Check permissions before stopping CI environments

app/services/ci/stop_environment_service.rb

@@ -10,6 +10,7 @@ def execute(branch_name)
       environments.each do |environment|
         next unless environment.stoppable?
+        next unless can?(current_user, :create_deployment, project)
         environment.stop!(current_user)
       end

spec/services/ci/stop_environment_service_spec.rb

 require 'spec_helper'
 describe Ci::StopEnvironmentService, services: true do
-  let(:project) { create(:project) }
+  let(:project) { create(:project, :private) }
   let(:user) { create(:user) }
   let(:service) { described_class.new(project, user) }
@@ -12,38 +12,46 @@
         create(:environment, :with_review_app, project: project)
       end
-      it 'stops environment' do
-        expect_any_instance_of(Environment).to receive(:stop!)
-        service.execute('master')
-      end
-      context 'when specified branch does not exist' do
-        it 'does not stop environment' do
-          expect_any_instance_of(Environment).not_to receive(:stop!)
-          service.execute('non/existent/branch')
+      context 'when user has permission to stop environment' do
+        before do
+          project.team << [user, :developer]
+        end
+        it 'stops environment' do
+          expect_environment_stopped_on('master')
+        end
+        context 'when specified branch does not exist' do
+          it 'does not stop environment' do
+            expect_environment_not_stopped_on('non/existent/branch')
+          end
+        end
+        context 'when no branch not specified' do
+          it 'does not stop environment' do
+            expect_environment_not_stopped_on(nil)
+          end
         end
-      end
-      context 'when no branch not specified' do
-        it 'does not stop environment' do
-          expect_any_instance_of(Environment).not_to receive(:stop!)
-          service.execute(nil)
+        context 'when environment is not stoppable' do
+          before do
+            allow_any_instance_of(Environment)
+              .to receive(:stoppable?).and_return(false)
+          end
+          it 'does not stop environment' do
+            expect_environment_not_stopped_on('master')
+          end
         end
       end
-      context 'when environment is not stoppable' do
+      context 'when user does not have permission to stop environment' do
         before do
-          allow_any_instance_of(Environment)
-            .to receive(:stoppable?).and_return(false)
+          project.team << [user, :guest]
         end
         it 'does not stop environment' do
-          expect_any_instance_of(Environment).not_to receive(:stop!)
-
-          service.execute('master')
+          expect_environment_not_stopped_on('master')
         end
       end
     end
@@ -53,10 +61,14 @@
         create(:environment, project: project)
       end
-      it 'does not stop environment' do
-        expect_any_instance_of(Environment).not_to receive(:stop!)
-        service.execute('master')
+      context 'when user has permission to stop environments' do
+        before do
+          project.team << [user, :master]
+        end
+        it 'does not stop environment' do
+          expect_environment_not_stopped_on('master')
+        end
       end
     end
@@ -67,4 +79,18 @@
       end
     end
   end
+
+  def expect_environment_stopped_on(branch)
+    expect_any_instance_of(Environment)
+      .to receive(:stop!)
+
+    service.execute(branch)
+  end
+
+  def expect_environment_not_stopped_on(branch)
+    expect_any_instance_of(Environment)
+      .not_to receive(:stop!)
+
+    service.execute(branch)
+  end
 end