debian-mirror-gitlab/app/policies/base_policy.rb

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

74 lines
2.3 KiB
Ruby
Raw Normal View History

2018-11-18 11:00:15 +05:30
# frozen_string_literal: true
2017-09-10 17:25:29 +05:30
class BasePolicy < DeclarativePolicy::Base
desc "User is an instance admin"
with_options scope: :user, score: 0
2019-12-21 20:55:43 +05:30
condition(:admin) do
2021-04-29 21:17:54 +05:30
if Gitlab::CurrentSettings.admin_mode
2019-12-21 20:55:43 +05:30
Gitlab::Auth::CurrentUserMode.new(@user).admin_mode?
else
@user&.admin?
end
end
2016-09-29 09:46:39 +05:30
2019-09-04 21:01:54 +05:30
desc "User is blocked"
with_options scope: :user, score: 0
condition(:blocked) { @user&.blocked? }
2019-12-21 20:55:43 +05:30
desc "User is deactivated"
with_options scope: :user, score: 0
condition(:deactivated) { @user&.deactivated? }
2020-07-28 23:09:34 +05:30
desc "User is support bot"
with_options scope: :user, score: 0
condition(:support_bot) { @user&.support_bot? }
2021-02-22 17:27:13 +05:30
desc "User is security bot"
with_options scope: :user, score: 0
condition(:security_bot) { @user&.security_bot? }
2021-09-04 01:27:46 +05:30
desc "User is automation bot"
with_options scope: :user, score: 0
condition(:automation_bot) { @user&.automation_bot? }
2020-02-01 01:16:34 +05:30
desc "User email is unconfirmed or user account is locked"
with_options scope: :user, score: 0
2021-01-03 14:25:43 +05:30
condition(:inactive) { @user&.confirmation_required_on_sign_in? || @user&.access_locked? }
2020-02-01 01:16:34 +05:30
2017-09-10 17:25:29 +05:30
with_options scope: :user, score: 0
condition(:external_user) { @user.nil? || @user.external? }
2017-08-17 22:00:37 +05:30
2017-09-10 17:25:29 +05:30
with_options scope: :user, score: 0
condition(:can_create_group) { @user&.can_create_group }
2016-09-29 09:46:39 +05:30
2017-09-10 17:25:29 +05:30
desc "The application is restricted from public visibility"
condition(:restricted_public_level, scope: :global) do
2018-03-17 18:26:18 +05:30
Gitlab::CurrentSettings.current_application_settings.restricted_visibility_levels.include?(Gitlab::VisibilityLevel::PUBLIC)
2016-09-29 09:46:39 +05:30
end
2018-03-27 19:54:05 +05:30
2019-07-07 11:18:12 +05:30
condition(:external_authorization_enabled, scope: :global, score: 0) do
::Gitlab::ExternalAuthorization.perform_check?
end
2020-03-13 15:44:24 +05:30
with_options scope: :user, score: 0
condition(:alert_bot) { @user&.alert_bot? }
2019-12-26 22:10:19 +05:30
rule { external_authorization_enabled & ~can?(:read_all_resources) }.policy do
2019-07-07 11:18:12 +05:30
prevent :read_cross_project
end
2021-04-17 20:07:23 +05:30
rule { admin }.policy do
# Only for actual administrator accounts, behaviour affected by admin mode application setting
enable :admin_all_resources
# Policy extended in EE to also enable auditors
enable :read_all_resources
enable :change_repository_storage
end
2019-12-26 22:10:19 +05:30
2018-03-27 19:54:05 +05:30
rule { default }.enable :read_cross_project
2020-07-28 23:09:34 +05:30
2022-05-07 20:08:51 +05:30
condition(:is_gitlab_com, score: 0, scope: :global) { ::Gitlab.com? }
2016-09-29 09:46:39 +05:30
end
2019-12-04 20:38:33 +05:30
2021-06-08 01:23:25 +05:30
BasePolicy.prepend_mod_with('BasePolicy')