diff --git a/ee/app/graphql/mutations/compliance_management/frameworks/destroy.rb b/ee/app/graphql/mutations/compliance_management/frameworks/destroy.rb index 234917be25e581d1eb4b6982d7ed46deebe5b0a6..3a60147cabd6fd6b152f0645bea79efa35d2adf9 100644 --- a/ee/app/graphql/mutations/compliance_management/frameworks/destroy.rb +++ b/ee/app/graphql/mutations/compliance_management/frameworks/destroy.rb @@ -6,7 +6,7 @@ module Frameworks class Destroy < ::Mutations::BaseMutation graphql_name 'DestroyComplianceFramework' - authorize :manage_compliance_framework + authorize :admin_compliance_framework argument :id, ::Types::GlobalIDType[::ComplianceManagement::Framework], diff --git a/ee/app/graphql/mutations/compliance_management/frameworks/update.rb b/ee/app/graphql/mutations/compliance_management/frameworks/update.rb index 16fbe77a9a1b2e1f499981270bcaaf5265fae731..6e81e04d007bca9630b0d12f7261925ba1343631 100644 --- a/ee/app/graphql/mutations/compliance_management/frameworks/update.rb +++ b/ee/app/graphql/mutations/compliance_management/frameworks/update.rb @@ -6,7 +6,7 @@ module Frameworks class Update < ::Mutations::BaseMutation graphql_name 'UpdateComplianceFramework' - authorize :manage_compliance_framework + authorize :admin_compliance_framework argument :id, ::Types::GlobalIDType[::ComplianceManagement::Framework], diff --git a/ee/app/graphql/types/compliance_management/compliance_framework_type.rb b/ee/app/graphql/types/compliance_management/compliance_framework_type.rb index 75305323915564bb8bb859bda83dc5b07ba2b6f6..629348e940963b875d8df2bc7736f6999a400a8e 100644 --- a/ee/app/graphql/types/compliance_management/compliance_framework_type.rb +++ b/ee/app/graphql/types/compliance_management/compliance_framework_type.rb @@ -30,7 +30,7 @@ class ComplianceFrameworkType < Types::BaseObject field :pipeline_configuration_full_path, GraphQL::Types::String, null: true, description: 'Full path of the compliance pipeline configuration stored in a project repository, such as `.gitlab/.compliance-gitlab-ci.yml@compliance/hipaa` **(ULTIMATE ALL)**.', - authorize: :manage_group_level_compliance_pipeline_config + authorize: :admin_compliance_pipeline_configuration field :projects, Types::ProjectType.connection_type, null: true, diff --git a/ee/app/policies/compliance_management/framework_policy.rb b/ee/app/policies/compliance_management/framework_policy.rb index dee298a55706ab7bf0fffdf6a17b634c27f6867e..815caf6fcad1310afb7eceb9b407225b10550946 100644 --- a/ee/app/policies/compliance_management/framework_policy.rb +++ b/ee/app/policies/compliance_management/framework_policy.rb @@ -17,7 +17,7 @@ class FrameworkPolicy < BasePolicy end rule { can?(:owner_access) & custom_compliance_frameworks_enabled }.policy do - enable :manage_compliance_framework + enable :admin_compliance_framework enable :read_compliance_framework end @@ -26,7 +26,7 @@ class FrameworkPolicy < BasePolicy end rule { can?(:owner_access) & group_level_compliance_pipeline_enabled }.policy do - enable :manage_group_level_compliance_pipeline_config + enable :admin_compliance_pipeline_configuration end end end diff --git a/ee/app/services/compliance_management/frameworks/create_service.rb b/ee/app/services/compliance_management/frameworks/create_service.rb index c21d2070d59a37322ce2c159be91da51449aadf0..3caa0ed88df751ca900ca6cc3de06ddfcb33b658 100644 --- a/ee/app/services/compliance_management/frameworks/create_service.rb +++ b/ee/app/services/compliance_management/frameworks/create_service.rb @@ -35,7 +35,7 @@ def execute private def permitted? - can? current_user, :manage_compliance_framework, framework + can? current_user, :admin_compliance_framework, framework