@@ -246,22 +246,10 @@ def of_ancestors_and_self
246
246
end
247
247
248
248
scope :project_creation_allowed , -> ( user ) do
249
- project_creation_allowed_on_levels = [
250
- ::Gitlab ::Access ::DEVELOPER_MAINTAINER_PROJECT_ACCESS ,
251
- ::Gitlab ::Access ::MAINTAINER_PROJECT_ACCESS ,
252
- nil
253
- ]
254
-
255
- # When the value of application_settings.default_project_creation is set to `NO_ONE_PROJECT_ACCESS`,
256
- # it means that a `nil` value for `groups.project_creation_level` is telling us:
257
- # do not allow project creation in such groups.
258
- # ie, `nil` is a placeholder value for inheriting the value from the ApplicationSetting.
259
- # So we remove `nil` from the list when the application_setting's value is `NO_ONE_PROJECT_ACCESS`
260
- if ::Gitlab ::CurrentSettings . default_project_creation == ::Gitlab ::Access ::NO_ONE_PROJECT_ACCESS
261
- project_creation_allowed_on_levels . delete ( nil )
262
- end
249
+ project_creation_levels_for_user = project_creation_levels_for_user ( user )
263
250
264
- with_project_creation_levels ( project_creation_allowed_on_levels ) . excluding_restricted_visibility_levels_for_user ( user )
251
+ with_project_creation_levels ( project_creation_levels_for_user )
252
+ . excluding_restricted_visibility_levels_for_user ( user )
265
253
end
266
254
267
255
scope :shared_into_ancestors , -> ( group ) do
@@ -414,6 +402,42 @@ def with_api_scopes
414
402
preload ( :namespace_settings , :group_feature , :parent )
415
403
end
416
404
405
+ # Handle project creation permissions based on application setting and group setting. The `default_project_creation`
406
+ # application setting is the default value and can be overridden by the `project_creation_level` group setting.
407
+ # `nil` value of namespaces.project_creation_level` means that allowed creation level has not been explicitly set by
408
+ # the group owner and is a placeholder value for inheriting the value from the ApplicationSetting.
409
+ def project_creation_levels_for_user ( user )
410
+ project_creation_allowed_on_levels = [
411
+ ::Gitlab ::Access ::DEVELOPER_MAINTAINER_PROJECT_ACCESS ,
412
+ ::Gitlab ::Access ::MAINTAINER_PROJECT_ACCESS ,
413
+ nil
414
+ ]
415
+
416
+ if user . can_admin_all_resources?
417
+ project_creation_allowed_on_levels << ::Gitlab ::Access ::ADMINISTRATOR_PROJECT_ACCESS
418
+ end
419
+
420
+ default_project_creation = ::Gitlab ::CurrentSettings . default_project_creation
421
+ prevent_project_creation_by_default = prevent_project_creation? ( user , default_project_creation )
422
+
423
+ # Remove nil (i.e. inherited `default_project_creation`) when the application setting is:
424
+ # 1. NO_ONE_PROJECT_ACCESS
425
+ # 2. ADMINISTRATOR_PROJECT_ACCESS and the user is not an admin
426
+ #
427
+ # To prevent showing groups in the namespaces dropdown on the project creation page that have no explicit group
428
+ # setting for `project_creation_level`.
429
+ project_creation_allowed_on_levels . delete ( nil ) if prevent_project_creation_by_default
430
+
431
+ project_creation_allowed_on_levels
432
+ end
433
+
434
+ def prevent_project_creation? ( user , project_creation_setting )
435
+ return true if project_creation_setting == ::Gitlab ::Access ::NO_ONE_PROJECT_ACCESS
436
+ return false if user . can_admin_all_resources?
437
+
438
+ project_creation_setting == ::Gitlab ::Access ::ADMINISTRATOR_PROJECT_ACCESS
439
+ end
440
+
417
441
private
418
442
419
443
def public_to_user_arel ( user )
0 commit comments