Refactor common protected ref check

3 files changed, 102 insertions, 16 deletions

diff --git a/app/policies/ci/pipeline_policy.rb b/app/policies/ci/pipeline_policy.rb
index 4e689a9efd5..6363c382ff8 100644
--- a/app/policies/ci/pipeline_policy.rb
+++ b/app/policies/ci/pipeline_policy.rb
@@ -2,16 +2,18 @@ module Ci
   class PipelinePolicy < BasePolicy
     delegate { @subject.project }
 
-    condition(:protected_ref) do
-      access = ::Gitlab::UserAccess.new(@user, project: @subject.project)
+    condition(:protected_ref) { ref_protected?(@user, @subject.project, @subject.tag?, @subject.ref) }
 
-      if @subject.tag?
-        !access.can_create_tag?(@subject.ref)
+    rule { protected_ref }.prevent :update_pipeline
+
+    def ref_protected?(user, project, tag, ref)
+      access = ::Gitlab::UserAccess.new(user, project: project)
+
+      if tag
+        !access.can_create_tag?(ref)
       else
-        !access.can_update_branch?(@subject.ref)
+        !access.can_update_branch?(ref)
       end
     end
-
-    rule { protected_ref }.prevent :update_pipeline
   end
 end
diff --git a/app/policies/ci/pipeline_schedule_policy.rb b/app/policies/ci/pipeline_schedule_policy.rb
index c0a2bb963e9..abcf536b2f7 100644
--- a/app/policies/ci/pipeline_schedule_policy.rb
+++ b/app/policies/ci/pipeline_schedule_policy.rb
@@ -3,15 +3,7 @@ module Ci
     alias_method :pipeline_schedule, :subject
 
     condition(:protected_ref) do
-      access = ::Gitlab::UserAccess.new(@user, project: @subject.project)
-
-      if @subject.project.repository.branch_exists?(@subject.ref)
-        !access.can_update_branch?(@subject.ref)
-      elsif @subject.project.repository.tag_exists?(@subject.ref)
-        !access.can_create_tag?(@subject.ref)
-      else
-        false
-      end
+      ref_protected?(@user, @subject.project, @subject.project.repository.tag_exists?(@subject.ref), @subject.ref)
     end
 
     condition(:owner_of_schedule) do
diff --git a/spec/policies/ci/pipeline_schedule_policy_spec.rb b/spec/policies/ci/pipeline_schedule_policy_spec.rb
new file mode 100644
index 00000000000..1b0e9fac355
--- /dev/null
+++ b/spec/policies/ci/pipeline_schedule_policy_spec.rb
@@ -0,0 +1,92 @@
+require 'spec_helper'
+
+describe Ci::PipelineSchedulePolicy, :models do
+  set(:user) { create(:user) }
+  set(:project) { create(:project, :repository) }
+  set(:pipeline_schedule) { create(:ci_pipeline_schedule, :nightly, project: project) }
+
+  let(:policy) do
+    described_class.new(user, pipeline_schedule)
+  end
+
+  describe 'rules' do
+    describe 'rules for protected ref' do
+      before do
+        project.add_developer(user)
+      end
+
+      context 'when no one can push or merge to the branch' do
+        before do
+          create(:protected_branch, :no_one_can_push,
+                 name: pipeline_schedule.ref, project: project)
+        end
+
+        it 'does not include ability to play pipeline schedule' do
+          expect(policy).to be_disallowed :play_pipeline_schedule
+        end
+      end
+
+      context 'when developers can push to the branch' do
+        before do
+          create(:protected_branch, :developers_can_merge,
+                 name: pipeline_schedule.ref, project: project)
+        end
+
+        it 'includes ability to update pipeline' do
+          expect(policy).to be_allowed :play_pipeline_schedule
+        end
+      end
+
+      context 'when no one can create the tag' do
+        let(:tag) { 'v1.0.0' }
+
+        before do
+          pipeline_schedule.update(ref: tag)
+
+          create(:protected_tag, :no_one_can_create,
+                 name: pipeline_schedule.ref, project: project)
+        end
+
+        it 'does not include ability to play pipeline schedule' do
+          expect(policy).to be_disallowed :play_pipeline_schedule
+        end
+      end
+
+      context 'when no one can create the tag but it is not a tag' do
+        before do
+          create(:protected_tag, :no_one_can_create,
+                 name: pipeline_schedule.ref, project: project)
+        end
+
+        it 'includes ability to play pipeline schedule' do
+          expect(policy).to be_allowed :play_pipeline_schedule
+        end
+      end
+    end
+
+    describe 'rules for owner of schedule' do
+      before do
+        project.add_developer(user)
+        pipeline_schedule.update(owner: user)
+      end
+
+      it 'includes abilities to do do all operations on pipeline schedule' do
+        expect(policy).to be_allowed :play_pipeline_schedule
+        expect(policy).to be_allowed :update_pipeline_schedule
+        expect(policy).to be_allowed :admin_pipeline_schedule
+      end
+    end
+
+    describe 'rules for a master' do
+      before do
+        project.add_master(user)
+      end
+
+      it 'includes abilities to do do all operations on pipeline schedule' do
+        expect(policy).to be_allowed :play_pipeline_schedule
+        expect(policy).to be_allowed :update_pipeline_schedule
+        expect(policy).to be_allowed :admin_pipeline_schedule
+      end
+    end
+  end
+end