Read about our upcoming Code of Conduct on this issue

This instance will be upgraded to Heptapod 0.28.1 on 2022-01-26 at 16:00 UTC+1 (a few minutes of down time)

group.rb 8.91 KB
Newer Older
Steven Thonus's avatar
Steven Thonus committed
1
2
require 'carrierwave/orm/activerecord'

3
class Group < Namespace
4
  include Gitlab::ConfigHelper
5
  include AfterCommitQueue
Rémy Coutable's avatar
Rémy Coutable committed
6
  include AccessRequestable
7
  include Avatarable
8
  include Referable
9
  include SelectForProjectAuthorization
10
  include LoadedInGroupList
11
  include GroupDescendant
Felipe Artur's avatar
Felipe Artur committed
12

13
  has_many :group_members, -> { where(requested_at: nil) }, dependent: :destroy, as: :source # rubocop:disable Cop/ActiveRecordDependent
14
  alias_method :members, :group_members
15
  has_many :users, through: :group_members
16
  has_many :owners,
17
    -> { where(members: { access_level: Gitlab::Access::OWNER }) },
18
19
20
    through: :group_members,
    source: :user

21
  has_many :requesters, -> { where.not(requested_at: nil) }, dependent: :destroy, as: :source, class_name: 'GroupMember' # rubocop:disable Cop/ActiveRecordDependent
22
  has_many :members_and_requesters, as: :source, class_name: 'GroupMember'
23

Felipe Artur's avatar
Felipe Artur committed
24
  has_many :milestones
25
  has_many :project_group_links, dependent: :destroy # rubocop:disable Cop/ActiveRecordDependent
26
  has_many :shared_projects, through: :project_group_links, source: :project
27
  has_many :notification_settings, dependent: :destroy, as: :source # rubocop:disable Cop/ActiveRecordDependent
28
  has_many :labels, class_name: 'GroupLabel'
Shinya Maeda's avatar
Shinya Maeda committed
29
  has_many :variables, class_name: 'Ci::GroupVariable'
30
  has_many :custom_attributes, class_name: 'GroupCustomAttribute'
Andrey Kumanyaev's avatar
Andrey Kumanyaev committed
31

32
33
  has_many :uploads, as: :model, dependent: :destroy # rubocop:disable Cop/ActiveRecordDependent

34
35
  has_many :badges, class_name: 'GroupBadge'

36
37
  accepts_nested_attributes_for :variables, allow_destroy: true

38
  validate :visibility_level_allowed_by_projects
39
  validate :visibility_level_allowed_by_sub_groups
40
  validate :visibility_level_allowed_by_parent
41
  validates :variables, variable_duplicates: true
42

43
44
  validates :two_factor_grace_period, presence: true, numericality: { greater_than_or_equal_to: 0 }

45
46
  after_create :post_create_hook
  after_destroy :post_destroy_hook
47
  after_save :update_two_factor_requirement
48
  after_update :path_changed_hook, if: :path_changed?
49

50
  class << self
51
52
53
54
    def supports_nested_groups?
      Gitlab::Database.postgresql?
    end

55
    def sort(method)
Markus Koller's avatar
Markus Koller committed
56
57
58
59
60
61
62
      if method == 'storage_size_desc'
        # storage_size is a virtual column so we need to
        # pass a string to avoid AR adding the table name
        reorder('storage_size DESC, namespaces.id DESC')
      else
        order_by(method)
      end
63
    end
64
65

    def reference_prefix
66
67
68
69
70
      User.reference_prefix
    end

    def reference_pattern
      User.reference_pattern
71
    end
72
73
74
75

    def visible_to_user(user)
      where(id: user.authorized_groups.select(:id).reorder(nil))
    end
76
77
78

    def select_for_project_authorization
      if current_scope.joins_values.include?(:shared_projects)
79
80
        joins('INNER JOIN namespaces project_namespace ON project_namespace.id = projects.namespace_id')
          .where('project_namespace.share_with_group_lock = ?',  false)
81
          .select("projects.id AS project_id, LEAST(project_group_links.group_access, members.access_level) AS access_level")
82
83
84
85
      else
        super
      end
    end
86
87
  end

