diff options
Diffstat (limited to 'app/policies')
23 files changed, 236 insertions, 64 deletions
diff --git a/app/policies/abuse_report_policy.rb b/app/policies/abuse_report_policy.rb new file mode 100644 index 00000000000..f1f994e6a42 --- /dev/null +++ b/app/policies/abuse_report_policy.rb @@ -0,0 +1,7 @@ +# frozen_string_literal: true + +class AbuseReportPolicy < ::BasePolicy + rule { admin }.policy do + enable :read_abuse_report + end +end diff --git a/app/policies/achievements/user_achievement_policy.rb b/app/policies/achievements/user_achievement_policy.rb new file mode 100644 index 00000000000..05650a05490 --- /dev/null +++ b/app/policies/achievements/user_achievement_policy.rb @@ -0,0 +1,12 @@ +# frozen_string_literal: true + +module Achievements + class UserAchievementPolicy < ::BasePolicy + delegate { @subject.achievement.namespace } + delegate { @subject.user } + + rule { can?(:read_user_profile) | can?(:admin_achievement) }.enable :read_user_achievement + + rule { ~can?(:read_achievement) }.prevent :read_user_achievement + end +end diff --git a/app/policies/base_policy.rb b/app/policies/base_policy.rb index 1ce866bd910..d6aaa3e983d 100644 --- a/app/policies/base_policy.rb +++ b/app/policies/base_policy.rb @@ -35,10 +35,18 @@ class BasePolicy < DeclarativePolicy::Base with_options scope: :user, score: 0 condition(:security_bot) { @user&.security_bot? } + desc "User is security policy bot" + with_options scope: :user, score: 0 + condition(:security_policy_bot) { @user&.security_policy_bot? } + desc "User is automation bot" with_options scope: :user, score: 0 condition(:automation_bot) { @user&.automation_bot? } + desc "User is llm bot" + with_options scope: :user, score: 0 + condition(:llm_bot) { @user&.llm_bot? } + desc "User email is unconfirmed or user account is locked" with_options scope: :user, score: 0 condition(:inactive) { @user&.confirmation_required_on_sign_in? || @user&.access_locked? } @@ -63,7 +71,7 @@ class BasePolicy < DeclarativePolicy::Base end rule { admin }.policy do - # Only for actual administrator accounts, behaviour affected by admin mode application setting + # Only for actual administrator accounts, behavior affected by admin mode application setting enable :admin_all_resources # Policy extended in EE to also enable auditors enable :read_all_resources diff --git a/app/policies/ci/build_policy.rb b/app/policies/ci/build_policy.rb index ca0b51e1385..73e4cbee54a 100644 --- a/app/policies/ci/build_policy.rb +++ b/app/policies/ci/build_policy.rb @@ -71,13 +71,17 @@ module Ci can?(:developer_access, @subject.project) end + # Use admin_ci_minutes for detailed quota and usage reporting + # this is limited to total usage and total quota for a builds namespace + rule { can_read_project_build }.enable :read_ci_minutes_limited_summary + rule { can_read_project_build }.enable :read_build_trace rule { debug_mode & ~project_update_build }.prevent :read_build_trace # Authorizing the user to access to protected entities. # There is a "jailbreak" mode to exceptionally bypass the authorization, # however, you should NEVER allow it, rather suspect it's a wrong feature/product design. - rule { ~can?(:jailbreak) & (archived | protected_ref | protected_environment) }.policy do + rule { ~can?