User pages are visible to users without login

... if the user is authorized to at least one public project.

1 files changed, 69 insertions, 0 deletions

diff --git a/features/user.feature b/features/user.feature
new file mode 100644
index 00000000000..c1c1ddda52b
--- /dev/null
+++ b/features/user.feature
@@ -0,0 +1,69 @@
+Feature: User
+  Background:
+    Given Create user "John Doe"
+    And "John Doe" is authorized to private project "Enterprise"
+
+  # Signed out
+
+  Scenario: I visit user "John Doe" page while not signed in when he is authorized to a public project
+    Given "John Doe" is authorized to internal project "Internal"
+    And "John Doe" is authorized to public project "Community"
+    When I visit user "John Doe" page
+    Then I should see user "John Doe" page
+    And I should not see project "Enterprise"
+    And I should not see project "Internal"
+    And I should see project "Community"
+
+  Scenario: I visit user "John Doe" page while not signed in when he is not authorized to a public project
+    Given "John Doe" is authorized to internal project "Internal"
+    When I visit user "John Doe" page
+    Then I should be redirected to sign in page
+
+  # Signed in as someone else
+
+  Scenario: I visit user "John Doe" page while signed in as someone else when he is authorized to a public project
+    Given "John Doe" is authorized to public project "Community"
+    And "John Doe" is authorized to internal project "Internal"
+    And I sign in as a user
+    When I visit user "John Doe" page
+    Then I should see user "John Doe" page
+    And I should not see project "Enterprise"
+    And I should see project "Internal"
+    And I should see project "Community"
+
+  Scenario: I visit user "John Doe" page while signed in as someone else when he is not authorized to a public project
+    Given "John Doe" is authorized to internal project "Internal"
+    And I sign in as a user
+    When I visit user "John Doe" page
+    Then I should see user "John Doe" page
+    And I should not see project "Enterprise"
+    And I should see project "Internal"
+    And I should not see project "Community"
+
+  Scenario: I visit user "John Doe" page while signed in as someone else when he is not authorized to a project I can see
+    Given I sign in as a user
+    When I visit user "John Doe" page
+    Then I should see user "John Doe" page
+    And I should not see project "Enterprise"
+    And I should not see project "Internal"
+    And I should not see project "Community"
+
+  # Signed in as the user himself
+
+  Scenario: I visit user "John Doe" page while signed in as "John Doe" when he has a public project
+    Given "John Doe" is authorized to internal project "Internal"
+    And "John Doe" is authorized to public project "Community"
+    And I sign in as "John Doe"
+    When I visit user "John Doe" page
+    Then I should see user "John Doe" page
+    And I should see project "Enterprise"
+    And I should see project "Internal"
+    And I should see project "Community"
+
+  Scenario: I visit user "John Doe" page while signed in as "John Doe" when he has no public project
+    Given I sign in as "John Doe"
+    When I visit user "John Doe" page
+    Then I should see user "John Doe" page
+    And I should see project "Enterprise"
+    And I should not see project "Internal"
+    And I should not see project "Community"