Skip to content

🛂 Update Handling of Gem Permissions #5849

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
landongrindheim wants to merge 15 commits into
base: master
Choose a base branch
from
Open

🛂 Update Handling of Gem Permissions #5849

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
3202054
Make ownership an organization OR user concern
landongrindheim Jul 25, 2025
4ad20fd
Add role-based methods to Organization
landongrindheim Jul 29, 2025
e5c7c3e
Introduce GemPermissions for finer grained access
landongrindheim Jul 29, 2025
d70f77e
Use GemPermissions for policies
landongrindheim Jul 30, 2025
30706cf
Allow anyone with push access to view events
landongrindheim Jul 30, 2025
964234a
Rename can_admin? -> can_perform_gem_admin?
landongrindheim Jul 30, 2025
c2596bb
Update ownership-based policies to use permissions
landongrindheim Jul 30, 2025
16c0340
Move to permissions-based access
landongrindheim Jul 30, 2025
f9deac5
Remove unused method
landongrindheim Jul 30, 2025
cffa861
Consider `can_push?` instead of ownership
landongrindheim Jul 30, 2025
f155580
Remove Rubygem#owned_by?
landongrindheim Jul 30, 2025
9e868f7
Test that maintainers cannot invite new members
landongrindheim Aug 8, 2025
6759a19
Remove edge case tests
landongrindheim Nov 7, 2025
f404215
Merge branch 'master' into landon/push-ownership-logic-to-rubygem-model
landongrindheim Nov 7, 2025
28ca093
Prevent maintainers (not owners) from transfering
landongrindheim Nov 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions app/models/rubygem.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -186,13 +186,17 @@ def indexed_versions?
end

def owned_by?(user)
return false unless user
ownerships.exists?(user_id: user.id) || (owned_by_organization? && user_authorized_for_organization?(user))
owned_by_with_role?(user, :maintainer)
end

def owned_by_with_role?(user, minimum_required_role)
return false if user.blank?
ownerships.user_with_minimum_role(user, minimum_required_role).exists?

if owned_by_organization?
organization.memberships.where(user: user).with_minimum_role(minimum_required_role).exists?
Copy link
Member

@colby-swandale colby-swandale Jul 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will leave out the current implementation of Outside Contributors, which uses the ownerships table.

else
ownerships.user_with_minimum_role(user, minimum_required_role).exists?
end
rescue KeyError
false
end
Expand Down
7 changes: 2 additions & 5 deletions app/policies/application_policy.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,14 +37,11 @@ def current_user?(record_user)

def rubygem_owned_by?(user)
rubygem.owned_by?(user) ||
organization_member_with_role?(user, :maintainer) ||
deny(t(:forbidden))
end

def rubygem_owned_by_with_role?(user, minimum_required_role:, minimum_required_org_role: :owner)
organization_member_with_role?(user, minimum_required_org_role) ||
rubygem.owned_by_with_role?(user, minimum_required_role) ||
deny(t(:forbidden))
def rubygem_owned_by_with_role?(user, minimum_required_role:)
rubygem.owned_by_with_role?(user, minimum_required_role) || deny(t(:forbidden))
end

def organization_member_with_role?(user, minimum_role)
Expand Down
6 changes: 3 additions & 3 deletions app/policies/oidc/rubygem_trusted_publisher_policy.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,14 +5,14 @@ class Scope < ApplicationPolicy::Scope
delegate :rubygem, to: :record

def show?
rubygem_owned_by_with_role?(user, minimum_required_role: :owner, minimum_required_org_role: :admin)
rubygem_owned_by_with_role?(user, minimum_required_role: :owner)
end

def create?
rubygem_owned_by_with_role?(user, minimum_required_role: :owner, minimum_required_org_role: :admin)
rubygem_owned_by_with_role?(user, minimum_required_role: :owner)
end

def destroy?
rubygem_owned_by_with_role?(user, minimum_required_role: :owner, minimum_required_org_role: :admin)
rubygem_owned_by_with_role?(user, minimum_required_role: :owner)
end
end
6 changes: 3 additions & 3 deletions app/policies/rubygem_policy.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,19 +13,19 @@ def create?
end