(:jailbreak) & (archived | (protected_ref & ~admin) | protected_environment) }.policy do prevent :update_build prevent :update_commit_status prevent :erase_build diff --git a/app/policies/ci/pipeline_schedule_policy.rb b/app/policies/ci/pipeline_schedule_policy.rb index 3a674bfef92..7b0d484f9f7 100644 --- a/app/policies/ci/pipeline_schedule_policy.rb +++ b/app/policies/ci/pipeline_schedule_policy.rb @@ -23,6 +23,10 @@ module Ci enable :update_pipeline_schedule end + # `take_ownership_pipeline_schedule` is deprecated, and should not be used. It can be removed in 17.0 + # once the deprecated field `take_ownership_pipeline_schedule` is removed from the GraphQL type + # `PermissionTypes::Ci::PipelineSchedules`. + # Use `admin_pipeline_schedule` to decide if a user has the ability to take ownership of a pipeline schedule. rule { can?(:admin_pipeline_schedule) & ~owner_of_schedule }.policy do enable :take_ownership_pipeline_schedule end diff --git a/app/policies/ci/runner_manager_policy.rb b/app/policies/ci/runner_manager_policy.rb new file mode 100644 index 00000000000..43e81e373fc --- /dev/null +++ b/app/policies/ci/runner_manager_policy.rb @@ -0,0 +1,18 @@ +# frozen_string_literal: true + +module Ci + class RunnerManagerPolicy < BasePolicy + with_options scope: :subject, score: 0 + + condition(:can_read_runner, scope: :subject) do + can?(:read_runner, @subject.runner) + end + + rule { anonymous }.prevent_all + + rule { can_read_runner }.policy do + enable :read_builds + enable :read_runner_manager + end + end +end diff --git a/app/policies/clusters/agent_policy.rb b/app/policies/clusters/agent_policy.rb index 25e78c84802..ecd83cceb8b 100644 --- a/app/policies/clusters/agent_policy.rb +++ b/app/policies/clusters/agent_policy.rb @@ -5,5 +5,19 @@ module Clusters alias_method :cluster_agent, :subject delegate { cluster_agent.project } + + # This condition is more expensive than the same permission check in ProjectPolicy, + # so having a higher score. + condition(:ci_access_authorized_agent, score: 10) do + @subject.ci_access_authorized_for?(@user) + end + + condition(:user_access_authorized_agent, score: 10) do + @subject.user_access_authorized_for?(@user) + end + + rule { ci_access_authorized_agent | user_access_authorized_agent }.policy do + enable :read_cluster_agent + end end end diff --git a/app/policies/clusters/instance_policy.rb b/app/policies/clusters/instance_policy.rb index 3c5ca4bf4e1..2781e943bae 100644 --- a/app/policies/clusters/instance_policy.rb +++ b/app/policies/clusters/instance_policy.rb @@ -9,6 +9,7 @@ module Clusters enable :update_cluster enable :admin_cluster enable :read_prometheus + enable :use_k8s_proxies end end end diff --git a/app/policies/concerns/archived_abilities.rb b/app/policies/concerns/archived_abilities.rb index b4dfad599c7..7d61f83528e 100644 --- a/app/policies/concerns/archived_abilities.rb +++ b/app/policies/concerns/archived_abilities.rb @@ -37,6 +37,7 @@ module ArchivedAbilities pages cluster release + timelog ].freeze class_methods do diff --git a/app/policies/concerns/policy_actor.rb b/app/policies/concerns/policy_actor.rb index 8fa09683b06..e000f1514e5 100644 --- a/app/policies/concerns/policy_actor.rb +++ b/app/policies/concerns/policy_actor.rb @@ -53,6 +53,10 @@ module PolicyActor false end + def security_policy_bot? + false + end + def automation_bot? false end diff --git a/app/policies/global_policy.rb b/app/policies/global_policy.rb index d028738ccc9..b96ad9a73c8 100644 --- a/app/policies/global_policy.rb +++ b/app/policies/global_policy.rb @@ -22,10 +22,12 @@ class GlobalPolicy < BasePolicy condition(:project_bot, scope: :user) { @user&.project_bot? } condition(:migration_bot, scope: :user) { @user&.migration_bot? } - condition(:create_runner_workflow_enabled) do - Feature.enabled?(:create_runner_workflow) + condition(:create_runner_workflow_enabled, scope: :user) do + Feature.enabled?(:create_runner_workflow_for_admin, @user) end + condition(:service_account, scope: :user) { @user&.service_account? } + rule { anonymous }.policy do prevent :log_in prevent :receive_notifications @@ -60,11 +62,15 @@ class GlobalPolicy < BasePolicy rule { ~can?(:access_api) }.prevent :execute_graphql_mutation - rule { blocked | (internal & ~migration_bot & ~security_bot) }.policy do + rule { blocked | (internal & ~migration_bot & ~security_bot & ~security_policy_bot) }.policy do prevent :access_git end - rule { project_bot }.policy do + rule { security_policy_bot }.policy do + enable :access_git + end + + rule { project_bot | service_account }.policy do prevent :log_in prevent :receive_notifications end @@ -119,11 +125,11 @@ class GlobalPolicy < BasePolicy enable :approve_user enable :reject_user enable :read_usage_trends_measurement - enable :create_instance_runners + enable :create_instance_runner end rule { ~create_runner_workflow_enabled }.policy do - prevent :create_instance_runners + prevent :create_instance_runner end # We can't use `read_statistics` because the user may have different permissions for different projects diff --git a/app/policies/group_label_policy.rb b/app/policies/group_label_policy.rb index 4a848e44fec..08d811d3dfa 100644 --- a/app/policies/group_label_policy.rb +++ b/app/policies/group_label_policy.rb @@ -1,5 +1,5 @@ # frozen_string_literal: true class GroupLabelPolicy < BasePolicy - delegate { @subject.parent_container } + delegate { @subject.preloaded_parent_container } end diff --git a/app/policies/group_policy.rb b/app/policies/group_policy.rb index 6cc65248914..285721de387 100644 --- a/app/policies/group_policy.rb +++ b/app/policies/group_policy.rb @@ -36,7 +36,20 @@ class GroupPolicy < Namespaces::GroupProjectNamespaceSharedPolicy condition(:request_access_enabled) { @subject.request_access_enabled } condition(:create_projects_disabled, scope: :subject) do - @subject.project_creation_level == ::Gitlab::Access::NO_ONE_PROJECT_ACCESS + next true if @user.nil? + + visibility_levels = if @user.can_admin_all_resources? + # admin can create projects even with restricted visibility levels + Gitlab::VisibilityLevel.values + else + Gitlab::VisibilityLevel.allowed_levels + end + + allowed_visibility_levels = visibility_levels.select do |level| + Project.new(namespace: @subject).visibility_level_allowed?(level) + end + + @subject.project_creation_level == ::Gitlab::Access::NO_ONE_PROJECT_ACCESS || allowed_visibility_levels.empty? end condition(:developer_maintainer_access, scope: :subject) do @@ -85,11 +98,15 @@ class GroupPolicy < Namespaces::GroupProjectNamespaceSharedPolicy condition(:crm_enabled, score: 0, scope: :subject) { @subject.crm_enabled? } condition(:create_runner_workflow_enabled) do - Feature.enabled?(:create_runner_workflow) + Feature.enabled?(:create_runner_workflow_for_namespace, group) + end + + condition(:achievements_enabled, scope: :subject) do + Feature.enabled?(:achievements, @subject) end condition(:group_runner_registration_allowed, scope: :subject) do - Gitlab::CurrentSettings.valid_runner_registrars.include?('group') && @subject.runner_registration_enabled? + @subject.runner_registration_enabled? end rule { can?(:read_group) & design_management_enabled }.policy do @@ -131,9 +148,17 @@ class GroupPolicy < Namespaces::GroupProjectNamespaceSharedPolicy enable :read_group_member enable :read_custom_emoji enable :read_counts + end + + rule { achievements_enabled }.policy do enable :read_achievement end + rule { can?(:maintainer_access) & achievements_enabled }.policy do + enable :admin_achievement + enable :award_achievement + end + rule { ~public_group & ~has_access }.prevent :read_counts rule { ~can_read_group_member }.policy do @@ -147,17 +172,16 @@ class GroupPolicy < Namespaces::GroupProjectNamespaceSharedPolicy rule { has_access }.enable :read_namespace rule { developer }.policy do - enable :create_metrics_dashboard_annotation - enable :delete_metrics_dashboard_annotation - enable :update_metrics_dashboard_annotation + enable :admin_metrics_dashboard_annotation enable :create_custom_emoji enable :create_package enable :developer_access enable :admin_crm_organization enable :admin_crm_contact - enable :read_cluster - + enable :read_cluster # Deprecated as certificate-based cluster integration (`Clusters::Cluster`). + enable :read_cluster_agent enable :read_group_all_available_runners + enable :use_k8s_proxies end rule { reporter }.policy do @@ -180,6 +204,7 @@ class GroupPolicy < Namespaces::GroupProjectNamespaceSharedPolicy enable :destroy_package enable :admin_package enable :create_projects + enable :import_projects enable :admin_pipeline enable :admin_build enable :add_cluster @@ -191,7 +216,6 @@ class GroupPolicy < Namespaces::GroupProjectNamespaceSharedPolicy enable :maintainer_access enable :read_upload enable :destroy_upload - enable :admin_achievement end rule { owner }.policy do @@ -204,7 +228,7 @@ class GroupPolicy < Namespaces::GroupProjectNamespaceSharedPolicy enable :read_group_runners enable :admin_group_runners enable :register_group_runners - enable :create_group_runners + enable :create_runner enable :set_note_created_at enable :set_emails_disabled @@ -246,17 +270,25 @@ class GroupPolicy < Namespaces::GroupProjectNamespaceSharedPolicy rule { ~can?(:view_globally) }.prevent :request_access rule { has_access }.prevent :request_access - rule { owner & (~share_with_group_locked | ~has_parent | ~parent_share_with_group_locked | can_change_parent_share_with_group_lock) }.enable :change_share_with_group_lock + rule do + owner & (~share_with_group_locked | ~has_parent | ~parent_share_with_group_locked | can_change_parent_share_with_group_lock) + end.enable :change_share_with_group_lock rule { developer & developer_maintainer_access }.enable :create_projects - rule { create_projects_disabled }.prevent :create_projects + rule { create_projects_disabled }.policy do + prevent :create_projects + prevent :import_projects + end rule { owner | admin }.policy do enable :owner_access enable :read_statistics end - rule { maintainer & can?(:create_projects) }.enable :transfer_projects + rule { maintainer & can?(:create_projects) }.policy do + enable :transfer_projects + enable :import_projects + end rule { read_package_registry_deploy_token }.policy do enable :read_package @@ -289,10 +321,12 @@ class GroupPolicy < Namespaces::GroupProjectNamespaceSharedPolicy rule { resource_access_token_creation_allowed & can?(:read_resource_access_tokens) }.policy do enable :create_resource_access_tokens + enable :manage_resource_access_tokens end rule { can?(:project_bot_access) }.policy do prevent :create_resource_access_tokens + prevent :manage_resource_access_tokens end rule { can?(:admin_group_member) }.policy do @@ -313,7 +347,7 @@ class GroupPolicy < Namespaces::GroupProjectNamespaceSharedPolicy rule { ~admin & ~group_runner_registration_allowed }.policy do prevent :register_group_runners - prevent :create_group_runners + prevent :create_runner end rule { migration_bot }.policy do @@ -325,8 +359,12 @@ class GroupPolicy < Namespaces::GroupProjectNamespaceSharedPolicy enable :read_observability end + rule { can?