A team can own one or more namespaces. By default all the namespaces can be accessed only by the members of the team.
It is possible to add read only (pull) access to all Portus users by toggling the "public" flag.
' data-original-title="What's this?" tabindex="0" data-html="true"] + a[data-placement="right" data-toggle="popover" data-container=".panel-heading" data-content='A team can own one or more namespaces. By default all the namespaces can be accessed only by the members of the team.
It is possible to add read only (pull) access to logged-in users or all Portus users by changing the visibility to "protected" or "public" respectively.
' data-original-title="What's this?" tabindex="0" data-html="true"] i.fa.fa-info-circle ' Namespaces owned .col-sm-6.text-right @@ -173,7 +173,7 @@ th Repositories th Webhooks th Created At - th Public + th Visibility tbody#namespaces - @team_namespaces.each do |namespace| = render(namespace) diff --git a/config/routes.rb b/config/routes.rb index bab1f3d42..39eaf4630 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -9,7 +9,7 @@ resources :team_users, only: [:create, :destroy, :update] resources :namespaces, only: [:create, :index, :show, :update] do - put "toggle_public", on: :member + put "change_visibility", on: :member resources :webhooks do resources :headers, only: [:create, :destroy], controller: :webhook_headers resources :deliveries, only: [:update], controller: :webhook_deliveries diff --git a/db/migrate/20160614114318_add_visibility_to_namespace.rb b/db/migrate/20160614114318_add_visibility_to_namespace.rb new file mode 100644 index 000000000..f5da95d21 --- /dev/null +++ b/db/migrate/20160614114318_add_visibility_to_namespace.rb @@ -0,0 +1,9 @@ +class AddVisibilityToNamespace < ActiveRecord::Migration + def up + add_column :namespaces, :visibility, :integer + end + + def down + remove_column :namespaces, :visibility, :integer + end +end diff --git a/db/migrate/20160614121943_move_public_to_visibility_on_namespace.rb b/db/migrate/20160614121943_move_public_to_visibility_on_namespace.rb new file mode 100644 index 000000000..09fba40bd --- /dev/null +++ b/db/migrate/20160614121943_move_public_to_visibility_on_namespace.rb @@ -0,0 +1,31 @@ +class MovePublicToVisibilityOnNamespace < ActiveRecord::Migration + def up + Namespace.all.each do |namespace| + namespace.visibility = namespace.public? ? :visibility_public : :visibility_private + namespace.save! + end + PublicActivity::Activity.where("activities.key = ? OR activities.key = ?", + "private", "public").each do |activity| + activity.parameters = { visibility: "visibility_#{activity.key}" } + activity.key = "namespace.change_visibility" + activity.save! + end + end + + def down + Namespace.all.each do |namespace| + namespace.public = namespace.visibility_public? ? true : false + namespace.save! + end + PublicActivity::Activity.where(key: "change_visibility").each do |activity| + if activity.parameters[:visibility] == 'visibility_private' + activity.key = "namespace.private" + else + # protected namespace are made public as well + activity.key = "namespace.public" + end + activity.parameters = {} + activity.save! + end + end +end diff --git a/db/migrate/20160614122012_remove_public_from_namespace.rb b/db/migrate/20160614122012_remove_public_from_namespace.rb new file mode 100644 index 000000000..17fe811c2 --- /dev/null +++ b/db/migrate/20160614122012_remove_public_from_namespace.rb @@ -0,0 +1,9 @@ +class RemovePublicFromNamespace < ActiveRecord::Migration + def up + remove_column :namespaces, :public, :boolean + end + + def down + add_column :namespaces, :public, :boolean + end +end diff --git a/db/schema.rb b/db/schema.rb index 920efecff..ac9ff13f6 100644 --- a/db/schema.rb +++ b/db/schema.rb @@ -11,7 +11,7 @@ # # It's strongly recommended that you check this file into your version control system. -ActiveRecord::Schema.define(version: 20160531151718) do +ActiveRecord::Schema.define(version: 20160614122012) do create_table "activities", force: :cascade do |t| t.integer "trackable_id", limit: 4 @@ -66,10 +66,10 @@ t.datetime "created_at", null: false t.datetime "updated_at", null: false t.integer "team_id", limit: 4 - t.boolean "public", default: false t.integer "registry_id", limit: 