88
  def to_reference(_from = nil, full: nil)
89
    "#{self.class.reference_prefix}#{full_path}"
90
91
  end

92
  def web_url
93
    Gitlab::Routing.url_helpers.group_canonical_url(self)
94
95
  end

96
  def human_name
97
    full_name
98
  end
99

100
  def visibility_level_allowed_by_parent?(level = self.visibility_level)
Rubén Dávila's avatar
Rubén Dávila committed
101
    return true unless parent_id && parent_id.nonzero?
102

103
104
    level <= parent.visibility_level
  end
105

106
  def visibility_level_allowed_by_projects?(level = self.visibility_level)
107
    !projects.where('visibility_level > ?', level).exists?
108
  end
109

110
  def visibility_level_allowed_by_sub_groups?(level = self.visibility_level)
111
    !children.where('visibility_level > ?', level).exists?
112
113
  end

114
115
116
117
  def visibility_level_allowed?(level = self.visibility_level)
    visibility_level_allowed_by_parent?(level) &&
      visibility_level_allowed_by_projects?(level) &&
      visibility_level_allowed_by_sub_groups?(level)
118
119
  end

120
121
122
123
124
125
126
  def lfs_enabled?
    return false unless Gitlab.config.lfs.enabled
    return Gitlab.config.lfs.enabled if self[:lfs_enabled].nil?

    self[:lfs_enabled]
  end

127
  def add_users(users, access_level, current_user: nil, expires_at: nil)
128
    GroupMember.add_users(
129
130
131
132
133
134
      self,
      users,
      access_level,
      current_user: current_user,
      expires_at: expires_at
    )
135
136
  end

137
  def add_user(user, access_level, current_user: nil, expires_at: nil)
138
139
140
141
142
143
144
    GroupMember.add_user(
      self,
      user,
      access_level,
      current_user: current_user,
      expires_at: expires_at
    )
145
146
  end

147
  def add_guest(user, current_user = nil)
148
    add_user(user, :guest, current_user: current_user)
149
150
151
  end

  def add_reporter(user, current_user = nil)
152
    add_user(user, :reporter, current_user: current_user)
153
154
155
  end

  def add_developer(user, current_user = nil)
156
    add_user(user, :developer, current_user: current_user)
157
158
159
  end

  def add_master(user, current_user = nil)
160
    add_user(user, :master, current_user: current_user)
161
162
  end

Douwe Maan's avatar
Douwe Maan committed
163
  def add_owner(user, current_user = nil)
164
    add_user(user, :owner, current_user: current_user)
Douwe Maan's avatar
Douwe Maan committed
165
166
  end

167
168
169
170
171
172
  def member?(user, min_access_level = Gitlab::Access::GUEST)
    return false unless user

    max_member_access_for_user(user) >= min_access_level
  end

Douwe Maan's avatar
Douwe Maan committed
173
  def has_owner?(user)
174
175
    return false unless user

176
    members_with_parents.owners.where(user_id: user).any?
Douwe Maan's avatar
Douwe Maan committed
177
178
179
  end

  def has_master?(user)
180
181
    return false unless user

182
    members_with_parents.masters.where(user_id: user).any?
Douwe Maan's avatar
Douwe Maan committed
183
184
  end

185
186
  # Check if user is a last owner of the group.
  # Parent owners are ignored for nested groups.
Douwe Maan's avatar
Douwe Maan committed
187
  def last_owner?(user)
188
    owners.include?(user) && owners.size == 1
Douwe Maan's avatar
Douwe Maan committed
189
190
  end

Steven Thonus's avatar
Steven Thonus committed
191
192
193
194
195
  def avatar_type
    unless self.avatar.image?
      self.errors.add :avatar, "only images allowed"
    end
  end
196

197
  def post_create_hook
198
199
    Gitlab::AppLogger.info("Group \"#{name}\" was created")