end def success diff --git a/ee/app/services/compliance_management/frameworks/destroy_service.rb b/ee/app/services/compliance_management/frameworks/destroy_service.rb index 59d5ab57adba75e306c64cbfd9b2026b63596be9..15fd3edc253753872550956d3ff9f2d97dac56bf 100644 --- a/ee/app/services/compliance_management/frameworks/destroy_service.rb +++ b/ee/app/services/compliance_management/frameworks/destroy_service.rb @@ -20,7 +20,7 @@ def execute private def permitted? - can? current_user, :manage_compliance_framework, framework + can? current_user, :admin_compliance_framework, framework end def success diff --git a/ee/app/services/compliance_management/frameworks/update_service.rb b/ee/app/services/compliance_management/frameworks/update_service.rb index c4268f0f6f0b019efae3fca6af7d3439fe8c6b68..f89881b2c130c4e3747d6708a3f310d8cba84c72 100644 --- a/ee/app/services/compliance_management/frameworks/update_service.rb +++ b/ee/app/services/compliance_management/frameworks/update_service.rb @@ -54,7 +54,7 @@ def audit_changes end def permitted? - can? current_user, :manage_compliance_framework, framework + can? current_user, :admin_compliance_framework, framework end def update_default_framework diff --git a/ee/app/services/concerns/compliance_management/frameworks.rb b/ee/app/services/concerns/compliance_management/frameworks.rb index 7bdb6c810cdf342c1f9971ccbcc6a8a94cce0ce6..a3e5e7c2bb4eb45dc0fbe68df2cc0a52a0c78159 100644 --- a/ee/app/services/concerns/compliance_management/frameworks.rb +++ b/ee/app/services/concerns/compliance_management/frameworks.rb @@ -5,7 +5,7 @@ module Frameworks def compliance_pipeline_configuration_available? return true if params[:pipeline_configuration_full_path].blank? - can?(current_user, :manage_group_level_compliance_pipeline_config, framework) + can?(current_user, :admin_compliance_pipeline_configuration, framework) end end end diff --git a/ee/spec/policies/compliance_management/framework_policy_spec.rb b/ee/spec/policies/compliance_management/framework_policy_spec.rb index bc80172c8ce6753e4c6e56ead98c52391854b153..7a35b35ecb2a2e76ce64055254599291f3432458 100644 --- a/ee/spec/policies/compliance_management/framework_policy_spec.rb +++ b/ee/spec/policies/compliance_management/framework_policy_spec.rb @@ -11,15 +11,15 @@ subject { described_class.new(user, framework) } shared_examples 'full access to compliance framework administration' do - it { is_expected.to be_allowed(:manage_compliance_framework) } + it { is_expected.to be_allowed(:admin_compliance_framework) } it { is_expected.to be_allowed(:read_compliance_framework) } - it { is_expected.to be_allowed(:manage_group_level_compliance_pipeline_config) } + it { is_expected.to be_allowed(:admin_compliance_pipeline_configuration) } end shared_examples 'no access to compliance framework administration' do - it { is_expected.to be_disallowed(:manage_compliance_framework) } + it { is_expected.to be_disallowed(:admin_compliance_framework) } it { is_expected.to be_disallowed(:read_compliance_framework) } - it { is_expected.to be_disallowed(:manage_group_level_compliance_pipeline_config) } + it { is_expected.to be_disallowed(:admin_compliance_pipeline_configuration) } end context 'feature is licensed' do @@ -58,8 +58,8 @@ end it { is_expected.to be_allowed(:read_compliance_framework) } - it { is_expected.to be_disallowed(:manage_compliance_framework) } - it { is_expected.to be_disallowed(:manage_group_level_compliance_pipeline_config) } + it { is_expected.to be_disallowed(:admin_compliance_framework) } + it { is_expected.to be_disallowed(:admin_compliance_pipeline_configuration) } end end