Merge branch '300291-fj-forbid-to-group-wikis-when-read-only' into 'master'

Forbid git pushes to group wikis when repo is read only

See merge request gitlab-org/gitlab!52801

ee/changelogs/unreleased/300291-fj-forbid-to-group-wikis-when-read-only.yml

+---
+title: Forbid git pushes to group wikis when repo is read only
+merge_request: 52801
+author:
+type: added

ee/lib/ee/gitlab/git_access_wiki.rb

@@ -9,7 +9,8 @@ module EE
       ERROR_MESSAGES = {
         write_to_group_wiki: "You are not allowed to write to this group's wiki.",
         group_not_found: 'The group you were looking for could not be found.',
-        no_group_repo: 'A repository for this group wiki does not exist yet.'
+        no_group_repo: 'A repository for this group wiki does not exist yet.',
+        repo_read_only: 'The repository is temporarily read-only. Please try again later.'
       }.freeze
 
       override :group
@@ -26,9 +27,13 @@ module EE
 
       override :check_push_access!
       def check_push_access!
-        return check_change_access! if group?
+        return super unless group?
 
-        super
+        if group.repository_read_only?
+          raise ::Gitlab::GitAccess::ForbiddenError, ERROR_MESSAGES[:repo_read_only]
+        end
+
+        check_change_access!
       end
 
       override :write_to_wiki_message

ee/spec/lib/gitlab/git_access_wiki_spec.rb

@@ -42,7 +42,16 @@ RSpec.describe Gitlab::GitAccessWiki do
           end
 
           it 'does not give access to upload wiki code' do
-            expect { subject }.to raise_error(Gitlab::GitAccess::ForbiddenError, "You can't push code to a read-only GitLab instance.")
+            expect { subject }.to raise_forbidden("You can't push code to a read-only GitLab instance.")
+          end
+        end
+
+        context 'when group is read-only' do
+          it 'does not allow push and allows pull access' do
+            allow(group).to receive(:repository_read_only?).and_return(true)
+
+            expect { push_changes(changes) }.to raise_forbidden('The repository is temporarily read-only. Please try again later.')
+            expect { pull_changes(changes) }.not_to raise_error
           end
         end
       end