diff --git a/app/policies/global_policy.rb b/app/policies/global_policy.rb index 616f37b34cdb68de11fe0aa234dbb5979de2d69a..0fc37bf123d784626e80d92362e56a22fe99ba22 100644 --- a/app/policies/global_policy.rb +++ b/app/policies/global_policy.rb @@ -161,6 +161,8 @@ class GlobalPolicy < BasePolicy enable :read_admin_metrics_dashboard enable :read_admin_system_information enable :read_admin_users + enable :read_admin_groups + enable :read_admin_projects enable :read_application_statistics end diff --git a/app/validators/json_schemas/admin_role_permissions.json b/app/validators/json_schemas/admin_role_permissions.json index 269169e049fd90c0d6f69d3dcaca54d6194f9b78..a1fd6f37f76eb00c075fa4053c6ce2c3b0254f35 100644 --- a/app/validators/json_schemas/admin_role_permissions.json +++ b/app/validators/json_schemas/admin_role_permissions.json @@ -15,6 +15,12 @@ }, "read_admin_users": { "type": "boolean" + }, + "read_admin_groups": { + "type": "boolean" + }, + "read_admin_projects": { + "type": "boolean" } } } diff --git a/app/validators/json_schemas/member_role_permissions.json b/app/validators/json_schemas/member_role_permissions.json index f4fccfed19ed311171aa3ab369ab3062d0b8a5e8..5e58612368b10128a0aa373f708043762d337cef 100644 --- a/app/validators/json_schemas/member_role_permissions.json +++ b/app/validators/json_schemas/member_role_permissions.json @@ -79,6 +79,12 @@ "read_admin_users": { "type": "boolean" }, + "read_admin_groups": { + "type": "boolean" + }, + "read_admin_projects": { + "type": "boolean" + }, "read_code": { "type": "boolean" }, diff --git a/doc/api/graphql/reference/_index.md b/doc/api/graphql/reference/_index.md index 462f91fff6ed29e488f74323ee3ee37ae4fe46a7..4d032b7842a2831d474cbd5dc7484cebf7a21f0a 100644 --- a/doc/api/graphql/reference/_index.md +++ b/doc/api/graphql/reference/_index.md @@ -46724,7 +46724,9 @@ Member role admin permission. | Value | Description | | ----- | ----------- | | `READ_ADMIN_CICD` {{< icon name="warning-solid" >}} | **Introduced** in GitLab 17.9. **Status**: Experiment. Read CI/CD details for runners and jobs in the Admin Area. | +| `READ_ADMIN_GROUPS` {{< icon name="warning-solid" >}} | **Introduced** in GitLab 18.3. **Status**: Experiment. Read group details in the Admin Area. | | `READ_ADMIN_MONITORING` {{< icon name="warning-solid" >}} | **Introduced** in GitLab 17.9. **Status**: Experiment. Read system information such as background migrations, health checks, audit logs, and Gitaly in the Admin Area. | +| `READ_ADMIN_PROJECTS` {{< icon name="warning-solid" >}} | **Introduced** in GitLab 18.3. **Status**: Experiment. Read project details in the Admin Area. | | `READ_ADMIN_SUBSCRIPTION` {{< icon name="warning-solid" >}} | **Introduced** in GitLab 17.9. **Status**: Experiment. Read subscription details in the Admin area. | | `READ_ADMIN_USERS` {{< icon name="warning-solid" >}} | **Introduced** in GitLab 17.9. **Status**: Experiment. Read the user list and user details in the Admin area. | @@ -46756,7 +46758,9 @@ Member role permission. | `MANAGE_PROTECTED_TAGS` | Create, read, update, and delete protected tags. | | `MANAGE_SECURITY_POLICY_LINK` | Allows linking security policy projects. | | `READ_ADMIN_CICD` | Read CI/CD details for runners and jobs in the Admin Area. | +| `READ_ADMIN_GROUPS` | Read group details in the Admin Area. | | `READ_ADMIN_MONITORING` | Read system information such as background migrations, health checks, audit logs, and Gitaly in the Admin Area. | +| `READ_ADMIN_PROJECTS` | Read project details in the Admin Area. | | `READ_ADMIN_SUBSCRIPTION` | Read subscription details in the Admin area. | | `READ_ADMIN_USERS` | Read the user list and user details in the Admin area. | | `READ_CODE` | Allows read-only access to the source code in the user interface. Does not allow users to edit or download repository archives, clone or pull repositories, view source code in an IDE, or view merge requests for private projects. You can download