(:maintainer_access) & observability_enabled }.policy do + enable :admin_observability + end + rule { ~create_runner_workflow_enabled }.policy do - prevent :create_group_runners + prevent :create_runner end # Should be matched with ProjectPolicy#read_internal_note diff --git a/app/policies/identity_provider_policy.rb b/app/policies/identity_provider_policy.rb index c539fc64d3f..1e748c78555 100644 --- a/app/policies/identity_provider_policy.rb +++ b/app/policies/identity_provider_policy.rb @@ -1,8 +1,8 @@ # frozen_string_literal: true class IdentityProviderPolicy < BasePolicy - desc "Provider is SAML or CAS3" - condition(:protected_provider, scope: :subject, score: 0) { %w(saml cas3).include?(@subject.to_s) } + desc "Provider is SAML" + condition(:protected_provider, scope: :subject, score: 0) { @subject.to_s == 'saml' } rule { anonymous }.prevent_all diff --git a/app/policies/issuable_policy.rb b/app/policies/issuable_policy.rb index 496708a9737..60ab1785972 100644 --- a/app/policies/issuable_policy.rb +++ b/app/policies/issuable_policy.rb @@ -1,10 +1,10 @@ # frozen_string_literal: true class IssuablePolicy < BasePolicy - delegate { @subject.project } + delegate { subject_container } condition(:locked, scope: :subject, score: 0) { @subject.discussion_locked? } - condition(:is_project_member) { @user && @subject.project && @subject.project.team.member?(@user) } + condition(:is_project_member) { subject_container.member?(@user) } condition(:can_read_issuable) { can?(:"read_#{@subject.to_ability_name}") } desc "User is the assignee or author" @@ -14,7 +14,7 @@ class IssuablePolicy < BasePolicy condition(:is_author) { @subject&.author == @user } - condition(:is_incident) { @subject.incident? } + condition(:is_incident) { @subject.incident_type_issue? } desc "Issuable is hidden" condition(:hidden, scope: :subject) { @subject.hidden? } @@ -57,6 +57,10 @@ class IssuablePolicy < BasePolicy enable :read_issuable enable :read_issuable_participables end + + def subject_container + @subject.project || @subject.try(:namespace) + end end IssuablePolicy.prepend_mod_with('IssuablePolicy') diff --git a/app/policies/issue_policy.rb b/app/policies/issue_policy.rb index d1e35793c64..538959c92bd 100644 --- a/app/policies/issue_policy.rb +++ b/app/policies/issue_policy.rb @@ -14,8 +14,8 @@ class IssuePolicy < IssuablePolicy desc "Project belongs to a group, crm is enabled and user can read contacts in the root group" condition(:can_read_crm_contacts, scope: :subject) do - subject.project.group&.crm_enabled? && - (@user&.can?(:read_crm_contact, @subject.project.root_ancestor) || @user&.support_bot?) + subject_container&.crm_enabled? && + (@user&.can?(:read_crm_contact, subject_container.root_ancestor) || @user&.support_bot?) end desc "Issue is confidential" @@ -43,6 +43,7 @@ class IssuePolicy < IssuablePolicy rule { confidential & ~can_read_confidential }.policy do prevent(*create_read_update_admin_destroy(:issue)) + prevent(*create_read_update_admin_destroy(:work_item)) prevent :read_issue_iid end @@ -59,6 +60,7 @@ class IssuePolicy < IssuablePolicy rule { ~can?(:read_issue) }.policy do prevent :read_design prevent :create_design + prevent :update_design prevent :destroy_design end diff --git a/app/policies/namespaces/group_project_namespace_shared_policy.rb b/app/policies/namespaces/group_project_namespace_shared_policy.rb index bfb1706bc5a..2214839fb62 100644 --- a/app/policies/namespaces/group_project_namespace_shared_policy.rb +++ b/app/policies/namespaces/group_project_namespace_shared_policy.rb @@ -17,5 +17,16 @@ module Namespaces rule { can?(:reporter_access) }.policy do enable :read_timelog_category end + + rule { can?(:guest_access) }.policy do + enable :create_work_item + enable :read_work_item + enable :read_issue + enable :read_namespace + end + + rule { can?