Download as
Browse Code »

Commit 1c62ec09b0fe8d51e9b375714c560eded1b35d51

Authored by Dmitriy Zaporozhets
1 parent dac7c44a
Exists in master and in 4 other branches 6-8-stable, 7-0-stable, 7-0-stable-spb, spb-stable

4 roles permission system

Showing 18 changed files with 66 additions and 111 deletions   Show diff stats
app/controllers/projects_controller.rb
  Diff comments   View file @1c62ec0
... ... @@ -28,7 +28,7 @@ class ProjectsController < ApplicationController
28 28  
29 29 Project.transaction do
30 30 @project.save!
31   - @project.users_projects.create!(:repo_access => Repository::REPO_RW , :project_access => Project::PROJECT_RWA, :user => current_user)
  31 + @project.users_projects.create!(:project_access => UsersProject::MASTER, :user => current_user)
32 32  
33 33 # when project saved no team member exist so
34 34 # project repository should be updated after first user add
... ...
app/models/project.rb
  Diff comments   View file @1c62ec0
1 1 require "grit"
2 2  
3 3 class Project < ActiveRecord::Base
4   - PROJECT_N = 0
5   - PROJECT_R = 1
6   - PROJECT_RW = 2
7   - PROJECT_RWA = 3
8   -
9 4 belongs_to :owner, :class_name => "User"
10 5  
11 6 has_many :merge_requests, :dependent => :destroy
... ... @@ -61,12 +56,7 @@ class Project &lt; ActiveRecord::Base
61 56 end
62 57  
63 58 def self.access_options
64   - {
65   - "Denied" => PROJECT_N,
66   - "Read" => PROJECT_R,
67   - "Report" => PROJECT_RW,
68   - "Admin" => PROJECT_RWA
69   - }
  59 + UsersProject.access_roles
70 60 end
71 61  
72 62 def repository
... ... @@ -193,11 +183,11 @@ class Project &lt; ActiveRecord::Base
193 183 # Should be rewrited for new access rights
194 184 def add_access(user, *access)
195 185 access = if access.include?(:admin)
196   - { :project_access => PROJECT_RWA }
  186 + { :project_access => UsersProject::MASTER }
197 187 elsif access.include?(:write)
198   - { :project_access => PROJECT_RW }
  188 + { :project_access => UsersProject::DEVELOPER }
199 189 else
200   - { :project_access => PROJECT_R }
  190 + { :project_access => UsersProject::GUEST }
201 191 end
202 192 opts = { :user => user }
203 193 opts.merge!(access)
... ... @@ -210,48 +200,48 @@ class Project &lt; ActiveRecord::Base
210 200  
211 201 def repository_readers
212 202 keys = Key.joins({:user => :users_projects}).
213   - where("users_projects.project_id = ? AND users_projects.repo_access = ?", id, Repository::REPO_R)
  203 + where("users_projects.project_id = ? AND users_projects.project_access = ?", id, UsersProject::REPORTER)
214 204 keys.map(&:identifier) + deploy_keys.map(&:identifier)
215 205 end
216 206  
217 207 def repository_writers
218 208 keys = Key.joins({:user => :users_projects}).
219   - where("users_projects.project_id = ? AND users_projects.repo_access = ?", id, Repository::REPO_RW)
  209 + where("users_projects.project_id = ? AND users_projects.project_access = ?", id, UsersProject::DEVELOPER)
220 210 keys.map(&:identifier)
221 211 end
222 212  
223 213 def repository_masters
224 214 keys = Key.joins({:user => :users_projects}).
