Block pushes from an owner if gem is reserved (#6406)

* Block pushes from an owner owned gem if reserved

* Prevent pending trusted publisher creation if gem is reserved

Author: jenshenny

app/models/oidc/pending_trusted_publisher.rb

@@ -32,6 +32,10 @@ def build_trusted_publisher(params)
 
   def available_rubygem_name
     return if rubygem_name.blank?
+
+    reserved = GemNameReservation.reserved?(rubygem_name)
+    return errors.add(:rubygem_name, :reserved) if reserved
+
     rubygem = Rubygem.name_is(rubygem_name).first
     return if rubygem.nil? || rubygem.pushable?
 

app/models/pusher.rb

@@ -35,7 +35,11 @@ def process
   end
 
   def authorize
-    (rubygem.pushable? && (api_key.user? || find_pending_trusted_publisher)) || owner.owns_gem?(rubygem) || notify_unauthorized
+    return notify_reserved if rubygem.reserved_name?
+    return true if rubygem.pushable? && (api_key.user? || find_pending_trusted_publisher)
+    return true if owner.owns_gem?(rubygem)
+
+    notify_unauthorized
   end
 
   def verify_gem_scope
@@ -255,8 +259,12 @@ def republish_notification(version)
     end
   end
 
+  def notify_reserved
+    notify("This gem name is reserved. You are not allowed to push this gem.", 403)
+  end
+
   def notify_unauthorized
-    if !api_key.user? || rubygem.reserved_name?
+    if !api_key.user?
       notify("You are not allowed to push this gem.", 403)
     elsif rubygem.unconfirmed_ownership?(owner)
       notify("You do not have permission to push to this gem. " \

app/models/rubygem.rb

@@ -295,7 +295,7 @@ def pushable?
   end
 
   def reserved_name?
-    GemNameReservation.reserved?(name)
+    GemNameReservation.reserved?(name) if name.present?
   end
 
   def create_ownership(user)

config/locales/de.yml

@@ -151,6 +151,7 @@ de:
           attributes:
             rubygem_name:
               unavailable: wird bereits verwendet
+              reserved:
     models:
       user: Benutzer
       api_key:

config/locales/en.yml

@@ -144,6 +144,7 @@ en:
           attributes:
             rubygem_name:
               unavailable: "is already in use"
+              reserved: "is reserved"
     models:
       user: User
       api_key:

config/locales/es.yml

@@ -147,6 +147,7 @@ es:
           attributes:
             rubygem_name:
               unavailable:
+              reserved:
     models:
       user: Usuario
       api_key:

config/locales/fr.yml

@@ -144,6 +144,7 @@ fr:
           attributes:
             rubygem_name:
               unavailable:
+              reserved:
     models:
       user:
       api_key:

config/locales/ja.yml

@@ -140,6 +140,7 @@ ja:
           attributes:
             rubygem_name:
               unavailable: 既に使われています
+              reserved:
     models:
       user: ユーザー
       api_key:

config/locales/nl.yml

@@ -139,6 +139,7 @@ nl:
           attributes:
             rubygem_name:
               unavailable:
+              reserved:
     models:
       user:
       api_key:

config/locales/pt-BR.yml

@@ -145,6 +145,7 @@ pt-BR:
           attributes:
             rubygem_name:
               unavailable:
+              reserved:
     models:
       user: Usuário
       api_key: