Use own abilities for namespace class

1 files changed, 15 insertions, 1 deletions

diff --git a/app/models/ability.rb b/app/models/ability.rb
index 7e8d14ab10d..0b77564adc6 100644
--- a/app/models/ability.rb
+++ b/app/models/ability.rb
@@ -10,7 +10,8 @@ class Ability
       when "ProjectSnippet" then project_snippet_abilities(user, subject)
       when "PersonalSnippet" then personal_snippet_abilities(user, subject)
       when "MergeRequest" then merge_request_abilities(user, subject)
-      when "Group", "Namespace" then group_abilities(user, subject)
+      when "Group" then group_abilities(user, subject)
+      when "Namespace" then namespace_abilities(user, subject)
       else []
       end.concat(global_abilities(user))
     end
@@ -144,6 +145,19 @@ class Ability
       rules.flatten
     end
 
+    def namespace_abilities user, namespace
+      rules = []
+
+      # Only namespace owner and administrators can manage it
+      if namespace.owner == user || user.admin?
+        rules << [
+          :manage_namespace
+        ]
+      end
+
+      rules.flatten
+    end
+
     [:issue, :note, :project_snippet, :personal_snippet, :merge_request].each do |name|
       define_method "#{name}_abilities" do |user, subject|
         if subject.author == user