Read about our upcoming Code of Conduct on this issue

user_access.rb 2.74 KB
Newer Older
1
module Gitlab
2
  class UserAccess
3
    extend Gitlab::Cache::RequestCache
4

5
    request_cache_key do
6
7
8
      [user&.id, project&.id]
    end

9
10
11
12
13
14
15
16
    attr_reader :user, :project

    def initialize(user, project: nil)
      @user = user
      @project = project
    end

    def can_do_action?(action)
17
      return false unless can_access_git?
18

19
20
21
22
      permission_cache[action] =
        permission_cache.fetch(action) do
          user.can?(action, project)
        end
23
24
25
26
27
28
29
    end

    def cannot_do_action?(action)
      !can_do_action?(action)
    end

    def allowed?
30
      return false unless can_access_git?
31

Jacob Vosmaer's avatar
Jacob Vosmaer committed
32
33
      if user.requires_ldap_check? && user.try_obtain_ldap_lease
        return false unless Gitlab::LDAP::Access.allowed?(user)
34
35
36
37
      end

      true
    end
38

39
    request_cache def can_create_tag?(ref)
40
41
      return false unless can_access_git?

42
43
      if protected?(ProtectedTag, project, ref)
        protected_tag_accessible_to?(ref, action: :create)
44
45
46
47
48
      else
        user.can?(:push_code, project)
      end
    end

49
    request_cache def can_delete_branch?(ref)
50
51
      return false unless can_access_git?

52
      if protected?(ProtectedBranch, project, ref)
53
54
55
56
57
58
        user.can?(:delete_protected_branch, project)
      else
        user.can?(:push_code, project)
      end
    end

59
    def can_update_branch?(ref)
60
61
62
      can_push_to_branch?(ref) || can_merge_to_branch?(ref)
    end

63
    request_cache def can_push_to_branch?(ref)
64
      return false unless can_access_git?
65

66
      if protected?(ProtectedBranch, project, ref)
67
68
        return true if project.empty_repo? && project.user_can_push_to_empty_repo?(user)

69
        protected_branch_accessible_to?(ref, action: :push)
70
71
72
73
74
      else
        user.can?(:push_code, project)
      end
    end

75
    request_cache def can_merge_to_branch?(ref)
76
      return false unless can_access_git?
77

78
79
      if protected?(ProtectedBranch, project, ref)
        protected_branch_accessible_to?(ref, action: :merge)
80
81
82
83
84
85
      else
        user.can?(:push_code, project)
      end
    end

    def can_read_project?
86
      return false unless can_access_git?
87
88
89

      user.can?(:read_project, project)
    end
90
91
92

    private

93
94
95
96
    def permission_cache
      @permission_cache ||= {}
    end

97
98
    def can_access_git?
      user && user.can?(:access_git)
99
    end
100
101
102

    def protected_branch_accessible_to?(ref, action:)
      ProtectedBranch.protected_ref_accessible_to?(
103
104
        ref, user,
        action: action,
105
106
107
108
109
        protected_refs: project.protected_branches)
    end

    def protected_tag_accessible_to?(ref, action:)
      ProtectedTag.protected_ref_accessible_to?(
110
111
        ref, user,
        action: action,
112
113
114
115
116
117
        protected_refs: project.protected_tags)
    end

    request_cache def protected?(kind, project, ref)
      kind.protected?(project, ref)
    end
118
119
  end
end