Check can :read_clusters in finder

This is in addtion to the can checks we have in the controller, as a
finder can be used elsewhere in the future.

1 files changed, 9 insertions, 3 deletions

diff --git a/app/finders/cluster_ancestors_finder.rb b/app/finders/cluster_ancestors_finder.rb
index 9f85e6e5c31..586fceb258a 100644
--- a/app/finders/cluster_ancestors_finder.rb
+++ b/app/finders/cluster_ancestors_finder.rb
@@ -1,18 +1,24 @@
 # frozen_string_literal: true
 
 class ClusterAncestorsFinder
-  def initialize(clusterable, user)
+  def initialize(clusterable, current_user)
     @clusterable = clusterable
-    @user = user
+    @current_user = current_user
   end
 
   def execute
+    return [] unless can_read_clusters?
+
     clusterable.clusters + ancestor_clusters
   end
 
   private
 
-  attr_reader :clusterable, :user
+  attr_reader :clusterable, :current_user
+
+  def can_read_clusters?
+    Ability.allowed?(current_user, :read_cluster, clusterable)
+  end
 
   def ancestor_clusters
     Clusters::Cluster.ancestor_clusters_for_clusterable(clusterable)