Merge branch '55376-related_merge_requests-api-call-returns-merge-requests-that-are-not-related-to-the-issue' into 'master'

Ensure that  related_merge_requests api call returns merge requests in the correct scope

Closes #55376

See merge request gitlab-org/gitlab-ce!25222

3 files changed, 29 insertions, 11 deletions

diff --git a/changelogs/unreleased/55376-related_merge_requests-api-call-returns-merge-requests-that-are-not-related-to-the-issue.yml b/changelogs/unreleased/55376-related_merge_requests-api-call-returns-merge-requests-that-are-not-related-to-the-issue.yml
new file mode 100644
index 00000000000..d2f24d6f499
--- /dev/null
+++ b/changelogs/unreleased/55376-related_merge_requests-api-call-returns-merge-requests-that-are-not-related-to-the-issue.yml
@@ -0,0 +1,5 @@
+---
+title: 'API: Ensure that related merge requests are referenced cross-project'
+merge_request: 25222
+author: Robert Schilling
+type: fixed
diff --git a/lib/api/issues.rb b/lib/api/issues.rb
index aa8010eb12d..94ed9ac6fb1 100644
--- a/lib/api/issues.rb
+++ b/lib/api/issues.rb
@@ -303,19 +303,14 @@ module API
       get ':id/issues/:issue_iid/related_merge_requests' do
         issue = find_project_issue(params[:issue_iid])
 
-        merge_request_iids = ::Issues::ReferencedMergeRequestsService.new(user_project, current_user)
+        merge_requests = ::Issues::ReferencedMergeRequestsService.new(user_project, current_user)
           .execute(issue)
           .flatten
-          .map(&:iid)
 
-        merge_requests =
-          if merge_request_iids.present?
-            MergeRequestsFinder.new(current_user, project_id: user_project.id, iids: merge_request_iids).execute
-          else
-            MergeRequest.none
-          end
-
-        present paginate(merge_requests), with: Entities::MergeRequestBasic, current_user: current_user, project: user_project
+        present paginate(::Kaminari.paginate_array(merge_requests)),
+          with: Entities::MergeRequestBasic,
+          current_user: current_user,
+          project: user_project
       end
 
       desc 'List merge requests closing issue' do
diff --git a/spec/requests/api/issues_spec.rb b/spec/requests/api/issues_spec.rb
index b5cc13eff29..d10ee6cc320 100644
--- a/spec/requests/api/issues_spec.rb
+++ b/spec/requests/api/issues_spec.rb
@@ -1894,7 +1894,7 @@ describe API::Issues do
         description: "See #{issue.to_reference}"
       }
       create(:merge_request, attributes).tap do |merge_request|
-        create(:note, :system, project: project, noteable: issue, author: user, note: merge_request.to_reference(full: true))
+        create(:note, :system, project: issue.project, noteable: issue, author: user, note: merge_request.to_reference(full: true))
       end
     end
 
@@ -1931,6 +1931,24 @@ describe API::Issues do
       expect_paginated_array_response(related_mr.id)
     end
 
+    it 'returns merge requests cross-project wide' do
+      project2 = create(:project, :public, creator_id: user.id, namespace: user.namespace)
+      merge_request = create_referencing_mr(user, project2, issue)
+
+      get_related_merge_requests(project.id, issue.iid, user)
+
+      expect_paginated_array_response([related_mr.id, merge_request.id])
+    end
+
+    it 'does not generate references to projects with no access' do
+      private_project = create(:project, :private)
+      create_referencing_mr(private_project.creator, private_project, issue)
+
+      get_related_merge_requests(project.id, issue.iid, user)
+
+      expect_paginated_array_response(related_mr.id)
+    end
+
     context 'no merge request mentioned a issue' do
       it 'returns empty array' do
         get_related_merge_requests(project.id, closed_issue.iid, user)