debian-mirror-gitlab/lib/gitlab/user_access.rb

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

156 lines
3.7 KiB
Ruby
Raw Normal View History

2018-12-13 13:39:08 +05:30
# frozen_string_literal: true
2014-09-02 18:07:02 +05:30
module Gitlab
2016-08-24 12:49:21 +05:30
class UserAccess
2017-09-10 17:25:29 +05:30
extend Gitlab::Cache::RequestCache
request_cache_key do
2020-10-24 23:57:45 +05:30
[user&.id, container&.to_global_id]
2017-09-10 17:25:29 +05:30
end
2020-10-24 23:57:45 +05:30
attr_reader :user, :push_ability
attr_accessor :container
2016-08-24 12:49:21 +05:30
2021-04-01 16:36:13 +05:30
def initialize(user, container: nil, push_ability: :push_code, skip_collaboration_check: false)
2016-08-24 12:49:21 +05:30
@user = user
2020-10-24 23:57:45 +05:30
@container = container
@push_ability = push_ability
2021-04-01 16:36:13 +05:30
@skip_collaboration_check = skip_collaboration_check
2016-08-24 12:49:21 +05:30
end
def can_do_action?(action)
2017-08-17 22:00:37 +05:30
return false unless can_access_git?
2018-03-17 18:26:18 +05:30
permission_cache[action] =
permission_cache.fetch(action) do
2020-10-24 23:57:45 +05:30
user.can?(action, container)
2018-03-17 18:26:18 +05:30
end
2016-08-24 12:49:21 +05:30
end
def cannot_do_action?(action)
!can_do_action?(action)
end
def allowed?
2017-08-17 22:00:37 +05:30
return false unless can_access_git?
2014-09-02 18:07:02 +05:30
2016-04-02 18:10:28 +05:30
if user.requires_ldap_check? && user.try_obtain_ldap_lease
2020-04-08 14:13:33 +05:30
return false unless Gitlab::Auth::Ldap::Access.allowed?(user)
2014-09-02 18:07:02 +05:30
end
true
end
2016-08-24 12:49:21 +05:30
2017-09-10 17:25:29 +05:30
request_cache def can_create_tag?(ref)
return false unless can_access_git?
2020-10-24 23:57:45 +05:30
if protected?(ProtectedTag, ref)
2017-09-10 17:25:29 +05:30
protected_tag_accessible_to?(ref, action: :create)
else
2020-10-24 23:57:45 +05:30
user.can?(:admin_tag, container)
2017-09-10 17:25:29 +05:30
end
end
request_cache def can_delete_branch?(ref)
2017-08-17 22:00:37 +05:30
return false unless can_access_git?
2020-10-24 23:57:45 +05:30
if protected?(ProtectedBranch, ref)
user.can?(:push_to_delete_protected_branch, container)
2017-08-17 22:00:37 +05:30
else
2020-10-24 23:57:45 +05:30
can_push?
2017-08-17 22:00:37 +05:30
end
end
2017-09-10 17:25:29 +05:30
def can_update_branch?(ref)
can_push_to_branch?(ref) || can_merge_to_branch?(ref)
end
request_cache def can_push_to_branch?(ref)
2020-10-24 23:57:45 +05:30
return false unless can_access_git? && container && can_collaborate?(ref)
return true unless protected?(ProtectedBranch, ref)
2016-08-24 12:49:21 +05:30
2020-10-24 23:57:45 +05:30
protected_branch_accessible_to?(ref, action: :push)
2016-08-24 12:49:21 +05:30
end
2017-09-10 17:25:29 +05:30
request_cache def can_merge_to_branch?(ref)
2017-08-17 22:00:37 +05:30
return false unless can_access_git?
2016-08-24 12:49:21 +05:30
2020-10-24 23:57:45 +05:30
if protected?(ProtectedBranch, ref)
2017-09-10 17:25:29 +05:30
protected_branch_accessible_to?(ref, action: :merge)
2016-08-24 12:49:21 +05:30
else
2020-10-24 23:57:45 +05:30
can_push?
2016-08-24 12:49:21 +05:30
end
end
2021-02-22 17:27:13 +05:30
def can_push_for_ref?(_)
can_do_action?(:push_code)
end
2017-08-17 22:00:37 +05:30
private
2021-04-01 16:36:13 +05:30
attr_reader :skip_collaboration_check
2020-10-24 23:57:45 +05:30
def can_push?
user.can?(push_ability, container)
end
def can_collaborate?(ref)
assert_project!
2021-01-29 00:20:46 +05:30
can_push? || branch_allows_collaboration_for?(ref)
end
def branch_allows_collaboration_for?(ref)
2021-04-01 16:36:13 +05:30
return false if skip_collaboration_check
2022-07-16 23:28:13 +05:30
project.branch_allows_collaboration?(user, ref)
2020-10-24 23:57:45 +05:30
end
2018-03-17 18:26:18 +05:30
def permission_cache
@permission_cache ||= {}
end
2020-04-08 14:13:33 +05:30
request_cache def can_access_git?
2017-08-17 22:00:37 +05:30
user && user.can?(:access_git)
end
2017-09-10 17:25:29 +05:30
def protected_branch_accessible_to?(ref, action:)
2020-10-24 23:57:45 +05:30
assert_project!
2017-09-10 17:25:29 +05:30
ProtectedBranch.protected_ref_accessible_to?(
ref, user,
2018-05-09 12:01:36 +05:30
project: project,
2017-09-10 17:25:29 +05:30
action: action,
protected_refs: project.protected_branches)
end
def protected_tag_accessible_to?(ref, action:)
2020-10-24 23:57:45 +05:30
assert_project!
2017-09-10 17:25:29 +05:30
ProtectedTag.protected_ref_accessible_to?(
ref, user,
2018-05-09 12:01:36 +05:30
project: project,
2017-09-10 17:25:29 +05:30
action: action,
protected_refs: project.protected_tags)
end
2020-10-24 23:57:45 +05:30
request_cache def protected?(kind, refs)
assert_project!
2019-07-07 11:18:12 +05:30
kind.protected?(project, refs)
2017-09-10 17:25:29 +05:30
end
2020-10-24 23:57:45 +05:30
def project
container
end
# Any method that assumes that it is operating on a project should make this
# explicit by calling `#assert_project!`.
# TODO: remove when we make this class polymorphic enough not to care about projects
# See: https://gitlab.com/gitlab-org/gitlab/-/issues/227635
def assert_project!
raise "No project! #{project.inspect} is not a Project" unless project.is_a?(::Project)
end
2014-09-02 18:07:02 +05:30
end
end