project_snippet_policy.rb 1.82 KB
Newer Older
1 2
# frozen_string_literal: true

3
class ProjectSnippetPolicy < BasePolicy
4 5 6 7
  delegate :project

  desc "Snippet is public"
  condition(:public_snippet, scope: :subject) { @subject.public? }
8
  condition(:internal_snippet, scope: :subject) { @subject.internal? }
9 10 11 12 13 14
  condition(:private_snippet, scope: :subject) { @subject.private? }
  condition(:public_project, scope: :subject) { @subject.project.public? }

  condition(:is_author) { @user && @subject.author == @user }

  # We have to check both project feature visibility and a snippet visibility and take the stricter one
15
  # This will be simplified - check https://gitlab.com/gitlab-org/gitlab-foss/issues/27573
16
  rule { ~can?(:read_project) }.policy do
17 18 19
    prevent :read_snippet
    prevent :update_snippet
    prevent :admin_snippet
20 21
  end

22 23 24 25 26
  # we have to use this complicated prevent because the delegated project
  # policy is overly greedy in allowing :read_snippet, since it doesn't have
  # any information about the snippet. However, :read_snippet on the *project*
  # is used to hide/show various snippet-related controls, so we can't just
  # move all of the handling here.
27
  rule do
28
    all?(private_snippet | (internal_snippet & external_user),
29
         ~project.guest,
30
         ~is_author,
31
         ~can?(:read_all_resources))
32
  end.prevent :read_snippet
33

34
  rule { internal_snippet & ~is_author & ~admin & ~project.maintainer }.policy do
35 36
    prevent :update_snippet
    prevent :admin_snippet
37 38
  end

39
  rule { public_snippet }.enable :read_snippet
40

41
  rule { is_author & ~project.reporter & ~admin }.policy do
42
    prevent :admin_snippet
43 44
  end

45
  rule { is_author | admin | project.maintainer }.policy do
46 47 48
    enable :read_snippet
    enable :update_snippet
    enable :admin_snippet
49
  end
50

51
  rule { ~can?(:read_snippet) }.prevent :create_note
52
end
53 54

ProjectSnippetPolicy.prepend_if_ee('EE::ProjectSnippetPolicy')