Filter not accessible label events

Label events may use cross-project or cross-group references,
if the projects are not accessible by user, we don't show these
label events.

1 files changed, 14 insertions, 0 deletions

diff --git a/app/policies/resource_label_event_policy.rb b/app/policies/resource_label_event_policy.rb
new file mode 100644
index 00000000000..de4748d9890
--- /dev/null
+++ b/app/policies/resource_label_event_policy.rb
@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+class ResourceLabelEventPolicy < BasePolicy
+  condition(:can_read_label) { @subject.label_id.nil? || can?(:read_label, @subject.label) }
+  condition(:can_read_issuable) { can?(:"read_#{@subject.issuable.to_ability_name}", @subject.issuable) }
+
+  rule { can_read_label }.policy do
+    enable :read_label
+  end
+
+  rule { can_read_label & can_read_issuable }.policy do
+    enable :read_resource_label_event
+  end
+end