summaryrefslogtreecommitdiff
path: root/app/helpers/visibility_level_helper.rb
blob: 304b58d232a65eebf25b60c2fb7c0522f7c3f651 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
# frozen_string_literal: true

module VisibilityLevelHelper
  def visibility_level_color(level)
    case level
    when Gitlab::VisibilityLevel::PRIVATE
      'vs-private'
    when Gitlab::VisibilityLevel::INTERNAL
      'vs-internal'
    when Gitlab::VisibilityLevel::PUBLIC
      'vs-public'
    end
  end

  # Return the description for the +level+ argument.
  #
  # +level+       One of the Gitlab::VisibilityLevel constants
  # +form_model+  Either a model object (Project, Snippet, etc.) or the name of
  #               a Project or Snippet class.
  def visibility_level_description(level, form_model)
    case form_model
    when Project
      project_visibility_level_description(level)
    when Group
      group_visibility_level_description(level)
    when Snippet
      snippet_visibility_level_description(level, form_model)
    end
  end

  def project_visibility_level_description(level)
    case level
    when Gitlab::VisibilityLevel::PRIVATE
      _("Project access must be granted explicitly to each user. If this project is part of a group, access will be granted to members of the group.")
    when Gitlab::VisibilityLevel::INTERNAL
      _("The project can be accessed by any logged in user.")
    when Gitlab::VisibilityLevel::PUBLIC
      _("The project can be accessed without any authentication.")
    end
  end

  def group_visibility_level_description(level)
    case level
    when Gitlab::VisibilityLevel::PRIVATE
      _("The group and its projects can only be viewed by members.")
    when Gitlab::VisibilityLevel::INTERNAL
      _("The group and any internal projects can be viewed by any logged in user.")
    when Gitlab::VisibilityLevel::PUBLIC
      _("The group and any public projects can be viewed without any authentication.")
    end
  end

  def snippet_visibility_level_description(level, snippet = nil)
    case level
    when Gitlab::VisibilityLevel::PRIVATE
      if snippet.is_a? ProjectSnippet
        _("The snippet is visible only to project members.")
      else
        _("The snippet is visible only to me.")
      end
    when Gitlab::VisibilityLevel::INTERNAL
      _("The snippet is visible to any logged in user.")
    when Gitlab::VisibilityLevel::PUBLIC
      _("The snippet can be accessed without any authentication.")
    end
  end

  # Note: these messages closely mirror the form validation strings found in the project
  # model and any changes or additons to these may also need to be made there.
  def disallowed_project_visibility_level_description(level, project)
    level_name = Gitlab::VisibilityLevel.level_name(level).downcase
    reasons = []
    instructions = []

    unless project.visibility_level_allowed_as_fork?(level)
      reasons << "the fork source project has lower visibility"
    end

    unless project.visibility_level_allowed_by_group?(level)
      errors = visibility_level_errors_for_group(project.group, level_name)

      reasons << errors[:reason]
      instructions << errors[:instruction]
    end

    reasons = reasons.any? ? ' because ' + reasons.to_sentence : ''
    "This project cannot be #{level_name}#{reasons}.#{instructions.join}".html_safe
  end

  # Note: these messages closely mirror the form validation strings found in the group
  # model and any changes or additons to these may also need to be made there.
  def disallowed_group_visibility_level_description(level, group)
    level_name = Gitlab::VisibilityLevel.level_name(level).downcase
    reasons = []
    instructions = []

    unless group.visibility_level_allowed_by_projects?(level)
      reasons << "it contains projects with higher visibility"
    end

    unless group.visibility_level_allowed_by_sub_groups?(level)
      reasons << "it contains sub-groups with higher visibility"
    end

    unless group.visibility_level_allowed_by_parent?(level)
      errors = visibility_level_errors_for_group(group.parent, level_name)

      reasons << errors[:reason]
      instructions << errors[:instruction]
    end

    reasons = reasons.any? ? ' because ' + reasons.to_sentence : ''
    "This group cannot be #{level_name}#{reasons}.#{instructions.join}".html_safe
  end

  def visibility_icon_description(form_model)
    if form_model.respond_to?(:visibility_level_allowed_as_fork?)
      project_visibility_icon_description(form_model.visibility_level)
    elsif form_model.respond_to?(:visibility_level_allowed_by_sub_groups?)
      group_visibility_icon_description(form_model.visibility_level)
    end
  end

  def group_visibility_icon_description(level)
    "#{visibility_level_label(level)} - #{group_visibility_level_description(level)}"
  end

  def project_visibility_icon_description(level)
    "#{visibility_level_label(level)} - #{project_visibility_level_description(level)}"
  end

  def visibility_level_label(level)
    # The visibility level can be:
    # 'VisibilityLevel|Private', 'VisibilityLevel|Internal', 'VisibilityLevel|Public'
    s_(Project.visibility_levels.key(level))
  end

  def restricted_visibility_levels(show_all = false)
    return [] if current_user.admin? && !show_all

    Gitlab::CurrentSettings.restricted_visibility_levels || []
  end

  delegate  :default_project_visibility,
            :default_group_visibility,
            to: :'Gitlab::CurrentSettings.current_application_settings'

  def disallowed_visibility_level?(form_model, level)
    return false unless form_model.respond_to?(:visibility_level_allowed?)

    !form_model.visibility_level_allowed?(level)
  end

  # Visibility level can be restricted in two ways:
  #
  # 1. The group permissions (e.g. a subgroup is private, which requires
  # all projects to be private)
  # 2. The global allowed visibility settings, set by the admin
  def selected_visibility_level(form_model, requested_level)
    requested_level =
      if requested_level.present?
        requested_level.to_i
      else
        default_project_visibility
      end

    [requested_level, max_allowed_visibility_level(form_model)].min
  end

  def available_visibility_levels(form_model)
    Gitlab::VisibilityLevel.values.reject do |level|
      disallowed_visibility_level?(form_model, level) ||
      restricted_visibility_levels.include?(level)
    end
  end

  def snippets_selected_visibility_level(visibility_levels, selected)
    visibility_levels.find { |level| level == selected } || visibility_levels.min
  end

  def multiple_visibility_levels_restricted?
    restricted_visibility_levels.many? # rubocop: disable CodeReuse/ActiveRecord
  end

  def all_visibility_levels_restricted?
    Gitlab::VisibilityLevel.values == restricted_visibility_levels
  end

  private

  def max_allowed_visibility_level(form_model)
    # First obtain the maximum visibility for the project or group
    current_level = max_allowed_visibility_level_by_model(form_model)

    # Now limit this by the global setting
    Gitlab::VisibilityLevel.closest_allowed_level(current_level)
  end

  def max_allowed_visibility_level_by_model(form_model)
    current_level = Gitlab::VisibilityLevel::PRIVATE

    Gitlab::VisibilityLevel.values.sort.each do |value|
      if disallowed_visibility_level?(form_model, value)
        break
      else
        current_level = value
      end
    end

    current_level
  end

  def visibility_level_errors_for_group(group, level_name)
    group_name = link_to group.name, group_path(group)
    change_visibility = link_to 'change the visibility', edit_group_path(group)

    { reason: "the visibility of #{group_name} is #{group.visibility}",
      instruction: " To make this group #{level_name}, you must first #{change_visibility} of the parent group." }
  end
end