debian-mirror-gitlab/app/policies/ci/pipeline_schedule_policy.rb

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

57 lines
1.8 KiB
Ruby
Raw Normal View History

2018-11-18 11:00:15 +05:30
# frozen_string_literal: true
2017-08-17 22:00:37 +05:30
module Ci
class PipelineSchedulePolicy < PipelinePolicy
2017-09-10 17:25:29 +05:30
alias_method :pipeline_schedule, :subject
2018-03-17 18:26:18 +05:30
condition(:protected_ref) do
2023-09-09 18:01:29 +05:30
if full_ref?(@subject.ref)
is_tag = Gitlab::Git.tag_ref?(@subject.ref)
ref_name = Gitlab::Git.ref_name(@subject.ref)
else
# NOTE: this block should not be removed
# until the full ref validation is in place
# and all old refs are updated and validated
is_tag = @subject.project.repository.tag_exists?(@subject.ref)
ref_name = @subject.ref
end
ref_protected?(@user, @subject.project, is_tag, ref_name)
2018-03-17 18:26:18 +05:30
end
2017-09-10 17:25:29 +05:30
condition(:owner_of_schedule) do
2018-05-09 12:01:36 +05:30
pipeline_schedule.owned_by?(@user)
2017-09-10 17:25:29 +05:30
end
2018-05-09 12:01:36 +05:30
rule { can?(:create_pipeline) }.enable :play_pipeline_schedule
2018-03-17 18:26:18 +05:30
2018-05-09 12:01:36 +05:30
rule { can?(:admin_pipeline) | (can?(:update_build) & owner_of_schedule) }.policy do
2017-09-10 17:25:29 +05:30
enable :admin_pipeline_schedule
2020-11-05 12:06:23 +05:30
enable :read_pipeline_schedule_variables
2017-09-10 17:25:29 +05:30
end
2018-03-17 18:26:18 +05:30
2022-05-03 16:02:30 +05:30
rule { admin | (owner_of_schedule & can?(:update_build)) }.policy do
enable :update_pipeline_schedule
end
2023-05-27 22:25:52 +05:30
# `take_ownership_pipeline_schedule` is deprecated, and should not be used. It can be removed in 17.0
# once the deprecated field `take_ownership_pipeline_schedule` is removed from the GraphQL type
# `PermissionTypes::Ci::PipelineSchedules`.
# Use `admin_pipeline_schedule` to decide if a user has the ability to take ownership of a pipeline schedule.
2018-05-09 12:01:36 +05:30
rule { can?(:admin_pipeline_schedule) & ~owner_of_schedule }.policy do
2018-03-17 18:26:18 +05:30
enable :take_ownership_pipeline_schedule
end
2023-09-09 18:01:29 +05:30
rule { protected_ref }.policy do
prevent :play_pipeline_schedule
prevent :create_pipeline_schedule
end
private
def full_ref?(ref)
Gitlab::Git.tag_ref?(ref) || Gitlab::Git.branch_ref?(ref)
end
2017-08-17 22:00:37 +05:30
end
end