1 files changed, 60 insertions, 0 deletions
diff --git a/spec/features/issuables/markdown_references/internal_references_spec.rb b/spec/features/issuables/markdown_references/internal_references_spec.rb
index 8af4b157cd8..9613e22bf24 100644
--- a/spec/features/issuables/markdown_references/internal_references_spec.rb
+++ b/spec/features/issuables/markdown_references/internal_references_spec.rb
@@ -10,6 +10,7 @@ describe "Internal references", :js do
   let(:public_project_user) { public_project.owner }
   let(:public_project) { create(:project, :public, :repository) }
   let(:public_project_issue) { create(:issue, project: public_project) }
+  let(:public_project_merge_request) { create(:merge_request, source_project: public_project) }
 
   context "when referencing to open issue" do
     context "from private project" do
@@ -77,4 +78,63 @@ describe "Internal references", :js do
       end
     end
   end
+
+  context "when referencing to open merge request" do
+    context "from private project" do
+      context "from issue" do
+        before do
+          sign_in(private_project_user)
+
+          visit(project_issue_path(private_project, private_project_issue))
+
+          add_note("##{public_project_merge_request.to_reference(private_project)}")
+        end
+
+        context "when user doesn't have access to private project" do
+          before do
+            sign_in(public_project_user)
+
+            visit(project_merge_request_path(public_project, public_project_merge_request))
+          end
+
+          it { expect(page).not_to have_css(".note") }
+        end
+      end
+
+      context "from merge request" do
+        before do
+          sign_in(private_project_user)
+
+          visit(project_merge_request_path(private_project, private_project_merge_request))
+
+          add_note("##{public_project_merge_request.to_reference(private_project)}")
+        end
+
+        context "when user doesn't have access to private project" do
+          before do
+            sign_in(public_project_user)
+
+            visit(project_merge_request_path(public_project, public_project_merge_request))
+          end
+
+          it "doesn't show any references" do
+            page.within(".merge-request-details") do
+              expect(page).not_to have_content("#merge-requests .merge-requests-title")
+            end
+          end
+        end
+
+        context "when user has access to private project" do
+          before do
+            visit(project_merge_request_path(public_project, public_project_merge_request))
+          end
+
+          it "shows references" do
+            expect(page).to have_content("mentioned in merge request #{private_project_merge_request.to_reference(public_project)}")
+                       .and have_content(private_project_user.name)
+          end
+        end
+      end
+    end
+  end
 end