Enable share_with_group_lock on subgroup

…when needed

3 files changed, 188 insertions, 0 deletions

diff --git a/app/models/namespace.rb b/app/models/namespace.rb
index e7cbc5170e8..aeda829415a 100644
--- a/app/models/namespace.rb
+++ b/app/models/namespace.rb
@@ -44,6 +44,10 @@ class Namespace < ActiveRecord::Base
 
   after_commit :refresh_access_of_projects_invited_groups, on: :update, if: -> { previous_changes.key?('share_with_group_lock') }
 
+  before_create :sync_share_with_group_lock_with_parent
+  before_update :sync_share_with_group_lock_with_parent, if: :parent_changed?
+  after_commit :force_share_with_group_lock_on_descendants, on: :update, if: -> { previous_changes.key?('share_with_group_lock') && share_with_group_lock? }
+
   # Legacy Storage specific hooks
 
   after_update :move_dir, if: :path_changed?
@@ -219,4 +223,14 @@ class Namespace < ActiveRecord::Base
       errors.add(:parent_id, "has too deep level of nesting")
     end
   end
+
+  def sync_share_with_group_lock_with_parent
+    if has_parent? && parent.share_with_group_lock?
+      self.share_with_group_lock = true
+    end
+  end
+
+  def force_share_with_group_lock_on_descendants
+    descendants.update_all(share_with_group_lock: true)
+  end
 end
diff --git a/spec/features/groups/share_lock_spec.rb b/spec/features/groups/share_lock_spec.rb
new file mode 100644
index 00000000000..2e2da6b862c
--- /dev/null
+++ b/spec/features/groups/share_lock_spec.rb
@@ -0,0 +1,62 @@
+require 'spec_helper'
+
+feature 'Group share lock' do
+  given(:root_owner) { create(:user) }
+  given(:root_group) { create(:group) }
+
+  background do
+    root_group.add_owner(root_owner)
+    sign_in(root_owner)
+  end
+
+  context 'with a subgroup' do
+    given!(:subgroup) { create(:group, parent: root_group) }
+
+    context 'when enabling the parent group share lock' do
+      scenario 'the subgroup share lock becomes enabled' do
+        visit edit_group_path(root_group)
+        check 'group_share_with_group_lock'
+
+        click_on 'Save group'
+
+        expect(subgroup.reload.share_with_group_lock?).to be_truthy
+      end
+    end
+
+    context 'when disabling the parent group share lock (which was already enabled)' do
+      background do
+        visit edit_group_path(root_group)
+        check 'group_share_with_group_lock'
+        click_on 'Save group'
+      end
+
+      context 'and the subgroup share lock is enabled' do
+        scenario 'the subgroup share lock does not change' do
+          visit edit_group_path(root_group)
+          uncheck 'group_share_with_group_lock'
+
+          click_on 'Save group'
+
+          expect(subgroup.reload.share_with_group_lock?).to be_truthy
+        end
+      end
+
+      context 'but the subgroup share lock is disabled' do
+        background do
+          visit edit_group_path(subgroup)
+          uncheck 'group_share_with_group_lock'
+          click_on 'Save group'
+        end
+
+        scenario 'the subgroup share lock does not change' do
+          visit edit_group_path(root_group)
+          uncheck 'group_share_with_group_lock'
+
+          click_on 'Save group'
+
+          expect(subgroup.reload.share_with_group_lock?).to be_falsey
+        end
+      end
+    end
+  end
+end
diff --git a/spec/models/namespace_spec.rb b/spec/models/namespace_spec.rb
index 69286eff984..2bfe04fecc7 100644
--- a/spec/models/namespace_spec.rb
+++ b/spec/models/namespace_spec.rb
@@ -406,4 +406,116 @@ describe Namespace do
 
     it { expect(group.all_projects.to_a).to eq([project2, project1]) }
   end
+
+  describe '#share_with_group_lock with subgroups' do
+    context 'when creating a subgroup' do
+      let(:subgroup) { create(:group, parent: root_group )}
+
+      context 'under a parent with share lock enabled' do
+        let(:root_group) { create(:group, share_with_group_lock: true) }
+
+        it 'enables share lock on the subgroup' do
+          expect(subgroup.share_with_group_lock).to be_truthy
+        end
+      end
+
+      context 'under a parent with share lock disabled' do
+        let(:root_group) { create(:group) }
+
+        it 'does not enable share lock on the subgroup' do
+          expect(subgroup.share_with_group_lock).to be_falsey
+        end
+      end
+    end
+
+    context 'when enabling the parent group share lock' do
+      let(:root_group) { create(:group) }
+      let!(:subgroup) { create(:group, parent: root_group )}
+
+      it 'the subgroup share lock becomes enabled' do
+        root_group.update(share_with_group_lock: true)
+
+        expect(subgroup.reload.share_with_group_lock).to be_truthy
+      end
+    end
+
+    context 'when disabling the parent group share lock (which was already enabled)' do
+      let(:root_group) { create(:group, share_with_group_lock: true) }
+
+      context 'and the subgroup share lock is enabled' do
+        let(:subgroup) { create(:group, parent: root_group, share_with_group_lock: true )}
+
+        it 'the subgroup share lock does not change' do
+          root_group.update(share_with_group_lock: false)
+
+          expect(subgroup.reload.share_with_group_lock).to be_truthy
+        end
+      end
+
+      context 'but the subgroup share lock is disabled' do
+        let(:subgroup) { create(:group, parent: root_group )}
+
+        it 'the subgroup share lock does not change' do
+          root_group.update(share_with_group_lock: false)
+
+          expect(subgroup.reload.share_with_group_lock?).to be_falsey
+        end
+      end
+    end
+
+    # Note: Group transfers are not yet implemented
+    context 'when a group is transferred into a root group' do
+      context 'when the root group share lock is enabled' do
+        let(:root_group) { create(:group, share_with_group_lock: true) }
+
+        context 'when the subgroup share lock is enabled' do
+          let(:subgroup) { create(:group, share_with_group_lock: true )}
+
+          it 'the subgroup share lock does not change' do
+            subgroup.parent = root_group
+            subgroup.save!
+
+            expect(subgroup.share_with_group_lock).to be_truthy
+          end
+        end
+
+        context 'when the subgroup share lock is disabled' do
+          let(:subgroup) { create(:group)}
+
+          it 'the subgroup share lock becomes enabled' do
+            subgroup.parent = root_group
+            subgroup.save!
+
+            expect(subgroup.share_with_group_lock).to be_truthy
+          end
+        end
+      end
+
+      context 'when the root group share lock is disabled' do
+        let(:root_group) { create(:group) }
+
+        context 'when the subgroup share lock is enabled' do
+          let(:subgroup) { create(:group, share_with_group_lock: true )}
+
+          it 'the subgroup share lock does not change' do
+            subgroup.parent = root_group
+            subgroup.save!
+
+            expect(subgroup.share_with_group_lock).to be_truthy
+          end
+        end
+
+        context 'when the subgroup share lock is disabled' do
+          let(:subgroup) { create(:group)}
+
+          it 'the subgroup share lock does not change' do
+            subgroup.parent = root_group
+            subgroup.save!
+
+            expect(subgroup.share_with_group_lock).to be_falsey
+          end
+        end
+      end
+    end
+  end
 end