Add an option to have a private profile on GitLab

9 files changed, 80 insertions, 33 deletions

diff --git a/app/controllers/profiles_controller.rb b/app/controllers/profiles_controller.rb
index 074db361949..56a7b766b77 100644
--- a/app/controllers/profiles_controller.rb
+++ b/app/controllers/profiles_controller.rb
@@ -99,7 +99,8 @@ class ProfilesController < Profiles::ApplicationController
       :username,
       :website_url,
       :organization,
-      :preferred_language
+      :preferred_language,
+      :private_profile
     )
   end
 end
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 31f47a7aa7c..2f65f4a7403 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -13,6 +13,8 @@ class UsersController < ApplicationController
 
   skip_before_action :authenticate_user!
   before_action :user, except: [:exists]
+  before_action :authorize_read_user_profile!,
+                only: [:calendar, :calendar_activities, :groups, :projects, :contributed_projects, :snippets]
 
   def show
     respond_to do |format|
@@ -148,4 +150,8 @@ class UsersController < ApplicationController
   def build_canonical_path(user)
     url_for(safe_params.merge(username: user.to_param))
   end
+
+  def authorize_read_user_profile!
+    access_denied! unless can?(current_user, :read_user_profile, user)
+  end
 end
diff --git a/app/finders/personal_projects_finder.rb b/app/finders/personal_projects_finder.rb
index 18adfea747f..a56a3a1e1a9 100644
--- a/app/finders/personal_projects_finder.rb
+++ b/app/finders/personal_projects_finder.rb
@@ -1,4 +1,6 @@
 class PersonalProjectsFinder < UnionFinder
+  include Gitlab::Allowable
+
   def initialize(user, params = {})
     @user = user
     @params = params
@@ -14,6 +16,8 @@ class PersonalProjectsFinder < UnionFinder
   #
   # Returns an ActiveRecord::Relation.
   def execute(current_user = nil)
+    return Project.none unless can?(current_user, :read_user_profile, @user)
+
     segments = all_projects(current_user)
 
     find_union(segments, Project).includes(:namespace).order_updated_desc
diff --git a/app/finders/user_recent_events_finder.rb b/app/finders/user_recent_events_finder.rb
index 74776b2ed1f..876f086a3ef 100644
--- a/app/finders/user_recent_events_finder.rb
+++ b/app/finders/user_recent_events_finder.rb
@@ -7,6 +7,7 @@
 class UserRecentEventsFinder
   prepend FinderWithCrossProjectAccess
   include FinderMethods
+  include Gitlab::Allowable
 
   requires_cross_project_access
 
@@ -21,6 +22,8 @@ class UserRecentEventsFinder
   end
 
   def execute
+    return Event.none unless can?(current_user, :read_user_profile, target_user)
+
     recent_events(params[:offset] || 0)
       .joins(:project)
       .with_associations
diff --git a/app/helpers/users_helper.rb b/app/helpers/users_helper.rb
index 4d17b22a4a1..8ee4203b6f5 100644
--- a/app/helpers/users_helper.rb
+++ b/app/helpers/users_helper.rb
@@ -42,7 +42,13 @@ module UsersHelper
   private
 
   def get_profile_tabs
-    [:activity, :groups, :contributed, :projects, :snippets]
+    tabs = []
+
+    if can?(current_user, :read_user_profile, @user)
+      tabs += [:activity, :groups, :contributed, :projects, :snippets]
+    end
+
+    tabs
   end
 
   def get_current_user_menu_items
diff --git a/app/policies/user_policy.rb b/app/policies/user_policy.rb
index ee219f0a0d0..8499e45e846 100644
--- a/app/policies/user_policy.rb
+++ b/app/policies/user_policy.rb
@@ -5,6 +5,9 @@ class UserPolicy < BasePolicy
   desc "This is the ghost user"
   condition(:subject_ghost, scope: :subject, score: 0) { @subject.ghost? }
 
+  desc "The profile is private"
+  condition(:private_profile, scope: :subject, score: 0) { @subject.private_profile? }
+
   rule { ~restricted_public_level }.enable :read_user
   rule { ~anonymous }.enable :read_user
 
@@ -12,4 +15,7 @@ class UserPolicy < BasePolicy
     enable :destroy_user
     enable :update_user
   end
+
+  rule { default }.enable :read_user_profile
+  rule { private_profile & ~(user_is_self | admin) }.prevent :read_user_profile
 end
diff --git a/app/services/users/build_service.rb b/app/services/users/build_service.rb
index c69b46cab5a..acc2fa153ae 100644
--- a/app/services/users/build_service.rb
+++ b/app/services/users/build_service.rb
@@ -64,7 +64,8 @@ module Users
         :theme_id,
         :twitter,
         :username,
-        :website_url
+        :website_url,
+        :private_profile
       ]
     end
 
