Commit b90f1098 authored by Toon Claes's avatar Toon Claes
Browse files

Add User#full_private_access? to check if user has Private access

In CE only the admin has access to all private groups & projects. In EE also an
auditor can have full private access.

To overcome merge conflicts, or accidental incorrect access rights, abstract
this out in `User#full_private_access?`.

`User#admin?` now only should be used for admin-only features. For private
access-related features `User#full_private_access?` should be used.

Backported from gitlab-org/gitlab-ee!2199
parent eaffeb8af270
......@@ -41,7 +41,7 @@ def by_assignee(items)
def self.not_restricted_by_confidentiality(user)
return Issue.where('issues.confidential IS NOT TRUE') if user.blank?
return Issue.all if user.admin?
return Issue.all if user.full_private_access?
Issue.where('
issues.confidential IS NOT TRUE
......
......@@ -90,7 +90,7 @@ def get_permission(user, level)
when DISABLED
false
when PRIVATE
user && (project.team.member?(user) || user.admin?)
user && (project.team.member?(user) || user.full_private_access?)
when ENABLED
true
else
......
......@@ -984,6 +984,12 @@ def access_level=(new_level)
self.admin = (new_level == 'admin')
end
# Does the user have access to all private groups & projects?
# Overridden in EE to also check auditor?
def full_private_access?
admin?
end
def update_two_factor_requirement
periods = expanded_groups_requiring_two_factor_authentication.pluck(:two_factor_grace_period)
......
---
title: Add User#full_private_access? to check if user has access to all private groups & projects
merge_request: 12373
author:
......@@ -28,7 +28,7 @@ class << self
def levels_for_user(user = nil)
return [PUBLIC] unless user
if user.admin?
if user.full_private_access?
[PRIVATE, INTERNAL, PUBLIC]
elsif user.external?
[PUBLIC]
......
......@@ -21,7 +21,7 @@
describe '.levels_for_user' do
it 'returns all levels for an admin' do
user = double(:user, admin?: true)
user = build(:user, :admin)
expect(described_class.levels_for_user(user))
.to eq([Gitlab::VisibilityLevel::PRIVATE,
......@@ -30,7 +30,7 @@
end
it 'returns INTERNAL and PUBLIC for internal users' do
user = double(:user, admin?: false, external?: false)
user = build(:user)
expect(described_class.levels_for_user(user))
.to eq([Gitlab::VisibilityLevel::INTERNAL,
......@@ -38,7 +38,7 @@
end
it 'returns PUBLIC for external users' do
user = double(:user, admin?: false, external?: true)
user = build(:user, :external)
expect(described_class.levels_for_user(user))
.to eq([Gitlab::VisibilityLevel::PUBLIC])
......
......@@ -1733,6 +1733,20 @@ def add_user(access)
end
end
describe '#full_private_access?' do
it 'returns false for regular user' do
user = build(:user)
expect(user.full_private_access?).to be_falsy
end
it 'returns true for admin user' do
user = build(:user, :admin)
expect(user.full_private_access?).to be_truthy
end
end
describe '.ghost' do
it "creates a ghost user if one isn't already present" do
ghost = User.ghost
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment