Use update build policy instead of new play policy

8 files changed, 22 insertions, 20 deletions

diff --git a/app/policies/ci/build_policy.rb b/app/policies/ci/build_policy.rb
index 2c39d31488f..d4af4490608 100644
--- a/app/policies/ci/build_policy.rb
+++ b/app/policies/ci/build_policy.rb
@@ -1,5 +1,7 @@
 module Ci
   class BuildPolicy < CommitStatusPolicy
+    alias_method :build, :subject
+
     def rules
       super
 
@@ -9,17 +11,17 @@ module Ci
         cannot! :"#{rule}_commit_status" unless can? :"#{rule}_build"
       end
 
-      can! :play_build if can_play_action?
+      if can?(:update_build) && protected_action?
+        cannot! :update_build
+      end
     end
 
     private
 
-    alias_method :build, :subject
-
-    def can_play_action?
+    def protected_action?
       return false unless build.action?
 
-      ::Gitlab::UserAccess
+      !::Gitlab::UserAccess
         .new(user, project: build.project)
         .can_push_to_branch?(build.ref)
     end
diff --git a/app/policies/environment_policy.rb b/app/policies/environment_policy.rb
index cc94d4a7e05..2fa15e64562 100644
--- a/app/policies/environment_policy.rb
+++ b/app/policies/environment_policy.rb
@@ -12,6 +12,6 @@ class EnvironmentPolicy < BasePolicy
   private
 
   def can_play_stop_action?
-    Ability.allowed?(user, :play_build, environment.stop_action)
+    Ability.allowed?(user, :update_build, environment.stop_action)
   end
 end
diff --git a/app/serializers/build_action_entity.rb b/app/serializers/build_action_entity.rb
index 3eff724ae91..75dda1af709 100644
--- a/app/serializers/build_action_entity.rb
+++ b/app/serializers/build_action_entity.rb
@@ -19,6 +19,6 @@ class BuildActionEntity < Grape::Entity
   alias_method :build, :object
 
   def playable?
-    build.playable? && can?(request.user, :play_build, build)
+    build.playable? && can?(request.user, :update_build, build)
   end
 end
diff --git a/app/serializers/build_entity.rb b/app/serializers/build_entity.rb
index 10ba7c90c10..1380b347d8e 100644
--- a/app/serializers/build_entity.rb
+++ b/app/serializers/build_entity.rb
@@ -26,7 +26,7 @@ class BuildEntity < Grape::Entity
   alias_method :build, :object
 
   def playable?
-    build.playable? && can?(request.user, :play_build, build)
+    build.playable? && can?(request.user, :update_build, build)
   end
 
   def detailed_status
diff --git a/app/services/ci/play_build_service.rb b/app/services/ci/play_build_service.rb
index 5b3ff1ced38..e24f48c2d16 100644
--- a/app/services/ci/play_build_service.rb
+++ b/app/services/ci/play_build_service.rb
@@ -1,7 +1,7 @@
 module Ci
   class PlayBuildService < ::BaseService
     def execute(build)
-      unless can?(current_user, :play_build, build)
+      unless can?(current_user, :update_build, build)
         raise Gitlab::Access::AccessDeniedError
       end
 
diff --git a/app/views/projects/ci/builds/_build.html.haml b/app/views/projects/ci/builds/_build.html.haml
index 2227d36eed2..c0019996176 100644
--- a/app/views/projects/ci/builds/_build.html.haml
+++ b/app/views/projects/ci/builds/_build.html.haml
@@ -102,7 +102,7 @@
           = link_to cancel_namespace_project_build_path(job.project.namespace, job.project, job, return_to: request.original_url), method: :post, title: 'Cancel', class: 'btn btn-build' do
             = icon('remove', class: 'cred')
         - elsif allow_retry
-          - if job.playable? && !admin && can?(current_user, :play_build, job)
+          - if job.playable? && !admin && can?(current_user, :update_build, job)
             = link_to play_namespace_project_build_path(job.project.namespace, job.project, job, return_to: request.original_url), method: :post, title: 'Play', class: 'btn btn-build' do
               = custom_icon('icon_play')
           - elsif job.retryable?
diff --git a/lib/gitlab/ci/status/build/play.rb b/lib/gitlab/ci/status/build/play.rb
index 8130c7d1c90..fae34a2f927 100644
--- a/lib/gitlab/ci/status/build/play.rb
+++ b/lib/gitlab/ci/status/build/play.rb
@@ -14,7 +14,7 @@ module Gitlab
           end
 
           def has_action?
-            can?(user, :play_build, subject)
+            can?(user, :update_build, subject)
           end
 
           def action_icon
diff --git a/spec/policies/ci/build_policy_spec.rb b/spec/policies/ci/build_policy_spec.rb
index e4693cdcef0..3f4ce222b60 100644
--- a/spec/policies/ci/build_policy_spec.rb
+++ b/spec/policies/ci/build_policy_spec.rb
@@ -108,8 +108,8 @@ describe Ci::BuildPolicy, :models do
             create(:ci_build, :manual, ref: 'some-ref', pipeline: pipeline)
           end
 
-          it 'does not include ability to play build' do
-            expect(policies).not_to include :play_build
+          it 'does not include ability to update build' do
+            expect(policies).not_to include :update_build
           end
         end
 
@@ -118,8 +118,8 @@ describe Ci::BuildPolicy, :models do
             create(:ci_build, ref: 'some-ref', pipeline: pipeline)
           end
 
-          it 'does not include ability to play build' do
-            expect(policies).not_to include :play_build
+          it 'includes ability to update build' do
+            expect(policies).to include :update_build
           end
         end
       end
@@ -128,16 +128,16 @@ describe Ci::BuildPolicy, :models do
         context 'when build is a manual action' do
           let(:build) { create(:ci_build, :manual, pipeline: pipeline) }
 
-          it 'includes ability to play build' do
-            expect(policies).to include :play_build
+          it 'includes ability to update build' do
+            expect(policies).to include :update_build
           end
         end
 
         context 'when build is not a manual action' do
-          let(:build) { create(:ci_build,  pipeline: pipeline) }
+          let(:build) { create(:ci_build, pipeline: pipeline) }
 
-          it 'does not include ability to play build' do
-            expect(policies).not_to include :play_build
+          it 'includes ability to update build' do
+            expect(policies).to include :update_build
           end
         end
       end