diff options
Diffstat (limited to 'app/policies')
-rw-r--r-- | app/policies/base_policy.rb | 5 | ||||
-rw-r--r-- | app/policies/group_policy.rb | 37 | ||||
-rw-r--r-- | app/policies/issue_policy.rb | 9 | ||||
-rw-r--r-- | app/policies/project_policy.rb | 12 | ||||
-rw-r--r-- | app/policies/releases/evidence_policy.rb | 1 | ||||
-rw-r--r-- | app/policies/terraform/state_policy.rb | 9 |
6 files changed, 58 insertions, 15 deletions
diff --git a/app/policies/base_policy.rb b/app/policies/base_policy.rb index 13d732e4edd..1c93073025d 100644 --- a/app/policies/base_policy.rb +++ b/app/policies/base_policy.rb @@ -27,10 +27,7 @@ class BasePolicy < DeclarativePolicy::Base desc "User email is unconfirmed or user account is locked" with_options scope: :user, score: 0 - condition(:inactive) do - Feature.enabled?(:inactive_policy_condition, default_enabled: true) && - @user&.confirmation_required_on_sign_in? || @user&.access_locked? - end + condition(:inactive) { @user&.confirmation_required_on_sign_in? || @user&.access_locked? } with_options scope: :user, score: 0 condition(:external_user) { @user.nil? || @user.external? } diff --git a/app/policies/group_policy.rb b/app/policies/group_policy.rb index c98e82efef7..f9ec026a6d2 100644 --- a/app/policies/group_policy.rb +++ b/app/policies/group_policy.rb @@ -46,6 +46,19 @@ class GroupPolicy < BasePolicy group_projects_for(user: @user, group: @subject, only_owned: false).any? { |p| p.design_management_enabled? } end + desc "Deploy token with read_package_registry scope" + condition(:read_package_registry_deploy_token) do + @user.is_a?(DeployToken) && @user.groups.include?(@subject) && @user.read_package_registry + end + + desc "Deploy token with write_package_registry scope" + condition(:write_package_registry_deploy_token) do + @user.is_a?(DeployToken) && @user.groups.include?(@subject) && @user.write_package_registry + end + + with_scope :subject + condition(:resource_access_token_available) { resource_access_token_available? } + rule { design_management_enabled }.policy do enable :read_design_activity end @@ -91,7 +104,6 @@ class GroupPolicy < BasePolicy rule { developer }.policy do enable :admin_milestone - enable :read_package enable :create_metrics_dashboard_annotation enable :delete_metrics_dashboard_annotation enable :update_metrics_dashboard_annotation @@ -105,6 +117,7 @@ class GroupPolicy < BasePolicy enable :admin_issue enable :read_metrics_dashboard_annotation enable :read_prometheus + enable :read_package end rule { maintainer }.policy do @@ -167,6 +180,20 @@ class GroupPolicy < BasePolicy rule { maintainer & can?(:create_projects) }.enable :transfer_projects + rule { read_package_registry_deploy_token }.policy do + enable :read_package + enable :read_group + end + + rule { write_package_registry_deploy_token }.policy do + enable :create_package + enable :read_group + end + + rule { resource_access_token_available & can?(:admin_group) }.policy do + enable :admin_resource_access_tokens + end + def access_level return GroupMember::NO_ACCESS if @user.nil? return GroupMember::NO_ACCESS unless user_is_user? @@ -183,6 +210,14 @@ class GroupPolicy < BasePolicy def user_is_user? user.is_a?(User) end + + def group + @subject + end + + def resource_access_token_available? + true + end end GroupPolicy.prepend_if_ee('EE::GroupPolicy') diff --git a/app/policies/issue_policy.rb b/app/policies/issue_policy.rb index b02bb8621ed..44c448eb601 100644 --- a/app/policies/issue_policy.rb +++ b/app/policies/issue_policy.rb @@ -15,9 +15,6 @@ class IssuePolicy < IssuablePolicy desc "Issue is confidential" condition(:confidential, scope: :subject) { @subject.confidential? } - desc "Issue has moved" - condition(:moved) { @subject.moved? } - rule { confidential & ~can_read_confidential }.policy do prevent(*create_read_update_admin_destroy(:issue)) prevent :read_issue_iid @@ -38,12 +35,6 @@ class IssuePolicy < IssuablePolicy rule { ~can?(:read_design) }.policy do prevent :move_design end - - rule { locked | moved }.policy do - prevent :create_design - prevent :move_design - prevent :destroy_design - end end IssuePolicy.prepend_if_ee('EE::IssuePolicy') diff --git a/app/policies/project_policy.rb b/app/policies/project_policy.rb index 87ee7d201e4..59e2d617bf7 100644 --- a/app/policies/project_policy.rb +++ b/app/policies/project_policy.rb @@ -104,6 +104,9 @@ class ProjectPolicy < BasePolicy with_scope :subject condition(:service_desk_enabled) { @subject.service_desk_enabled? } + with_scope :subject + condition(:resource_access_token_available) { resource_access_token_available? } + # We aren't checking `:read_issue` or `:read_merge_request` in this case # because it could be possible for a user to see an issuable-iid # (`:read_issue_iid` or `:read_merge_request_iid`) but then wouldn't be @@ -237,7 +240,6 @@ class ProjectPolicy < BasePolicy enable :read_merge_request enable :read_sentry_issue enable :update_sentry_issue - enable :read_incidents enable :read_prometheus enable :read_metrics_dashboard_annotation enable :metrics_dashboard @@ -589,6 +591,10 @@ class ProjectPolicy < BasePolicy prevent :read_project end + rule { resource_access_token_available & can?(:admin_project) }.policy do + enable :admin_resource_access_tokens + end + private def user_is_user? @@ -663,6 +669,10 @@ class ProjectPolicy < BasePolicy end end + def resource_access_token_available? + true + end + def project @subject end diff --git a/app/policies/releases/evidence_policy.rb b/app/policies/releases/evidence_policy.rb index 701913e6fe4..3e35f2f5e87 100644 --- a/app/policies/releases/evidence_policy.rb +++ b/app/policies/releases/evidence_policy.rb @@ -15,6 +15,7 @@ module Releases # - Project # - Milestones # - Issues + # TODO: remove issues from this check: https://gitlab.com/gitlab-org/gitlab/-/issues/259674 condition(:allowed_to_read_evidence) do can?(:read_release) && can?(:download_code) && diff --git a/app/policies/terraform/state_policy.rb b/app/policies/terraform/state_policy.rb new file mode 100644 index 00000000000..ba6109e5975 --- /dev/null +++ b/app/policies/terraform/state_policy.rb @@ -0,0 +1,9 @@ +# frozen_string_literal: true + +module Terraform + class StatePolicy < BasePolicy + alias_method :terraform_state, :subject + + delegate { terraform_state.project } + end +end |