200
201
202
203
    system_hook_service.execute_hooks_for(self, :create)
  end

  def post_destroy_hook
204
205
    Gitlab::AppLogger.info("Group \"#{name}\" was removed")

206
207
208
209
210
211
    system_hook_service.execute_hooks_for(self, :destroy)
  end

  def system_hook_service
    SystemHooksService.new
  end
212

213
  def refresh_members_authorized_projects(blocking: true)
214
    UserProjectAccessChangedService.new(user_ids_for_project_authorizations)
215
      .execute(blocking: blocking)
216
217
218
  end

  def user_ids_for_project_authorizations
219
    members_with_parents.pluck(:user_id)
220
221
222
  end

  def members_with_parents
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
    # Avoids an unnecessary SELECT when the group has no parents
    source_ids =
      if parent_id
        self_and_ancestors.reorder(nil).select(:id)
      else
        id
      end

    GroupMember
      .active_without_invites
      .where(source_id: source_ids)
  end

  def members_with_descendants
    GroupMember
      .active_without_invites
      .where(source_id: self_and_descendants.reorder(nil).select(:id))
240
241
242
  end

  def users_with_parents
243
244
245
    User
      .where(id: members_with_parents.select(:user_id))
      .reorder(nil)
246
  end
Z.J. van de Weg's avatar
Z.J. van de Weg committed
247

248
  def users_with_descendants
249
250
251
    User
      .where(id: members_with_descendants.select(:user_id))
      .reorder(nil)
252
253
  end

254
255
256
  def max_member_access_for_user(user)
    return GroupMember::OWNER if user.admin?

257
258
259
260
    members_with_parents
      .where(user_id: user)
      .reorder(access_level: :desc)
      .first&.
261
262
263
      access_level || GroupMember::NO_ACCESS
  end

Z.J. van de Weg's avatar
Z.J. van de Weg committed
264
265
266
267
268
269
270
271
272
  def mattermost_team_params
    max_length = 59

    {
      name: path[0..max_length],
      display_name: name[0..max_length],
      type: public? ? 'O' : 'I' # Open vs Invite-only
    }
  end
273

Shinya Maeda's avatar
Shinya Maeda committed
274
  def secret_variables_for(ref, project)
275
276
277
278
279
    list_of_ids = [self] + ancestors
    variables = Ci::GroupVariable.where(group: list_of_ids)
    variables = variables.unprotected unless project.protected_for?(ref)
    variables = variables.group_by(&:group_id)
    list_of_ids.reverse.map { |group| variables[group.id] }.compact.flatten
Shinya Maeda's avatar
Shinya Maeda committed
280
281
  end

282
283
284
285
286
287
288
289
  def group_member(user)
    if group_members.loaded?
      group_members.find { |gm| gm.user_id == user.id }
    else
      group_members.find_by(user_id: user)
    end
  end

Jarka Kadlecova's avatar
Jarka Kadlecova committed
290
291
292
293
  def hashed_storage?(_feature)
    false
  end

294
  private
295
296
297
298
299
300

  def update_two_factor_requirement
    return unless require_two_factor_authentication_changed? || two_factor_grace_period_changed?

    users.find_each(&:update_two_factor_requirement)
  end
301

302
303
304
305
  def path_changed_hook
    system_hook_service.execute_hooks_for(self, :rename)
  end

306
307
308
  def visibility_level_allowed_by_parent
    return if visibility_level_allowed_by_parent?

309
    errors.add(:visibility_level, "#{visibility} is not allowed since the parent group has a #{parent.visibility} visibility.")
310
311
312
313
314
  end

  def visibility_level_allowed_by_projects
    return if visibility_level_allowed_by_projects?

315
    errors.add(:visibility_level, "#{visibility} is not allowed since this group contains projects with higher visibility.")
316
317
318
319
320
  end

  def visibility_level_allowed_by_sub_groups
    return if visibility_level_allowed_by_sub_groups?

321
    errors.add(:visibility_level, "#{visibility} is not allowed since there are sub-groups with higher visibility.")
322
  end
323
end