developer_permissions + [:admin_feature_flags_client]
end
where(:project_visibility, :access_level, :role, :allowed) do
:public | ProjectFeature::ENABLED | :maintainer | true
:public | ProjectFeature::ENABLED | :developer | true
:public | ProjectFeature::ENABLED | :guest | true
:public | ProjectFeature::ENABLED | :anonymous | true
:public | ProjectFeature::PRIVATE | :maintainer | true
:public | ProjectFeature::PRIVATE | :developer | true
:public | ProjectFeature::PRIVATE | :guest | true
:public | ProjectFeature::PRIVATE | :anonymous | false
:public | ProjectFeature::DISABLED | :maintainer | false
:public | ProjectFeature::DISABLED | :developer | false
:public | ProjectFeature::DISABLED | :guest | false
:public | ProjectFeature::DISABLED | :anonymous | false
:internal | ProjectFeature::ENABLED | :maintainer | true
:internal | ProjectFeature::ENABLED | :developer | true
:internal | ProjectFeature::ENABLED | :guest | true
:internal | ProjectFeature::ENABLED | :anonymous | false
:internal | ProjectFeature::PRIVATE | :maintainer | true
:internal | ProjectFeature::PRIVATE | :developer | true
:internal | ProjectFeature::PRIVATE | :guest | true
:internal | ProjectFeature::PRIVATE | :anonymous | false
:internal | ProjectFeature::DISABLED | :maintainer | false
:internal | ProjectFeature::DISABLED | :developer | false
:internal | ProjectFeature::DISABLED | :guest | false
:internal | ProjectFeature::DISABLED | :anonymous | false
:private | ProjectFeature::ENABLED | :maintainer | true
:private | ProjectFeature::ENABLED | :developer | true
:private | ProjectFeature::ENABLED | :guest | false
:private | ProjectFeature::ENABLED | :anonymous | false
:private | ProjectFeature::PRIVATE | :maintainer | true
:private | ProjectFeature::PRIVATE | :developer | true
:private | ProjectFeature::PRIVATE | :guest | false
:private | ProjectFeature::PRIVATE | :anonymous | false
:private | ProjectFeature::DISABLED | :maintainer | false
:private | ProjectFeature::DISABLED | :developer | false
:private | ProjectFeature::DISABLED | :guest | false
:private | ProjectFeature::DISABLED | :anonymous | false
end
with_them do
let(:current_user) { user_subject(role) }
let(:project) { project_subject(project_visibility) }
it 'allows/disallows the abilities based on the feature flags access level' do
project.project_feature.update!(feature_flags_access_level: access_level)
if allowed
expect_allowed(*permissions_abilities(role))
else
expect_disallowed(*permissions_abilities(role))
end
end
end
end
describe 'Releases feature' do
using RSpec::Parameterized::TableSyntax
let(:guest_permissions) { [:read_release] }
let(:developer_permissions) do
guest_permissions + [:create_release, :update_release, :destroy_release]
end
let(:maintainer_permissions) do
developer_permissions
end
where(:project_visibility, :access_level, :role, :allowed) do
:public | ProjectFeature::ENABLED | :maintainer | true
:public | ProjectFeature::ENABLED | :developer | true
:public | ProjectFeature::ENABLED | :guest | true
:public | ProjectFeature::ENABLED | :anonymous | true
:public | ProjectFeature::PRIVATE | :maintainer | true
:public | ProjectFeature::PRIVATE | :developer | true
:public | ProjectFeature::PRIVATE | :guest | true
:public | ProjectFeature::PRIVATE | :anonymous | false
:public | ProjectFeature::DISABLED | :maintainer | false
:public | ProjectFeature::DISABLED | :developer | false
:public | ProjectFeature::DISABLED | :guest | false
:public | ProjectFeature::DISABLED | :anonymous | false
:internal | ProjectFeature::ENABLED | :maintainer | true
:internal | ProjectFeature::ENABLED | :developer | true
:internal | ProjectFeature::ENABLED | :guest | true