(:create_work_item) }.enable :create_task end end + +Namespaces::GroupProjectNamespaceSharedPolicy.prepend_mod diff --git a/app/policies/namespaces/user_namespace_policy.rb b/app/policies/namespaces/user_namespace_policy.rb index 1deeae8241f..bfed61e72d3 100644 --- a/app/policies/namespaces/user_namespace_policy.rb +++ b/app/policies/namespaces/user_namespace_policy.rb @@ -11,6 +11,7 @@ module Namespaces rule { owner | admin }.policy do enable :owner_access enable :create_projects + enable :import_projects enable :admin_namespace enable :read_namespace enable :read_statistics @@ -20,9 +21,9 @@ module Namespaces enable :edit_billing end - rule { ~can_create_personal_project }.prevent :create_projects + rule { ~can_create_personal_project }.prevent :create_projects, :import_projects - rule { bot_user_namespace }.prevent :create_projects + rule { bot_user_namespace }.prevent :create_projects, :import_projects rule { (owner | admin) & can?(:create_projects) }.enable :transfer_projects end diff --git a/app/policies/project_hook_policy.rb b/app/policies/project_hook_policy.rb index c177fabb1ba..b4590c13670 100644 --- a/app/policies/project_hook_policy.rb +++ b/app/policies/project_hook_policy.rb @@ -1,10 +1,9 @@ # frozen_string_literal: true class ProjectHookPolicy < ::BasePolicy - delegate(:project) + delegate { @subject.project } rule { can?(:admin_project) }.policy do - enable :read_web_hook enable :destroy_web_hook end end diff --git a/app/policies/project_label_policy.rb b/app/policies/project_label_policy.rb index 6656d5990a5..3b125429510 100644 --- a/app/policies/project_label_policy.rb +++ b/app/policies/project_label_policy.rb @@ -1,5 +1,5 @@ # frozen_string_literal: true class ProjectLabelPolicy < BasePolicy - delegate { @subject.parent_container } + delegate { @subject.preloaded_parent_container } end diff --git a/app/policies/project_policy.rb b/app/policies/project_policy.rb index 3d22002e828..47d8d0eef3e 100644 --- a/app/policies/project_policy.rb +++ b/app/policies/project_policy.rb @@ -38,6 +38,9 @@ class ProjectPolicy < BasePolicy desc "User is a project bot" condition(:project_bot) { user.project_bot? && team_member? } + desc "User is a security policy bot on the project" + condition(:security_policy_bot) { user&.security_policy_bot? && team_member? } + desc "Project is public" condition(:public_project, scope: :subject, score: 0) { project.public? } @@ -49,6 +52,9 @@ class ProjectPolicy < BasePolicy desc "User is a member of the group" condition(:group_member, scope: :subject) { project_group_member? } + desc "User is a requester of the group" + condition(:group_requester, scope: :subject) { project_group_requester? } + desc "Project is archived" condition(:archived, scope: :subject, score: 0) { project.archived? } @@ -222,8 +228,8 @@ class ProjectPolicy < BasePolicy condition(:"#{f}_disabled", score: 32) { !access_allowed_to?(f.to_sym) } end - condition(:project_runner_registration_allowed) do - Gitlab::CurrentSettings.valid_runner_registrars.include?('project') + condition(:project_runner_registration_allowed, scope: :subject) do + Gitlab::CurrentSettings.valid_runner_registrars.include?('project') && @subject.runner_registration_enabled end condition :registry_enabled do @@ -234,10 +240,16 @@ class ProjectPolicy < BasePolicy Gitlab.config.packages.enabled end + condition :terraform_state_disabled do + !Gitlab.config.terraform_state.enabled + end + condition(:create_runner_workflow_enabled) do - Feature.enabled?(:create_runner_workflow) + Feature.enabled?(:create_runner_workflow_for_namespace, project.namespace) end + condition(:namespace_catalog_available) { namespace_catalog_available? } + # `:read_project` may be prevented in EE, but `:read_project_for_iids` should # not. rule { guest | admin }.enable :read_project_for_iids @@ -274,9 +286,6 @@ class ProjectPolicy < BasePolicy enable :set_show_default_award_emojis enable :set_show_diff_preview_in_email enable :set_warn_about_potentially_unwanted_characters - - enable :register_project_runners - enable :create_project_runners enable :manage_owners end @@ -349,10 +358,10 @@ class ProjectPolicy < BasePolicy enable :metrics_dashboard enable :read_confidential_issues enable :read_package - enable :read_product_analytics enable :read_ci_cd_analytics enable :read_external_emails enable :read_grafana + enable :export_work_items end # We define `:public_user_access` separately because there are cases in gitlab-ee @@ -404,11 +413,15 @@ class ProjectPolicy < BasePolicy end rule { infrastructure_disabled }.policy do - prevent(*create_read_update_admin_destroy(:terraform_state)) prevent(*create_read_update_admin_destroy(:cluster)) prevent(:read_pod_logs) prevent(:read_prometheus) prevent(:admin_project_google_cloud) + prevent(:admin_project_aws) + end + + rule { infrastructure_disabled | terraform_state_disabled }.policy do + prevent(*create_read_update_admin_destroy(:terraform_state)) end rule { can?(:metrics_dashboard) }.policy do @@ -424,10 +437,11 @@ class ProjectPolicy < BasePolicy prevent(*create_read_update_admin_destroy(:package)) end - rule { owner | admin | guest | group_member }.prevent :request_access + rule { owner | admin | guest | group_member | group_requester }.prevent :request_access rule { ~request_access_enabled }.prevent :request_access rule { can?(:developer_access) & can?(:create_issue) }.enable :import_issues + rule { can?(:reporter_access) & can?(:create_work_item) }.enable :import_work_items rule { can?(:developer_access) }.policy do enable :create_package @@ -453,16 +467,17 @@ class ProjectPolicy < BasePolicy enable :destroy_environment enable :create_deployment enable :update_deployment - enable :read_cluster + enable :read_cluster # Deprecated as certificate-based cluster integration (`Clusters::Cluster`). + enable :read_cluster_agent + enable :use_k8s_proxies enable :create_release enable :update_release enable :destroy_release - enable :create_metrics_dashboard_annotation - enable :delete_metrics_dashboard_annotation - enable :update_metrics_dashboard_annotation + enable :admin_metrics_dashboard_annotation enable :read_alert_management_alert enable :update_alert_management_alert enable :create_design + enable :update_design enable :move_design enable :destroy_design enable :read_terraform_state @@ -476,7 +491,6 @@ class ProjectPolicy < BasePolicy enable :update_escalation_status enable :read_secure_files enable :update_sentry_issue - enable :read_airflow_dags end rule { can?(:developer_access) & user_confirmed? }.policy do @@ -527,11 +541,13 @@ class ProjectPolicy < BasePolicy enable :destroy_freeze_period enable :admin_feature_flags_client enable :register_project_runners - enable :create_project_runners + enable :create_runner + enable :admin_project_runners + enable :read_project_runners enable :update_runners_registration_token enable :admin_project_google_cloud + enable :admin_project_aws enable :admin_secure_files - enable :read_web_hooks enable :read_upload enable :destroy_upload enable :admin_incident_management_timeline_event_tag @@ -751,6 +767,7 @@ class ProjectPolicy < BasePolicy prevent :read_design prevent :read_design_activity prevent :create_design + prevent :update_design prevent :destroy_design prevent :move_design end @@ -779,6 +796,7 @@ class ProjectPolicy < BasePolicy rule { write_package_registry_deploy_token }.policy do enable :create_package enable :read_package + enable :destroy_package enable :read_project end @@ -812,6 +830,7 @@ class ProjectPolicy < BasePolicy rule { can?