app/policies/packages/policies/project_policy.rb


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54

# frozen_string_literal: true

module Packages
  module Policies
    class ProjectPolicy < BasePolicy
      delegate(:project) { @subject.project }

      overrides(:read_package)

      condition(:package_registry_access_level_feature_flag_enabled, scope: :subject) do
        ::Feature.enabled?(:package_registry_access_level, @subject)
      end

      condition(:packages_enabled_for_everyone, scope: :subject) do
        @subject.package_registry_access_level == ProjectFeature::PUBLIC
      end

      # This rule can be removed if the `package_registry_access_level` feature flag is removed.
      # Reason: If the feature flag is globally enabled, this rule will never be executed.
      rule { anonymous & ~project.public_project & ~package_registry_access_level_feature_flag_enabled }.prevent_all

      # This rule can be removed if the `package_registry_access_level` feature flag is removed.
      # Reason: If the feature flag is globally enabled, this rule will never be executed.
      rule do
        ~project.public_project & ~project.internal_access &
          ~project.project_allowed_for_job_token & ~package_registry_access_level_feature_flag_enabled
      end.prevent_all

      rule { project.packages_disabled }.policy do
        prevent(:read_package)
      end

      rule { can?(:reporter_access) }.policy do
        enable :read_package
      end

      rule { can?(:public_access) }.policy do
        enable :read_package
      end

      rule { project.read_package_registry_deploy_token }.policy do
        enable :read_package
      end

      rule { project.write_package_registry_deploy_token }.policy do
        enable :read_package
      end

      rule { package_registry_access_level_feature_flag_enabled & packages_enabled_for_everyone }.policy do
        enable :read_package
      end
    end
  end
end