debian-mirror-gitlab/app/models/project_feature.rb

148 lines
4.5 KiB
Ruby
Raw Normal View History

2018-11-18 11:00:15 +05:30
# frozen_string_literal: true
2019-07-07 11:18:12 +05:30
class ProjectFeature < ApplicationRecord
2020-06-23 00:09:42 +05:30
include Featurable
2021-10-27 15:23:28 +05:30
extend Gitlab::ConfigHelper
2016-09-29 09:46:39 +05:30
2021-04-29 21:17:54 +05:30
# When updating this array, make sure to update rubocop/cop/gitlab/feature_available_usage.rb as well.
2021-04-17 20:07:23 +05:30
FEATURES = %i[
issues
forking
merge_requests
wiki
snippets
builds
repository
pages
metrics_dashboard
analytics
operations
security_and_compliance
container_registry
].freeze
2021-04-29 21:17:54 +05:30
EXPORTABLE_FEATURES = (FEATURES - [:security_and_compliance, :pages]).freeze
2020-06-23 00:09:42 +05:30
set_available_features(FEATURES)
2021-09-04 01:27:46 +05:30
PRIVATE_FEATURES_MIN_ACCESS_LEVEL = {
merge_requests: Gitlab::Access::REPORTER,
metrics_dashboard: Gitlab::Access::REPORTER,
container_registry: Gitlab::Access::REPORTER
}.freeze
2019-12-04 20:38:33 +05:30
PRIVATE_FEATURES_MIN_ACCESS_LEVEL_FOR_PRIVATE_PROJECT = { repository: Gitlab::Access::REPORTER }.freeze
2016-09-29 09:46:39 +05:30
2016-11-24 13:41:30 +05:30
class << self
2019-02-15 15:39:39 +05:30
def required_minimum_access_level(feature)
feature = ensure_feature!(feature)
PRIVATE_FEATURES_MIN_ACCESS_LEVEL.fetch(feature, Gitlab::Access::GUEST)
end
2019-12-04 20:38:33 +05:30
# Guest users can perform certain features on public and internal projects, but not private projects.
def required_minimum_access_level_for_private_project(feature)
feature = ensure_feature!(feature)
PRIVATE_FEATURES_MIN_ACCESS_LEVEL_FOR_PRIVATE_PROJECT.fetch(feature) do
required_minimum_access_level(feature)
end
end
2016-11-24 13:41:30 +05:30
end
2021-10-27 15:23:28 +05:30
belongs_to :project
2016-11-03 12:29:30 +05:30
2018-03-17 18:26:18 +05:30
validates :project, presence: true
2016-11-03 12:29:30 +05:30
validate :repository_children_level
2018-12-05 23:21:45 +05:30
validate :allowed_access_levels
2016-09-29 09:46:39 +05:30
2021-04-17 20:07:23 +05:30
default_value_for :builds_access_level, value: ENABLED, allows_nil: false
default_value_for :issues_access_level, value: ENABLED, allows_nil: false
default_value_for :forking_access_level, value: ENABLED, allows_nil: false
default_value_for :merge_requests_access_level, value: ENABLED, allows_nil: false
default_value_for :snippets_access_level, value: ENABLED, allows_nil: false
default_value_for :wiki_access_level, value: ENABLED, allows_nil: false
default_value_for :repository_access_level, value: ENABLED, allows_nil: false
default_value_for :analytics_access_level, value: ENABLED, allows_nil: false
2020-04-22 19:07:51 +05:30
default_value_for :metrics_dashboard_access_level, value: PRIVATE, allows_nil: false
2021-04-17 20:07:23 +05:30
default_value_for :operations_access_level, value: ENABLED, allows_nil: false
default_value_for :security_and_compliance_access_level, value: PRIVATE, allows_nil: false
2016-09-29 09:46:39 +05:30
2020-03-13 15:44:24 +05:30
default_value_for(:pages_access_level, allows_nil: false) do |feature|
if ::Gitlab::Pages.access_control_is_forced?
PRIVATE
else
feature.project&.public? ? ENABLED : PRIVATE
end
end
2019-09-30 21:07:59 +05:30
2021-10-27 15:23:28 +05:30
default_value_for(:container_registry_access_level) do |feature|
if gitlab_config_features.container_registry
ENABLED
else
DISABLED
end
end
2018-12-05 23:21:45 +05:30
def public_pages?
return true unless Gitlab.config.pages.access_control
2018-11-18 11:00:15 +05:30
2020-03-13 15:44:24 +05:30
return false if ::Gitlab::Pages.access_control_is_forced?
2018-12-05 23:21:45 +05:30
pages_access_level == PUBLIC || pages_access_level == ENABLED && project.public?
2018-11-18 11:00:15 +05:30
end
2019-12-04 20:38:33 +05:30
def private_pages?
!public_pages?
end
2018-12-05 23:21:45 +05:30
private
2016-11-03 12:29:30 +05:30
# Validates builds and merge requests access level
# which cannot be higher than repository access level
def repository_children_level
validator = lambda do |field|
2020-06-23 00:09:42 +05:30
level = public_send(field) || ENABLED # rubocop:disable GitlabSecurity/PublicSend
2016-11-03 12:29:30 +05:30
not_allowed = level > repository_access_level
self.errors.add(field, "cannot have higher visibility level than repository access level") if not_allowed
end
%i(merge_requests_access_level builds_access_level).each(&validator)
end
2018-12-05 23:21:45 +05:30
# Validates access level for other than pages cannot be PUBLIC
def allowed_access_levels
validator = lambda do |field|
2020-06-23 00:09:42 +05:30
level = public_send(field) || ENABLED # rubocop:disable GitlabSecurity/PublicSend
not_allowed = level > ENABLED
2018-12-05 23:21:45 +05:30
self.errors.add(field, "cannot have public visibility level") if not_allowed
end
(FEATURES - %i(pages)).each {|f| validator.call("#{f}_access_level")}
end
2019-03-13 22:55:13 +05:30
def get_permission(user, feature)
case access_level(feature)
2016-09-29 09:46:39 +05:30
when DISABLED
false
when PRIVATE
2019-03-13 22:55:13 +05:30
team_access?(user, feature)
2016-09-29 09:46:39 +05:30
when ENABLED
true
2018-12-05 23:21:45 +05:30
when PUBLIC
true
2016-09-29 09:46:39 +05:30
else
true
end
end
2019-03-13 22:55:13 +05:30
def team_access?(user, feature)
return unless user
2020-01-01 13:55:28 +05:30
return true if user.can_read_all_resources?
2019-03-13 22:55:13 +05:30
project.team.member?(user, ProjectFeature.required_minimum_access_level(feature))
end
2016-09-29 09:46:39 +05:30
end
2019-12-04 20:38:33 +05:30
2021-06-08 01:23:25 +05:30
ProjectFeature.prepend_mod_with('ProjectFeature')