diff --git a/app/views/profiles/show.html.haml b/app/views/profiles/show.html.haml
index 507cd5dcc12..a4835584b50 100644
--- a/app/views/profiles/show.html.haml
+++ b/app/views/profiles/show.html.haml
@@ -69,6 +69,12 @@
         = f.text_field :location
       = f.text_field :organization
       = f.text_area :bio, rows: 4, maxlength: 250, help: 'Tell us about yourself in fewer than 250 characters.'
+      %hr
+      %h5 Private profile
+      - private_profile_label = capture do
+        Don't display activity-related personal information on your profile
+        = link_to icon('question-circle'), help_page_path('user/profile/index.md', anchor: 'private-profile')
+      = f.check_box :private_profile, label: private_profile_label
       .prepend-top-default.append-bottom-default
         = f.submit 'Update profile settings', class: 'btn btn-success'
         = link_to 'Cancel', user_path(current_user), class: 'btn btn-cancel'
diff --git a/app/views/users/show.html.haml b/app/views/users/show.html.haml
index b2ec7166832..8d9e86d02c4 100644
--- a/app/views/users/show.html.haml
+++ b/app/views/users/show.html.haml
@@ -23,8 +23,9 @@
           = link_to new_abuse_report_path(user_id: @user.id, ref_url: request.referrer), class: 'btn',
             title: 'Report abuse', data: { toggle: 'tooltip', placement: 'bottom', container: 'body' } do
             = icon('exclamation-circle')
-      = link_to user_path(@user, rss_url_options), class: 'btn btn-default has-tooltip', title: 'Subscribe', 'aria-label': 'Subscribe' do
-        = icon('rss')
+      - if can?(current_user, :read_user_profile, @user)
+        = link_to user_path(@user, rss_url_options), class: 'btn btn-default has-tooltip', title: 'Subscribe', 'aria-label': 'Subscribe' do
+          = icon('rss')
       - if current_user && current_user.admin?
         = link_to [:admin, @user], class: 'btn btn-default', title: 'View user in admin area',
           data: {toggle: 'tooltip', placement: 'bottom', container: 'body'} do
@@ -40,10 +41,12 @@
           = @user.name
 
         .cover-desc.member-date
-          %span.middle-dot-divider
-            @#{@user.username}
-          %span.middle-dot-divider
-            Member since #{@user.created_at.to_date.to_s(:long)}
+          %p
+            %span.middle-dot-divider
+              @#{@user.username}
+            - if can?(current_user, :read_user_profile, @user)
+              %span.middle-dot-divider
+                Member since #{@user.created_at.to_date.to_s(:long)}
 
         .cover-desc
           - unless @user.public_email.blank?
@@ -78,30 +81,31 @@
         %p.profile-user-bio
           = @user.bio
 
-    .scrolling-tabs-container
-      .fade-left= icon('angle-left')
-      .fade-right= icon('angle-right')
-      %ul.nav-links.user-profile-nav.scrolling-tabs.nav.nav-tabs
-        - if profile_tab?(:activity)
-          %li.js-activity-tab
-            = link_to user_path, data: { target: 'div#activity', action: 'activity', toggle: 'tab' } do
-              Activity
-        - if profile_tab?(:groups)
-          %li.js-groups-tab
-            = link_to user_groups_path, data: { target: 'div#groups', action: 'groups', toggle: 'tab', endpoint: user_groups_path(format: :json) } do
-              Groups
-        - if profile_tab?(:contributed)
-          %li.js-contributed-tab
-            = link_to user_contributed_projects_path, data: { target: 'div#contributed', action: 'contributed', toggle: 'tab', endpoint: user_contributed_projects_path(format: :json) } do
-              Contributed projects
-        - if profile_tab?(:projects)
-          %li.js-projects-tab
-            = link_to user_projects_path, data: { target: 'div#projects', action: 'projects', toggle: 'tab', endpoint: user_projects_path(format: :json) } do
-              Personal projects
-        - if profile_tab?(:snippets)
-          %li.js-snippets-tab
-            = link_to user_snippets_path, data: { target: 'div#snippets', action: 'snippets', toggle: 'tab', endpoint: user_snippets_path(format: :json) } do
-              Snippets
+    - unless profile_tabs.empty?
+      .scrolling-tabs-container
+        .fade-left= icon('angle-left')
+        .fade-right= icon('angle-right')
+        %ul.nav-links.user-profile-nav.scrolling-tabs.nav.nav-tabs
+          - if profile_tab?(:activity)
+            %li.js-activity-tab
+              = link_to user_path, data: { target: 'div#activity', action: 'activity', toggle: 'tab' } do
+                Activity
+          - if profile_tab?(:groups)
+            %li.js-groups-tab
+              = link_to user_groups_path, data: { target: 'div#groups', action: 'groups', toggle: 'tab', endpoint: user_groups_path(format: :json) } do
+                Groups
+          - if profile_tab?(:contributed)
+            %li.js-contributed-tab
+              = link_to user_contributed_projects_path, data: { target: 'div#contributed', action: 'contributed', toggle: 'tab', endpoint: user_contributed_projects_path(format: :json) } do
+                Contributed projects
+          - if profile_tab?(:projects)
+            %li.js-projects-tab
+              = link_to user_projects_path, data: { target: 'div#projects', action: 'projects', toggle: 'tab', endpoint: user_projects_path(format: :json) } do
+                Personal projects
+          - if profile_tab?(:snippets)
+            %li.js-snippets-tab
+              = link_to user_snippets_path, data: { target: 'div#snippets', action: 'snippets', toggle: 'tab', endpoint: user_snippets_path(format: :json) } do
+                Snippets
 
   %div{ class: container_class }
     .tab-content
@@ -137,3 +141,13 @@
 
     .loading-status
       = spinner
+
+  - if profile_tabs.empty?
+    .row
+      .col-12
+        .svg-content
+          = image_tag 'illustrations/profile_private_mode.svg'
+      .col-12.text-center
+        .text-content
+          %h4
+            This user has a private profile