diff options
author | Bob Van Landuyt <bob@vanlanduyt.co> | 2018-02-27 14:18:32 +0100 |
---|---|---|
committer | Bob Van Landuyt <bob@vanlanduyt.co> | 2018-03-07 15:12:31 +0100 |
commit | c9557ad711c6cdf4465fb8c3c9b0dbaffcafa0e8 (patch) | |
tree | 0b54dcec837e4101588813df8c10e1232e13bc32 | |
parent | b2ef83856de8c175d384688d09023d16dcfef0c6 (diff) | |
download | gitlab-ce-c9557ad711c6cdf4465fb8c3c9b0dbaffcafa0e8.tar.gz |
Allow maintainers to push to a single branch
-rw-r--r-- | lib/gitlab/user_access.rb | 6 | ||||
-rw-r--r-- | spec/lib/gitlab/user_access_spec.rb | 35 |
2 files changed, 40 insertions, 1 deletions
diff --git a/lib/gitlab/user_access.rb b/lib/gitlab/user_access.rb index 91b8bb2a83f..fa32776d9f8 100644 --- a/lib/gitlab/user_access.rb +++ b/lib/gitlab/user_access.rb @@ -68,8 +68,12 @@ module Gitlab return true if project.user_can_push_to_empty_repo?(user) protected_branch_accessible_to?(ref, action: :push) + elsif user.can?(:push_code, project) + true + elsif user.can?(:push_single_branch, project) + project.branches_allowing_maintainer_access_to_user(user).include?(ref) else - user.can?(:push_code, project) + false end end diff --git a/spec/lib/gitlab/user_access_spec.rb b/spec/lib/gitlab/user_access_spec.rb index 7280acb6c82..40c8286b1b9 100644 --- a/spec/lib/gitlab/user_access_spec.rb +++ b/spec/lib/gitlab/user_access_spec.rb @@ -1,6 +1,8 @@ require 'spec_helper' describe Gitlab::UserAccess do + include ProjectForksHelper + let(:access) { described_class.new(user, project: project) } let(:project) { create(:project, :repository) } let(:user) { create(:user) } @@ -118,6 +120,39 @@ describe Gitlab::UserAccess do end end + describe 'allowing pushes to maintainers of forked projects' do + let(:canonical_project) { create(:project, :public, :repository) } + let(:project) { fork_project(canonical_project, create(:user), repository: true) } + + before do + create( + :merge_request, + target_project: canonical_project, + source_project: project, + source_branch: 'awesome-feature', + allow_maintainer_to_push: true + ) + end + + it 'allows users that have push access to the canonical project to push to the MR branch' do + canonical_project.add_developer(user) + + expect(access.can_push_to_branch?('awesome-feature')).to be_truthy + end + + it 'does not allow the user to push to other branches' do + canonical_project.add_developer(user) + + expect(access.can_push_to_branch?('master')).to be_falsey + end + + it 'does not allow the user to push if he does not have push access to the canonical project' do + canonical_project.add_guest(user) + + expect(access.can_push_to_branch?('awesome-feature')).to be_falsey + end + end + describe 'merge to protected branch if allowed for developers' do before do @branch = create :protected_branch, :developers_can_merge, project: project |