1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
|
# frozen_string_literal: true
module Projects
module GroupLinks
class CreateService < BaseService
include GroupLinkable
def initialize(project, shared_with_group, user, params)
@shared_with_group = shared_with_group
super(project, user, params)
end
def execute
if adding_a_group_as_owner? && cannot_assign_owner_responsibilities_to_member_in_project?
error('403 Forbidden', 403)
else
super
end
end
private
delegate :root_ancestor, to: :project
def adding_a_group_as_owner?
params[:link_group_access].to_i == Gitlab::Access::OWNER
end
def cannot_assign_owner_responsibilities_to_member_in_project?
!current_user.can?(:manage_owners, project)
end
def valid_to_create?
can?(current_user, :admin_project, project) &&
can?(current_user, :read_namespace_via_membership, shared_with_group) &&
sharing_allowed?
end
def build_link
@link = project.project_group_links.new(
group: shared_with_group,
group_access: params[:link_group_access],
expires_at: params[:expires_at]
)
end
def setup_authorizations
AuthorizedProjectUpdate::ProjectRecalculateWorker.perform_async(project.id)
# AuthorizedProjectsWorker uses an exclusive lease per user but
# specialized workers might have synchronization issues. Until we
# compare the inconsistency rates of both approaches, we still run
# AuthorizedProjectsWorker but with some delay and lower urgency as a
# safety net.
shared_with_group.refresh_members_authorized_projects(
priority: UserProjectAccessChangedService::LOW_PRIORITY
)
end
end
end
end
Projects::GroupLinks::CreateService.prepend_mod_with('Projects::GroupLinks::CreateService')
|