4, null: false t.boolean "global", default: false t.text "description", limit: 65535 + t.integer "visibility", limit: 4 end add_index "namespaces", ["name", "registry_id"], name: "index_namespaces_on_name_and_registry_id", unique: true, using: :btree diff --git a/spec/controllers/admin/activities_controller_spec.rb b/spec/controllers/admin/activities_controller_spec.rb index 56419cf1d..7b8e54bbb 100644 --- a/spec/controllers/admin/activities_controller_spec.rb +++ b/spec/controllers/admin/activities_controller_spec.rb @@ -31,8 +31,12 @@ let(:activity_owner) { create(:user, username: "castiel") } let(:registry) { create(:registry, hostname: "registry.test.lan") } let(:global_namespace) do - create(:namespace, name: "globalnamespace", registry: registry, global: true, - team: global_team, public: true) + create(:namespace, + name: "globalnamespace", + registry: registry, + global: true, + team: global_team, + visibility: "visibility_public") end let(:namespace) { create(:namespace, name: "patched_images", registry: registry, team: team) } let(:team) { create(:team, name: "qa", owners: [user]) } @@ -65,12 +69,18 @@ create(:activity_namespace_create, trackable_id: namespace.id, owner_id: activity_owner.id) - create(:activity_namespace_public, + create(:activity_namespace_change_visibility, trackable_id: namespace.id, - owner_id: activity_owner.id) - create(:activity_namespace_private, + owner_id: activity_owner.id, + parameters: { visibility: "visibility_public" }) + create(:activity_namespace_change_visibility, trackable_id: namespace.id, - owner_id: activity_owner.id) + owner_id: activity_owner.id, + parameters: { visibility: "visibility_protected" }) + create(:activity_namespace_change_visibility, + trackable_id: namespace.id, + owner_id: activity_owner.id, + parameters: { visibility: "visibility_private" }) create(:activity_repository_push, trackable_id: tag.repository.id, recipient_id: tag.id, @@ -95,8 +105,9 @@ team,qa,remove member,dean,castiel,2015-01-01 00:00:00 UTC,role viewer team,qa,change member role,dean,castiel,2015-01-01 00:00:00 UTC,from viewer to contributor namespace,patched_images,create,-,castiel,2015-01-01 00:00:00 UTC,owned by team qa -namespace,patched_images,make public,-,castiel,2015-01-01 00:00:00 UTC,- -namespace,patched_images,make private,-,castiel,2015-01-01 00:00:00 UTC,- +namespace,patched_images,change visibility,-,castiel,2015-01-01 00:00:00 UTC,is public +namespace,patched_images,change visibility,-,castiel,2015-01-01 00:00:00 UTC,is protected +namespace,patched_images,change visibility,-,castiel,2015-01-01 00:00:00 UTC,is private repository,patched_images/sles12:1.0.0,push tag,-,castiel,2015-01-01 00:00:00 UTC,- repository,registry.test.lan/sles11sp3:1.0.0,push tag,-,castiel,2015-01-01 00:00:00 UTC,- CSV diff --git a/spec/controllers/comments_controller_spec.rb b/spec/controllers/comments_controller_spec.rb index 6892d0ddc..2117f3088 100644 --- a/spec/controllers/comments_controller_spec.rb +++ b/spec/controllers/comments_controller_spec.rb @@ -5,9 +5,23 @@ let(:owner) { create(:user) } let(:user) { create(:user) } let!(:team) { create(:team, owners: [owner]) } - let!(:public_namespace) { create(:namespace, public: 1, team: team) } + let!(:public_namespace) do + create(:namespace, + visibility: Namespace.visibilities[:visibility_public], + team: team) + end let!(:visible_repository) { create(:repository, namespace: public_namespace) } - let!(:private_namespace) { create(:namespace, public: 0, team: team) } + let!(:protected_namespace) do + create(:namespace, + visibility: Namespace.visibilities[:visibility_protected], + team: team) + end + let!(:protected_repository) { create(:repository, namespace: protected_namespace) } + let!(:private_namespace) do + create(:namespace, + visibility: Namespace.visibilities[:visibility_private], + team: team) + end let!(:invisible_repository) { create(:repository, namespace: private_namespace) } let(:comment) { create(:comment, author: owner) } let!