individual files because read-only access inherently grants the ability to make a local copy of the file. | diff --git a/doc/api/openapi/openapi_v2.yaml b/doc/api/openapi/openapi_v2.yaml index 3f5632c395230a42e4bcde7da1c525cbf84cf682..f354190342605831e439b6aa5f31e9d136c50be9 100644 --- a/doc/api/openapi/openapi_v2.yaml +++ b/doc/api/openapi/openapi_v2.yaml @@ -48991,6 +48991,10 @@ definitions: type: boolean read_dependency: type: boolean + read_admin_groups: + type: boolean + read_admin_projects: + type: boolean read_code: type: boolean read_runners: diff --git a/doc/user/custom_roles/abilities.md b/doc/user/custom_roles/abilities.md index b7cf58d4f106ea6b2f881069b5a8d06c7f0f3a98..b32d7555c4a4aabb403d90345cef38ee5d0eaee7 100644 --- a/doc/user/custom_roles/abilities.md +++ b/doc/user/custom_roles/abilities.md @@ -35,6 +35,8 @@ Any dependencies are noted in the `Description` column for each permission. | Permission | Description | API Attribute | Scope | Introduced | |:-----------|:------------|:--------------|:------|:-----------| | View CI/CD | Read CI/CD details for runners and jobs in the Admin Area. | [`read_admin_cicd`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/177233) | Instance | GitLab [17.9](https://gitlab.com/gitlab-org/gitlab/-/issues/507960) | +| View Groups | Read group details in the Admin Area. | [`read_admin_groups`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/197777) | Instance | GitLab [18.3](https://gitlab.com/gitlab-org/gitlab/-/issues/534449) | +| View Projects | Read project details in the Admin Area. | [`read_admin_projects`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/197777) | Instance | GitLab [18.3](https://gitlab.com/gitlab-org/gitlab/-/issues/534449) | | View subscription details | Read subscription details in the Admin area. | [`read_admin_subscription`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/178230) | Instance | GitLab [17.9](https://gitlab.com/gitlab-org/gitlab/-/issues/507961) | | View system monitoring | Read system information such as background migrations, health checks, audit logs, and Gitaly in the Admin Area. | [`read_admin_monitoring`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/179439) | Instance | GitLab [17.9](https://gitlab.com/gitlab-org/gitlab/-/issues/507959) | | View users | Read the user list and user details in the Admin area. | [`read_admin_users`](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/177514) | Instance | GitLab [17.9](https://gitlab.com/gitlab-org/gitlab/-/issues/508782) | diff --git a/ee/app/policies/ee/global_policy.rb b/ee/app/policies/ee/global_policy.rb index a0215b40927fd8915f948bb625513386c8ae6836..783e4b2a9d4d20d179224c6bfaa6fb606be2752a 100644 --- a/ee/app/policies/ee/global_policy.rb +++ b/ee/app/policies/ee/global_policy.rb @@ -126,6 +126,12 @@ module GlobalPolicy License.feature_available?(:remote_development) end + condition(:has_admin_custom_role, scope: :user) do + MemberRole.all_customizable_admin_permission_keys.any? do |ability| + custom_role_ability(@user).allowed?(ability) + end + end + MemberRole.all_customizable_admin_permission_keys.each do |ability| desc "Admin custom role that enables #{ability.to_s.tr('_', ' ')}" condition(:"custom_role_enables_#{ability}") do @@ -227,15 +233,16 @@ module GlobalPolicy enable :access_git end - rule { custom_role_enables_read_admin_cicd }.policy do + rule { has_admin_custom_role }.policy do enable :access_admin_area enable :read_application_statistics + end + + rule { custom_role_enables_read_admin_cicd }.policy do enable :read_admin_cicd end rule { custom_role_enables_read_admin_monitoring }.policy do - enable :access_admin_area - enable :read_application_statistics enable :read_admin_audit_log enable :read_admin_background_migrations enable :read_admin_gitaly_servers @@ -244,19 +251,23 @@ module GlobalPolicy end rule { custom_role_enables_read_admin_subscription }.policy do - enable :access_admin_area - enable :read_application_statistics enable :read_admin_subscription enable :read_billable_member enable :read_licenses end rule { custom_role_enables_read_admin_users }.policy do - enable :access_admin_area - enable :read_application_statistics enable :read_admin_users end + rule { custom_role_enables_read_admin_groups }.policy do + enable :read_admin_groups + end + + rule { custom_role_enables_read_admin_projects }.policy do + enable :read_admin_projects + end + rule { admin & duo_core_features_available }.policy do enable :manage_duo_core_settings end diff --git a/ee/config/custom_abilities/admin/read_admin_groups.yml b/ee/config/custom_abilities/admin/read_admin_groups.yml new file mode 100644 index 0000000000000000000000000000000000000000..e1a297d301533374ca333a2722f6dc29aada7e97 --- /dev/null +++ b/ee/config/custom_abilities/admin/read_admin_groups.yml @@ -0,0 +1,8 @@ +--- +title: View Groups +name: read_admin_groups +description: Read group details in the Admin Area. +introduced_by_issue: https://gitlab.com/gitlab-org/gitlab/-/issues/534449 +introduced_by_mr: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/197777 +feature_category: admin +milestone: '18.3' diff --git a/ee/config/custom_abilities/admin/read_admin_projects.yml b/ee/config/custom_abilities/admin/read_admin_projects.yml new file mode 100644 index 0000000000000000000000000000000000000000..ce3ef39173fc0e705c7f2ff8006587f507439c3b --- /dev/null +++ b/ee/config/custom_abilities/admin/read_admin_projects.yml @@ -0,0 +1,8 @@ +--- +title: View Projects +name: read_admin_projects +description: Read project details in the Admin Area. +introduced_by_issue: https://gitlab.com/gitlab-org/gitlab/-/issues/534449 +introduced_by_mr: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/197777 +feature_category: admin +milestone: '18.3' diff --git a/ee/spec/policies/global_policy_spec.rb b/ee/spec/policies/global_policy_spec.rb index f84526d68fda8b58fcfc7c2ba31f7094019fbf5b..fc6fc36a2828af740f728c98307e197d372a0591 100644 --- a/ee/spec/policies/global_policy_spec.rb +++ b/ee/spec/policies/global_policy_spec.rb @@ -911,18 +911,21 @@ end context 'custom permissions', :enable_admin_mode do + let_it_be(:enabled_for_all) { %i[access_admin_area read_application_statistics] } + where(:custom_ability, :enabled_permissions) do - :read_admin_cicd | %i[access_admin_area read_admin_cicd] + :read_admin_cicd | %i[read_admin_cicd] :read_admin_monitoring | %i[ - access_admin_area read_admin_audit_log read_admin_background_migrations read_admin_gitaly_servers read_admin_health_check read_admin_system_information ] - :read_admin_subscription | %i[access_admin_area read_admin_subscription read_billable_member read_licenses] - :read_admin_users | %i[access_admin_area read_admin_users] + :read_admin_subscription | %i[read_admin_subscription read_billable_member read_licenses] + :read_admin_users | %i[read_admin_users] + :read_admin_groups | %i[read_admin_groups] + :read_admin_projects | %i[read_admin_projects] end with_them do @@ -936,7 +939,7 @@ stub_licensed_features(custom_roles: true) end - it { is_expected.to be_allowed(*enabled_permissions) } + it { is_expected.to be_allowed(*(enabled_permissions + enabled_for_all)) } end context 'when custom_roles feature is disabled' do @@ -944,7 +947,7 @@ stub_licensed_features(custom_roles: false) end - it { is_expected.to be_disallowed(*enabled_permissions) } + it { is_expected.to be_disallowed(*(enabled_permissions + enabled_for_all)) } end end end diff --git a/spec/policies/global_policy_spec.rb b/spec/policies/global_policy_spec.rb index cbc04ca9a7ab90b25bbe7a8b3c1f37db0b104991..42cb96a0491aa3942d4c3cd6f2edfc2cedf73723 100644 --- a/spec/policies/global_policy_spec.rb +++ b/spec/policies/global_policy_spec.rb @@ -754,6 +754,8 @@ :access_admin_area, :read_application_statistics, :read_admin_users, + :read_admin_groups, + :read_admin_projects, :read_admin_audit_log, :read_admin_background_jobs, :read_admin_background_migrations,