EE::ProtectedRefAccess used for Protected Tags

app/models/concerns/protected_branch_access.rb

@@ -3,7 +3,7 @@ module ProtectedBranchAccess
 
   included do
     include ProtectedRefAccess
-    include EE::ProtectedBranchAccess
+    include EE::ProtectedRefAccess
 
     belongs_to :protected_branch
 

app/models/concerns/protected_ref.rb

@@ -19,8 +19,8 @@ module ProtectedRef
 
         # Returns access levels that grant the specified access type to the given user / group.
         access_level_class = const_get("#{type}_access_level".camelize)
-        scope :"#{type}_access_by_user", -> (user) { access_level_class.joins(:protected_branch).where(protected_branch_id: self.ids).merge(access_level_class.by_user(user)) }
-        scope :"#{type}_access_by_group", -> (group) { access_level_class.joins(:protected_branch).where(protected_branch_id: self.ids).merge(access_level_class.by_group(group)) }
+        scope :"#{type}_access_by_user", -> (user) { access_level_class.joins(self.model_name.singular).where("#{self.model_name.singular}_id" => self.ids).merge(access_level_class.by_user(user)) }
+        scope :"#{type}_access_by_group", -> (group) { access_level_class.joins(self.model_name.singular).where("#{self.model_name.singular}_id" => self.ids).merge(access_level_class.by_group(group)) }
       end
     end
 

app/models/concerns/protected_tag_access.rb

@@ -3,6 +3,7 @@ module ProtectedTagAccess
 
   included do
     include ProtectedRefAccess
+    include EE::ProtectedRefAccess
 
     belongs_to :protected_tag
 

app/models/ee/protected_branch_access.rb → app/models/ee/protected_ref_access.rb

-# EE-specific code related to protected branch access levels.
+# EE-specific code related to protected branch/tag access levels.
 #
 # Note: Don't directly include this concern into a model class.
-# Instead, include `ProtectedBranchAccess`, which in turn includes
-# this concern. A number of methods here depend on `ProtectedBranchAccess`
-# being next up in the ancestor chain.
+# Instead, include `ProtectedBranchAccess` or `ProtectedTagAccess`, which in
+# turn include this concern. A number of methods here depend on
+# `ProtectedRefAccess` being next up in the ancestor chain.
 
 module EE
-  module ProtectedBranchAccess
+  module ProtectedRefAccess
     extend ActiveSupport::Concern
 
     included do
       belongs_to :user
       belongs_to :group
 
-      validates :group_id, uniqueness: { scope: :protected_branch, allow_nil: true }
-      validates :user_id, uniqueness: { scope: :protected_branch, allow_nil: true }
-      validates :access_level, uniqueness: { scope: :protected_branch, if: :role?,
+
+      protected_type = self.parent.model_name.singular
+      validates :group_id, uniqueness: { scope: protected_type, allow_nil: true }
+      validates :user_id, uniqueness: { scope: protected_type, allow_nil: true }
+      validates :access_level, uniqueness: { scope: protected_type, if: :role?,
                                              conditions: -> { where(user_id: nil, group_id: nil) } }
 
       scope :by_user, -> (user) { where(user: user ) }