diff --git a/app/assets/javascripts/packages_and_registries/settings/project/components/container_protection_tag_rules.vue b/app/assets/javascripts/packages_and_registries/settings/project/components/container_protection_tag_rules.vue index 860af1e9738a78fc43b07d2d43866399180ba7f3..ff9a7fcce6abb37d13e6b5e9953ef5993e214f67 100644 --- a/app/assets/javascripts/packages_and_registries/settings/project/components/container_protection_tag_rules.vue +++ b/app/assets/javascripts/packages_and_registries/settings/project/components/container_protection_tag_rules.vue @@ -346,7 +346,7 @@ export default { @click="openEditFormDrawer(item)" /> `destroyContainerRegistryProtectionTagRule` | [`Boolean!`](#boolean) | If `true`, the user can perform `destroy_container_registry_protection_tag_rule` on this resource. | +| `deleteContainerRegistryProtectionTagRule` | [`Boolean!`](#boolean) | If `true`, the user can perform `delete_container_registry_protection_tag_rule` on this resource. | ### `ContainerRepository` @@ -26904,7 +26904,8 @@ four standard [pagination arguments](#pagination-arguments): | Name | Type | Description | | ---- | ---- | ----------- | -| `destroyContainerRepository` | [`Boolean!`](#boolean) | If `true`, the user can perform `destroy_container_image` on this resource. | +| `destroyContainerImage` {{< icon name="warning-solid" >}} | [`Boolean!`](#boolean) | **Deprecated** in GitLab 18.5. This was renamed. Use: `delete_container_image`. | +| `destroyContainerRepository` | [`Boolean!`](#boolean) | If `true`, the user can perform `delete_container_image` on this resource. | ### `ContainerRepositoryReferrer` @@ -26975,7 +26976,8 @@ A tag from a container repository. | Name | Type | Description | | ---- | ---- | ----------- | -| `destroyContainerRepositoryTag` | [`Boolean!`](#boolean) | If `true`, the user can perform `destroy_container_image_tag` on this resource. | +| `destroyContainerImageTag` {{< icon name="warning-solid" >}} | [`Boolean!`](#boolean) | **Deprecated** in GitLab 18.5. This was renamed. Use: `delete_container_image_tag`. | +| `destroyContainerRepositoryTag` | [`Boolean!`](#boolean) | If `true`, the user can perform `delete_container_image_tag` on this resource. | ### `ContainerTagsExpirationPolicy` diff --git a/ee/spec/policies/container_registry/protection/tag_rule_policy_spec.rb b/ee/spec/policies/container_registry/protection/tag_rule_policy_spec.rb index f3096b815df187539503595a6df89b1a8d5ebfbf..a3115b887c07c8709d5ac14e132815879d28130d 100644 --- a/ee/spec/policies/container_registry/protection/tag_rule_policy_spec.rb +++ b/ee/spec/policies/container_registry/protection/tag_rule_policy_spec.rb @@ -24,7 +24,7 @@ project.send(:"add_#{user_role}", user) end - it { is_expected.to send(expected_result, :destroy_container_registry_protection_tag_rule) } + it { is_expected.to send(expected_result, :delete_container_registry_protection_tag_rule) } end end end diff --git a/ee/spec/policies/container_repository_policy_spec.rb b/ee/spec/policies/container_repository_policy_spec.rb index f9cd845c3fab9580919427c2d40e2596a93c6c43..b5c495102d80fea7188378affd1bb62f5b742eaa 100644 --- a/ee/spec/policies/container_repository_policy_spec.rb +++ b/ee/spec/policies/container_repository_policy_spec.rb @@ -9,7 +9,7 @@ subject { described_class.new(user, container_repository) } - describe 'destroy_container_image' do + describe 'delete_container_image' do context 'when the project has an immutable tag protection rule' do before_all do create(:container_registry_protection_tag_rule, :immutable, project:) @@ -28,14 +28,14 @@ project.send(:"add_#{user_role}", user) end - it { expect_allowed(:destroy_container_image) } + it { expect_allowed(:delete_container_image) } end end context 'when the current user is an admin', :enable_admin_mode do let(:user) { build_stubbed(:admin) } - it { expect_allowed(:destroy_container_image) } + it { expect_allowed(:delete_container_image) } end end @@ -48,14 +48,14 @@ project.send(:"add_#{user_role}", user) end - it { expect_allowed(:destroy_container_image) } + it { expect_allowed(:delete_container_image) } end end context 'when the current user is an admin', :enable_admin_mode do let(:user) { build_stubbed(:admin) } - it { expect_allowed(:destroy_container_image) } + it { expect_allowed(:delete_container_image) } end end end diff --git a/lib/api/project_container_repositories.rb b/lib/api/project_container_repositories.rb index 73455cb236d75eb2c7c9a8f288900088e1ac406a..eeeadf9e74f15b3c909ce4858bbaadd3db00b031 100644 --- a/lib/api/project_container_repositories.rb +++ b/lib/api/project_container_repositories.rb @@ -194,7 +194,7 @@ class ProjectContainerRepositories < ::API::Base requires :tag_name, type: String, desc: 'The name of the tag' end delete ':id/registry/repositories/:repository_id/tags/:tag_name', requirements: REPOSITORY_ENDPOINT_REQUIREMENTS do - authorize_destroy_container_image_tag! + authorize_delete_container_image_tag! result = ::Projects::ContainerRepository::DeleteTagsService .new(repository.project, current_user, tags: [declared_params[:tag_name]]) @@ -221,8 +221,8 @@ def authorize_read_container_image! authorize! :read_container_image, repository end - def authorize_destroy_container_image_tag! - authorize! :destroy_container_image_tag, tag + def authorize_delete_container_image_tag! + authorize! :delete_container_image_tag, tag end def authorize_admin_container_image! diff --git a/spec/controllers/projects/registry/tags_controller_spec.rb b/spec/controllers/projects/registry/tags_controller_spec.rb index e5d8ea752eefa22438982b366c2bc312390c58ed..08ce053fc48db466bf0c6ab079d77c253c985cc3 100644 --- a/spec/controllers/projects/registry/tags_controller_spec.rb +++ b/spec/controllers/projects/registry/tags_controller_spec.rb @@ -83,7 +83,7 @@ def get_tags describe 'POST destroy' do before do - allow(controller).to receive(:authorize_destroy_container_image_tag!).and_call_original + allow(controller).to receive(:authorize_delete_container_image_tag!).and_call_original end context 'when user has access to registry' do @@ -101,7 +101,7 @@ def get_tags destroy_tag('rc1') - expect(controller).to have_received(:authorize_destroy_container_image_tag!) + expect(controller).to have_received(:authorize_delete_container_image_tag!) end it 'makes it possible to delete a tag that ends with a dot' do @@ -109,7 +109,7 @@ def get_tags destroy_tag('test.') - expect(controller).to have_received(:authorize_destroy_container_image_tag!) + expect(controller).to have_received(:authorize_delete_container_image_tag!) end it 'tracks the event', :snowplow do @@ -126,13 +126,13 @@ def get_tags before do project.add_developer(user) allow(Ability).to receive(:allowed?).and_call_original - allow(Ability).to receive(:allowed?).with(user, :destroy_container_image_tag, project).and_return(false) + allow(Ability).to receive(:allowed?).with(user, :delete_container_image_tag, project).and_return(false) end it 'returns not_found' do destroy_tag('test.') - expect(controller).to have_received(:authorize_destroy_container_image_tag!) + expect(controller).to have_received(:authorize_delete_container_image_tag!) expect(response).to have_gitlab_http_status(:not_found) end end diff --git a/spec/graphql/mutations/container_repositories/destroy_spec.rb b/spec/graphql/mutations/container_repositories/destroy_spec.rb index ff2d35ffecf2a17407798b0d28e49abffd6f3dcd..56a87d61e56d1fc6e8cb669689282d024cdfdbcd 100644 --- a/spec/graphql/mutations/container_repositories/destroy_spec.rb +++ b/spec/graphql/mutations/container_repositories/destroy_spec.rb @@ -12,7 +12,7 @@ let_it_be(:project) { container_repository.project } let(:id) { container_repository.to_global_id } - specify { expect(described_class).to require_graphql_authorizations(:destroy_container_image) } + specify { expect(described_class).to require_graphql_authorizations(:delete_container_image) } describe '#resolve' do let(:tags) { %w[a b c] } diff --git a/spec/graphql/mutations/container_repositories/destroy_tags_spec.rb b/spec/graphql/mutations/container_repositories/destroy_tags_spec.rb index d4c96c5bca2d433022559dc97e91e98aa0012a08..da72922f61bdf68bdddf3ed054ad486e321a27a1 100644 --- a/spec/graphql/mutations/container_repositories/destroy_tags_spec.rb +++ b/spec/graphql/mutations/container_repositories/destroy_tags_spec.rb @@ -11,7 +11,7 @@ let(:id) { repository.to_global_id } let(:current_user) { create(:user) } - specify { expect(described_class).to require_graphql_authorizations(:destroy_container_image_tag) } + specify { expect(described_class).to require_graphql_authorizations(:delete_container_image_tag) } describe '#resolve' do let(:tags) { %w[A C D E] } diff --git a/spec/policies/container_registry/protection/tag_rule_policy_spec.rb b/spec/policies/container_registry/protection/tag_rule_policy_spec.rb index f70a04d0c6731d6774ac8f45dcb19a6c64dca54d..3a4c619208363a5afe5a31d3ad3f48da07da7542 100644 --- a/spec/policies/container_registry/protection/tag_rule_policy_spec.rb +++ b/spec/policies/container_registry/protection/tag_rule_policy_spec.rb @@ -14,14 +14,14 @@ let(:user) { nil } let_it_be(:rule) { build(:container_registry_protection_tag_rule) } - it { expect_disallowed(:destroy_container_registry_protection_tag_rule) } + it { expect_disallowed(:delete_container_registry_protection_tag_rule) } end context 'for admin', :enable_admin_mode do let(:user) { build_stubbed(:admin) } let_it_be(:rule) { build(:container_registry_protection_tag_rule) } - it { expect_allowed(:destroy_container_registry_protection_tag_rule) } + it { expect_allowed(:delete_container_registry_protection_tag_rule) } end context 'for a tag rule' do @@ -38,7 +38,7 @@ project.send(:"add_#{user_role}", user) end - it { is_expected.to send(expected_result, :destroy_container_registry_protection_tag_rule) } + it { is_expected.to send(expected_result, :delete_container_registry_protection_tag_rule) } end end end diff --git a/spec/policies/container_registry/tag_policy_spec.rb b/spec/policies/container_registry/tag_policy_spec.rb index 04eecd7c73d785f13192b111de614b29d78d53d3..3dfa225b2efaad04aefdd17e4bbd4069f8bec3df 100644 --- a/spec/policies/container_registry/tag_policy_spec.rb +++ b/spec/policies/container_registry/tag_policy_spec.rb @@ -11,7 +11,7 @@ subject { described_class.new(user, tag) } - describe 'destroy_container_image_tag' do + describe 'delete_container_image_tag' do using RSpec::Parameterized::TableSyntax shared_examples 'matching expected result with protection rules' do @@ -23,13 +23,13 @@ allow(tag).to receive(:protection_rule).and_return(protection_rule) end - it { is_expected.to send(expected_result, :destroy_container_image_tag) } + it { is_expected.to send(expected_result, :delete_container_image_tag) } end context 'for admin', :enable_admin_mode do let(:user) { build_stubbed(:admin) } - it { expect_allowed(:destroy_container_image_tag) } + it { expect_allowed(:delete_container_image_tag) } end context 'for owner' do @@ -38,7 +38,7 @@ end context 'when tag has no protection rule' do - it { expect_allowed(:destroy_container_image_tag) } + it { expect_allowed(:delete_container_image_tag) } end context 'when tag has protection rule' do @@ -60,7 +60,7 @@ end context 'when tag has no protection rule' do - it { expect_allowed(:destroy_container_image_tag) } + it { expect_allowed(:delete_container_image_tag) } end context 'when tag has protection rule' do @@ -82,7 +82,7 @@ end context 'when tag has no protection rule' do - it { expect_allowed(:destroy_container_image_tag) } + it { expect_allowed(:delete_container_image_tag) } end context 'when tag has protection rule' do diff --git a/spec/policies/container_repository_policy_spec.rb b/spec/policies/container_repository_policy_spec.rb index f3a09ea34a319a4606796e469d77b45a255c9c7d..61957fd6bd9547596aeb68ab34eb6c02d97c84a5 100644 --- a/spec/policies/container_repository_policy_spec.rb +++ b/spec/policies/container_repository_policy_spec.rb @@ -13,11 +13,11 @@ context 'when the current user is anonymous' do let(:user) { nil } - it { is_expected.to be_disallowed(:destroy_container_image) } + it { is_expected.to be_disallowed(:delete_container_image) } end end - describe 'destroy_container_image' do + describe 'delete_container_image' do using RSpec::Parameterized::TableSyntax before do @@ -47,13 +47,13 @@ project.send(:"add_#{user_role}", user) end - it { is_expected.to send(expected_result, :destroy_container_image) } + it { is_expected.to send(expected_result, :delete_container_image) } end context 'when the current user is an admin', :enable_admin_mode do let(:user) { build_stubbed(:admin) } - it { expect_allowed(:destroy_container_image) } + it { expect_allowed(:delete_container_image) } end it_behaves_like 'not allowing anonymous user' @@ -68,7 +68,7 @@ project.send(:"add_#{user_role}", user) end - it { expect_allowed(:destroy_container_image) } + it { expect_allowed(:delete_container_image) } end end @@ -85,7 +85,7 @@ project.send(:"add_#{user_role}", user) end - it { expect_allowed(:destroy_container_image) } + it { expect_allowed(:delete_container_image) } end end diff --git a/spec/policies/project_policy_spec.rb b/spec/policies/project_policy_spec.rb index d3b3b852dcf365b56b06363591ccc1181e74c013..d9533b876538547bc397494e102b1f906226ae3d 100644 --- a/spec/policies/project_policy_spec.rb +++ b/spec/policies/project_policy_spec.rb @@ -3221,7 +3221,7 @@ def update_access_level(project, feature, state) let(:developer_operations_permissions) do guest_operations_permissions + [ - :create_container_image, :update_container_image, :destroy_container_image, :destroy_container_image_tag + :create_container_image, :update_container_image, :delete_container_image, :delete_container_image_tag ] end diff --git a/spec/requests/api/graphql/mutations/container_registry/protection/tag_rule/delete_spec.rb b/spec/requests/api/graphql/mutations/container_registry/protection/tag_rule/delete_spec.rb index 2ffd1aead9b02931b01d626615e70a38b9e7100b..d2beb7f44ee5c0fe66da81c4b2da621e4ef5b124 100644 --- a/spec/requests/api/graphql/mutations/container_registry/protection/tag_rule/delete_spec.rb +++ b/spec/requests/api/graphql/mutations/container_registry/protection/tag_rule/delete_spec.rb @@ -21,7 +21,7 @@ stub_gitlab_api_client_to_support_gitlab_api(supported: true) end - specify { expect(described_class).to require_graphql_authorizations(:destroy_container_registry_protection_tag_rule) } + specify { expect(described_class).to require_graphql_authorizations(:delete_container_registry_protection_tag_rule) } subject(:post_graphql_mutation_request) do post_graphql_mutation(mutation, current_user: current_user) @@ -48,7 +48,7 @@ 'minimumAccessLevelForDelete' => container_protection_rule.minimum_access_level_for_delete.upcase, 'minimumAccessLevelForPush' => container_protection_rule.minimum_access_level_for_push.upcase, 'userPermissions' => { - 'destroyContainerRegistryProtectionTagRule' => true + 'deleteContainerRegistryProtectionTagRule' => true } ) ) diff --git a/spec/support/shared_contexts/policies/project_policy_shared_context.rb b/spec/support/shared_contexts/policies/project_policy_shared_context.rb index ec36bf8f8453ce72f10b33dd4d0dc410b7aab885..39377958c250f7c89470797c09faf269936afce3 100644 --- a/spec/support/shared_contexts/policies/project_policy_shared_context.rb +++ b/spec/support/shared_contexts/policies/project_policy_shared_context.rb @@ -67,7 +67,7 @@ create_commit_status create_container_image create_deployment create_environment create_merge_request_from create_pipeline create_release create_wiki - destroy_container_image destroy_container_image_tag push_code read_pod_logs + delete_container_image delete_container_image_tag push_code read_pod_logs read_terraform_state resolve_note update_build cancel_build update_container_image update_deployment update_environment update_merge_request update_pipeline update_release destroy_release