Skip to content

Move `authorize_read_build_trace!` out of `Projects::ApplicationController`

Problem

We currently have authorize_read_build_trace! in the Projects::ApplicationController that provides a more specific error message if debug_mode is enabled. This code isn't scoped to the domain.

This code should be moved out of the Projects::ApplicationController to somewhere more specific to the CI domain. Currently it is there because it needs to be shared with the artifacts and jobs controllers but ends up callable from all project related controllers when it's only relevant in those two.

It should be scoped to CI via an concern.


Implementation Plan

Delete authorize_read_build_trace! from Projects::ApplicationController

Add a new file at app/controllers/concerns/ci/auth_build_trace.rb

with roughly the following content

module Ci
  module AuthBuildTrace
    extend ActiveSupport::Concern

    def authorize_read_build_trace!
      return if can?(current_user, :read_build_trace, build)

      if build.debug_mode?
        access_denied!(
          _('You must have developer or higher permissions in the associated project to view job logs when debug trace ' \
            "is enabled. To disable debug trace, set the 'CI_DEBUG_TRACE' and 'CI_DEBUG_SERVICES' variables to 'false' " \
            'in your pipeline configuration or CI/CD settings. If you must view this job log, a project maintainer ' \
            'or owner must add you to the project with developer permissions or higher.')
        )
      else
        access_denied!(_('The current user is not authorized to access the job log.'))
      end
    end
  end
end

Add the includes to the Projects::JobsController and the Projects::ArtifactsController. Code samples:

class Projects::JobsController < Projects::ApplicationController
  include Ci::AuthBuildTrace
class Projects::ArtifactsController < Projects::ApplicationController
  include Ci::AuthBuildTrace
Edited by Allison Browne