225   - where("users_projects.project_id = ? AND users_projects.repo_access = ?", id, Repository::REPO_MASTER)
  215 + where("users_projects.project_id = ? AND users_projects.project_access = ?", id, UsersProject::MASTER)
226 216 keys.map(&:identifier)
227 217 end
228 218  
229 219 def readers
230   - @readers ||= users_projects.includes(:user).where(:project_access => [PROJECT_R, PROJECT_RW, PROJECT_RWA]).map(&:user)
  220 + @readers ||= users_projects.includes(:user).map(&:user)
231 221 end
232 222  
233 223 def writers
234   - @writers ||= users_projects.includes(:user).where(:project_access => [PROJECT_RW, PROJECT_RWA]).map(&:user)
  224 + @writers ||= users_projects.includes(:user).map(&:user)
235 225 end
236 226  
237 227 def admins
238   - @admins ||= users_projects.includes(:user).where(:project_access => PROJECT_RWA).map(&:user)
  228 + @admins ||= users_projects.includes(:user).where(:project_access => UsersProject::MASTER).map(&:user)
239 229 end
240 230  
241 231 def allow_read_for?(user)
242   - !users_projects.where(:user_id => user.id, :project_access => [PROJECT_R, PROJECT_RW, PROJECT_RWA]).empty?
  232 + !users_projects.where(:user_id => user.id).empty?
243 233 end
244 234  
245 235 def allow_write_for?(user)
246   - !users_projects.where(:user_id => user.id, :project_access => [PROJECT_RW, PROJECT_RWA]).empty?
  236 + !users_projects.where(:user_id => user.id).empty?
247 237 end
248 238  
249 239 def allow_admin_for?(user)
250   - !users_projects.where(:user_id => user.id, :project_access => [PROJECT_RWA]).empty? || owner_id == user.id
  240 + !users_projects.where(:user_id => user.id, :project_access => [UsersProject::MASTER]).empty? || owner_id == user.id
251 241 end
252 242  
253 243 def allow_pull_for?(user)
254   - !users_projects.where(:user_id => user.id, :repo_access => [Repository::REPO_R, Repository::REPO_RW, Repository::REPO_MASTER]).empty?
  244 + !users_projects.where(:user_id => user.id, :project_access => [UsersProject::REPORTER, UsersProject::DEVELOPER, UsersProject::MASTER]).empty?
255 245 end
256 246  
257 247 def root_ref
... ...
app/models/repository.rb
  Diff comments   View file @1c62ec0
1 1 require File.join(Rails.root, "lib", "gitlabhq", "git_host")
2 2  
3 3 class Repository
4   - REPO_N = 0
5   - REPO_R = 1
6   - REPO_RW = 2
7   - REPO_MASTER = 3
8   -
9 4 attr_accessor :project
10 5  
11 6 def self.default_ref
... ... @@ -13,12 +8,7 @@ class Repository
13 8 end
14 9  
15 10 def self.access_options
16   - {
17   - "Denied" => REPO_N,
18   - "Pull" => REPO_R,
19   - "Pull & Push" => REPO_RW,
20   - "Master" => REPO_MASTER
21   - }
  11 + {}
22 12 end
23 13  
24 14 def initialize(project)
... ...
app/models/users_project.rb
  Diff comments   View file @1c62ec0
1 1 class UsersProject < ActiveRecord::Base
2   - REPORTER = 21
3   - DEVELOPER = 22
4   - MASTER = 33
  2 + GUEST = 10
  3 + REPORTER = 20
  4 + DEVELOPER = 30
  5 + MASTER = 40
5 6  
6 7 belongs_to :user
7 8 belongs_to :project
... ... @@ -21,7 +22,6 @@ class UsersProject &lt; ActiveRecord::Base
21 22 UsersProject.transaction do
22 23 user_ids.each do |user_id|
23 24 users_project = UsersProject.new(
24   - :repo_access => repo_access,
25 25 :project_access => project_access,
26 26 :user_id => user_id
27 27 )
... ... @@ -35,7 +35,6 @@ class UsersProject &lt; ActiveRecord::Base
35 35 UsersProject.transaction do
36 36 project_ids.each do |project_id|
37 37 users_project = UsersProject.new(
38   - :repo_access => repo_access,
39 38 :project_access => project_access,
40 39 )
41 40 users_project.project_id = project_id
... ... @@ -47,6 +46,7 @@ class UsersProject &lt; ActiveRecord::Base
47 46  
48 47 def self.access_roles
49 48 {
  49 + "Guest" => GUEST,
50 50 "Reporter" => REPORTER,
51 51 "Developer" => DEVELOPER,
52 52 "Master" => MASTER
... ... @@ -54,7 +54,7 @@ class UsersProject &lt; ActiveRecord::Base
54 54 end
55 55  
56 56 def role_access
57   - "#{project_access}#{repo_access}"
  57 + project_access
58 58 end
59 59  
60 60 def update_repository
... ... @@ -68,7 +68,7 @@ class UsersProject &lt; ActiveRecord::Base
68 68 end
69 69  
70 70 def repo_access_human
71   - Repository.access_options.key(self.repo_access)
  71 + ""
72 72 end
73 73 end
74 74 # == Schema Information
... ...