def configure_oidc?
rubygem_owned_by_with_role?(user, minimum_required_role: :owner, minimum_required_org_role: :admin)
rubygem_owned_by_with_role?(user, minimum_required_role: :admin)
end

def configure_trusted_publishers?
rubygem_owned_by_with_role?(user, minimum_required_role: :owner, minimum_required_org_role: :admin)
rubygem_owned_by_with_role?(user, minimum_required_role: :admin)
end

def show_events?
rubygem_owned_by?(user)
end

def show_unconfirmed_ownerships?
rubygem_owned_by_with_role?(user, minimum_required_role: :owner, minimum_required_org_role: :admin)
rubygem_owned_by_with_role?(user, minimum_required_role: :admin)
end

def add_owner?
Expand Down
17 changes: 9 additions & 8 deletions test/policies/rubygem_policy_test.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,12 +48,12 @@ def org_policy!(user)
refute_authorized policy!(nil), :configure_oidc?
end

should "only allow owners, org owners and admins" do
should "only allow org owners and admins when owned by an org" do
assert_authorized org_policy!(@org_owner), :configure_oidc?
assert_authorized org_policy!(@org_admin), :configure_oidc?
assert_authorized org_policy!(@owner), :configure_oidc?

refute_authorized org_policy!(@org_maintainer), :configure_oidc?
refute_authorized org_policy!(@owner), :configure_oidc?
refute_authorized org_policy!(@user), :configure_oidc?
refute_authorized org_policy!(nil), :configure_oidc?
end
Expand All @@ -71,10 +71,11 @@ def org_policy!(user)
assert_authorized org_policy!(@org_owner), :show_events?
assert_authorized org_policy!(@org_admin), :show_events?
assert_authorized org_policy!(@org_maintainer), :show_events?
assert_authorized org_policy!(@owner), :show_events?
assert_authorized org_policy!(@maintainer), :show_events?

# the gem is owned by an org, so org membership is prioritized
refute_authorized org_policy!(@user), :show_events?
refute_authorized org_policy!(@owner), :show_events?
refute_authorized org_policy!(@maintainer), :show_events?
refute_authorized org_policy!(nil), :show_events?
end
end
Expand All @@ -87,12 +88,12 @@ def org_policy!(user)
refute_authorized policy!(nil), :configure_trusted_publishers?
end

should "only allow owners, org owners and admins" do
should "only allow org owners and admins when gem is owned by an org" do
assert_authorized org_policy!(@org_owner), :configure_trusted_publishers?
assert_authorized org_policy!(@org_admin), :configure_trusted_publishers?
assert_authorized org_policy!(@owner), :configure_trusted_publishers?

refute_authorized org_policy!(@org_maintainer), :configure_trusted_publishers?
refute_authorized org_policy!(@owner), :configure_trusted_publishers?
refute_authorized org_policy!(@maintainer), :configure_trusted_publishers?
refute_authorized org_policy!(@user), :configure_trusted_publishers?
refute_authorized org_policy!(nil), :configure_trusted_publishers?
Expand All @@ -107,12 +108,12 @@ def org_policy!(user)
refute_authorized policy!(nil), :show_unconfirmed_ownerships?
end

should "only allow owners, org owners and admins" do
should "only allow org owners and admins when gem is owned by an org" do
assert_authorized org_policy!(@org_owner), :show_unconfirmed_ownerships?
assert_authorized org_policy!(@org_admin), :show_unconfirmed_ownerships?
assert_authorized org_policy!(@owner), :show_unconfirmed_ownerships?

refute_authorized org_policy!(@org_maintainer), :show_unconfirmed_ownerships?
refute_authorized org_policy!(@owner), :show_unconfirmed_ownerships?
refute_authorized org_policy!(@user), :show_unconfirmed_ownerships?
refute_authorized org_policy!(nil), :show_unconfirmed_ownerships?
end
Expand Down
Loading