Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
李少辉-开发者
gitlab-foss
提交
d7f10c29
G
gitlab-foss
项目概览
李少辉-开发者
/
gitlab-foss
通知
15
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
G
gitlab-foss
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
前往新版Gitcode,体验更适合开发者的 AI 搜索 >>
提交
d7f10c29
编写于
6月 14, 2019
作者:
M
Mayra Cabrera
提交者:
Stan Hu
6月 14, 2019
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
Do not blindly expose public project statistics
Add the missing check on GraphQL API for project statistics
上级
ad722a4e
变更
5
隐藏空白更改
内联
并排
Showing
5 changed file
with
93 addition
and
3 deletion
+93
-3
app/graphql/types/project_statistics_type.rb
app/graphql/types/project_statistics_type.rb
+2
-0
app/graphql/types/project_type.rb
app/graphql/types/project_type.rb
+1
-1
app/policies/project_statistics_policy.rb
app/policies/project_statistics_policy.rb
+5
-0
spec/policies/project_statistics_policy_spec.rb
spec/policies/project_statistics_policy_spec.rb
+83
-0
spec/requests/api/graphql/project/project_statistics_spec.rb
spec/requests/api/graphql/project/project_statistics_spec.rb
+2
-2
未找到文件。
app/graphql/types/project_statistics_type.rb
浏览文件 @
d7f10c29
...
...
@@ -4,6 +4,8 @@ module Types
class
ProjectStatisticsType
<
BaseObject
graphql_name
'ProjectStatistics'
authorize
:read_statistics
field
:commit_count
,
GraphQL
::
INT_TYPE
,
null:
false
field
:storage_size
,
GraphQL
::
INT_TYPE
,
null:
false
...
...
app/graphql/types/project_type.rb
浏览文件 @
d7f10c29
...
...
@@ -70,7 +70,7 @@ module Types
field
:group
,
Types
::
GroupType
,
null:
true
field
:statistics
,
Types
::
ProjectStatisticsType
,
null:
fals
e
,
null:
tru
e
,
resolve:
->
(
obj
,
_args
,
_ctx
)
{
Gitlab
::
Graphql
::
Loaders
::
BatchProjectStatisticsLoader
.
new
(
obj
.
id
).
find
}
field
:repository
,
Types
::
RepositoryType
,
null:
false
...
...
app/policies/project_statistics_policy.rb
0 → 100644
浏览文件 @
d7f10c29
# frozen_string_literal: true
class
ProjectStatisticsPolicy
<
BasePolicy
delegate
{
@subject
.
project
}
end
spec/policies/project_statistics_policy_spec.rb
0 → 100644
浏览文件 @
d7f10c29
# frozen_string_literal: true
require
'spec_helper'
describe
ProjectStatisticsPolicy
do
using
RSpec
::
Parameterized
::
TableSyntax
describe
'#rules'
do
let
(
:external
)
{
create
(
:user
,
:external
)
}
let
(
:guest
)
{
create
(
:user
)
}
let
(
:reporter
)
{
create
(
:user
)
}
let
(
:developer
)
{
create
(
:user
)
}
let
(
:maintainer
)
{
create
(
:user
)
}
let
(
:users
)
do
{
unauthenticated:
nil
,
non_member:
create
(
:user
),
guest:
guest
,
reporter:
reporter
,
developer:
developer
,
maintainer:
maintainer
}
end
where
(
:project_type
,
:user_type
,
:outcome
)
do
[
# Public projects
[
:public
,
:unauthenticated
,
false
],
[
:public
,
:non_member
,
false
],
[
:public
,
:guest
,
false
],
[
:public
,
:reporter
,
true
],
[
:public
,
:developer
,
true
],
[
:public
,
:maintainer
,
true
],
# Private project
[
:private
,
:unauthenticated
,
false
],
[
:private
,
:non_member
,
false
],
[
:private
,
:guest
,
false
],
[
:private
,
:reporter
,
true
],
[
:private
,
:developer
,
true
],
[
:private
,
:maintainer
,
true
],
# Internal projects
[
:internal
,
:unauthenticated
,
false
],
[
:internal
,
:non_member
,
false
],
[
:internal
,
:guest
,
false
],
[
:internal
,
:reporter
,
true
],
[
:internal
,
:developer
,
true
],
[
:internal
,
:maintainer
,
true
]
]
end
with_them
do
let
(
:user
)
{
users
[
user_type
]
}
let
(
:project
)
{
create
(
:project
,
visibility_level:
Gitlab
::
VisibilityLevel
.
level_value
(
project_type
.
to_s
))
}
let
(
:project_statistics
)
{
create
(
:project_statistics
,
project:
project
)
}
subject
{
Ability
.
allowed?
(
user
,
:read_statistics
,
project_statistics
)
}
before
do
project
.
add_guest
(
guest
)
project
.
add_reporter
(
reporter
)
project
.
add_developer
(
developer
)
project
.
add_maintainer
(
maintainer
)
end
it
{
is_expected
.
to
eq
(
outcome
)
}
context
'when the user is external'
do
let
(
:user
)
{
external
}
before
do
unless
[
:unauthenticated
,
:non_member
].
include?
(
user_type
)
project
.
add_user
(
external
,
user_type
)
end
end
it
{
is_expected
.
to
eq
(
outcome
)
}
end
end
end
end
spec/requests/api/graphql/project/project_statistics_spec.rb
浏览文件 @
d7f10c29
...
...
@@ -34,10 +34,10 @@ describe 'rendering namespace statistics' do
context
'when the project is public'
do
let
(
:project
)
{
create
(
:project
,
:public
)
}
it
'
includes the statistics regardless of the user
'
do
it
'
hides statistics for unauthenticated requests
'
do
post_graphql
(
query
,
current_user:
nil
)
expect
(
graphql_data
[
'project'
][
'statistics'
]).
to
be_
present
expect
(
graphql_data
[
'project'
][
'statistics'
]).
to
be_
blank
end
end
end
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录