app/services/clusters/update_service.rb


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63

# frozen_string_literal: true

module Clusters
  class UpdateService
    attr_reader :current_user, :params

    def initialize(user = nil, params = {})
      @current_user, @params = user, params.dup
    end

    def execute(cluster)
      if validate_params(cluster)
        cluster.update(params)
      else
        false
      end
    end

    private

    def can_admin_pipeline_for_project?(project)
      Ability.allowed?(current_user, :admin_pipeline, project)
    end

    def validate_params(cluster)
      if params[:management_project_id].present?
        management_project = management_project_scope(cluster).find_by_id(params[:management_project_id])

        unless management_project
          cluster.errors.add(:management_project_id, _('Project does not exist or you don\'t have permission to perform this action'))

          return false
        end

        unless can_admin_pipeline_for_project?(management_project)
          # Use same message as not found to prevent enumeration
          cluster.errors.add(:management_project_id, _('Project does not exist or you don\'t have permission to perform this action'))

          return false
        end
      end

      true
    end

    def management_project_scope(cluster)
      return ::Project.all if cluster.instance_type?

      group =
        if cluster.group_type?
          cluster.first_group
        elsif cluster.project_type?
          cluster.first_project&.namespace
        end

      # Prevent users from selecting nested projects until
      # https://gitlab.com/gitlab-org/gitlab/issues/34650 is resolved
      include_subgroups = cluster.group_type?

      ::GroupProjectsFinder.new(group: group, current_user: current_user, options: { only_owned: true, include_subgroups: include_subgroups }).execute
    end
  end
end