ssh_access.rb revision 4551681c4cb82bac457cde91a4cce63e6c070a9b
70N/Aclass SshAccess
70N/A
286N/A class Error < ::StandardError; end
70N/A class InvalidAccessOnMirrorError < Error; end
70N/A
70N/A PERMISSIONS = %w{
70N/A read
70N/A write
70N/A }
70N/A
70N/A PERMISSION_MAP = {
70N/A everyone: {
70N/A 'public_r' => %w{read},
70N/A 'public_rw' => %w{read write},
70N/A 'private_r' => %w{},
70N/A 'private_rw' => %w{},
70N/A },
70N/A permission: {
70N/A all: {
70N/A 'public_r' => %w{},
70N/A 'public_rw' => %w{},
70N/A 'private_r' => %w{read},
70N/A 'private_rw' => %w{read write},
70N/A },
70N/A owner: %{read write},
70N/A editor: %{read write},
70N/A }
70N/A }
70N/A
70N/A class << self
418N/A
70N/A def determine_permission(requested_permission, permission, repository)
70N/A not_a_write_to_mirror_repository!(requested_permission, repository) &&
70N/A (allowed_for_everyone?(requested_permission, repository) ||
359N/A allowed_for?(requested_permission, repository, through: permission))
359N/A end
359N/A
98N/A def write_to_mirror_repository?(requested_permission, repository)
321N/A repository.remote? && requested_permission == 'write'
321N/A end
213N/A
304N/A def not_a_write_to_mirror_repository!(requested_permission, repository)
325N/A if write_to_mirror_repository?(requested_permission, repository)
320N/A raise InvalidAccessOnMirrorError
332N/A end
231N/A true
98N/A end
347N/A
346N/A def allowed_for?(requested_permission, repository, through: nil)
324N/A through.present? &&
347N/A (included_in?(:permission, :all, repository, requested_permission) ||
310N/A included_in_role?(through.role.to_sym, requested_permission))
316N/A end
290N/A
332N/A def allowed_for_everyone?(requested_permission, repository)
332N/A included_in?(:everyone, repository, requested_permission)
332N/A end
210N/A
128N/A def included_in?(*groups, repository, requested_permission)
414N/A in_map = groups.reduce(PERMISSION_MAP) { |map, group| map[group] }
326N/A !! in_map[repository.access].try(:include?, requested_permission)
335N/A end
370N/A
70N/A def included_in_role?(role, requested_permission)
400N/A !! PERMISSION_MAP[:permission][role].try(:include?, requested_permission)
294N/A end
98N/A
277N/A def extract_permission_params(params, repository)
356N/A key_field = params[:key_id].sub("key-", "")
289N/A requested_permission = params[:permission]
326N/A user = User.joins(:keys).
290N/A where(keys: {id: key_field}).first
286N/A permission = nil
90N/A permission = repository.highest_permission(user) if user
295N/A [requested_permission, permission]
70N/A end
299N/A
262N/A end
277N/A
332N/Aend
332N/A