(:commented_repository) do @@ -40,6 +54,12 @@ expect(response.status).to eq 200 end + it "allows logged-in users to write comments for a repository under a protected namespace" do + sign_in user + post :create, repository_id: protected_repository.id, comment: valid_attributes, format: :js + expect(response.status).to eq 200 + end + it "does allow the admin to write comments for every repository" do sign_in admin post :create, repository_id: invisible_repository.id, comment: valid_attributes, format: :js diff --git a/spec/controllers/namespaces_controller_spec.rb b/spec/controllers/namespaces_controller_spec.rb index 2161062df..e6b896f93 100644 --- a/spec/controllers/namespaces_controller_spec.rb +++ b/spec/controllers/namespaces_controller_spec.rb @@ -65,19 +65,25 @@ end end - describe "PUT #toggle_public" do - it "allows the owner of the team to change the public attribute" do + describe "PUT #change_visibility" do + it "allows the owner of the team to change the visibility attribute" do sign_in owner - put :toggle_public, id: namespace.id, format: :js + put :change_visibility, + id: namespace.id, + visibility: "visibility_public", + format: :js namespace.reload - expect(namespace).to be_public + expect(namespace.visibility).to eq("visibility_public") expect(response.status).to eq 200 end it "blocks users that are not part of the team" do sign_in create(:user) - put :toggle_public, id: namespace.id, format: :js + put :change_visibility, + id: namespace.id, + visibility: "visibility_public", + format: :js expect(response.status).to eq 401 end @@ -296,27 +302,52 @@ end it "tracks set namespace private" do - namespace.update_attributes(public: true) + namespace.update_attributes(visibility: Namespace.visibilities[:visibilty_public]) expect do - put :toggle_public, id: namespace.id, format: :js + put :change_visibility, + id: namespace.id, + visibility: "visibility_private", + format: :js end.to change(PublicActivity::Activity, :count).by(1) activity = PublicActivity::Activity.last - expect(activity.key).to eq("namespace.private") + expect(activity.key).to eq("namespace.change_visibility") + expect(activity.parameters[:visibility]).to eq("visibility_private") + expect(activity.owner).to eq(owner) + expect(activity.trackable).to eq(namespace) + end + + it "tracks set namespace protected" do + namespace.update_attributes(visibility: Namespace.visibilities[:visibilty_public]) + + expect do + put :change_visibility, + id: namespace.id, + visibility: "visibility_protected", + format: :js + end.to change(PublicActivity::Activity, :count).by(1) + + activity = PublicActivity::Activity.last + expect(activity.key).to eq("namespace.change_visibility") + expect(activity.parameters[:visibility]).to eq("visibility_protected") expect(activity.owner).to eq(owner) expect(activity.trackable).to eq(namespace) end it "tracks set namespace public" do - namespace.update_attributes(public: false) + namespace.update_attributes(visibility: Namespace.visibilities[:visibility_private]) expect do - put :toggle_public, id: namespace.id, format: :js + put :change_visibility, + id: namespace.id, + visibility: "visibility_public", + format: :js end.to change(PublicActivity::Activity, :count).by(1) activity = PublicActivity::Activity.last - expect(activity.key).to eq("namespace.public") + expect(activity.key).to eq("namespace.change_visibility") + expect(activity.parameters[:visibility]).to eq("visibility_public") expect(activity.owner).to eq(owner) expect(activity.trackable).to eq(namespace) end diff --git a/spec/controllers/repositories_controller_spec.rb b/spec/controllers/repositories_controller_spec.rb index fcdcf31d6..f52effbba 100644 --- a/spec/controllers/repositories_controller_spec.rb +++ b/spec/controllers/repositories_controller_spec.rb @@ -3,9 +3,17 @@ describe RepositoriesController, type: :controller do let(:valid_session) { {} } let(:user) { create(:user) } - let!(:public_namespace) { create(:namespace, public: 1, team: create(:team)) } + let!(:public_namespace) do + create(:namespace, + visibility: Namespace.visibilities[:visibility_public], + team: create(:team)) + end let!(:visible_repository) { create(:repository, namespace: public_namespace) } - let!(:private_namespace) { create(:namespace, public: 0, team: create(:team)) } + let!(:private_namespace) do + create(:namespace, + visibility: Namespace.visibilities[:visibility_private], + team: create(:team)) + end let!