diff options
author | Shinya Maeda <shinya@gitlab.com> | 2017-10-03 20:39:28 +0300 |
---|---|---|
committer | Shinya Maeda <shinya@gitlab.com> | 2017-10-03 20:39:28 +0300 |
commit | 6d4e28295863fb1969c4785b3c8463c12cafb52f (patch) | |
tree | 186730b614677e1f4de979d9266e6b8bd8a395ba /app/policies | |
parent | ab3b36103dd22e0ef0bbaa514901c421d83eb649 (diff) | |
parent | ea4c3371a738aa5b1825f9ea45ff7fdf64e889f8 (diff) |
Merge branch 'master' into feature/sm/35954-create-kubernetes-cluster-on-gke-from-k8s-service
Diffstat (limited to 'app/policies')
-rw-r--r-- | app/policies/global_policy.rb | 11 | ||||
-rw-r--r-- | app/policies/namespace_policy.rb | 4 |
2 files changed, 15 insertions, 0 deletions
diff --git a/app/policies/global_policy.rb b/app/policies/global_policy.rb index 1be7bbe9953..64e550d19d0 100644 --- a/app/policies/global_policy.rb +++ b/app/policies/global_policy.rb @@ -11,6 +11,8 @@ class GlobalPolicy < BasePolicy with_options scope: :user, score: 0 condition(:access_locked) { @user.access_locked? } + condition(:can_create_fork, scope: :user) { @user.manageable_namespaces.any? { |namespace| @user.can?(:create_projects, namespace) } } + rule { anonymous }.policy do prevent :log_in prevent :access_api @@ -40,6 +42,10 @@ class GlobalPolicy < BasePolicy enable :create_group end + rule { can_create_fork }.policy do + enable :create_fork + end + rule { access_locked }.policy do prevent :log_in end @@ -47,4 +53,9 @@ class GlobalPolicy < BasePolicy rule { ~(anonymous & restricted_public_level) }.policy do enable :read_users_list end + + rule { admin }.policy do + enable :read_custom_attribute + enable :update_custom_attribute + end end diff --git a/app/policies/namespace_policy.rb b/app/policies/namespace_policy.rb index 85b67f0a237..92213f0155e 100644 --- a/app/policies/namespace_policy.rb +++ b/app/policies/namespace_policy.rb @@ -1,10 +1,14 @@ class NamespacePolicy < BasePolicy rule { anonymous }.prevent_all + condition(:personal_project, scope: :subject) { @subject.kind == 'user' } + condition(:can_create_personal_project, scope: :user) { @user.can_create_project? } condition(:owner) { @subject.owner == @user } rule { owner | admin }.policy do enable :create_projects enable :admin_namespace end + + rule { personal_project & ~can_create_personal_project }.prevent :create_projects end |