change project attachment permissions to include bot uploaders (#759)

phac-nml · Sep 13, 2024 · a7011a8 · a7011a8
1 parent b4a071e
commit a7011a8
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/app/models/member.rb b/app/models/member.rb
@@ -215,14 +215,20 @@ def can_view_attachments?(user, object_namespace, include_group_links = true) #
     end
 
     def can_create_attachment?(user, object_namespace, include_group_links = true) # rubocop:disable Style/OptionalBooleanParameter
+      effective_access_level = effective_access_level(object_namespace, user, include_group_links)
+      return true if (effective_access_level == Member::AccessLevel::UPLOADER) && Current.token&.active?
+
       Member::AccessLevel.manageable.include?(
-        effective_access_level(object_namespace, user, include_group_links)
+        effective_access_level
       )
     end
 
     def can_destroy_attachment?(user, object_namespace, include_group_links = true) # rubocop:disable Style/OptionalBooleanParameter
+      effective_access_level = effective_access_level(object_namespace, user, include_group_links)
+      return true if (effective_access_level == Member::AccessLevel::UPLOADER) && Current.token&.active?
+
       Member::AccessLevel.manageable.include?(
-        effective_access_level(object_namespace, user, include_group_links)
+        effective_access_level
       )
     end