Commit f5ac701e authored by Douglas Barbosa Alexandre's avatar Douglas Barbosa Alexandre

Merge branch '228617-prevent-mr-policies' into 'master'

Prevent certain policies at MR level when namespace is read only

See merge request gitlab-org/gitlab!36713
parents 586f09e4 c16dbbf0
...@@ -10,10 +10,20 @@ module EE ...@@ -10,10 +10,20 @@ module EE
@subject.target_project&.can_override_approvers? @subject.target_project&.can_override_approvers?
end end
condition(:over_storage_limit, scope: :subject) { @subject.target_project&.namespace&.over_storage_limit? }
rule { ~can_override_approvers }.prevent :update_approvers rule { ~can_override_approvers }.prevent :update_approvers
rule { can?(:update_merge_request) }.policy do rule { can?(:update_merge_request) }.policy do
enable :update_approvers enable :update_approvers
end end
rule { over_storage_limit }.policy do
prevent :approve_merge_request
prevent :update_merge_request
prevent :reopen_merge_request
prevent :create_note
prevent :resolve_note
end
end end
end end
end end
---
title: Prevent certain policies at Merge Request level when namespace exceeds storage limit
merge_request: 36713
author:
type: added
...@@ -134,4 +134,34 @@ RSpec.describe MergeRequestPolicy do ...@@ -134,4 +134,34 @@ RSpec.describe MergeRequestPolicy do
end end
end end
end end
context 'when checking for namespace whether exceeding storage limit' do
context 'when namespace does exceeds storage limit' do
before do
allow(merge_request.target_project.namespace).to receive(:over_storage_limit?).and_return(true)
end
it 'does not allow few policies for all users including maintainer' do
expect(policy_for(maintainer)).to be_disallowed(:approve_merge_request,
:update_merge_request,
:reopen_merge_request,
:create_note,
:resolve_note)
end
end
context 'when namespace does not exceeds storage limit' do
before do
allow(merge_request.target_project.namespace).to receive(:over_storage_limit?).and_return(false)
end
it 'does not lock basic policies for any user' do
expect(policy_for(maintainer)).to be_allowed(:approve_merge_request,
:update_merge_request,
:reopen_merge_request,
:create_note,
:resolve_note)
end
end
end
end end
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment