diff --git a/app/policies/project_policy.rb b/app/policies/project_policy.rb index 15f91cae86b76d66e21408a6c26ffb697590f843..c70dc2887100c30347128a7bc5018cd37a2f4a93 100644 --- a/app/policies/project_policy.rb +++ b/app/policies/project_policy.rb @@ -162,6 +162,11 @@ class ProjectPolicy < BasePolicy with_scope :subject condition(:service_desk_enabled) { @subject.service_desk_enabled? } + with_scope :subject + condition(:model_experiments_enabled) do + Feature.enabled?(:ml_experiment_tracking, @subject) && @subject.feature_available?(:model_experiments, @user) + end + with_scope :subject condition(:model_registry_enabled) { Feature.enabled?(:model_registry, @subject) } @@ -223,6 +228,7 @@ class ProjectPolicy < BasePolicy feature_flags releases infrastructure + model_experiments ] features.each do |f| @@ -899,6 +905,10 @@ class ProjectPolicy < BasePolicy enable :read_model_registry end + rule { model_experiments_enabled }.policy do + enable :read_model_experiments + end + private def user_is_user? diff --git a/spec/policies/project_policy_spec.rb b/spec/policies/project_policy_spec.rb index d07a4e9f207c2f49b214589328d003f8df33c54f..ee8d811971a07dc00f35bb883b2261040bf15cab 100644 --- a/spec/policies/project_policy_spec.rb +++ b/spec/policies/project_policy_spec.rb @@ -3283,6 +3283,32 @@ def permissions_abilities(role) end end + describe ':read_model_experiments' do + using RSpec::Parameterized::TableSyntax + + where(:ff_ml_experiment_tracking, :current_user, :access_level, :allowed) do + false | ref(:owner) | Featurable::ENABLED | false + true | ref(:guest) | Featurable::ENABLED | true + true | ref(:guest) | Featurable::PRIVATE | true + true | ref(:guest) | Featurable::DISABLED | false + true | ref(:non_member) | Featurable::ENABLED | true + true | ref(:non_member) | Featurable::PRIVATE | false + true | ref(:non_member) | Featurable::DISABLED | false + end + with_them do + before do + stub_feature_flags(ml_experiment_tracking: ff_ml_experiment_tracking) + project.project_feature.update!(model_experiments_access_level: access_level) + end + + if params[:allowed] + it { is_expected.to be_allowed(:read_model_experiments) } + else + it { is_expected.not_to be_allowed(:read_model_experiments) } + end + end + end + private def project_subject(project_type)