:internal | ProjectFeature::ENABLED | :anonymous | false
:internal | ProjectFeature::PRIVATE | :maintainer | true
:internal | ProjectFeature::PRIVATE | :developer | true
:internal | ProjectFeature::PRIVATE | :guest | true
:internal | ProjectFeature::PRIVATE | :anonymous | false
:internal | ProjectFeature::DISABLED | :maintainer | false
:internal | ProjectFeature::DISABLED | :developer | false
:internal | ProjectFeature::DISABLED | :guest | false
:internal | ProjectFeature::DISABLED | :anonymous | false
:private | ProjectFeature::ENABLED | :maintainer | true
:private | ProjectFeature::ENABLED | :developer | true
:private | ProjectFeature::ENABLED | :guest | true
:private | ProjectFeature::ENABLED | :anonymous | false
:private | ProjectFeature::PRIVATE | :maintainer | true
:private | ProjectFeature::PRIVATE | :developer | true
:private | ProjectFeature::PRIVATE | :guest | true
:private | ProjectFeature::PRIVATE | :anonymous | false
:private | ProjectFeature::DISABLED | :maintainer | false
:private | ProjectFeature::DISABLED | :developer | false
:private | ProjectFeature::DISABLED | :guest | false
:private | ProjectFeature::DISABLED | :anonymous | false
end
with_them do
let(:current_user) { user_subject(role) }
let(:project) { project_subject(project_visibility) }
it 'allows/disallows the abilities based on the Releases access level' do
project.project_feature.update!(releases_access_level: access_level)
if allowed
expect_allowed(*permissions_abilities(role))
else
expect_disallowed(*permissions_abilities(role))
2021-02-22 17:27:13 +05:30
end
end
end
end
2021-04-17 20:07:23 +05:30
2023-01-13 00:05:48 +05:30
describe 'infrastructure feature' do
using RSpec::Parameterized::TableSyntax
let(:guest_permissions) { [] }
let(:developer_permissions) do
guest_permissions + [:read_terraform_state, :read_pod_logs, :read_prometheus]
end
let(:maintainer_permissions) do
developer_permissions + [:create_cluster, :read_cluster, :update_cluster, :admin_cluster, :admin_terraform_state, :admin_project_google_cloud]
end
where(:project_visibility, :access_level, :role, :allowed) do
:public | ProjectFeature::ENABLED | :maintainer | true
:public | ProjectFeature::ENABLED | :developer | true
:public | ProjectFeature::ENABLED | :guest | true
:public | ProjectFeature::ENABLED | :anonymous | true
:public | ProjectFeature::PRIVATE | :maintainer | true
:public | ProjectFeature::PRIVATE | :developer | true
:public | ProjectFeature::PRIVATE | :guest | true
:public | ProjectFeature::PRIVATE | :anonymous | false
:public | ProjectFeature::DISABLED | :maintainer | false
:public | ProjectFeature::DISABLED | :developer | false
:public | ProjectFeature::DISABLED | :guest | false
:public | ProjectFeature::DISABLED | :anonymous | false
:internal | ProjectFeature::ENABLED | :maintainer | true
:internal | ProjectFeature::ENABLED | :developer | true
:internal | ProjectFeature::ENABLED | :guest | true
:internal | ProjectFeature::ENABLED | :anonymous | false
:internal | ProjectFeature::PRIVATE | :maintainer | true
:internal | ProjectFeature::PRIVATE | :developer | true
:internal | ProjectFeature::PRIVATE | :guest | true
:internal | ProjectFeature::PRIVATE | :anonymous | false
:internal | ProjectFeature::DISABLED | :maintainer | false
:internal | ProjectFeature::DISABLED | :developer | false
:internal | ProjectFeature::DISABLED | :guest | false
:internal | ProjectFeature::DISABLED | :anonymous | false
:private | ProjectFeature::ENABLED | :maintainer | true
:private | ProjectFeature::ENABLED | :developer | true
:private | ProjectFeature::ENABLED | :guest | true
:private | ProjectFeature::ENABLED | :anonymous | false
:private | ProjectFeature::PRIVATE | :maintainer | true
:private | ProjectFeature::PRIVATE | :developer | true
:private | ProjectFeature::PRIVATE | :guest | true
:private | ProjectFeature::PRIVATE | :anonymous | false
:private | ProjectFeature::DISABLED | :maintainer | false
:private | ProjectFeature::DISABLED | :developer | false
:private | ProjectFeature::DISABLED | :guest | false
:private | ProjectFeature::DISABLED | :anonymous | false
end
with_them do
let(:current_user) { user_subject(role) }
let(:project) { project_subject(project_visibility) }
it 'allows/disallows the abilities based on the infrastructure access level' do
project.project_feature.update!(infrastructure_access_level: access_level)
if allowed
expect_allowed(*permissions_abilities(role))
else
expect_disallowed(*permissions_abilities(role))
end
end
end
end
2021-04-17 20:07:23 +05:30
describe 'access_security_and_compliance' do
context 'when the "Security & Compliance" is enabled' do
before do
project.project_feature.update!(security_and_compliance_access_level: Featurable::PRIVATE)
end
%w[owner maintainer developer].each do |role|
context "when the role is #{role}" do
let(:current_user) { public_send(role) }
it { is_expected.to be_allowed(:access_security_and_compliance) }
end
end
context 'with admin' do
let(:current_user) { admin }
context 'when admin mode enabled', :enable_admin_mode do
it { is_expected.to be_allowed(:access_security_and_compliance) }
end
context 'when admin mode disabled' do
it { is_expected.to be_disallowed(:access_security_and_compliance) }
end
end
%w[reporter guest].each do |role|
context "when the role is #{role}" do
let(:current_user) { public_send(role) }
it { is_expected.to be_disallowed(:access_security_and_compliance) }
end
end
context 'with non member' do
let(:current_user) { non_member }
it { is_expected.to be_disallowed(:access_security_and_compliance) }
end
context 'with anonymous' do
let(:current_user) { anonymous }
it { is_expected.to be_disallowed(:access_security_and_compliance) }
end
end
context 'when the "Security & Compliance" is not enabled' do
before do
project.project_feature.update!(security_and_compliance_access_level: Featurable::DISABLED)
end
%w[owner maintainer developer reporter guest].each do |role|
context "when the role is #{role}" do
let(:current_user) { public_send(role) }
it { is_expected.to be_disallowed(:access_security_and_compliance) }
end
end
context 'with admin' do
let(:current_user) { admin }
context 'when admin mode enabled', :enable_admin_mode do
it { is_expected.to be_disallowed(:access_security_and_compliance) }
end
context 'when admin mode disabled' do
it { is_expected.to be_disallowed(:access_security_and_compliance) }
end
end
context 'with non member' do
let(:current_user) { non_member }
it { is_expected.to be_disallowed(:access_security_and_compliance) }
end
context 'with anonymous' do
let(:current_user) { anonymous }
it { is_expected.to be_disallowed(:access_security_and_compliance) }
end
end
end
2021-04-29 21:17:54 +05:30
2021-09-04 01:27:46 +05:30
describe 'when user is authenticated via CI_JOB_TOKEN', :request_store do
2021-10-27 15:23:28 +05:30
using RSpec::Parameterized::TableSyntax
2021-04-29 21:17:54 +05:30
2021-10-27 15:23:28 +05:30
where(:project_visibility, :user_role, :external_user, :scope_project_type, :token_scope_enabled, :result) do
:private | :reporter | false | :same | true | true
:private | :reporter | false | :same | false | true
:private | :reporter | false | :different | true | false
:private | :reporter | false | :different | false | true
:private | :guest | false | :same | true | true
:private | :guest | false | :same | false | true
:private | :guest | false | :different | true | false
