Fix broken user_allowed check in Git Annex push

Closes #816

CHANGELOG-EE

@@ -3,7 +3,8 @@ Please view this file on the master branch, on stable branches it's out of date.
 v 8.11.0 (unreleased)
 
 v 8.10.2 (unreleased)
-  - Dicouple an ES index update from RepositoryUpdateMirrorWorker
+  - Decouple an ES index update from RepositoryUpdateMirrorWorker
+  - Fix broken user_allowed check in Git Annex push
   - Fix pagination on search result page when ES search is enabled
 
 v 8.10.1

lib/gitlab/git_access.rb

@@ -253,7 +253,7 @@ module Gitlab
     end
 
     def git_annex_access_check(project, changes)
-      unless user && user_allowed?
+      unless user && user_access.allowed?
         return build_status_object(false, "You don't have access")
       end
 
@@ -265,7 +265,7 @@ module Gitlab
         return build_status_object(false, "You can't use git-annex with a secondary GitLab Geo node.")
       end
 
-      if user.can?(:push_code, project)
+      if user.can?(:push_code, project) && git_annex_branch_sync?(changes)
         build_status_object(true)
       else
         build_status_object(false, "You don't have permission")

spec/lib/gitlab/git_access_spec.rb

@@ -363,12 +363,14 @@ describe Gitlab::GitAccess, lib: true do
           describe 'git annex enabled' do
             before { allow(Gitlab.config.gitlab_shell).to receive(:git_annex_enabled).and_return(true) }
 
+            it { expect(access.check('git-annex-shell', []).allowed?).to be_truthy }
             it { expect(access.push_access_check(git_annex_changes)).to be_allowed }
           end
 
           describe 'git annex disabled' do
             before { allow(Gitlab.config.gitlab_shell).to receive(:git_annex_enabled).and_return(false) }
 
+            it { expect(access.check('git-annex-shell', []).allowed?).to be_falsey }
             it { expect(access.push_access_check(git_annex_changes)).not_to be_allowed }
           end
         end