branch_check.rb 5.41 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11
# frozen_string_literal: true

module Gitlab
  module Checks
    class BranchCheck < BaseChecker
      ERROR_MESSAGES = {
        delete_default_branch: 'The default branch of a project cannot be deleted.',
        force_push_protected_branch: 'You are not allowed to force push code to a protected branch on this project.',
        non_master_delete_protected_branch: 'You are not allowed to delete protected branches from this project. Only a project maintainer or owner can delete a protected branch.',
        non_web_delete_protected_branch: 'You can only delete protected branches using the web interface.',
        merge_protected_branch: 'You are not allowed to merge code into protected branches on this project.',
12 13 14 15
        push_protected_branch: 'You are not allowed to push code to protected branches on this project.',
        create_protected_branch: 'You are not allowed to create protected branches on this project.',
        invalid_commit_create_protected_branch: 'You can only use an existing protected branch ref as the basis of a new protected branch.',
        non_web_create_protected_branch: 'You can only create protected branches using the web interface and API.'
16 17 18 19 20 21
      }.freeze

      LOG_MESSAGES = {
        delete_default_branch_check: "Checking if default branch is being deleted...",
        protected_branch_checks: "Checking if you are force pushing to a protected branch...",
        protected_branch_push_checks: "Checking if you are allowed to push to the protected branch...",
22
        protected_branch_creation_checks: "Checking if you are allowed to create a protected branch...",
23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48
        protected_branch_deletion_checks: "Checking if you are allowed to delete the protected branch..."
      }.freeze

      def validate!
        return unless branch_name

        logger.log_timed(LOG_MESSAGES[:delete_default_branch_check]) do
          if deletion? && branch_name == project.default_branch
            raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:delete_default_branch]
          end
        end

        protected_branch_checks
      end

      private

      def protected_branch_checks
        logger.log_timed(LOG_MESSAGES[:protected_branch_checks]) do
          return unless ProtectedBranch.protected?(project, branch_name) # rubocop:disable Cop/AvoidReturnFromBlocks

          if forced_push?
            raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:force_push_protected_branch]
          end
        end

49 50 51
        if creation? && protected_branch_creation_enabled?
          protected_branch_creation_checks
        elsif deletion?
52 53 54 55 56 57
          protected_branch_deletion_checks
        else
          protected_branch_push_checks
        end
      end

58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73
      def protected_branch_creation_checks
        logger.log_timed(LOG_MESSAGES[:protected_branch_creation_checks]) do
          unless user_access.can_merge_to_branch?(branch_name)
            raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:create_protected_branch]
          end

          unless safe_commit_for_new_protected_branch?
            raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:invalid_commit_create_protected_branch]
          end

          unless updated_from_web?
            raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:non_web_create_protected_branch]
          end
        end
      end

74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122
      def protected_branch_deletion_checks
        logger.log_timed(LOG_MESSAGES[:protected_branch_deletion_checks]) do
          unless user_access.can_delete_branch?(branch_name)
            raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:non_master_delete_protected_branch]
          end

          unless updated_from_web?
            raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:non_web_delete_protected_branch]
          end
        end
      end

      def protected_branch_push_checks
        logger.log_timed(LOG_MESSAGES[:protected_branch_push_checks]) do
          if matching_merge_request?
            unless user_access.can_merge_to_branch?(branch_name) || user_access.can_push_to_branch?(branch_name)
              raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:merge_protected_branch]
            end
          else
            unless user_access.can_push_to_branch?(branch_name)
              raise GitAccess::UnauthorizedError, push_to_protected_branch_rejected_message
            end
          end
        end
      end

      def push_to_protected_branch_rejected_message
        if project.empty_repo?
          empty_project_push_message
        else
          ERROR_MESSAGES[:push_protected_branch]
        end
      end

      def empty_project_push_message
        <<~MESSAGE

        A default branch (e.g. master) does not yet exist for #{project.full_path}
        Ask a project Owner or Maintainer to create a default branch:

          #{project_members_url}

        MESSAGE
      end

      def project_members_url
        Gitlab::Routing.url_helpers.project_project_members_url(project)
      end

123 124 125 126
      def protected_branch_creation_enabled?
        Feature.enabled?(:protected_branch_creation, project, default_enabled: true)
      end

127 128 129 130 131 132 133
      def matching_merge_request?
        Checks::MatchingMergeRequest.new(newrev, branch_name, project).match?
      end

      def forced_push?
        Gitlab::Checks::ForcePush.force_push?(project, oldrev, newrev)
      end
134 135 136 137

      def safe_commit_for_new_protected_branch?
        ProtectedBranch.any_protected?(project, project.repository.branch_names_contains_sha(newrev))
      end
138 139 140
    end
  end
end