summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLuke Duncalfe <lduncalfe@eml.cc>2019-06-26 10:15:14 +1200
committerLuke Duncalfe <lduncalfe@eml.cc>2019-06-26 10:15:14 +1200
commitbbdcbd98aed2bfb4eba008669d3fca500b6e0ace (patch)
treed79260df3dc7becd70402ca6875b6c44e0d88722
parentb2a615c3c60dd3315ecf33d5fdb61061c9d4003e (diff)
downloadgitlab-ce-graphql-error-when-authorizing-with-no-permissions-defined.tar.gz
https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/29921#note_184713939
-rw-r--r--doc/development/api_graphql_styleguide.md2
-rw-r--r--lib/gitlab/graphql/authorize/authorize_resource.rb6
-rw-r--r--spec/lib/gitlab/graphql/authorize/authorize_resource_spec.rb18
3 files changed, 1 insertions, 25 deletions
diff --git a/doc/development/api_graphql_styleguide.md b/doc/development/api_graphql_styleguide.md
index 2ed2a905db7..aeddad14995 100644
--- a/doc/development/api_graphql_styleguide.md
+++ b/doc/development/api_graphql_styleguide.md
@@ -447,7 +447,7 @@ want to validate the abilities for.
Alternatively, we can add a `find_object` method that will load the
object on the mutation. This would allow you to use the
-`authorized_find!` and `authorized_find!` helper methods.
+`authorized_find!` helper method.
When a user is not allowed to perform the action, or an object is not
found, we should raise a
diff --git a/lib/gitlab/graphql/authorize/authorize_resource.rb b/lib/gitlab/graphql/authorize/authorize_resource.rb
index c619464f69f..ef5caaf5b0e 100644
--- a/lib/gitlab/graphql/authorize/authorize_resource.rb
+++ b/lib/gitlab/graphql/authorize/authorize_resource.rb
@@ -27,12 +27,6 @@ module Gitlab
raise NotImplementedError, "Implement #find_object in #{self.class.name}"
end
- def authorized_find(*args)
- object = find_object(*args)
-
- object if authorized?(object)
- end
-
def authorized_find!(*args)
object = find_object(*args)
authorize!(object)
diff --git a/spec/lib/gitlab/graphql/authorize/authorize_resource_spec.rb b/spec/lib/gitlab/graphql/authorize/authorize_resource_spec.rb
index f9c4c619330..20842f55014 100644
--- a/spec/lib/gitlab/graphql/authorize/authorize_resource_spec.rb
+++ b/spec/lib/gitlab/graphql/authorize/authorize_resource_spec.rb
@@ -34,12 +34,6 @@ describe Gitlab::Graphql::Authorize::AuthorizeResource do
end
end
- describe '#authorized_find' do
- it 'returns the object' do
- expect(loading_resource.authorized_find).to eq(project)
- end
- end
-
describe '#authorized_find!' do
it 'returns the object' do
expect(loading_resource.authorized_find!).to eq(project)
@@ -66,12 +60,6 @@ describe Gitlab::Graphql::Authorize::AuthorizeResource do
end
end
- describe '#authorized_find' do
- it 'returns `nil`' do
- expect(loading_resource.authorized_find).to be_nil
- end
- end
-
describe '#authorized_find!' do
it 'raises an error' do
expect { loading_resource.authorize!(project) }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
@@ -127,12 +115,6 @@ describe Gitlab::Graphql::Authorize::AuthorizeResource do
end
let(:error) { /#{fake_class.name} has no authorizations/ }
- describe '#authorized_find' do
- it 'raises a comprehensive error message' do
- expect { loading_resource.authorized_find }.to raise_error(error)
- end
- end
-
describe '#authorized_find!' do
it 'raises a comprehensive error message' do
expect { loading_resource.authorized_find! }.to raise_error(error)