require 'spec_helper' describe GroupPolicy do let(:guest) { create(:user) } let(:reporter) { create(:user) } let(:developer) { create(:user) } let(:maintainer) { create(:user) } let(:owner) { create(:user) } let(:admin) { create(:admin) } let(:group) { create(:group, :private) } let(:guest_permissions) do [:read_label, :read_group, :upload_file, :read_namespace, :read_group_activity, :read_group_issues, :read_group_boards, :read_group_labels, :read_group_milestones, :read_group_merge_requests] end let(:reporter_permissions) { [:admin_label] } let(:developer_permissions) { [:admin_milestone] } let(:maintainer_permissions) do [ :create_projects, :read_cluster, :create_cluster, :update_cluster, :admin_cluster, :add_cluster ] end let(:owner_permissions) do [ :admin_group, :admin_namespace, :admin_group_member, :change_visibility_level, :set_note_created_at, (Gitlab::Database.postgresql? ? :create_subgroup : nil) ].compact end before do group.add_guest(guest) group.add_reporter(reporter) group.add_developer(developer) group.add_maintainer(maintainer) group.add_owner(owner) end subject { described_class.new(current_user, group) } def expect_allowed(*permissions) permissions.each { |p| is_expected.to be_allowed(p) } end def expect_disallowed(*permissions) permissions.each { |p| is_expected.not_to be_allowed(p) } end context 'with no user' do let(:group) { create(:group, :public) } let(:current_user) { nil } it do expect_allowed(:read_group) expect_disallowed(:upload_file) expect_disallowed(*reporter_permissions) expect_disallowed(*developer_permissions) expect_disallowed(*maintainer_permissions) expect_disallowed(*owner_permissions) expect_disallowed(:read_namespace) end end context 'with no user and public project' do let(:project) { create(:project, :public) } let(:user) { create(:user) } let(:current_user) { nil } before do Projects::GroupLinks::CreateService.new( project, user, link_group_access: ProjectGroupLink::DEVELOPER ).execute(group) end it { expect_disallowed(:read_group) } end context 'with foreign user and public project' do let(:project) { create(:project, :public) } let(:user) { create(:user) } let(:current_user) { create(:user) } before do Projects::GroupLinks::CreateService.new( project, user, link_group_access: ProjectGroupLink::DEVELOPER ).execute(group) end it { expect_disallowed(:read_group) } end context 'has projects' do let(:current_user) { create(:user) } let(:project) { create(:project, namespace: group) } before do project.add_developer(current_user) end it do expect_allowed(:read_list, :read_label) end context 'in subgroups', :nested_groups do let(:subgroup) { create(:group, :private, parent: group) } let(:project) { create(:project, namespace: subgroup) } it do expect_allowed(:read_list, :read_label) end end end context 'guests' do let(:current_user) { guest } it do expect_allowed(*guest_permissions) expect_disallowed(*reporter_permissions) expect_disallowed(*developer_permissions) expect_disallowed(*maintainer_permissions) expect_disallowed(*owner_permissions) end end context 'reporter' do let(:current_user) { reporter } it do expect_allowed(*guest_permissions) expect_allowed(*reporter_permissions) expect_disallowed(*developer_permissions) expect_disallowed(*maintainer_permissions) expect_disallowed(*owner_permissions) end end context 'developer' do let(:current_user) { developer } it do expect_allowed(*guest_permissions) expect_allowed(*reporter_permissions) expect_allowed(*developer_permissions) expect_disallowed(*maintainer_permissions) expect_disallowed(*owner_permissions) end end context 'maintainer' do let(:current_user) { maintainer } it do expect_allowed(*guest_permissions) expect_allowed(*reporter_permissions) expect_allowed(*developer_permissions) expect_allowed(*maintainer_permissions) expect_disallowed(*owner_permissions) end end context 'owner' do let(:current_user) { owner } it do allow(Group).to receive(:supports_nested_objects?).and_return(true) expect_allowed(*guest_permissions) expect_allowed(*reporter_permissions) expect_allowed(*developer_permissions) expect_allowed(*maintainer_permissions) expect_allowed(*owner_permissions) end end context 'admin' do let(:current_user) { admin } it do allow(Group).to receive(:supports_nested_objects?).and_return(true) expect_allowed(*guest_permissions) expect_allowed(*reporter_permissions) expect_allowed(*developer_permissions) expect_allowed(*maintainer_permissions) expect_allowed(*owner_permissions) end end describe 'when nested group support feature is disabled' do before do allow(Group).to receive(:supports_nested_objects?).and_return(false) end context 'admin' do let(:current_user) { admin } it 'allows every owner permission except creating subgroups' do create_subgroup_permission = [:create_subgroup] updated_owner_permissions = owner_permissions - create_subgroup_permission expect_disallowed(*create_subgroup_permission) expect_allowed(*updated_owner_permissions) end end context 'owner' do let(:current_user) { owner } it 'allows every owner permission except creating subgroups' do create_subgroup_permission = [:create_subgroup] updated_owner_permissions = owner_permissions - create_subgroup_permission expect_disallowed(*create_subgroup_permission) expect_allowed(*updated_owner_permissions) end end end describe 'private nested group use the highest access level from the group and inherited permissions', :nested_groups do let(:nested_group) { create(:group, :private, parent: group) } before do nested_group.add_guest(guest) nested_group.add_guest(reporter) nested_group.add_guest(developer) nested_group.add_guest(maintainer) group.owners.destroy_all # rubocop: disable DestroyAll group.add_guest(owner) nested_group.add_owner(owner) end subject { described_class.new(current_user, nested_group) } context 'with no user' do let(:current_user) { nil } it do expect_disallowed(*guest_permissions) expect_disallowed(*reporter_permissions) expect_disallowed(*developer_permissions) expect_disallowed(*maintainer_permissions) expect_disallowed(*owner_permissions) end end context 'guests' do let(:current_user) { guest } it do expect_allowed(*guest_permissions) expect_disallowed(*reporter_permissions) expect_disallowed(*developer_permissions) expect_disallowed(*maintainer_permissions) expect_disallowed(*owner_permissions) end end context 'reporter' do let(:current_user) { reporter } it do expect_allowed(*guest_permissions) expect_allowed(*reporter_permissions) expect_disallowed(*developer_permissions) expect_disallowed(*maintainer_permissions) expect_disallowed(*owner_permissions) end end context 'developer' do let(:current_user) { developer } it do expect_allowed(*guest_permissions) expect_allowed(*reporter_permissions) expect_allowed(*developer_permissions) expect_disallowed(*maintainer_permissions) expect_disallowed(*owner_permissions) end end context 'maintainer' do let(:current_user) { maintainer } it do expect_allowed(*guest_permissions) expect_allowed(*reporter_permissions) expect_allowed(*developer_permissions) expect_allowed(*maintainer_permissions) expect_disallowed(*owner_permissions) end end context 'owner' do let(:current_user) { owner } it do allow(Group).to receive(:supports_nested_objects?).and_return(true) expect_allowed(*guest_permissions) expect_allowed(*reporter_permissions) expect_allowed(*developer_permissions) expect_allowed(*maintainer_permissions) expect_allowed(*owner_permissions) end end end describe 'change_share_with_group_lock' do context 'when the current_user owns the group' do let(:current_user) { owner } context 'when the group share_with_group_lock is enabled' do let(:group) { create(:group, share_with_group_lock: true, parent: parent) } context 'when the parent group share_with_group_lock is enabled' do context 'when the group has a grandparent' do let(:parent) { create(:group, share_with_group_lock: true, parent: grandparent) } context 'when the grandparent share_with_group_lock is enabled' do let(:grandparent) { create(:group, share_with_group_lock: true) } context 'when the current_user owns the parent' do before do parent.add_owner(current_user) end context 'when the current_user owns the grandparent' do before do grandparent.add_owner(current_user) end it { expect_allowed(:change_share_with_group_lock) } end context 'when the current_user does not own the grandparent' do it { expect_disallowed(:change_share_with_group_lock) } end end context 'when the current_user does not own the parent' do it { expect_disallowed(:change_share_with_group_lock) } end end context 'when the grandparent share_with_group_lock is disabled' do let(:grandparent) { create(:group) } context 'when the current_user owns the parent' do before do parent.add_owner(current_user) end it { expect_allowed(:change_share_with_group_lock) } end context 'when the current_user does not own the parent' do it { expect_disallowed(:change_share_with_group_lock) } end end end context 'when the group does not have a grandparent' do let(:parent) { create(:group, share_with_group_lock: true) } context 'when the current_user owns the parent' do before do parent.add_owner(current_user) end it { expect_allowed(:change_share_with_group_lock) } end context 'when the current_user does not own the parent' do it { expect_disallowed(:change_share_with_group_lock) } end end end context 'when the parent group share_with_group_lock is disabled' do let(:parent) { create(:group) } it { expect_allowed(:change_share_with_group_lock) } end end context 'when the group share_with_group_lock is disabled' do it { expect_allowed(:change_share_with_group_lock) } end end context 'when the current_user does not own the group' do let(:current_user) { create(:user) } it { expect_disallowed(:change_share_with_group_lock) } end end it_behaves_like 'clusterable policies' do let(:clusterable) { create(:group) } let(:cluster) do create(:cluster, :provided_by_gcp, :group, groups: [clusterable]) end end end