From 0a0f66c816469e197237a6eeaedeb959b5d1c823 Mon Sep 17 00:00:00 2001
From: Michael Kozono <mkozono@gmail.com>
Date: Mon, 22 May 2017 12:44:59 -0700
Subject: [PATCH] Refactor to remove a special case

---
 lib/gitlab/ci_access.rb           |  9 +++++++++
 lib/gitlab/git_access.rb          | 12 +++++-------
 spec/lib/gitlab/ci_access_spec.rb | 15 +++++++++++++++
 3 files changed, 29 insertions(+), 7 deletions(-)
 create mode 100644 lib/gitlab/ci_access.rb
 create mode 100644 spec/lib/gitlab/ci_access_spec.rb

diff --git a/lib/gitlab/ci_access.rb b/lib/gitlab/ci_access.rb
new file mode 100644
index 00000000000..def1373d8cf
--- /dev/null
+++ b/lib/gitlab/ci_access.rb
@@ -0,0 +1,9 @@
+module Gitlab
+  # For backwards compatibility, generic CI (which is a build without a user) is
+  # allowed to :build_download_code without any other checks.
+  class CiAccess
+    def can_do_action?(action)
+      action == :build_download_code
+    end
+  end
+end
diff --git a/lib/gitlab/git_access.rb b/lib/gitlab/git_access.rb
index 75cc69c02f7..f44426d62b8 100644
--- a/lib/gitlab/git_access.rb
+++ b/lib/gitlab/git_access.rb
@@ -29,7 +29,11 @@ module Gitlab
       @project  = project
       @protocol = protocol
       @authentication_abilities = authentication_abilities
-      @user_access = UserAccess.new(user, project: project)
+      @user_access = if ci?
+                       CiAccess.new
+                     else
+                       UserAccess.new(user, project: project)
+                     end
     end
 
     def check(cmd, changes)
@@ -62,11 +66,6 @@ module Gitlab
       authentication_abilities.include?(:build_download_code) && user_access.can_do_action?(:build_download_code)
     end
 
-    # Allow generic CI (build without a user) for backwards compatibility
-    def ci_can_download_code?
-      authentication_abilities.include?(:build_download_code) && ci?
-    end
-
     def protocol_allowed?
       Gitlab::ProtocolAccess.allowed?(protocol)
     end
@@ -129,7 +128,6 @@ module Gitlab
       return if deploy_key?
 
       passed = user_can_download_code? ||
-        ci_can_download_code? ||
         build_can_download_code? ||
         guest_can_download_code?
 
diff --git a/spec/lib/gitlab/ci_access_spec.rb b/spec/lib/gitlab/ci_access_spec.rb
new file mode 100644
index 00000000000..eaf8f1d0f1c
--- /dev/null
+++ b/spec/lib/gitlab/ci_access_spec.rb
@@ -0,0 +1,15 @@
+require 'spec_helper'
+
+describe Gitlab::CiAccess, lib: true do
+  let(:access) { Gitlab::CiAccess.new }
+
+  describe '#can_do_action?' do
+    context 'when action is :build_download_code' do
+      it { expect(access.can_do_action?(:build_download_code)).to be_truthy }
+    end
+
+    context 'when action is not :build_download_code' do
+      it { expect(access.can_do_action?(:download_code)).to be_falsey }
+    end
+  end
+end
-- 
GitLab