:private | :guest | false | :different | false | true
:internal | :reporter | false | :same | true | true
:internal | :reporter | true | :same | true | true
:internal | :reporter | false | :same | false | true
:internal | :reporter | false | :different | true | true
:internal | :reporter | true | :different | true | false
:internal | :reporter | false | :different | false | true
:internal | :guest | false | :same | true | true
:internal | :guest | true | :same | true | true
:internal | :guest | false | :same | false | true
:internal | :guest | false | :different | true | true
:internal | :guest | true | :different | true | false
:internal | :guest | false | :different | false | true
:public | :reporter | false | :same | true | true
:public | :reporter | false | :same | false | true
:public | :reporter | false | :different | true | true
:public | :reporter | false | :different | false | true
:public | :guest | false | :same | true | true
:public | :guest | false | :same | false | true
:public | :guest | false | :different | true | true
:public | :guest | false | :different | false | true
2021-09-04 01:27:46 +05:30
end
2021-10-27 15:23:28 +05:30
with_them do
let(:current_user) { public_send(user_role) }
let(:project) { public_send("#{project_visibility}_project") }
let(:job) { build_stubbed(:ci_build, project: scope_project, user: current_user) }
2021-09-30 23:02:18 +05:30
2021-10-27 15:23:28 +05:30
let(:scope_project) do
if scope_project_type == :same
project
else
create(:project, :private)
2021-09-30 23:02:18 +05:30
end
2021-04-29 21:17:54 +05:30
end
2021-09-04 01:27:46 +05:30
2021-10-27 15:23:28 +05:30
before do
current_user.set_ci_job_token_scope!(job)
current_user.external = external_user
2022-11-25 23:54:43 +05:30
scope_project.update!(ci_outbound_job_token_scope_enabled: token_scope_enabled)
2021-09-04 01:27:46 +05:30
end
2021-10-27 15:23:28 +05:30
it "enforces the expected permissions" do
if result
is_expected.to be_allowed("#{user_role}_access".to_sym)
else
is_expected.to be_disallowed("#{user_role}_access".to_sym)
2021-09-30 23:02:18 +05:30
end
2021-09-04 01:27:46 +05:30
end
2021-04-29 21:17:54 +05:30
end
2021-09-04 01:27:46 +05:30
end
2021-04-29 21:17:54 +05:30
2021-09-04 01:27:46 +05:30
describe 'container_image policies' do
using RSpec::Parameterized::TableSyntax
2021-04-29 21:17:54 +05:30
2021-09-30 23:02:18 +05:30
# These are permissions that admins should not have when the project is private
# or the container registry is private.
let(:admin_excluded_permissions) { [:build_read_container_image] }
let(:anonymous_operations_permissions) { [:read_container_image] }
let(:guest_operations_permissions) { anonymous_operations_permissions + [:build_read_container_image] }
2021-09-04 01:27:46 +05:30
let(:developer_operations_permissions) do
guest_operations_permissions + [
:create_container_image, :update_container_image, :destroy_container_image
]
2021-04-29 21:17:54 +05:30
end
2021-09-04 01:27:46 +05:30
let(:maintainer_operations_permissions) do
developer_operations_permissions + [
:admin_container_image
]
end
2021-04-29 21:17:54 +05:30
2021-09-30 23:02:18 +05:30
let(:all_permissions) { maintainer_operations_permissions }
2021-09-04 01:27:46 +05:30
where(:project_visibility, :access_level, :role, :allowed) do
2021-09-30 23:02:18 +05:30
:public | ProjectFeature::ENABLED | :admin | true
:public | ProjectFeature::ENABLED | :owner | true
2021-09-04 01:27:46 +05:30
:public | ProjectFeature::ENABLED | :maintainer | true
:public | ProjectFeature::ENABLED | :developer | true
:public | ProjectFeature::ENABLED | :reporter | true
:public | ProjectFeature::ENABLED | :guest | true
:public | ProjectFeature::ENABLED | :anonymous | true
