blob: 1c23b36748941782233673ec3dff1445993447ed (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
|
# frozen_string_literal: true
module Ci
class RunnerPolicy < BasePolicy
with_options scope: :subject, score: 0
condition(:locked, scope: :subject) { @subject.locked? }
condition(:owned_runner) do
@user.owns_runner?(@subject)
end
with_options scope: :subject, score: 0
condition(:is_instance_runner) do
@subject.instance_type?
end
with_options scope: :subject, score: 0
condition(:is_group_runner) do
@subject.group_type?
end
with_options scope: :user, score: 5
condition(:any_developer_maintainer_owned_groups_inheriting_shared_runners) do
@user.developer_maintainer_owned_groups.with_shared_runners_enabled.any?
end
with_options scope: :user, score: 5
condition(:any_developer_projects_inheriting_shared_runners) do
@user.authorized_projects(Gitlab::Access::DEVELOPER).with_shared_runners_enabled.any?
end
with_options score: 10
condition(:any_associated_projects_in_group_runner_inheriting_group_runners) do
# Check if any projects where user is a developer+ are inheriting group runners
@subject.groups&.any? do |group|
group.all_projects
.with_group_runners_enabled
.visible_to_user_and_access_level(@user, Gitlab::Access::DEVELOPER)
.exists?
end
end
condition(:belongs_to_multiple_projects, scope: :subject) do
@subject.belongs_to_more_than_one_project?
end
rule { anonymous }.prevent_all
rule { admin | owned_runner }.policy do
enable :read_builds
enable :read_runner
end
rule { is_instance_runner & any_developer_maintainer_owned_groups_inheriting_shared_runners }.policy do
enable :read_runner
end
rule { is_instance_runner & any_developer_projects_inheriting_shared_runners }.policy do
enable :read_runner
end
rule { is_group_runner & any_associated_projects_in_group_runner_inheriting_group_runners }.policy do
enable :read_runner
end
rule { admin | owned_runner }.policy do
enable :assign_runner
enable :update_runner
enable :delete_runner
end
rule { ~admin & belongs_to_multiple_projects }.prevent :delete_runner
rule { ~admin & locked }.prevent :assign_runner
end
end
Ci::RunnerPolicy.prepend_mod_with('Ci::RunnerPolicy')
|
