BigW Consortium Gitlab

member.rb 6.36 KB
Newer Older
1
class Member < ActiveRecord::Base
2
  include Sortable
3
  include Importable
4
  include Expirable
5 6
  include Gitlab::Access

7 8
  attr_accessor :raw_invite_token

9
  belongs_to :created_by, class_name: "User"
10 11 12
  belongs_to :user
  belongs_to :source, polymorphic: true

13
  validates :user, presence: true, unless: :invite?
14
  validates :source, presence: true
15
  validates :user_id, uniqueness: { scope: [:source_type, :source_id],
16 17
                                    message: "already exists in source",
                                    allow_nil: true }
18
  validates :access_level, inclusion: { in: Gitlab::Access.all_values }, presence: true
Douwe Maan committed
19 20 21 22
  validates :invite_email,
    presence: {
      if: :invite?
    },
23
    email: {
Douwe Maan committed
24 25 26 27 28 29
      allow_nil: true
    },
    uniqueness: {
      scope: [:source_type, :source_id],
      allow_nil: true
    }
30

31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46
  # This scope encapsulates (most of) the conditions a row in the member table
  # must satisfy if it is a valid permission. Of particular note:
  #
  #   * Access requests must be excluded
  #   * Blocked users must be excluded
  #   * Invitations take effect immediately
  #   * expires_at is not implemented. A background worker purges expired rows
  scope :active, -> do
    is_external_invite = arel_table[:user_id].eq(nil).and(arel_table[:invite_token].not_eq(nil))
    user_is_active = User.arel_table[:state].eq(:active)

    includes(:user).references(:users)
      .where(is_external_invite.or(user_is_active))
      .where(requested_at: nil)
  end

47
  scope :invite, -> { where.not(invite_token: nil) }
48
  scope :non_invite, -> { where(invite_token: nil) }
49
  scope :request, -> { where.not(requested_at: nil) }
50 51 52 53 54 55 56 57 58

  scope :has_access, -> { active.where('access_level > 0') }

  scope :guests, -> { active.where(access_level: GUEST) }
  scope :reporters, -> { active.where(access_level: REPORTER) }
  scope :developers, -> { active.where(access_level: DEVELOPER) }
  scope :masters,  -> { active.where(access_level: MASTER) }
  scope :owners,  -> { active.where(access_level: OWNER) }
  scope :owners_and_masters,  -> { active.where(access_level: [OWNER, MASTER]) }
59

60
  before_validation :generate_invite_token, on: :create, if: -> (member) { member.invite_email.present? }
61

62
  after_create :send_invite, if: :invite?, unless: :importing?
James Lopez committed
63 64 65 66
  after_create :send_request, if: :request?, unless: :importing?
  after_create :create_notification_setting, unless: [:pending?, :importing?]
  after_create :post_create_hook, unless: [:pending?, :importing?]
  after_update :post_update_hook, unless: [:pending?, :importing?]
67
  after_destroy :post_destroy_hook, unless: :pending?
68

69
  delegate :name, :username, :email, to: :user, prefix: true
70

71 72
  default_value_for :notification_level, NotificationSetting.levels[:global]

73
  class << self
Stan Hu committed
74
    def access_for_user_ids(user_ids)
Adam Niedzielski committed
75
      where(user_id: user_ids).has_access.pluck(:user_id, :access_level).to_h
Stan Hu committed
76 77
    end

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93
    def find_by_invite_token(invite_token)
      invite_token = Devise.token_generator.digest(self, :invite_token, invite_token)
      find_by(invite_token: invite_token)
    end

    # This method is used to find users that have been entered into the "Add members" field.
    # These can be the User objects directly, their IDs, their emails, or new emails to be invited.
    def user_for_id(user_id)
      return user_id if user_id.is_a?(User)

      user = User.find_by(id: user_id)
      user ||= User.find_by(email: user_id)
      user ||= user_id
      user
    end

94
    def add_user(members, user_id, access_level, current_user: nil, expires_at: nil)
95
      user = user_for_id(user_id)
96

97 98 99 100 101 102 103
      # `user` can be either a User object or an email to be invited
      if user.is_a?(User)
        member = members.find_or_initialize_by(user_id: user.id)
      else
        member = members.build
        member.invite_email = user
      end
104

105
      if can_update_member?(current_user, member) || project_creator?(member, access_level)
106 107
        member.created_by ||= current_user
        member.access_level = access_level
Adam Niedzielski committed
108
        member.expires_at = expires_at
109

110 111
        member.save
      end
112
    end
113 114 115

    private

116
    def can_update_member?(current_user, member)
Douwe Maan committed
117 118 119
      # There is no current user for bulk actions, in which case anything is allowed
      !current_user ||
        current_user.can?(:update_group_member, member) ||
120
        current_user.can?(:update_project_member, member)
121
    end
122 123 124 125 126

    def project_creator?(member, access_level)
      member.new_record? && member.owner? &&
        access_level.to_i == ProjectMember::MASTER
    end
Douwe Maan committed
127 128
  end

129 130 131 132
  def real_source_type
    source_type
  end

133 134 135 136
  def invite?
    self.invite_token.present?
  end

137
  def request?
138
    requested_at.present?
139 140
  end

141 142
  def pending?
    invite? || request?
143 144
  end

145
  def accept_request
146 147
    return false unless request?

148
    updated = self.update(requested_at: nil)
149
    after_accept_request if updated
150

151
    updated
152 153
  end

154
  def accept_invite!(new_user)
Douwe Maan committed
155
    return false unless invite?
156

157 158 159 160 161 162 163 164 165 166 167 168
    self.invite_token = nil
    self.invite_accepted_at = Time.now.utc

    self.user = new_user

    saved = self.save

    after_accept_invite if saved

    saved
  end

Douwe Maan committed
169 170 171 172 173 174 175 176 177 178
  def decline_invite!
    return false unless invite?

    destroyed = self.destroy

    after_decline_invite if destroyed

    destroyed
  end

179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196
  def generate_invite_token
    raw, enc = Devise.token_generator.generate(self.class, :invite_token)
    @raw_invite_token = raw
    self.invite_token = enc
  end

  def generate_invite_token!
    generate_invite_token && save(validate: false)
  end

  def resend_invite
    return unless invite?

    generate_invite_token! unless @raw_invite_token

    send_invite
  end

197
  def create_notification_setting
198
    user.notification_settings.find_or_create_for(source)
199 200
  end

201
  def notification_setting
202
    @notification_setting ||= user.notification_settings_for(source)
203 204
  end

205 206 207 208 209 210
  private

  def send_invite
    # override in subclass
  end

211
  def send_request
212
    notification_service.new_access_request(self)
213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230
  end

  def post_create_hook
    system_hook_service.execute_hooks_for(self, :create)
  end

  def post_update_hook
    # override in subclass
  end

  def post_destroy_hook
    system_hook_service.execute_hooks_for(self, :destroy)
  end

  def after_accept_invite
    post_create_hook
  end

Douwe Maan committed
231 232 233 234
  def after_decline_invite
    # override in subclass
  end

235
  def after_accept_request
236 237 238 239 240 241 242 243 244 245
    post_create_hook
  end

  def system_hook_service
    SystemHooksService.new
  end

  def notification_service
    NotificationService.new
  end
246
end