(:admin_project) & resource_access_token_feature_available & resource_access_token_creation_allowed }.policy do enable :create_resource_access_tokens + enable :manage_resource_access_tokens end rule { can?(:admin_project) }.policy do @@ -820,6 +839,7 @@ class ProjectPolicy < BasePolicy rule { can?(:project_bot_access) }.policy do prevent :create_resource_access_tokens + prevent :manage_resource_access_tokens end rule { user_defined_variables_allowed | can?(:maintainer_access) }.policy do @@ -832,7 +852,7 @@ class ProjectPolicy < BasePolicy rule { ~admin & ~project_runner_registration_allowed }.policy do prevent :register_project_runners - prevent :create_project_runners + prevent :create_runner end rule { can?(:admin_project_member) }.policy do @@ -858,12 +878,20 @@ class ProjectPolicy < BasePolicy end rule { ~create_runner_workflow_enabled }.policy do - prevent :create_project_runners + prevent :create_runner end # Should be matched with GroupPolicy#read_internal_note rule { admin | can?(:reporter_access) }.enable :read_internal_note + rule { can?(:developer_access) & namespace_catalog_available }.policy do + enable :read_namespace_catalog + end + + rule { can?(:owner_access) & namespace_catalog_available }.policy do + enable :add_catalog_resource + end + private def user_is_user? @@ -897,16 +925,19 @@ class ProjectPolicy < BasePolicy end end - # rubocop: disable CodeReuse/ActiveRecord def project_group_member? return false if @user.nil? return false unless user_is_user? - project.group && - ( - project.group.members_with_parents.exists?(user_id: @user.id) || - project.group.requesters.exists?(user_id: @user.id) - ) + project.group && project.group.member?(@user) + end + + # rubocop: disable CodeReuse/ActiveRecord + def project_group_requester? + return false if @user.nil? + return false unless user_is_user? + + project.group && project.group.requesters.exists?(user_id: @user.id) end # rubocop: enable CodeReuse/ActiveRecord @@ -957,6 +988,10 @@ class ProjectPolicy < BasePolicy def project @subject end + + def namespace_catalog_available? + false + end end ProjectPolicy.prepend_mod_with('ProjectPolicy') diff --git a/app/policies/project_snippet_policy.rb b/app/policies/project_snippet_policy.rb index b8f0be9b4c5..e11c1a39757 100644 --- a/app/policies/project_snippet_policy.rb +++ b/app/policies/project_snippet_policy.rb @@ -25,10 +25,12 @@ class ProjectSnippetPolicy < BasePolicy # is used to hide/show various snippet-related controls, so we can't just # move all of the handling here. rule do - all?(private_snippet | (internal_snippet & external_user), - ~project.guest, - ~is_author, - ~can?(:read_all_resources)) + all?( + private_snippet | (internal_snippet & external_user), + ~project.guest, + ~is_author, + ~can?(:read_all_resources) + ) end.prevent :read_snippet rule { internal_snippet & ~is_author & ~admin & ~project.maintainer }.policy do diff --git a/app/policies/user_policy.rb b/app/policies/user_policy.rb index ed5b01e52b4..1078eda38e7 100644 --- a/app/policies/user_policy.rb +++ b/app/policies/user_policy.rb @@ -37,6 +37,7 @@ class UserPolicy < BasePolicy rule { (private_profile | blocked_user | unconfirmed_user) & ~(user_is_self | admin) }.prevent :read_user_profile rule { user_is_self | admin }.enable :disable_two_factor rule { (user_is_self | admin) & ~blocked }.enable :create_user_personal_access_token + rule { (user_is_self | admin) & ~blocked }.enable :manage_user_personal_access_token rule { (user_is_self | admin) & ~blocked }.enable :get_user_associations_count end |