CE Port of Protected Environments backend

app/policies/project_policy.rb

@@ -251,6 +251,7 @@ class ProjectPolicy < BasePolicy
     enable :update_pages
     enable :read_cluster
     enable :create_cluster
+    enable :create_environment_terminal
   end
 
   rule { (mirror_available & can?(:admin_project)) | admin }.enable :admin_remote_mirror

app/serializers/environment_entity.rb

@@ -23,8 +23,7 @@ class EnvironmentEntity < Grape::Entity
     stop_project_environment_path(environment.project, environment)
   end
 
-  expose :terminal_path, if: ->(environment, _) { environment.has_terminals? } do |environment|
-    can?(request.current_user, :admin_environment, environment.project) &&
+  expose :terminal_path, if: ->(*) { environment.has_terminals? && can_access_terminal? } do |environment|
     terminal_project_environment_path(environment.project, environment)
   end
 
@@ -40,7 +39,13 @@ class EnvironmentEntity < Grape::Entity
 
   private
 
+  alias_method :environment, :object
+
   def current_user
     request.current_user
   end
+
+  def can_access_terminal?
+    can?(request.current_user, :create_environment_terminal, environment)
+  end
 end

app/services/ci/enqueue_build_service.rb

+# frozen_string_literal: true
+module Ci
+  class EnqueueBuildService < BaseService
+    def execute(build)
+      build.enqueue
+    end
+  end
+end

app/services/ci/process_pipeline_service.rb

@@ -37,7 +37,7 @@ module Ci
 
     def process_build(build, current_status)
       if valid_statuses_for_when(build.when).include?(current_status)
-        build.action? ? build.actionize : build.enqueue
+        build.action? ? build.actionize : enqueue_build(build)
         true
       else
         build.skip
@@ -93,5 +93,9 @@ module Ci
         .where.not(id: latest_statuses.map(&:first))
         .update_all(retried: true) if latest_statuses.any?
     end
+
+    def enqueue_build(build)
+      Ci::EnqueueBuildService.new(project, @user).execute(build)
+    end
   end
 end

changelogs/unreleased/2747-protected-environments-backend-ce.yml

+---
+title: CE Port of Protected Environments backend
+merge_request: 20859
+author:
+type: other

lib/gitlab/import_export/relation_factory.rb

@@ -47,7 +47,7 @@ module Gitlab
       end
 
       def initialize(relation_sym:, relation_hash:, members_mapper:, user:, project:, excluded_keys: [])
-        @relation_name = OVERRIDES[relation_sym] || relation_sym
+        @relation_name = self.class.overrides[relation_sym] || relation_sym
         @relation_hash = relation_hash.except('noteable_id')
         @members_mapper = members_mapper
         @user = user
@@ -76,6 +76,10 @@ module Gitlab
         generate_imported_object
       end
 
+      def self.overrides
+        OVERRIDES
+      end
+
       private
 
       def setup_models

spec/services/ci/enqueue_build_service_spec.rb

+# frozen_string_literal: true
+require 'spec_helper'
+
+describe Ci::EnqueueBuildService, '#execute' do
+  let(:user) { create(:user) }
+  let(:project) { create(:project) }
+  let(:ci_build) { create(:ci_build, :created) }
+
+  subject { described_class.new(project, user).execute(ci_build) }
+
+  it 'enqueues the build' do
+    subject
+
+    expect(ci_build.pending?).to be_truthy
+  end
+end

spec/support/import_export/configuration_helper.rb

@@ -9,7 +9,7 @@ module ConfigurationHelper
   end
 
   def relation_class_for_name(relation_name)
-    relation_name = Gitlab::ImportExport::RelationFactory::OVERRIDES[relation_name.to_sym] || relation_name
+    relation_name = Gitlab::ImportExport::RelationFactory.overrides[relation_name.to_sym] || relation_name
     Gitlab::ImportExport::RelationFactory.relation_class(relation_name)
   end