app/views/admin/projects/show.html.haml
  Diff comments   View file @1c62ec0
... ... @@ -53,7 +53,6 @@
53 53 %td
54 54 = link_to tm.user_name, admin_users_path(tm.user)
55 55 %td= select_tag :tm_project_access, options_for_select(Project.access_options, tm.project_access), :class => "medium project-access-select", :disabled => :disabled
56   - %td= select_tag :tm_repo_access, options_for_select(Repository.access_options, tm.repo_access), :class => "medium repo-access-select", :disabled => :disabled
57 56 %td= link_to 'Edit Access', edit_admin_team_member_path(tm), :class => "btn small"
58 57 %td= link_to 'Remove from team', admin_team_member_path(tm), :confirm => 'Are you sure?', :method => :delete, :class => "btn danger small"
59 58  
... ... @@ -68,7 +67,6 @@
68 67 %tr
69 68 %td= select_tag :user_ids, options_from_collection_for_select(@users , :id, :name), :multiple => true
70 69 %td= select_tag :project_access, options_for_select(Project.access_options), :class => "project-access-select"
71   - %td= select_tag :repo_access, options_for_select(Repository.access_options), :class => "repo-access-select"
72 70  
73 71 .actions
74 72 = submit_tag 'Add', :class => "btn primary"
... ...
app/views/admin/team_members/_form.html.haml
  Diff comments   View file @1c62ec0
... ... @@ -10,10 +10,6 @@
10 10 .input
11 11 = f.select :project_access, options_for_select(Project.access_options, @admin_team_member.project_access), {}, :class => "project-access-select"
12 12  
13   - .clearfix
14   - %label Repository Access:
15   - .input
16   - = f.select :repo_access, options_for_select(Repository.access_options, @admin_team_member.repo_access), {}, :class => "repo-access-select"
17 13 %br
18 14 .actions
19 15 = f.submit 'Save', :class => "btn primary"
... ...
app/views/admin/users/show.html.haml
  Diff comments   View file @1c62ec0
... ... @@ -61,7 +61,6 @@
61 61 %tr
62 62 %td= link_to project.name, admin_project_path(project)
63 63 %td= select_tag :tm_project_access, options_for_select(Project.access_options, tm.project_access), :class => "medium project-access-select", :disabled => :disabled
64   - %td= select_tag :tm_repo_access, options_for_select(Repository.access_options, tm.repo_access), :class => "medium repo-access-select", :disabled => :disabled
65 64 %td= link_to 'Edit Access', edit_admin_team_member_path(tm), :class => "btn small"
66 65 %td= link_to 'Remove from team', admin_team_member_path(tm), :confirm => 'Are you sure?', :method => :delete, :class => "btn small danger"
67 66  
... ... @@ -76,7 +75,6 @@
76 75 %tr
77 76 %td= select_tag :project_ids, options_from_collection_for_select(@projects , :id, :name), :multiple => true
78 77 %td= select_tag :project_access, options_for_select(Project.access_options), :class => "project-access-select"
79   - %td= select_tag :repo_access, options_for_select(Repository.access_options), :class => "repo-access-select"
80 78  
81 79 .actions
82 80 = submit_tag 'Add', :class => "btn primary"
... ...
app/views/help/permissions.html.haml
  Diff comments   View file @1c62ec0
... ... @@ -3,6 +3,12 @@
3 3  
4 4 %h4 Reporter
5 5 %ul
  6 + %li Create new issue
  7 + %li Create new merge request
  8 + %li Write on project wall
  9 +
  10 +%h4 Reporter
  11 +%ul
6 12 %li Pull project code
7 13 %li Create new issue
8 14 %li Create new merge request
... ...
