Commit 824b53e4 authored by Steve Abrams's avatar Steve Abrams Committed by Kerri Miller

Update deploy token package permissions

Include read_package in deploy token permissions
to allow mvn deploy to work with a write_package_registry
deploy token.
parent e9ab64ae
......@@ -194,6 +194,7 @@ class GroupPolicy < BasePolicy
rule { write_package_registry_deploy_token }.policy do
enable :create_package
enable :read_package
enable :read_group
end
......
......@@ -568,6 +568,7 @@ class ProjectPolicy < BasePolicy
rule { write_package_registry_deploy_token }.policy do
enable :create_package
enable :read_package
enable :read_project
end
......
---
title: Fix deploy token permissions for write_package_registry
merge_request: 47675
author:
type: fixed
......@@ -876,6 +876,7 @@ RSpec.describe GroupPolicy do
let(:deploy_token) { create(:deploy_token, :group, write_package_registry: true) }
it { is_expected.to be_allowed(:create_package) }
it { is_expected.to be_allowed(:read_package) }
it { is_expected.to be_allowed(:read_group) }
it { is_expected.to be_disallowed(:destroy_package) }
end
......
......@@ -697,6 +697,7 @@ RSpec.describe ProjectPolicy do
let(:deploy_token) { create(:deploy_token, write_package_registry: true) }
it { is_expected.to be_allowed(:create_package) }
it { is_expected.to be_allowed(:read_package) }
it { is_expected.to be_allowed(:read_project) }
it { is_expected.to be_disallowed(:destroy_package) }
end
......
......@@ -92,15 +92,30 @@ RSpec.describe API::MavenPackages do
end
shared_examples 'downloads with a deploy token' do
it 'allows download with deploy token' do
download_file(
package_file.file_name,
{},
Gitlab::Auth::AuthFinders::DEPLOY_TOKEN_HEADER => deploy_token.token
)
context 'successful download' do
subject do
download_file(
package_file.file_name,
{},
Gitlab::Auth::AuthFinders::DEPLOY_TOKEN_HEADER => deploy_token.token
)
end
expect(response).to have_gitlab_http_status(:ok)
expect(response.media_type).to eq('application/octet-stream')
it 'allows download with deploy token' do
subject
expect(response).to have_gitlab_http_status(:ok)
expect(response.media_type).to eq('application/octet-stream')
end
it 'allows download with deploy token with only write_package_registry scope' do
deploy_token.update!(read_package_registry: false)
subject
expect(response).to have_gitlab_http_status(:ok)
expect(response.media_type).to eq('application/octet-stream')
end
end
end
......@@ -355,6 +370,15 @@ RSpec.describe API::MavenPackages do
expect(response).to have_gitlab_http_status(:ok)
expect(response.media_type).to eq('application/octet-stream')
end
it 'returns the file with only write_package_registry scope' do
deploy_token_for_group.update!(read_package_registry: false)
subject
expect(response).to have_gitlab_http_status(:ok)
expect(response.media_type).to eq('application/octet-stream')
end
end
end
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment