diff --git a/app/policies/base_policy.rb b/app/policies/base_policy.rb index ef15569c16c7b42e1fe3730596083b5dcdb9c5ee..21ada3bb99ff1783a22c5ffc7fb88476a60e006f 100644 --- a/app/policies/base_policy.rb +++ b/app/policies/base_policy.rb @@ -5,6 +5,7 @@ class BasePolicy < DeclarativePolicy::Base with_options scope: :user, score: 0 condition(:admin) do next false if @user&.from_ci_job_token? + next true if user_is_user? && @user.admin_bot? if Gitlab::CurrentSettings.admin_mode Gitlab::Auth::CurrentUserMode.new(@user).admin_mode? diff --git a/ee/spec/services/compliance_management/pipl/block_non_compliant_user_service_spec.rb b/ee/spec/services/compliance_management/pipl/block_non_compliant_user_service_spec.rb index 05c122b141ced364b7d8c327945d6fd7656ec956..35c912d294167161fdfffe6d93624996fd013ffc 100644 --- a/ee/spec/services/compliance_management/pipl/block_non_compliant_user_service_spec.rb +++ b/ee/spec/services/compliance_management/pipl/block_non_compliant_user_service_spec.rb @@ -8,7 +8,7 @@ subject(:execute) { described_class.new(pipl_user: pipl_user, current_user: blocking_user).execute } let(:pipl_user) { create(:pipl_user) } - let(:blocking_user) { Users::Internal.admin_bot } + let(:blocking_user) { create(:user, :admin) } shared_examples 'does not block the user' do it 'does not change the user status and note' do @@ -94,7 +94,7 @@ end context 'when the block operation fails' do - let(:pipl_user) { create(:pipl_user, user: blocking_user, initial_email_sent_at: 60.days.ago) } + let(:pipl_user) { create(:pipl_user, user: Users::Internal.admin_bot, initial_email_sent_at: 60.days.ago) } it_behaves_like 'does not block the user' it_behaves_like 'has a validation error', diff --git a/ee/spec/services/compliance_management/pipl/delete_non_compliant_user_service_spec.rb b/ee/spec/services/compliance_management/pipl/delete_non_compliant_user_service_spec.rb index c0aa1016f3426f66dac30bb65bdffbbe3f302952..f73b525c589b7b0f946ed56718c4249b4701e058 100644 --- a/ee/spec/services/compliance_management/pipl/delete_non_compliant_user_service_spec.rb +++ b/ee/spec/services/compliance_management/pipl/delete_non_compliant_user_service_spec.rb @@ -9,7 +9,7 @@ let_it_be_with_reload(:pipl_user) { create(:pipl_user, :deletable) } let_it_be_with_reload(:user) { pipl_user.user } - let(:deleting_user) { Users::Internal.admin_bot } + let(:deleting_user) { create(:user, :admin) } shared_examples 'does not delete the user' do it 'does not schedule a deletion migration' do diff --git a/spec/policies/base_policy_spec.rb b/spec/policies/base_policy_spec.rb index 5512484d4c335f06c2bb7f6b933e559895e3e6ec..d5e95625c9fed4ff050799aaa264b902aca475fe 100644 --- a/spec/policies/base_policy_spec.rb +++ b/spec/policies/base_policy_spec.rb @@ -65,6 +65,12 @@ def policy end end + context 'with the admin bot user' do + let(:current_user) { ::Users::Internal.admin_bot } + + it { is_expected.to be_allowed(ability) } + end + context 'with anonymous' do let(:current_user) { nil } diff --git a/spec/policies/group_policy_spec.rb b/spec/policies/group_policy_spec.rb index e89fff842e518815dde8781aa3234c52b0416e07..6471e3d8cfb2b5735331e5db3be7e5f9a3331536 100644 --- a/spec/policies/group_policy_spec.rb +++ b/spec/policies/group_policy_spec.rb @@ -1298,7 +1298,7 @@ end context 'all other user types' do - User::USER_TYPES.except(:human, :project_bot, :placeholder, :import_user).each_value do |user_type| + User::USER_TYPES.except(:human, :project_bot, :admin_bot, :placeholder, :import_user).each_value do |user_type| context "with user_type #{user_type}" do before do current_user.update!(user_type: user_type) diff --git a/spec/policies/packages/policies/dependency_proxy/group_policy_spec.rb b/spec/policies/packages/policies/dependency_proxy/group_policy_spec.rb index 62e5e6b9d2b84ceb019e0c7b5ce44e42451aa335..e772212b7c220d250fcb5900b006f19c0a8ce611 100644 --- a/spec/policies/packages/policies/dependency_proxy/group_policy_spec.rb +++ b/spec/policies/packages/policies/dependency_proxy/group_policy_spec.rb @@ -92,7 +92,9 @@ end context 'with all other user types' do - User::USER_TYPES.except(:human, :project_bot, :security_policy_bot, :placeholder).each_value do |user_type| + excluded_types = %i[human project_bot security_policy_bot admin_bot placeholder] + + User::USER_TYPES.except(*excluded_types).each_value do |user_type| context "with user_type #{user_type}" do let_it_be(:auth_token) { create(:personal_access_token, user: non_group_member) }