Examples with ProjectAuthorizationAction org.finos.legend.sdlc.domain.model.project.accessRole.ProjectAuthorizationAction used on opensource projects

Example 1 with ProjectAuthorizationAction

use of org.finos.legend.sdlc.domain.model.project.accessRole.ProjectAuthorizationAction in project legend-sdlc by finos.

the class GitLabProjectApi method checkUserAuthorizationActions.

@Override
public Set<ProjectAuthorizationAction> checkUserAuthorizationActions(String id, Set<ProjectAuthorizationAction> actions) {
    try {
        GitLabProjectId projectId = parseProjectId(id);
        org.gitlab4j.api.models.Project gitLabProject = withRetries(() -> getGitLabApi(projectId.getGitLabMode()).getProjectApi().getProject(projectId.getGitLabId()));
        if (!isLegendSDLCProject(gitLabProject)) {
            throw new LegendSDLCServerException("Failed to get project " + id);
        }
        AccessLevel userLevel = getUserAccess(gitLabProject);
        if (userLevel == null) {
            return Collections.emptySet();
        }
        return actions.stream().filter(Objects::nonNull).filter(a -> checkUserAction(projectId, a, userLevel)).collect(Collectors.toSet());
    } catch (Exception e) {
        throw buildException(e, () -> "Failed to get project " + id);
    }
}

Example 2 with ProjectAuthorizationAction

use of org.finos.legend.sdlc.domain.model.project.accessRole.ProjectAuthorizationAction in project legend-sdlc by finos.

the class GitLabProjectApi method checkUserReleasePermission.

private boolean checkUserReleasePermission(GitLabProjectId projectId, ProjectAuthorizationAction action, AccessLevel accessLevel) {
    try {
        List<ProtectedTag> protectedTags = withRetries(() -> getGitLabApi(projectId.getGitLabMode()).getTagsApi().getProtectedTags(projectId.getGitLabId()));
        if (protectedTags == null || protectedTags.isEmpty()) {
            // By default user can perform a release if the user has developer access or above https://docs.gitlab.com/ee/user/permissions.html#release-permissions-with-protected-tags
            return defaultReleaseAction(accessLevel);
        }
        protectedTags = protectedTags.stream().filter(a -> a.getName().startsWith("release") || a.getName().startsWith("version")).collect(Collectors.toList());
        for (ProtectedTag tag : protectedTags) {
            if (tag.getCreateAccessLevels().isEmpty()) {
                return defaultReleaseAction(accessLevel);
            }
            // with th release protected tag the user must have the min access_level
            List<ProtectedTag.CreateAccessLevel> matchedTags = tag.getCreateAccessLevels().stream().filter(a -> a.getAccess_level().value >= accessLevel.value).collect(Collectors.toList());
            // if the  machedTags are empty or null user access does not match any of the protected tags
            if (matchedTags.isEmpty()) {
                return defaultReleaseAction(accessLevel);
            }
            // User does not meet all criteria not authorized for the action
            if (matchedTags.size() != tag.getCreateAccessLevels().size()) {
                return false;
            }
        }
    } catch (Exception e) {
        throw buildException(e, () -> "Failed to get protected tags for " + projectId.getGitLabId());
    }
    return false;
}