(:invisible_repository) { create(:repository, namespace: private_namespace) } before :each do diff --git a/spec/factories/activities.rb b/spec/factories/activities.rb index 866ef36a1..3fca988c5 100644 --- a/spec/factories/activities.rb +++ b/spec/factories/activities.rb @@ -33,15 +33,9 @@ trackable_type "Namespace" end - factory :activity_namespace_public, class: PublicActivity::Activity do + factory :activity_namespace_change_visibility, class: PublicActivity::Activity do owner_type "User" - key "namespace.public" - trackable_type "Namespace" - end - - factory :activity_namespace_private, class: PublicActivity::Activity do - owner_type "User" - key "namespace.private" + key "namespace.change_visibility" trackable_type "Namespace" end diff --git a/spec/factories/namespaces.rb b/spec/factories/namespaces.rb index 8f220b0bc..8ee72fbfa 100644 --- a/spec/factories/namespaces.rb +++ b/spec/factories/namespaces.rb @@ -7,10 +7,10 @@ # created_at :datetime not null # updated_at :datetime not null # team_id :integer -# public :boolean default("0") # registry_id :integer not null # global :boolean default("0") # description :text(65535) +# visibility :integer # # Indexes # @@ -26,6 +26,7 @@ "namespace#{n}" end + visibility Namespace.visibilities[:visibility_private] registry { association(:registry) } end end diff --git a/spec/features/dashboard_spec.rb b/spec/features/dashboard_spec.rb index c7e51fdcc..4d96d8c00 100644 --- a/spec/features/dashboard_spec.rb +++ b/spec/features/dashboard_spec.rb @@ -13,8 +13,19 @@ let!(:another_user) { create(:admin) } let!(:another_team) { create(:team, owners: [another_user]) } - let!(:public_namespace) { create(:namespace, team: another_team, public: true) } + let!(:another_team2) { create(:team, owners: [another_user]) } + let!(:public_namespace) do + create(:namespace, + team: another_team, + visibility: Namespace.visibilities[:visibility_public]) + end let!(:public_repository) { create(:repository, namespace: public_namespace) } + let!(:protected_namespace) do + create(:namespace, + team: another_team2, + visibility: Namespace.visibilities[:visibility_protected]) + end + let!(:protected_repository) { create(:repository, namespace: protected_namespace) } before do login_as user, scope: :user @@ -27,6 +38,7 @@ expect(page).to have_content("#{namespace.name}/#{repository.name}") expect(page).to have_content("#{namespace.name}/#{starred_repo.name}") expect(page).to have_content("#{public_namespace.name}/#{public_repository.name}") + expect(page).to have_content("#{protected_namespace.name}/#{protected_repository.name}") end scenario "Show personal repositories", js: true do @@ -38,6 +50,7 @@ expect(page).not_to have_content("#{namespace.name}/#{starred_repo.name}") expect(page).not_to have_content("#{namespace.name}/#{repository.name}") expect(page).not_to have_content("#{public_namespace.name}/#{public_repository.name}") + expect(page).not_to have_content("#{protected_namespace.name}/#{protected_repository.name}") end scenario "Show personal repositories", js: true do @@ -49,6 +62,7 @@ expect(page).not_to have_content("#{personal_namespace.name}/#{personal_repository.name}") expect(page).not_to have_content("#{namespace.name}/#{repository.name}") expect(page).not_to have_content("#{public_namespace.name}/#{public_repository.name}") + expect(page).not_to have_content("#{protected_namespace.name}/#{protected_repository.name}") end end diff --git a/spec/features/namespaces_spec.rb b/spec/features/namespaces_spec.rb index 34c88ee42..d73d7c6dd 100644 --- a/spec/features/namespaces_spec.rb +++ b/spec/features/namespaces_spec.rb @@ -108,22 +108,26 @@ expect(page).to_not have_css("#add_namespace_btn i.fa-minus-circle") end - scenario "The namespace can be toggled public/private", js: true do + scenario "The namespace visibility can be changed", js: true do visit namespaces_path id = namespace.id - expect(namespace.public?).to be false - expect(page).to have_css("#namespace_#{id} .fa-toggle-off") + expect(namespace.visibility_private?).to be true + expect(page).to have_css("#namespace_#{id} a#private.btn-primary") - find("#namespace_#{id} .btn").click + find("#namespace_#{id} a#protected.btn").click wait_for_ajax - expect(page).to have_css("#namespace_#{id} .fa-toggle-on") + expect(page).to have_css("#namespace_#{id} a#protected.btn-primary") namespace = Namespace.find(id) - expect(namespace.public?).to be true + expect(namespace.visibility_protected?).to be true - wait_for_effect_on("#float-alert") - expect(page).to have_content("Namespace '#{namespace.name}' is now public") + find("#namespace_#{id} a#public.btn").click + wait_for_ajax + + expect(page).to have_css("#namespace_#{id} a#public.btn-primary") + namespace = Namespace.find(id) + expect(namespace.visibility_public?).to be true end end diff --git a/spec/models/namespace_spec.rb b/spec/models/namespace_spec.rb index 0f99ea273..756c08cc4 100644 --- a/spec/models/namespace_spec.rb +++ b/spec/models/namespace_spec.rb @@ -7,10 +7,10 @@ # created_at :datetime not null # updated_at :datetime not null # team_id :integer -# public :boolean default("0") # registry_id :integer not null # global :boolean default("0") # description :text(65535) +# visibility :integer # # Indexes # @@ -66,10 +66,16 @@ end context "global namespace" do - it "must be public" do - namespace = create(:namespace, global: true, public: true) - namespace.public = false + it "cannot be private" do + namespace = create( + :namespace, + global: true, + visibility: Namespace.visibilities[:visibility_public]) + namespace.visibility = Namespace.visibilities[:visibility_private] expect(namespace.save).to be false + + namespace.visibility = Namespace.visibilities[:visibility_protected] + expect(namespace.save).to be true end end @@ -87,7 +93,11 @@ context "global namespace" do it "returns the name of the namespace" do - global_namespace = create(:namespace, global: true, public: true, registry: registry) + global_namespace = create( + :namespace, + global: true, + visibility: Namespace.visibilities[:visibility_public], + registry: registry) expect(global_namespace.clean_name).to eq(registry.hostname) end end diff --git a/spec/policies/namespace_policy_spec.rb b/spec/policies/namespace_policy_spec.rb index 5e07a68cc..549ce1c98 100644 --- a/spec/policies/namespace_policy_spec.rb +++ b/spec/policies/namespace_policy_spec.rb @@ -44,7 +44,7 @@ end it "allows access to any user if the namespace is public" do - namespace.public = true + namespace.visibility = :visibility_public expect(subject).to permit(user, namespace) end @@ -63,9 +63,24 @@ end it "allows access to a non-logged user if the namespace is public" do - namespace.public = true + namespace.visibility = :visibility_public expect(subject).to permit(nil, namespace) end + + it "disallows access to a non-logged-in user if the namespace is protected" do + namespace.visibility = :visibility_protected + expect do + subject.new(nil, namespace).pull? + end.to raise_error(Pundit::NotAuthorizedError, /must be logged in/) + end + + it "allows access to any logged-in user if the namespace is protected" do + namespace.visibility = :visibility_protected + expect(subject).to permit(user, namespace) + expect(subject).to permit(viewer, namespace) + expect(subject).to permit(owner, namespace) + expect(subject).to permit(@admin, namespace) + end end permissions :push? do @@ -130,7 +145,7 @@ end end - permissions :toggle_public? do + permissions :change_visibility? do it "allows admin to change it" do expect(subject).to permit(@admin, namespace) end @@ -149,15 +164,19 @@ it "disallows access to user who is not logged in" do expect do - subject.new(nil, namespace).toggle_public? + subject.new(nil, namespace).change_visibility? end.to raise_error(Pundit::NotAuthorizedError, /must be logged in/) end context "global namespace" do - let(:namespace) { create(:namespace, global: true, public: true) } + let(:namespace) { create(:namespace, global: true, visibility: :visibility_public) } + + it "allows access to admin" do + expect(subject).to permit(@admin, namespace) + end - it "disallow access to everybody" do - expect(subject).to_not permit(@admin, namespace) + it "disallows access to everyone normal users" do + expect(subject).to_not permit(user, namespace) end end end @@ -176,7 +195,7 @@ end it "always shows public namespaces" do - n = create(:namespace, public: true) + n = create(:namespace, visibility: :visibility_public) create(:team, namespaces: [n], owners: [owner]) expect(Pundit.policy_scope(create(:user), Namespace).to_a).to