Make ProjectSnippetPolicy EE-ready

Signed-off-by: Rémy Coutable <remy@rymai.me>

1 files changed, 5 insertions, 6 deletions

diff --git a/app/policies/project_snippet_policy.rb b/app/policies/project_snippet_policy.rb
index 288bf070cfc..7dafa33bb99 100644
--- a/app/policies/project_snippet_policy.rb
+++ b/app/policies/project_snippet_policy.rb
@@ -5,13 +5,12 @@ class ProjectSnippetPolicy < BasePolicy
 
   desc "Snippet is public"
   condition(:public_snippet, scope: :subject) { @subject.public? }
+  condition(:internal_snippet, scope: :subject) { @subject.internal? }
   condition(:private_snippet, scope: :subject) { @subject.private? }
   condition(:public_project, scope: :subject) { @subject.project.public? }
 
   condition(:is_author) { @user && @subject.author == @user }
 
-  condition(:internal, scope: :subject) { @subject.internal? }
-
   # We have to check both project feature visibility and a snippet visibility and take the stricter one
   # This will be simplified - check https://gitlab.com/gitlab-org/gitlab-ce/issues/27573
   rule { ~can?(:read_project) }.policy do
@@ -26,13 +25,13 @@ class ProjectSnippetPolicy < BasePolicy
   # is used to hide/show various snippet-related controls, so we can't just move
   # all of the handling here.
   rule do
-    all?(private_snippet | (internal & external_user),
+    all?(private_snippet | (internal_snippet & external_user),
          ~project.guest,
-         ~admin,
-         ~is_author)
+         ~is_author,
+         ~full_private_access)
   end.prevent :read_project_snippet
 
-  rule { internal & ~is_author & ~admin }.policy do
+  rule { internal_snippet & ~is_author & ~admin }.policy do
     prevent :update_project_snippet
     prevent :admin_project_snippet
   end