BigW Consortium Gitlab

Commit f21b15d5 by Tomasz Maczukin

Limit projects to user available projects if user is not an admin

parent b58744cd
......@@ -388,7 +388,13 @@ module API
expose :version, :revision, :platform, :architecture
expose :contacted_at, as: :last_contact
expose :token, if: lambda { |runner, options| options[:user_is_admin] || !runner.is_shared? }
expose :projects, with: Entities::RunnerProjectDetails
expose :projects, with: Entities::RunnerProjectDetails do |runner, options|
if options[:user_is_admin]
runner.projects
else
runner.projects.where(id: options[:available_projects_ids])
end
end
end
class Build < Grape::Entity
......
......@@ -33,7 +33,11 @@ module API
runner = get_runner(params[:id])
authenticate_show_runner!(runner)
present runner, with: Entities::RunnerDetails, user_is_admin: current_user.is_admin?
available_projects_ids = runner.projects.select{ |p| can?(current_user, :read_project, p) }
.map(&:id) unless current_user.is_admin?
present runner, with: Entities::RunnerDetails, user_is_admin: current_user.is_admin?,
available_projects_ids: available_projects_ids
end
# Update runner's details
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment