Skip to content

GitLab

  • Menu
Projects Groups Snippets
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • heptapod heptapod
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 162
    • Issues 162
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 0
    • Merge requests 0
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Monitor
    • Monitor
    • Incidents
  • Packages & Registries
    • Packages & Registries
    • Container Registry
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • heptapod
  • heptapodheptapod
  • Merge requests
  • !97

Merged
Created Aug 24, 2020 by Georges Racinet@gracinet🦑Owner

Enforcing publishing permission from the Web application

  • Overview 1
  • Commits 6
  • Pipelines 2
  • Changes 7

This adds checks in the Web application to ensure that the current user has publishing permissions for actions done in the UI or with the API that create public changesets:

  • merging of Merge Requests
  • direct commit creations

This could be done with branch protection and is actually not so far from it, except that it's intended to really correspond to publication, which can be different (see the example of direct commits, which can be draft).

We should add on top of that a complete permission check in the Mercurial process, and we will, but not in the stable branch.

Assignee
Assign to
Reviewer
Request review from
Time tracking
Source branch: topic/heptapod-stable/mr-permissions