diff --git a/app/policies/global_policy.rb b/app/policies/global_policy.rb index fa7b117f3cd104bb92d9a69827618ab5a8c58509..406144b7a5c4af7cadfecee847593280d04c2244 100644 --- a/app/policies/global_policy.rb +++ b/app/policies/global_policy.rb @@ -120,6 +120,8 @@ class GlobalPolicy < BasePolicy # We can't use `read_statistics` because the user may have different permissions for different projects rule { admin }.enable :use_project_statistics_filters + rule { admin }.enable :delete_runners + rule { external_user }.prevent :create_snippet end diff --git a/spec/policies/global_policy_spec.rb b/spec/policies/global_policy_spec.rb index 4a8855f1da79dc5dc9f3d22b5770c2a17c9cf37f..da0427420e42406b321126b1c64b083b90cb4f6a 100644 --- a/spec/policies/global_policy_spec.rb +++ b/spec/policies/global_policy_spec.rb @@ -591,4 +591,34 @@ it { is_expected.not_to be_allowed(:log_in) } end end + + describe 'delete runners' do + context 'when anonymous' do + let(:current_user) { nil } + + it { is_expected.not_to be_allowed(:delete_runners) } + end + + context 'regular user' do + it { is_expected.not_to be_allowed(:delete_runners) } + end + + context 'when external' do + let(:current_user) { build(:user, :external) } + + it { is_expected.not_to be_allowed(:delete_runners) } + end + + context 'admin user' do + let_it_be(:current_user) { create(:user, :admin) } + + context 'when admin mode is enabled', :enable_admin_mode do + it { is_expected.to be_allowed(:delete_runners) } + end + + context 'when admin mode is disabled' do + it { is_expected.to be_disallowed(:delete_runners) } + end + end + end end