app/views/team_members/_form.html.haml
  Diff comments   View file @1c62ec0
... ... @@ -14,18 +14,9 @@
14 14  
15 15 .clearfix
16 16 = f.label :project_access, "Project Access"
17   - .input= f.select :_project_access, options_for_select(UsersProject.access_roles, @team_member.role_access), {}, :class => "project-access-select"
18   -
  17 + .input= f.select :project_access, options_for_select(Project.access_options, @team_member.project_access), {}, :class => "project-access-select"
19 18  
20 19  
21   - -#.clearfix
22   - -#= f.label :project_access, "Project Access"
23   - -#.input= f.select :project_access, options_for_select(Project.access_options, @team_member.project_access), {}, :class => "project-access-select"
24   -
25   - -#.clearfix
26   - -#= f.label :repo_access, "Repository Access"
27   - -#.input= f.select :repo_access, options_for_select(Repository.access_options, @team_member.repo_access), {}, :class => "repo-access-select"
28   -
29 20 .actions
30 21 = f.submit 'Save', :class => "btn primary"
31 22 = link_to "Cancel", team_project_path(@project), :class => "btn"
... ... @@ -37,6 +28,6 @@
37 28  
38 29 :javascript
39 30 $('select#team_member_user_id').chosen();
40   - $('select#team_member__project_access').chosen();
  31 + $('select#team_member_project_access').chosen();
41 32 //$('select#team_member_repo_access').chosen();
42 33 //$('select#team_member_project_access').chosen();
... ...
app/views/team_members/_show.html.haml
  Diff comments   View file @1c62ec0
... ... @@ -11,9 +11,6 @@
11 11  
12 12 .span3
13 13 = form_for(member, :as => :team_member, :url => project_team_member_path(@project, member)) do |f|
14   - = f.select :_project_access, options_for_select(UsersProject.access_roles, member.role_access), {}, :class => "medium project-access-select", :disabled => !allow_admin
15   - -#.span3
16   - -#= form_for(member, :as => :team_member, :url => project_team_member_path(@project, member)) do |f|
17   - -#= f.select :repo_access, options_for_select(Repository.access_options, member.repo_access), {}, :class => "medium repo-access-select", :disabled => !allow_admin
  14 + = f.select :project_access, options_for_select(UsersProject.access_roles, member.project_access), {}, :class => "medium project-access-select", :disabled => !allow_admin
18 15 - if @project.owner == user
19 16 %span.label Project Owner
... ...
app/views/team_members/show.html.haml
  Diff comments   View file @1c62ec0
... ... @@ -28,13 +28,6 @@
28 28 = form_for(@team_member, :as => :team_member, :url => project_team_member_path(@project, @team_member)) do |f|
29 29 = f.select :project_access, options_for_select(Project.access_options, @team_member.project_access), {}, :class => "project-access-select", :disabled => !allow_admin
30 30  
31   - %tr
32   - %td Repository Access
33   - %td
34   - = form_for(@team_member, :as => :team_member, :url => project_team_member_path(@project, @team_member)) do |f|
35   - = f.select :repo_access, options_for_select(Repository.access_options, @team_member.repo_access), {}, :class => "repo-access-select", :disabled => !allow_admin
36   -
37   -
38 31 - unless user.skype.empty?
39 32 %tr
40 33 %td Skype:
... ...
app/views/widgets/_project_member.html.haml
  Diff comments   View file @1c62ec0
... ... @@ -13,7 +13,6 @@
13 13  
14 14 .span3
15 15 %span.label= member.project_access_human
16   - %span.label= member.repo_access_human
17 16  
18 17 - if can? current_user, :write_project, @project
19 18 - if @project.issues_enabled && @project.merge_requests_enabled
... ...