2021-09-30 23:02:18 +05:30
:public | ProjectFeature::PRIVATE | :admin | true
:public | ProjectFeature::PRIVATE | :owner | true
2021-09-04 01:27:46 +05:30
:public | ProjectFeature::PRIVATE | :maintainer | true
:public | ProjectFeature::PRIVATE | :developer | true
:public | ProjectFeature::PRIVATE | :reporter | true
:public | ProjectFeature::PRIVATE | :guest | false
:public | ProjectFeature::PRIVATE | :anonymous | false
2021-09-30 23:02:18 +05:30
:public | ProjectFeature::DISABLED | :admin | false
:public | ProjectFeature::DISABLED | :owner | false
2021-09-04 01:27:46 +05:30
:public | ProjectFeature::DISABLED | :maintainer | false
:public | ProjectFeature::DISABLED | :developer | false
:public | ProjectFeature::DISABLED | :reporter | false
:public | ProjectFeature::DISABLED | :guest | false
:public | ProjectFeature::DISABLED | :anonymous | false
2021-09-30 23:02:18 +05:30
:internal | ProjectFeature::ENABLED | :admin | true
:internal | ProjectFeature::ENABLED | :owner | true
2021-09-04 01:27:46 +05:30
:internal | ProjectFeature::ENABLED | :maintainer | true
:internal | ProjectFeature::ENABLED | :developer | true
:internal | ProjectFeature::ENABLED | :reporter | true
:internal | ProjectFeature::ENABLED | :guest | true
:internal | ProjectFeature::ENABLED | :anonymous | false
2021-09-30 23:02:18 +05:30
:internal | ProjectFeature::PRIVATE | :admin | true
:internal | ProjectFeature::PRIVATE | :owner | true
2021-09-04 01:27:46 +05:30
:internal | ProjectFeature::PRIVATE | :maintainer | true
:internal | ProjectFeature::PRIVATE | :developer | true
:internal | ProjectFeature::PRIVATE | :reporter | true
:internal | ProjectFeature::PRIVATE | :guest | false
:internal | ProjectFeature::PRIVATE | :anonymous | false
2021-09-30 23:02:18 +05:30
:internal | ProjectFeature::DISABLED | :admin | false
:internal | ProjectFeature::DISABLED | :owner | false
2021-09-04 01:27:46 +05:30
:internal | ProjectFeature::DISABLED | :maintainer | false
:internal | ProjectFeature::DISABLED | :developer | false
:internal | ProjectFeature::DISABLED | :reporter | false
:internal | ProjectFeature::DISABLED | :guest | false
:internal | ProjectFeature::DISABLED | :anonymous | false
2021-09-30 23:02:18 +05:30
:private | ProjectFeature::ENABLED | :admin | true
:private | ProjectFeature::ENABLED | :owner | true
2021-09-04 01:27:46 +05:30
:private | ProjectFeature::ENABLED | :maintainer | true
:private | ProjectFeature::ENABLED | :developer | true
:private | ProjectFeature::ENABLED | :reporter | true
:private | ProjectFeature::ENABLED | :guest | false
:private | ProjectFeature::ENABLED | :anonymous | false
2021-09-30 23:02:18 +05:30
:private | ProjectFeature::PRIVATE | :admin | true
:private | ProjectFeature::PRIVATE | :owner | true
2021-09-04 01:27:46 +05:30
:private | ProjectFeature::PRIVATE | :maintainer | true
:private | ProjectFeature::PRIVATE | :developer | true
:private | ProjectFeature::PRIVATE | :reporter | true
:private | ProjectFeature::PRIVATE | :guest | false
:private | ProjectFeature::PRIVATE | :anonymous | false
2021-09-30 23:02:18 +05:30
:private | ProjectFeature::DISABLED | :admin | false
:private | ProjectFeature::DISABLED | :owner | false
2021-09-04 01:27:46 +05:30
:private | ProjectFeature::DISABLED | :maintainer | false
:private | ProjectFeature::DISABLED | :developer | false
:private | ProjectFeature::DISABLED | :reporter | false
:private | ProjectFeature::DISABLED | :guest | false
:private | ProjectFeature::DISABLED | :anonymous | false
2021-04-29 21:17:54 +05:30
end
2021-09-04 01:27:46 +05:30
with_them do
let(:current_user) { send(role) }
let(:project) { send("#{project_visibility}_project") }
2021-09-30 23:02:18 +05:30
