Allow Members::ApproveAccessRequestService to accept a new :force param

This param allows to bypass permission check. It is useful for LDAP-sync
where even owners don't have the :admin_group_member permission.

See
https://gitlab.com/gitlab-org/gitlab-ee/blob/6081c37123abae4570f78831b33c2f45f92c2765/app/policies/group_policy.rb#L38
and https://gitlab.com/gitlab-org/gitlab-ee/issues/1159

Signed-off-by: Rémy Coutable <remy@rymai.me>

1 files changed, 16 insertions, 5 deletions

diff --git a/app/services/members/approve_access_request_service.rb b/app/services/members/approve_access_request_service.rb
index 416aee2ab51..c13f289f61e 100644
--- a/app/services/members/approve_access_request_service.rb
+++ b/app/services/members/approve_access_request_service.rb
@@ -4,17 +4,25 @@ module Members
 
     attr_accessor :source
 
+    # source - The source object that respond to `#requesters` (i.g. project or group)
+    # current_user - The user that performs the access request approval
+    # params - A hash of parameters
+    #   :user_id - User ID used to retrieve the access requester
+    #   :id - Member ID used to retrieve the access requester
+    #   :access_level - Optional access level set when the request is accepted
     def initialize(source, current_user, params = {})
       @source = source
       @current_user = current_user
-      @params = params
+      @params = params.slice(:user_id, :id, :access_level)
     end
 
-    def execute
+    # opts - A hash of options
+    #   :force - Bypass permission check: current_user can be nil in that case
+    def execute(opts = {})
       condition = params[:user_id] ? { user_id: params[:user_id] } : { id: params[:id] }
       access_requester = source.requesters.find_by!(condition)
 
-      raise Gitlab::Access::AccessDeniedError unless can_update_access_requester?(access_requester)
+      raise Gitlab::Access::AccessDeniedError unless can_update_access_requester?(access_requester, opts)
 
       access_requester.access_level = params[:access_level] if params[:access_level]
       access_requester.accept_request
@@ -24,8 +32,11 @@ module Members
 
     private
 
-    def can_update_access_requester?(access_requester)
-      access_requester && can?(current_user, action_member_permission(:update, access_requester), access_requester)
+    def can_update_access_requester?(access_requester, opts = {})
+      access_requester && (
+        opts[:force] ||
+        can?(current_user, action_member_permission(:update, access_requester), access_requester)
+      )
     end
   end
 end