Use build policy to determine if user can play build

9 files changed, 6 insertions, 69 deletions

diff --git a/app/models/ci/build.rb b/app/models/ci/build.rb
index 9edc4cd96b9..b3acb25b9ce 100644
--- a/app/models/ci/build.rb
+++ b/app/models/ci/build.rb
@@ -115,12 +115,6 @@ module Ci
       commands.present?
     end
 
-    def can_play?(current_user)
-      ::Gitlab::UserAccess
-        .new(current_user, project: project)
-        .can_push_to_branch?(ref)
-    end
-
     def play(current_user)
       Ci::PlayBuildService
         .new(project, current_user)
diff --git a/app/models/environment.rb b/app/models/environment.rb
index f8b9a21c08e..bf33010fd21 100644
--- a/app/models/environment.rb
+++ b/app/models/environment.rb
@@ -122,12 +122,6 @@ class Environment < ActiveRecord::Base
     available? && stop_action.present?
   end
 
-  def can_trigger_stop_action?(current_user)
-    return false unless stop_action?
-
-    stop_action.can_play?(current_user)
-  end
-
   def stop_with_action!(current_user)
     return unless available?
 
diff --git a/app/serializers/build_action_entity.rb b/app/serializers/build_action_entity.rb
index 3d12c64b88a..0bb7e561073 100644
--- a/app/serializers/build_action_entity.rb
+++ b/app/serializers/build_action_entity.rb
@@ -19,6 +19,6 @@ class BuildActionEntity < Grape::Entity
   alias_method :build, :object
 
   def playable?
-    build.playable? && build.can_play?(request.user)
+    can?(request.user, :play_build, build) && build.playable?
   end
 end
diff --git a/app/serializers/build_entity.rb b/app/serializers/build_entity.rb
index 401a277dadc..f301900c43c 100644
--- a/app/serializers/build_entity.rb
+++ b/app/serializers/build_entity.rb
@@ -26,7 +26,7 @@ class BuildEntity < Grape::Entity
   alias_method :build, :object
 
   def playable?
-    build.playable? && build.can_play?(request.user)
+    can?(request.user, :play_build, build) && build.playable?
   end
 
   def detailed_status
diff --git a/app/services/ci/stop_environments_service.rb b/app/services/ci/stop_environments_service.rb
index d1e341bc9b5..bd9735fc0ac 100644
--- a/app/services/ci/stop_environments_service.rb
+++ b/app/services/ci/stop_environments_service.rb
@@ -9,7 +9,8 @@ module Ci
       return unless can?(current_user, :create_deployment, project)
 
       environments.each do |environment|
-        next unless environment.can_trigger_stop_action?(current_user)
+        next unless environment.stop_action?
+        next unless can?(current_user, :play_build, environment.stop_action)
 
         environment.stop_with_action!(current_user)
       end
diff --git a/app/views/projects/ci/builds/_build.html.haml b/app/views/projects/ci/builds/_build.html.haml
index ceec36e2440..769640c4842 100644
--- a/app/views/projects/ci/builds/_build.html.haml
+++ b/app/views/projects/ci/builds/_build.html.haml
@@ -101,7 +101,7 @@
           = link_to cancel_namespace_project_build_path(build.project.namespace, build.project, build, return_to: request.original_url), method: :post, title: 'Cancel', class: 'btn btn-build' do
             = icon('remove', class: 'cred')
         - elsif allow_retry
-          - if build.playable? && !admin && build.can_play?(current_user)
+          - if build.playable? && !admin && can?(current_user, :play_build, build)
             = link_to play_namespace_project_build_path(build.project.namespace, build.project, build, return_to: request.original_url), method: :post, title: 'Play', class: 'btn btn-build' do
               = custom_icon('icon_play')
           - elsif build.retryable?
diff --git a/lib/gitlab/ci/status/build/play.rb b/lib/gitlab/ci/status/build/play.rb
index 29d0558a265..4c893f62925 100644
--- a/lib/gitlab/ci/status/build/play.rb
+++ b/lib/gitlab/ci/status/build/play.rb
@@ -10,7 +10,7 @@ module Gitlab
           end
 
           def has_action?
-            can?(user, :update_build, subject) && subject.can_play?(user)
+            can?(user, :play_build, subject)
           end
 
           def action_icon
diff --git a/spec/models/ci/build_spec.rb b/spec/models/ci/build_spec.rb
index 09e9f5bd8ba..cdceca975e5 100644
--- a/spec/models/ci/build_spec.rb
+++ b/spec/models/ci/build_spec.rb
@@ -925,33 +925,6 @@ describe Ci::Build, :models do
     end
   end
 
-  describe '#can_play?' do
-    before do
-      project.add_developer(user)
-    end
-
-    let(:build) do
-      create(:ci_build, ref: 'some-ref', pipeline: pipeline)
-    end
-
-    context 'when branch build is running for is protected' do
-      before do
-        create(:protected_branch, :no_one_can_push,
-               name: 'some-ref', project: project)
-      end
-
-      it 'indicates that user can not trigger an action' do
-        expect(build.can_play?(user)).to be_falsey
-      end
-    end
-
-    context 'when branch build is running for is not protected' do
-      it 'indicates that user can trigger an action' do
-        expect(build.can_play?(user)).to be_truthy
-      end
-    end
-  end
-
   describe '#play' do
     let(:build) { create(:ci_build, :manual, pipeline: pipeline) }
 
diff --git a/spec/models/environment_spec.rb b/spec/models/environment_spec.rb
index fb7cee47ae8..9e00f2247e8 100644
--- a/spec/models/environment_spec.rb
+++ b/spec/models/environment_spec.rb
@@ -155,31 +155,6 @@ describe Environment, models: true do
     end
   end
 
-  describe '#can_trigger_stop_action?' do
-    let(:user) { create(:user) }
-    let(:project) { create(:project) }
-
-    let(:environment) do
-      create(:environment, :with_review_app, project: project)
-    end
-
-    context 'when user can trigger stop action' do
-      before do
-        project.add_developer(user)
-      end
-
-      it 'returns value that evaluates to true' do
-        expect(environment.can_trigger_stop_action?(user)).to be_truthy
-      end
-    end
-
-    context 'when user is not allowed to trigger stop action' do
-      it 'returns value that evaluates to false' do
-        expect(environment.can_trigger_stop_action?(user)).to be_falsey
-      end
-    end
-  end
-
   describe '#stop_with_action!' do
     let(:user) { create(:admin) }