db/migrate/20120216085842_move_to_roles_permissions.rb 0 → 100644
  Diff comments   View file @1c62ec0
... ... @@ -0,0 +1,18 @@
  1 +class MoveToRolesPermissions < ActiveRecord::Migration
  2 + def up
  3 + repo_n = 0
  4 + repo_r = 1
  5 + repo_rw = 2
  6 + project_rwa = 3
  7 +
  8 + UsersProject.update_all ["project_access = ?", UsersProject::MASTER], ["project_access = ?", project_rwa]
  9 + UsersProject.update_all ["project_access = ?", UsersProject::DEVELOPER], ["repo_access = ?", repo_rw]
  10 + UsersProject.update_all ["project_access = ?", UsersProject::REPORTER], ["repo_access = ?", repo_r]
  11 + UsersProject.update_all ["project_access = ?", UsersProject::GUEST], ["repo_access = ?", repo_n]
  12 +
  13 + remove_column :users_projects, :repo_access
  14 + end
  15 +
  16 + def down
  17 + end
  18 +end
... ...
db/schema.rb
  Diff comments   View file @1c62ec0
... ... @@ -11,19 +11,7 @@
11 11 #
12 12 # It's strongly recommended to check this file into your version control system.
13 13  
14   -ActiveRecord::Schema.define(:version => 20120215182305) do
15   -
16   - create_table "features", :force => true do |t|
17   - t.string "name"
18   - t.string "branch_name"
19   - t.integer "assignee_id"
20   - t.integer "author_id"
21   - t.integer "project_id"
22   - t.datetime "created_at"
23   - t.datetime "updated_at"
24   - t.string "version"
25   - t.integer "status", :default => 0, :null => false
26   - end
  14 +ActiveRecord::Schema.define(:version => 20120216085842) do
27 15  
28 16 create_table "issues", :force => true do |t|
29 17 t.string "title"
... ... @@ -160,7 +148,6 @@ ActiveRecord::Schema.define(:version =&gt; 20120215182305) do
160 148 t.integer "project_id", :null => false
161 149 t.datetime "created_at"
162 150 t.datetime "updated_at"
163   - t.integer "repo_access", :default => 0, :null => false
164 151 t.integer "project_access", :default => 0, :null => false
165 152 end
166 153  
... ...
spec/models/note_spec.rb
  Diff comments   View file @1c62ec0
... ... @@ -64,9 +64,8 @@ describe Note do
64 64  
65 65 describe :read do
66 66 before do
67   - @p1.users_projects.create(:user => @u1, :project_access => Project::PROJECT_N)
68   - @p1.users_projects.create(:user => @u2, :project_access => Project::PROJECT_R)
69   - @p2.users_projects.create(:user => @u3, :project_access => Project::PROJECT_R)
  67 + @p1.users_projects.create(:user => @u2, :project_access => UsersProject::GUEST)
  68 + @p2.users_projects.create(:user => @u3, :project_access => UsersProject::GUEST)
70 69 end
71 70  
72 71 it { @abilities.allowed?(@u1, :read_note, @p1).should be_false }
... ... @@ -76,9 +75,8 @@ describe Note do
76 75  
77 76 describe :write do
78 77 before do
79   - @p1.users_projects.create(:user => @u1, :project_access => Project::PROJECT_R)
80   - @p1.users_projects.create(:user => @u2, :project_access => Project::PROJECT_RW)
81   - @p2.users_projects.create(:user => @u3, :project_access => Project::PROJECT_RW)
  78 + @p1.users_projects.create(:user => @u2, :project_access => UsersProject::DEVELOPER)
  79 + @p2.users_projects.create(:user => @u3, :project_access => UsersProject::DEVELOPER)
82 80 end
83 81  
84 82 it { @abilities.allowed?(@u1, :write_note, @p1).should be_false }
... ... @@ -88,9 +86,9 @@ describe Note do
88 86  
89 87 describe :admin do
90 88 before do
91   - @p1.users_projects.create(:user => @u1, :project_access => Project::PROJECT_R)
92   - @p1.users_projects.create(:user => @u2, :project_access => Project::PROJECT_RWA)
93   - @p2.users_projects.create(:user => @u3, :project_access => Project::PROJECT_RWA)
  89 + @p1.users_projects.create(:user => @u1, :project_access => UsersProject::REPORTER)
  90 + @p1.users_projects.create(:user => @u2, :project_access => UsersProject::MASTER)
  91 + @p2.users_projects.create(:user => @u3, :project_access => UsersProject::MASTER)
94 92 end
95 93  
96 94 it { @abilities.allowed?(@u1, :admin_note, @p1).should be_false }
... ...
