Merge branch 'api-delete-group-share' into 'master'

API: Add endpoint to delete a group share

Closes #24771

See merge request !7662

4 files changed, 66 insertions, 0 deletions

diff --git a/changelogs/unreleased/api-delete-group-share.yml b/changelogs/unreleased/api-delete-group-share.yml
new file mode 100644
index 00000000000..26cfb35bba3
--- /dev/null
+++ b/changelogs/unreleased/api-delete-group-share.yml
@@ -0,0 +1,4 @@
+---
+title: 'API: Add ability to unshare a project from a group'
+merge_request: 7662
+author: Robert Schilling
diff --git a/doc/api/projects.md b/doc/api/projects.md
index 467a880ac13..de5d3b07c21 100644
--- a/doc/api/projects.md
+++ b/doc/api/projects.md
@@ -1074,6 +1074,25 @@ Parameters:
 | `group_access` | integer | yes | The permissions level to grant the group |
 | `expires_at` | string | no | Share expiration date in ISO 8601 format: 2016-09-26 |
 
+### Delete a shared project link within a group
+
+Unshare the project from the group. Returns `204` and no content on success.
+
+```
+DELETE /projects/:id/share/:group_id
+```
+
+Parameters:
+
+| Attribute | Type | Required | Description |
+| --------- | ---- | -------- | ----------- |
+| `id` | integer/string | yes | The ID of the project or NAMESPACE/PROJECT_NAME |
+| `group_id` | integer | yes | The ID of the group |
+
+```bash
+curl --request DELETE --header "PRIVATE-TOKEN: 9koXpg98eAheJpvBs5tK" https://gitlab.example.com/api/v3/projects/5/share/17
+```
+
 ## Hooks
 
 Also called Project Hooks and Webhooks.
diff --git a/lib/api/projects.rb b/lib/api/projects.rb
index 6b856128c2e..ddfde178d30 100644
--- a/lib/api/projects.rb
+++ b/lib/api/projects.rb
@@ -438,6 +438,19 @@ module API
         end
       end
 
+      params do
+        requires :group_id, type: Integer, desc: 'The ID of the group'
+      end
+      delete ":id/share/:group_id" do
+        authorize! :admin_project, user_project
+
+        link = user_project.project_group_links.find_by(group_id: params[:group_id])
+        not_found!('Group Link') unless link
+
+        link.destroy
+        no_content!
+      end
+
       # Upload a file
       #
       # Parameters:
diff --git a/spec/requests/api/projects_spec.rb b/spec/requests/api/projects_spec.rb
index f020d471422..e53ee2a4e76 100644
--- a/spec/requests/api/projects_spec.rb
+++ b/spec/requests/api/projects_spec.rb
@@ -908,6 +908,36 @@ describe API::API, api: true  do
     end
   end
 
+  describe 'DELETE /projects/:id/share/:group_id' do
+    it 'returns 204 when deleting a group share' do
+      group = create(:group, :public)
+      create(:project_group_link, group: group, project: project)
+
+      delete api("/projects/#{project.id}/share/#{group.id}", user)
+
+      expect(response).to have_http_status(204)
+      expect(project.project_group_links).to be_empty
+    end
+
+    it 'returns a 400 when group id is not an integer' do
+      delete api("/projects/#{project.id}/share/foo", user)
+
+      expect(response).to have_http_status(400)
+    end
+
+    it 'returns a 404 error when group link does not exist' do
+      delete api("/projects/#{project.id}/share/1234", user)
+
+      expect(response).to have_http_status(404)
+    end
+
+    it 'returns a 404 error when project does not exist' do
+      delete api("/projects/123/share/1234", user)
+
+      expect(response).to have_http_status(404)
+    end
+  end
+
   describe 'GET /projects/search/:query' do
     let!(:query) { 'query'}
     let!(:search)           { create(:empty_project, name: query, creator_id: user.id, namespace: user.namespace) }