before do
enable_admin_mode!(admin) if role == :admin
2021-09-04 01:27:46 +05:30
project.project_feature.update!(container_registry_access_level: access_level)
2021-09-30 23:02:18 +05:30
end
2021-09-04 01:27:46 +05:30
2021-09-30 23:02:18 +05:30
it 'allows/disallows the abilities based on the container_registry feature access level' do
2021-09-04 01:27:46 +05:30
if allowed
expect_allowed(*permissions_abilities(role))
2021-09-30 23:02:18 +05:30
expect_disallowed(*(all_permissions - permissions_abilities(role)))
2021-09-04 01:27:46 +05:30
else
2021-09-30 23:02:18 +05:30
expect_disallowed(*all_permissions)
end
end
it 'allows build_read_container_image to admins who are also team members' do
if allowed && role == :admin
project.add_reporter(current_user)
expect_allowed(:build_read_container_image)
2021-09-04 01:27:46 +05:30
end
end
2021-04-29 21:17:54 +05:30
2021-09-04 01:27:46 +05:30
def permissions_abilities(role)
case role
2021-09-30 23:02:18 +05:30
when :admin
if project_visibility == :private || access_level == ProjectFeature::PRIVATE
maintainer_operations_permissions - admin_excluded_permissions
else
maintainer_operations_permissions
end
when :maintainer, :owner
2021-09-04 01:27:46 +05:30
maintainer_operations_permissions
when :developer
developer_operations_permissions
2021-09-30 23:02:18 +05:30
when :reporter, :guest
2021-09-04 01:27:46 +05:30
guest_operations_permissions
2021-09-30 23:02:18 +05:30
when :anonymous
anonymous_operations_permissions
2021-09-04 01:27:46 +05:30
else
raise "Unknown role #{role}"
end
end
2021-04-29 21:17:54 +05:30
end
2021-09-04 01:27:46 +05:30
end
2021-04-29 21:17:54 +05:30
2021-09-04 01:27:46 +05:30
describe 'update_runners_registration_token' do
context 'when anonymous' do
2021-04-29 21:17:54 +05:30
let(:current_user) { anonymous }
2021-09-04 01:27:46 +05:30
it { is_expected.not_to be_allowed(:update_runners_registration_token) }
end
context 'admin' do
let(:current_user) { create(:admin) }
context 'when admin mode is enabled', :enable_admin_mode do
it { is_expected.to be_allowed(:update_runners_registration_token) }
end
context 'when admin mode is disabled' do
it { is_expected.to be_disallowed(:update_runners_registration_token) }
end
end
%w(guest reporter developer).each do |role|
context role do
let(:current_user) { send(role) }
it { is_expected.to be_disallowed(:update_runners_registration_token) }
end
end
%w(maintainer owner).each do |role|
context role do
let(:current_user) { send(role) }
it { is_expected.to be_allowed(:update_runners_registration_token) }
end
2021-04-29 21:17:54 +05:30
end
end
2022-05-07 20:08:51 +05:30
describe 'register_project_runners' do
context 'admin' do
let(:current_user) { admin }
context 'when admin mode is enabled', :enable_admin_mode do
2022-11-25 23:54:43 +05:30
it { is_expected.to be_allowed(:register_project_runners) }
2022-05-07 20:08:51 +05:30
2022-11-25 23:54:43 +05:30
context 'with project runner registration disabled' do
2022-05-07 20:08:51 +05:30
before do
2022-11-25 23:54:43 +05:30
stub_application_setting(valid_runner_registrars: ['group'])
2022-05-07 20:08:51 +05:30
end
it { is_expected.to be_allowed(:register_project_runners) }
end
end
context 'when admin mode is disabled' do
it { is_expected.to be_disallowed(:register_project_runners) }
end
end
context 'with owner' do
let(:current_user) { owner }
it { is_expected.to be_allowed(:register_project_runners) }
2022-11-25 23:54:43 +05:30
context 'with project runner registration disabled' do
2022-05-07 20:08:51 +05:30
before do
2022-11-25 23:54:43 +05:30
stub_application_setting(valid_runner_registrars: ['group'])
2022-05-07 20:08:51 +05:30
end
2022-11-25 23:54:43 +05:30
