Allow users to add cluster with ancestors

Include a new policy in Clusterables
(projects and groups), which checks if another cluster
can be added

clusterable_has_cluster? and multiple_clusters_available
private methods will be overriden in EE

Related to https://gitlab.com/gitlab-org/gitlab-ce/issues/34758

4 files changed, 124 insertions, 2 deletions

diff --git a/spec/policies/group_policy_spec.rb b/spec/policies/group_policy_spec.rb
index 9d0093e8159..e55401a80cd 100644
--- a/spec/policies/group_policy_spec.rb
+++ b/spec/policies/group_policy_spec.rb
@@ -25,7 +25,8 @@ describe GroupPolicy do
       :read_cluster,
       :create_cluster,
       :update_cluster,
-      :admin_cluster
+      :admin_cluster,
+      :add_cluster
     ]
   end
 
@@ -382,4 +383,14 @@ describe GroupPolicy do
       it { expect_disallowed(:change_share_with_group_lock) }
     end
   end
+
+  it_behaves_like 'clusterable policies' do
+    let(:clusterable) { create(:group) }
+    let(:cluster) do
+      create(:cluster,
+             :provided_by_gcp,
+             :group,
+             groups: [clusterable])
+    end
+  end
 end
diff --git a/spec/policies/project_policy_spec.rb b/spec/policies/project_policy_spec.rb
index 69468f9ad85..fa47b95899a 100644
--- a/spec/policies/project_policy_spec.rb
+++ b/spec/policies/project_policy_spec.rb
@@ -48,7 +48,7 @@ describe ProjectPolicy do
       update_deployment admin_project_snippet
       admin_project_member admin_note admin_wiki admin_project
       admin_commit_status admin_build admin_container_image
-      admin_pipeline admin_environment admin_deployment
+      admin_pipeline admin_environment admin_deployment add_cluster
     ]
   end
 
@@ -465,4 +465,14 @@ describe ProjectPolicy do
       expect_disallowed(*maintainer_abilities)
     end
   end
+
+  it_behaves_like 'clusterable policies' do
+    let(:clusterable) { create(:project, :repository) }
+    let(:cluster) do
+      create(:cluster,
+             :provided_by_gcp,
+             :project,
+             projects: [clusterable])
+    end
+  end
 end
diff --git a/spec/presenters/clusterable_presenter_spec.rb b/spec/presenters/clusterable_presenter_spec.rb
index 4f4ae5e07c5..05afe5347d1 100644
--- a/spec/presenters/clusterable_presenter_spec.rb
+++ b/spec/presenters/clusterable_presenter_spec.rb
@@ -14,4 +14,68 @@ describe ClusterablePresenter do
       expect(subject).to be_kind_of(ProjectClusterablePresenter)
     end
   end
+
+  shared_examples 'appropriate member permissions' do
+    context 'with a developer' do
+      before do
+        clusterable.add_developer(user)
+      end
+
+      it { is_expected.to be_falsy }
+    end
+
+    context 'with a maintainer' do
+      before do
+        clusterable.add_maintainer(user)
+      end
+
+      it { is_expected.to be_truthy }
+    end
+  end
+
+  describe '#can_create_cluster?' do
+    let(:user) { create(:user) }
+
+    subject { described_class.new(clusterable).can_create_cluster? }
+
+    before do
+      allow(clusterable).to receive(:current_user).and_return(user)
+    end
+
+    context 'when clusterable is a group' do
+      let(:clusterable) { create(:group) }
+
+      it_behaves_like 'appropriate member permissions'
+    end
+
+    context 'when clusterable is a project' do
+      let(:clusterable) { create(:project, :repository) }
+
+      it_behaves_like 'appropriate member permissions'
+    end
+  end
+
+  describe '#can_add_cluster?' do
+    let(:user) { create(:user) }
+
+    subject { described_class.new(clusterable).can_add_cluster? }
+
+    before do
+      clusterable.add_maintainer(user)
+
+      allow(clusterable).to receive(:current_user).and_return(user)
+    end
+
+    context 'when clusterable is a group' do
+      let(:clusterable) { create(:group) }
+
+      it_behaves_like 'appropriate member permissions'
+    end
+
+    context 'when clusterable is a project' do
+      let(:clusterable) { create(:project, :repository) }
+
+      it_behaves_like 'appropriate member permissions'
+    end
+  end
 end
diff --git a/spec/support/shared_examples/policies/clusterable_shared_examples.rb b/spec/support/shared_examples/policies/clusterable_shared_examples.rb
new file mode 100644
index 00000000000..d99f94c76c3
--- /dev/null
+++ b/spec/support/shared_examples/policies/clusterable_shared_examples.rb
@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+shared_examples 'clusterable policies' do
+  describe '#add_cluster?' do
+    let(:current_user) { create(:user) }
+
+    subject { described_class.new(current_user, clusterable) }
+
+    context 'with a developer' do
+      before do
+        clusterable.add_developer(current_user)
+      end
+
+      it { expect_disallowed(:add_cluster) }
+    end
+
+    context 'with a maintainer' do
+      before do
+        clusterable.add_maintainer(current_user)
+      end
+
+      context 'with no clusters' do
+        it { expect_allowed(:add_cluster) }
+      end
+
+      context 'with an existing cluster' do
+        before do
+          cluster
+        end
+
+        it { expect_disallowed(:add_cluster) }
+      end
+    end
+  end
+end