Merge pull request #1134 from code0-tech/#1114-add-namespace-admin-permission

added namespace admin permission

Author: raphael-goetz

app/models/concerns/namespace_parent.rb

@@ -11,7 +11,10 @@ def ensure_namespace
     return namespace if namespace.present?
 
     ns = build_namespace
-    ns.save if persisted?
+    if persisted?
+      ns.save
+      ns.ensure_personal_namespace_administrator! if ns.user_type?
+    end
     ns
   end
 end

app/models/namespace.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class Namespace < ApplicationRecord
+  PERSONAL_NAMESPACE_ADMINISTRATOR_ROLE_NAME = 'Administrator'
+
   belongs_to :parent, polymorphic: true
 
   has_many :roles, class_name: 'NamespaceRole', inverse_of: :namespace
@@ -33,6 +35,33 @@ def member?(user)
       namespace_members.exists?(user: user)
     end
   end
+
+  def personal_namespace_owner_member?(member)
+    user_type? && member&.namespace_id == id && member.user_id == parent_id
+  end
+
+  def personal_namespace_owner_administrator_role?(role)
+    return false unless user_type? && role&.namespace_id == id
+
+    role.members.exists?(id: personal_namespace_owner_member&.id) &&
+      role.abilities.exists?(ability: :namespace_administrator)
+  end
+
+  def ensure_personal_namespace_administrator!
+    return unless user_type?
+
+    role = roles.find_or_create_by!(name: PERSONAL_NAMESPACE_ADMINISTRATOR_ROLE_NAME)
+    role.abilities.find_or_create_by!(ability: :namespace_administrator)
+
+    member = namespace_members.find_or_create_by!(user_id: parent_id)
+    member.member_roles.find_or_create_by!(role: role)
+  end
+
+  private
+
+  def personal_namespace_owner_member
+    namespace_members.find_by(user_id: parent_id)
+  end
 end
 
 Namespace.prepend_extensions

app/policies/namespace_member_policy.rb

@@ -4,6 +4,12 @@ class NamespaceMemberPolicy < BasePolicy
   delegate { subject.namespace }
 
   condition(:member_is_self) { subject.user.id == user&.id }
+  condition(:personal_namespace_owner_member) { subject.namespace.personal_namespace_owner_member?(subject) }
 
   rule { member_is_self }.enable :delete_member
+
+  rule { personal_namespace_owner_member }.policy do
+    prevent :delete_member
+    prevent :assign_member_roles
+  end
 end

app/policies/namespace_role_policy.rb

@@ -2,4 +2,14 @@
 
 class NamespaceRolePolicy < BasePolicy
   delegate { subject.namespace }
+
+  condition(:personal_namespace_owner_administrator_role) do
+    subject.namespace.personal_namespace_owner_administrator_role?(subject)
+  end
+
+  rule { personal_namespace_owner_administrator_role }.policy do
+    prevent :delete_namespace_role
+    prevent :assign_role_abilities
+    prevent :assign_role_projects
+  end
 end

spec/models/namespace_spec.rb

@@ -42,4 +42,20 @@
       expect { namespace.member?(user) }.to match_query_count(0)
     end
   end
+
+  describe 'personal namespace administrator via ensure_namespace' do
+    let(:user) { create(:user) }
+
+    it 'adds the owner as an administrator member' do
+      namespace = user.ensure_namespace
+
+      owner_member = namespace.namespace_members.find_by(user: user)
+      administrator_role = namespace.roles
+                                    .joins(:abilities)
+                                    .find_by(namespace_role_abilities: { ability: :namespace_administrator })
+
+      expect(owner_member).to be_present
+      expect(owner_member.roles).to include(administrator_role)
+    end
+  end
 end

spec/policies/namespace_member_policy_spec.rb

@@ -16,5 +16,13 @@
 
       it { is_expected.to be_allowed(:delete_member) }
     end
+
+    context 'when member is the personal namespace owner' do
+      let(:namespace) { current_user.ensure_namespace }
+      let(:namespace_member) { namespace.namespace_members.find_by(user: current_user) }
+
+      it { is_expected.not_to be_allowed(:delete_member) }
+      it { is_expected.not_to be_allowed(:assign_member_roles) }
+    end
   end
 end

spec/policies/namespace_project_policy_spec.rb

@@ -20,4 +20,11 @@
 
     it { is_expected.to be_allowed(:read_namespace_project) }
   end
+
+  context 'when project belongs to the personal namespace' do
+    let(:namespace) { current_user.ensure_namespace }
+    let(:namespace_project) { create(:namespace_project, namespace: namespace) }
+
+    it { is_expected.to be_allowed(:update_namespace_project) }
+  end
 end

spec/policies/namespace_role_policy_spec.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe NamespaceRolePolicy do
+  subject { described_class.new(create_authentication(current_user), namespace_role) }
+
+  let(:current_user) { create(:user) }
+  let(:namespace_role) { create(:namespace_role) }
+
+  context 'when role is the personal namespace owner administrator role' do
+    let(:namespace) { current_user.ensure_namespace }
+    let(:namespace_role) do
+      namespace.namespace_members.find_by(user: current_user).roles
+               .joins(:abilities)
+               .find_by(namespace_role_abilities: { ability: :namespace_administrator })
+    end
+
+    it { is_expected.not_to be_allowed(:delete_namespace_role) }
+    it { is_expected.not_to be_allowed(:assign_role_abilities) }
+    it { is_expected.not_to be_allowed(:assign_role_projects) }
+  end
+end