summaryrefslogtreecommitdiff
path: root/spec/finders
diff options
context:
space:
mode:
authorTiago Botelho <tiagonbotelho@hotmail.com>2018-12-11 14:52:22 +0000
committerBob Van Landuyt <bob@vanlanduyt.co>2019-01-21 08:46:11 +0100
commit9ec860ea05d5c74387cbff4593ca76072a38ad5f (patch)
tree178afe23115bc2b5866cffe86cfb70c367b808b5 /spec/finders
parent49efb57914b7daac651e0b3fbeb850584be66ce7 (diff)
downloadgitlab-ce-9ec860ea05d5c74387cbff4593ca76072a38ad5f.tar.gz
Group Guests are no longer able to see merge requests
Group guests will only be displayed merge requests to projects they have a access level to, higher than Reporter. Visible projects will still display the merge requests to Guests
Diffstat (limited to 'spec/finders')
-rw-r--r--spec/finders/merge_requests_finder_spec.rb32
1 files changed, 23 insertions, 9 deletions
diff --git a/spec/finders/merge_requests_finder_spec.rb b/spec/finders/merge_requests_finder_spec.rb
index ff4c6b8dd42..107da08a0a9 100644
--- a/spec/finders/merge_requests_finder_spec.rb
+++ b/spec/finders/merge_requests_finder_spec.rb
@@ -68,20 +68,34 @@ describe MergeRequestsFinder do
expect(merge_requests.size).to eq(2)
end
- it 'filters by group' do
- params = { group_id: group.id }
+ context 'filtering by group' do
+ it 'includes all merge requests when user has access' do
+ params = { group_id: group.id }
- merge_requests = described_class.new(user, params).execute
+ merge_requests = described_class.new(user, params).execute
- expect(merge_requests.size).to eq(3)
- end
+ expect(merge_requests.size).to eq(3)
+ end
- it 'filters by group including subgroups', :nested_groups do
- params = { group_id: group.id, include_subgroups: true }
+ it 'excludes merge requests from projects the user does not have access to' do
+ private_project = create_project_without_n_plus_1(:private, group: group)
+ private_mr = create(:merge_request, :simple, author: user, source_project: private_project, target_project: private_project)
+ params = { group_id: group.id }
- merge_requests = described_class.new(user, params).execute
+ private_project.add_guest(user)
+ merge_requests = described_class.new(user, params).execute
- expect(merge_requests.size).to eq(6)
+ expect(merge_requests.size).to eq(3)
+ expect(merge_requests).not_to include(private_mr)
+ end
+
+ it 'filters by group including subgroups', :nested_groups do
+ params = { group_id: group.id, include_subgroups: true }
+
+ merge_requests = described_class.new(user, params).execute
+
+ expect(merge_requests.size).to eq(6)
+ end
end
it 'filters by non_archived' do