debian-mirror-gitlab/app/policies/project_snippet_policy.rb

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

55 lines
1.8 KiB
Ruby
Raw Normal View History

2018-11-18 11:00:15 +05:30
# frozen_string_literal: true
2016-09-29 09:46:39 +05:30
class ProjectSnippetPolicy < BasePolicy
2017-09-10 17:25:29 +05:30
delegate :project
desc "Snippet is public"
condition(:public_snippet, scope: :subject) { @subject.public? }
2019-03-02 22:35:43 +05:30
condition(:internal_snippet, scope: :subject) { @subject.internal? }
2017-09-10 17:25:29 +05:30
condition(:private_snippet, scope: :subject) { @subject.private? }
condition(:public_project, scope: :subject) { @subject.project.public? }
condition(:is_author) { @user && @subject.author == @user }
# We have to check both project feature visibility and a snippet visibility and take the stricter one
2019-12-04 20:38:33 +05:30
# This will be simplified - check https://gitlab.com/gitlab-org/gitlab-foss/issues/27573
2017-09-10 17:25:29 +05:30
rule { ~can?(:read_project) }.policy do
2020-03-13 15:44:24 +05:30
prevent :read_snippet
prevent :update_snippet
prevent :admin_snippet
2017-09-10 17:25:29 +05:30
end
2020-03-13 15:44:24 +05:30
# we have to use this complicated prevent because the delegated project
# policy is overly greedy in allowing :read_snippet, since it doesn't have
# any information about the snippet. However, :read_snippet on the *project*
# is used to hide/show various snippet-related controls, so we can't just
# move all of the handling here.
2017-09-10 17:25:29 +05:30
rule do
2019-03-02 22:35:43 +05:30
all?(private_snippet | (internal_snippet & external_user),
2017-09-10 17:25:29 +05:30
~project.guest,
2019-03-02 22:35:43 +05:30
~is_author,
2019-12-26 22:10:19 +05:30
~can?(:read_all_resources))
2020-03-13 15:44:24 +05:30
end.prevent :read_snippet
2017-09-10 17:25:29 +05:30
2020-04-08 14:13:33 +05:30
rule { internal_snippet & ~is_author & ~admin & ~project.maintainer }.policy do
2020-03-13 15:44:24 +05:30
prevent :update_snippet
prevent :admin_snippet
2017-09-10 17:25:29 +05:30
end
2020-03-13 15:44:24 +05:30
rule { public_snippet }.enable :read_snippet
2017-09-10 17:25:29 +05:30
2020-01-01 13:55:28 +05:30
rule { is_author & ~project.reporter & ~admin }.policy do
2020-03-13 15:44:24 +05:30
prevent :admin_snippet
2020-01-01 13:55:28 +05:30
end
2020-04-08 14:13:33 +05:30
rule { is_author | admin | project.maintainer }.policy do
2020-03-13 15:44:24 +05:30
enable :read_snippet
enable :update_snippet
enable :admin_snippet
2016-09-29 09:46:39 +05:30
end
2019-02-02 18:00:53 +05:30
2020-03-13 15:44:24 +05:30
rule { ~can?(:read_snippet) }.prevent :create_note
2016-09-29 09:46:39 +05:30
end
2019-12-04 20:38:33 +05:30
2021-06-08 01:23:25 +05:30
ProjectSnippetPolicy.prepend_mod_with('ProjectSnippetPolicy')