Move to minimum role project create restriction
What does this MR do and why?
As group setting of Roles allowed to create projects
means minimum roles allowed to create projects, I changed code like below.
- Added the word
minimum
to the dropdown title. - Changed the dropdown item of
Developers + Maintainers
toDevelopers
. - Renamed
DEVELOPER_MAINTAINER_PROJECT_ACCESS
toDEVELOPER_PROJECT_ACCESS
throughout the codebase, including variable and method names of a similar nature. (BecauseDEVELOPER_MAINTAINER_PROJECT_ACCESS
meantDevelopers + Maintainers
.) - Added one test for
user#manageable_groups
after renamed the method's argument name. Because I found that there wasn't a test for it. - Changed the order of the dropdown items from highest to lowest roles.
References
MR acceptance checklist
Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Screenshots or screen recordings
Please see the dropdown title, the item of Developers
and the items' order.
- Group settings
Before | After |
---|---|
![]() |
![]() |
![]() |
![]() |
- Group settings in admin area
Before | After |
---|---|
![]() |
![]() |
![]() |
![]() |
- Default settings in admin area
Before | After |
---|---|
![]() |
![]() |
How to set up and validate locally
- Open gdk in a browser, and log in as an admin user.
- Open group settings. http://gdk.local:3000/groups/twitter/-/edit#js-permissions-settings
SeeMinimum roles allowed to create projects
. (Please read it differently, if your gdk's domain and group names are different) - Open group settings in admin area. http://gdk.local:3000/admin/groups/twitter/edit
SeeMinimum roles allowed to create projects
. - Open default settings in admin area. http://gdk.local:3000/admin/application_settings/general#js-visibility-settings
SeeDefault minimum roles for project creation protection
.
Concern
I changed Roles allowed to create projects
to Minimum roles allowed to create projects
of the dropdown title in group settings. I think Roles allowed to create subgroups
below it also means minimum roles. I suggest to add word minimum
to it in another MR.
The reason why it means minimum
is that Owner and Maintainer with ::Gitlab::Access::MAINTAINER_SUBGROUP_ACCESS
can create subgroups according to the following code.
https://gitlab.com/gitlab-org/gitlab/-/blob/master/app/policies/group_policy.rb#L330
rule { maintainer & maintainer_can_create_group }.enable :create_subgroup
https://gitlab.com/gitlab-org/gitlab/-/blob/master/app/policies/group_policy.rb#L20
condition(:maintainer) { access_level >= GroupMember::MAINTAINER }
Note
I found Gitlab::Access.project_creation_options
in https://gitlab.com/gitlab-org/gitlab/-/blob/master/ee/app/views/admin/application_settings/_project_creation_level.html.haml#L6.
But I don't think this file is called from anywhere. So there isn't a screenshot.
Related to #507410 (closed)