Fix assignment policies and authorize assignment views #18791
+27
−2
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
krauselukas
commented
Nov 6, 2025
krauselukas
commented
- The policy doesn't check if the assigner is authorized to add an assignee to a package. As of now everyone can add an assignee. We have to check if the assigner is a collaborator as well.
- Right now we show the assignment option to every user. We should only show it if the user is actually authorized to assign someone.
The policy doesn't check if the assigner is authorized to add an assignee to a package. As of now everyone can add an assigne. We have to check if the assigner is a collaborator as well.
Right now we show the assignment option to every user. We should only show it if the user is actually authorized to assign someone.
krauselukas
force-pushed
the
fix/show_assignment_option_authorization
branch
from
f92bd5e to
e6026eb
Compare
danidoni
reviewed
Nov 7, 2025
| return true if user.admin? | ||
| return false unless assigneer_is_a_collaborator? | ||
|
|
||
| record.assignee_is_a_collaborator? |
Contributor
There was a problem hiding this comment.
Correct me if I'm wrong:
We check the assigner is a collaborator and can indeed assign someone, that's right.
But then we check we can only assign collaborators.
So in the end this only allow collaborators to assign other collaborators, is this how it should be?
danidoni
reviewed
Nov 7, 2025
Comment on lines
+71
to
+76
| def assigneer_is_a_collaborator? | ||
| collaborators = (record.relationships + record.project.relationships).map(&:user) | ||
| return false if collaborators.empty? | ||
|
|
||
| collaborators.include?(user) | ||
| end |
Contributor
There was a problem hiding this comment.
I think this can be moved into User, that way you can reuse it for this and for the AssignmentPolicy
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.