project_feature.rb 3.18 KB
Newer Older
1
2
# frozen_string_literal: true

Felipe Artur's avatar
Felipe Artur committed
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
class ProjectFeature < ActiveRecord::Base
  # == Project features permissions
  #
  # Grants access level to project tools
  #
  # Tools can be enabled only for users, everyone or disabled
  # Access control is made only for non private projects
  #
  # levels:
  #
  # Disabled: not enabled for anyone
  # Private:  enabled only for team members
  # Enabled:  enabled for everyone able to access the project
  #

18
  # Permission levels
Felipe Artur's avatar
Felipe Artur committed
19
20
21
22
  DISABLED = 0
  PRIVATE  = 10
  ENABLED  = 20

Douwe Maan's avatar
Douwe Maan committed
23
  FEATURES = %i(issues merge_requests wiki snippets builds repository).freeze
Felipe Artur's avatar
Felipe Artur committed
24

25
26
27
28
29
30
31
  class << self
    def access_level_attribute(feature)
      feature = feature.model_name.plural.to_sym if feature.respond_to?(:model_name)
      raise ArgumentError, "invalid project feature: #{feature}" unless FEATURES.include?(feature)

      "#{feature}_access_level".to_sym
    end
32
33
34
35
36
37
38

    def quoted_access_level_column(feature)
      attribute = connection.quote_column_name(access_level_attribute(feature))
      table = connection.quote_table_name(table_name)

      "#{table}.#{attribute}"
    end
39
40
  end

41
42
43
44
  # Default scopes force us to unscope here since a service may need to check
  # permissions for a project in pending_delete
  # http://stackoverflow.com/questions/1540645/how-to-disable-default-scope-for-a-belongs-to
  belongs_to :project, -> { unscope(where: :pending_delete) }
Felipe Artur's avatar
Felipe Artur committed
45

46
47
  validates :project, presence: true

48
49
  validate :repository_children_level

50
51
52
53
54
  default_value_for :builds_access_level,         value: ENABLED, allows_nil: false
  default_value_for :issues_access_level,         value: ENABLED, allows_nil: false
  default_value_for :merge_requests_access_level, value: ENABLED, allows_nil: false
  default_value_for :snippets_access_level,       value: ENABLED, allows_nil: false
  default_value_for :wiki_access_level,           value: ENABLED, allows_nil: false
55
  default_value_for :repository_access_level,     value: ENABLED, allows_nil: false
56

Felipe Artur's avatar
Felipe Artur committed
57
  def feature_available?(feature, user)
58
59
60
61
    get_permission(user, access_level(feature))
  end

  def access_level(feature)
62
    public_send(ProjectFeature.access_level_attribute(feature)) # rubocop:disable GitlabSecurity/PublicSend
Felipe Artur's avatar
Felipe Artur committed
63
64
65
66
67
68
69
70
71
72
73
74
75
76
  end

  def builds_enabled?
    builds_access_level > DISABLED
  end

  def wiki_enabled?
    wiki_access_level > DISABLED
  end

  def merge_requests_enabled?
    merge_requests_access_level > DISABLED
  end

77
78
79
80
  def issues_enabled?
    issues_access_level > DISABLED
  end

Felipe Artur's avatar
Felipe Artur committed
81
82
  private

83
84
85
86
  # Validates builds and merge requests access level
  # which cannot be higher than repository access level
  def repository_children_level
    validator = lambda do |field|
87
      level = public_send(field) || ProjectFeature::ENABLED # rubocop:disable GitlabSecurity/PublicSend
88
89
90
91
92
93
94
      not_allowed = level > repository_access_level
      self.errors.add(field, "cannot have higher visibility level than repository access level") if not_allowed
    end

    %i(merge_requests_access_level builds_access_level).each(&validator)
  end

Felipe Artur's avatar
Felipe Artur committed
95
96
97
98
99
  def get_permission(user, level)
    case level
    when DISABLED
      false
    when PRIVATE
100
      user && (project.team.member?(user) || user.full_private_access?)
Felipe Artur's avatar
Felipe Artur committed
101
102
103
104
105
106
107
    when ENABLED
      true
    else
      true
    end
  end
end