spec/models/project_security_spec.rb
  Diff comments   View file @1c62ec0
... ... @@ -12,8 +12,7 @@ describe Project do
12 12  
13 13 describe "read access" do
14 14 before do
15   - @p1.users_projects.create(:project => @p1, :user => @u1, :project_access => Project::PROJECT_N)
16   - @p1.users_projects.create(:project => @p1, :user => @u2, :project_access => Project::PROJECT_R)
  15 + @p1.users_projects.create(:project => @p1, :user => @u2, :project_access => UsersProject::REPORTER)
17 16 end
18 17  
19 18 it { @abilities.allowed?(@u1, :read_project, @p1).should be_false }
... ... @@ -22,8 +21,7 @@ describe Project do
22 21  
23 22 describe "write access" do
24 23 before do
25   - @p1.users_projects.create(:project => @p1, :user => @u1, :project_access => Project::PROJECT_R)
26   - @p1.users_projects.create(:project => @p1, :user => @u2, :project_access => Project::PROJECT_RW)
  24 + @p1.users_projects.create(:project => @p1, :user => @u2, :project_access => UsersProject::DEVELOPER)
27 25 end
28 26  
29 27 it { @abilities.allowed?(@u1, :write_project, @p1).should be_false }
... ... @@ -32,8 +30,8 @@ describe Project do
32 30  
33 31 describe "admin access" do
34 32 before do
35   - @p1.users_projects.create(:project => @p1, :user => @u1, :project_access => Project::PROJECT_RW)
36   - @p1.users_projects.create(:project => @p1, :user => @u2, :project_access => Project::PROJECT_RWA)
  33 + @p1.users_projects.create(:project => @p1, :user => @u1, :project_access => UsersProject::DEVELOPER)
  34 + @p1.users_projects.create(:project => @p1, :user => @u2, :project_access => UsersProject::MASTER)
37 35 end
38 36  
39 37 it { @abilities.allowed?(@u1, :admin_project, @p1).should be_false }
... ...
spec/requests/projects_security_spec.rb
  Diff comments   View file @1c62ec0
... ... @@ -20,11 +20,9 @@ describe &quot;Projects&quot; do
20 20 @u2 = Factory :user
21 21 @u3 = Factory :user
22 22 # full access
23   - @project.users_projects.create(:user => @u1, :project_access => Project::PROJECT_RWA)
24   - # no access
25   - @project.users_projects.create(:user => @u2, :project_access => Project::PROJECT_N)
  23 + @project.users_projects.create(:user => @u1, :project_access => UsersProject::MASTER)
26 24 # readonly
27   - @project.users_projects.create(:user => @u3, :project_access => Project::PROJECT_R)
  25 + @project.users_projects.create(:user => @u3, :project_access => UsersProject::REPORTER)
28 26 end
29 27  
30 28 describe "GET /project_code" do
... ...
spec/requests/team_members_spec.rb
  Diff comments   View file @1c62ec0
... ... @@ -31,8 +31,7 @@ describe &quot;TeamMembers&quot; do
31 31 before do
32 32 within "#new_team_member" do
33 33 select @user_1.name, :from => "team_member_user_id"
34   - select "Report", :from => "team_member_project_access"
35   - select "Pull", :from => "team_member_repo_access"
  34 + select "Reporter", :from => "team_member_project_access"
36 35 end
37 36 end
38 37  
... ... @@ -45,8 +44,7 @@ describe &quot;TeamMembers&quot; do
45 44 page.should have_content @user_1.name
46 45  
47 46 @member.reload
48   - @member.project_access.should == Project::PROJECT_RW
49   - @member.repo_access.should == Repository::REPO_R
  47 + @member.project_access.should == UsersProject::REPORTER
50 48 end
51 49 end
52 50 end
... ...