diff options
| -rw-r--r-- | app/models/project.rb | 12 | ||||
| -rw-r--r-- | spec/models/project_security_spec.rb | 93 |
2 files changed, 94 insertions, 11 deletions
diff --git a/app/models/project.rb b/app/models/project.rb index 74d981f26d6..372b94d2066 100644 --- a/app/models/project.rb +++ b/app/models/project.rb @@ -36,6 +36,10 @@ class Project < ActiveRecord::Base # Relations belongs_to :group, foreign_key: "namespace_id", conditions: "type = 'Group'" belongs_to :namespace + + # TODO: replace owner with creator. + # With namespaces a project owner will be a namespace owner + # so this field makes sense only for global projects belongs_to :owner, class_name: "User" has_many :users, through: :users_projects has_many :events, dependent: :destroy @@ -296,4 +300,12 @@ class Project < ActiveRecord::Base def namespace_owner namespace.try(:owner) end + + def chief + if namespace + namespace_owner + else + owner + end + end end diff --git a/spec/models/project_security_spec.rb b/spec/models/project_security_spec.rb index 60f8d45c9c8..92c6bce08f6 100644 --- a/spec/models/project_security_spec.rb +++ b/spec/models/project_security_spec.rb @@ -4,38 +4,109 @@ describe Project do describe :authorization do before do @p1 = create(:project) + @u1 = create(:user) @u2 = create(:user) + @u3 = create(:user) + @u4 = @p1.chief + @abilities = Six.new @abilities << Ability end - describe "read access" do + let(:guest_actions) { Ability.project_guest_rules } + let(:report_actions) { Ability.project_report_rules } + let(:dev_actions) { Ability.project_dev_rules } + let(:master_actions) { Ability.project_master_rules } + let(:admin_actions) { Ability.project_admin_rules } + + describe "Non member rules" do + it "should deny for non-project users any actions" do + admin_actions.each do |action| + @abilities.allowed?(@u1, action, @p1).should be_false + end + end + end + + describe "Guest Rules" do + before do + @p1.users_projects.create(project: @p1, user: @u2, project_access: UsersProject::GUEST) + end + + it "should allow for project user any guest actions" do + guest_actions.each do |action| + @abilities.allowed?(@u2, action, @p1).should be_true + end + end + end + + describe "Report Rules" do before do @p1.users_projects.create(project: @p1, user: @u2, project_access: UsersProject::REPORTER) end - it { @abilities.allowed?(@u1, :read_project, @p1).should be_false } - it { @abilities.allowed?(@u2, :read_project, @p1).should be_true } + it "should allow for project user any report actions" do + report_actions.each do |action| + @abilities.allowed?(@u2, action, @p1).should be_true + end + end end - describe "write access" do + describe "Developer Rules" do + before do + @p1.users_projects.create(project: @p1, user: @u2, project_access: UsersProject::REPORTER) + @p1.users_projects.create(project: @p1, user: @u3, project_access: UsersProject::DEVELOPER) + end + + it "should deny for developer master-specific actions" do + [dev_actions - report_actions].each do |action| + @abilities.allowed?(@u2, action, @p1).should be_false + end + end + + it "should allow for project user any dev actions" do + dev_actions.each do |action| + @abilities.allowed?(@u3, action, @p1).should be_true + end + end + end + + describe "Master Rules" do before do @p1.users_projects.create(project: @p1, user: @u2, project_access: UsersProject::DEVELOPER) + @p1.users_projects.create(project: @p1, user: @u3, project_access: UsersProject::MASTER) end - it { @abilities.allowed?(@u1, :write_project, @p1).should be_false } - it { @abilities.allowed?(@u2, :write_project, @p1).should be_true } + it "should deny for developer master-specific actions" do + [master_actions - dev_actions].each do |action| + @abilities.allowed?(@u2, action, @p1).should be_false + end + end + + it "should allow for project user any master actions" do + master_actions.each do |action| + @abilities.allowed?(@u3, action, @p1).should be_true + end + end end - describe "admin access" do + describe "Admin Rules" do before do - @p1.users_projects.create(project: @p1, user: @u1, project_access: UsersProject::DEVELOPER) - @p1.users_projects.create(project: @p1, user: @u2, project_access: UsersProject::MASTER) + @p1.users_projects.create(project: @p1, user: @u2, project_access: UsersProject::DEVELOPER) + @p1.users_projects.create(project: @p1, user: @u3, project_access: UsersProject::MASTER) end - it { @abilities.allowed?(@u1, :admin_project, @p1).should be_false } - it { @abilities.allowed?(@u2, :admin_project, @p1).should be_true } + it "should deny for masters admin-specific actions" do + [admin_actions - master_actions].each do |action| + @abilities.allowed?(@u2, action, @p1).should be_false + end + end + + it "should allow for project owner any admin actions" do + admin_actions.each do |action| + @abilities.allowed?(@u4, action, @p1).should be_true + end + end end end end |