it { is_expected.to be_disallowed(:register_project_runners) }
2022-05-07 20:08:51 +05:30
end
end
context 'with maintainer' do
let(:current_user) { maintainer }
it { is_expected.to be_allowed(:register_project_runners) }
end
context 'with reporter' do
let(:current_user) { reporter }
it { is_expected.to be_disallowed(:register_project_runners) }
end
context 'with guest' do
let(:current_user) { guest }
it { is_expected.to be_disallowed(:register_project_runners) }
end
context 'with non member' do
let(:current_user) { create(:user) }
it { is_expected.to be_disallowed(:register_project_runners) }
end
context 'with anonymous' do
let(:current_user) { nil }
it { is_expected.to be_disallowed(:register_project_runners) }
end
end
2022-07-01 11:34:44 +05:30
describe 'update_sentry_issue' do
using RSpec::Parameterized::TableSyntax
where(:role, :allowed) do
:owner | true
:maintainer | true
:developer | true
:reporter | false
:guest | false
end
let(:project) { public_project }
let(:current_user) { public_send(role) }
with_them do
it do
expect(subject.can?(:update_sentry_issue)).to be(allowed)
end
end
end
2022-08-27 11:52:29 +05:30
2022-10-11 01:57:18 +05:30
describe 'read_milestone' do
context 'when project is public' do
let(:project) { public_project_in_group }
context 'and issues and merge requests are private' do
before do
project.project_feature.update!(
issues_access_level: ProjectFeature::PRIVATE,
merge_requests_access_level: ProjectFeature::PRIVATE
)
end
context 'when user is an inherited member from the group' do
context 'and user is a guest' do
let(:current_user) { inherited_guest }
it { is_expected.to be_allowed(:read_milestone) }
end
context 'and user is a reporter' do
let(:current_user) { inherited_reporter }
it { is_expected.to be_allowed(:read_milestone) }
end
context 'and user is a developer' do
let(:current_user) { inherited_developer }
it { is_expected.to be_allowed(:read_milestone) }
end
end
end
end
end
2022-11-25 23:54:43 +05:30
describe 'role_enables_download_code' do
using RSpec::Parameterized::TableSyntax
context 'default roles' do
let(:current_user) { public_send(role) }
context 'public project' do
let(:project) { public_project }
where(:role, :allowed) do
:owner | true
:maintainer | true
:developer | true
:reporter | true
:guest | true
with_them do
it do
expect(subject.can?(:download_code)).to be(allowed)
end
end
end
end
context 'private project' do
let(:project) { private_project }
where(:role, :allowed) do
:owner | true
:maintainer | true
:developer | true
:reporter | true
:guest | false
end
with_them do
it do
expect(subject.can?(:download_code)).to be(allowed)
end
end
end
end
end
2023-01-13 00:05:48 +05:30
describe 'read_code' do
let(:current_user) { create(:user) }
before do
allow(subject).to receive(:allowed?).and_call_original
allow(subject).to receive(:allowed?).with(:download_code).and_return(can_download_code)
end
context 'when the current_user can download_code' do
let(:can_download_code) { true }
it { expect_allowed(:read_code) }
end
context 'when the current_user cannot download_code' do
let(:can_download_code) { false }
it { expect_disallowed(:read_code) }
end
end
2022-10-11 01:57:18 +05:30
private
2022-08-27 11:52:29 +05:30
def project_subject(project_type)
case project_type
when :public
public_project
when :internal
internal_project
else
private_project
end
end
def user_subject(role)
case role
when :maintainer
maintainer
when :developer
developer
when :guest
guest
when :anonymous
anonymous
end
end
def permissions_abilities(role)
case role
when :maintainer
maintainer_permissions
when :developer
developer_permissions
else
guest_permissions
end
end
2016-09-29 09:46:39 +05:30
end