API: Introduce `#find_project!` which also check access permission

Signed-off-by: Rémy Coutable <remy@rymai.me>

1 files changed, 10 insertions, 7 deletions

diff --git a/lib/api/helpers.rb b/lib/api/helpers.rb
index 60067758e95..42f4c2ccf9d 100644
--- a/lib/api/helpers.rb
+++ b/lib/api/helpers.rb
@@ -68,7 +68,7 @@ module API
     end
 
     def user_project
-      @project ||= find_project(params[:id])
+      @project ||= find_project!(params[:id])
     end
 
     def available_labels
@@ -76,12 +76,15 @@ module API
     end
 
     def find_project(id)
-      project =
-        if id =~ /^\d+$/
-          Project.find_by(id: id)
-        else
-          Project.find_with_namespace(id)
-        end
+      if id =~ /^\d+$/
+        Project.find_by(id: id)
+      else
+        Project.find_with_namespace(id)
+      end
+    end
+
+    def find_project!(id)
+      project = find_project(id)
 
       if can?(current_user, :read_project, project)
         project