match_array([n]) end @@ -184,14 +203,14 @@ it "never shows public or personal namespaces" do user = create(:user) expect(Namespace.find_by(name: user.username)).not_to be_nil - create(:namespace, global: true, public: true) + create(:namespace, global: true, visibility: :visibility_public) expect(Pundit.policy_scope(create(:user), Namespace).to_a).to be_empty end it "does not show duplicates" do # Namespaces controlled by the team that are also public are listed twice expected = team.namespaces - expected.first.update_attributes(public: true) + expected.first.update_attributes(visibility: :visibility_public) expect(Pundit.policy_scope(viewer, Namespace).to_a).to match_array(expected) end end diff --git a/spec/policies/public_activity/activity_policy_spec.rb b/spec/policies/public_activity/activity_policy_spec.rb index cc329b5af..d3eeb1f86 100644 --- a/spec/policies/public_activity/activity_policy_spec.rb +++ b/spec/policies/public_activity/activity_policy_spec.rb @@ -34,27 +34,26 @@ it "returns pertinent namespace events" do namespace2 = create(:namespace, - registry: registry, - team: create(:team, - owners: [another_user]), - public: true) + registry: registry, + team: create(:team, owners: [another_user]), + visibility: Namespace.visibilities[:visibility_public]) activities = [ create(:activity_namespace_create, trackable_id: namespace.id, owner_id: activity_owner.id), - create(:activity_namespace_public, + create(:activity_namespace_change_visibility, trackable_id: namespace.id, owner_id: activity_owner.id), - create(:activity_namespace_private, + create(:activity_namespace_change_visibility, trackable_id: namespace.id, owner_id: activity_owner.id), # all the public/private events are shown, even the ones # involving namespaces the user does not control - create(:activity_namespace_public, + create(:activity_namespace_change_visibility, trackable_id: namespace2.id, owner_id: activity_owner.id), - create(:activity_namespace_private, + create(:activity_namespace_change_visibility, trackable_id: namespace2.id, owner_id: activity_owner.id) ] @@ -74,9 +73,9 @@ private_tag = create(:tag, repository: create(:repository, namespace: namespace2)) public_namespace = create(:namespace, - registry: registry, - public: true, - team: create(:team, + registry: registry, + visibility: Namespace.visibilities[:visibility_public], + team: create(:team, owners: [another_user], namespaces: [namespace2])) public_tag = create(:tag, repository: create(:repository, namespace: public_namespace)) diff --git a/spec/policies/repository_policy_spec.rb b/spec/policies/repository_policy_spec.rb index 7c75ac475..34534fe26 100644 --- a/spec/policies/repository_policy_spec.rb +++ b/spec/policies/repository_policy_spec.rb @@ -12,9 +12,20 @@ permissions :show? do before :each do - public_namespace = create(:namespace, team: team2, public: true, registry: registry) + public_namespace = create( + :namespace, + team: team2, + visibility: Namespace.visibilities[:visibility_public], + registry: registry) @public_repository = create(:repository, namespace: public_namespace) + protected_namespace = create( + :namespace, + team: team2, + visibility: Namespace.visibilities[:visibility_protected], + registry: registry) + @protected_repository = create(:repository, namespace: protected_namespace) + private_namespace = create(:namespace, team: team2, registry: registry) @private_repository = create(:repository, namespace: private_namespace) end @@ -31,6 +42,10 @@ expect(subject).to permit(user, @public_repository) end + it "grants access if the namespace is protected" do + expect(subject).to permit(user, @protected_repository) + end + it "grants access if the repository belongs to a namespace of a team member" do user3 = create(:user) TeamUser.create(team: team2, user: user3, role: TeamUser.roles["viewer"]) @@ -44,7 +59,11 @@ describe "scope" do before :each do - public_namespace = create(:namespace, team: team2, public: true, registry: registry) + public_namespace = create( + :namespace, + team: team2, + visibility: Namespace.visibilities[:visibility_public], + registry: registry) @public_repository = create(:repository, namespace: public_namespace) private_namespace = create(:namespace, team: team2, registry: registry)