1 files changed, 142 insertions, 25 deletions
diff --git a/spec/lib/gitlab/project_authorizations_spec.rb b/spec/lib/gitlab/project_authorizations_spec.rb
index 82ccb42f8a6..006daa29ea1 100644
--- a/spec/lib/gitlab/project_authorizations_spec.rb
+++ b/spec/lib/gitlab/project_authorizations_spec.rb
@@ -3,48 +3,55 @@
 require 'spec_helper'
 
 describe Gitlab::ProjectAuthorizations do
-  let(:group) { create(:group) }
-  let!(:owned_project) { create(:project) }
-  let!(:other_project) { create(:project) }
-  let!(:group_project) { create(:project, namespace: group) }
-
-  let(:user) { owned_project.namespace.owner }
-
   def map_access_levels(rows)
     rows.each_with_object({}) do |row, hash|
       hash[row.project_id] = row.access_level
     end
   end
 
-  before do
-    other_project.add_reporter(user)
-    group.add_developer(user)
-  end
-
-  let(:authorizations) do
+  subject(:authorizations) do
     described_class.new(user).calculate
   end
 
-  it 'returns the correct number of authorizations' do
-    expect(authorizations.length).to eq(3)
-  end
+  context 'user added to group and project' do
+    let(:group) { create(:group) }
+    let!(:other_project) { create(:project) }
+    let!(:group_project) { create(:project, namespace: group) }
+    let!(:owned_project) { create(:project) }
+    let(:user) { owned_project.namespace.owner }
 
-  it 'includes the correct projects' do
-    expect(authorizations.pluck(:project_id))
-      .to include(owned_project.id, other_project.id, group_project.id)
-  end
+    before do
+      other_project.add_reporter(user)
+      group.add_developer(user)
+    end
+
+    it 'returns the correct number of authorizations' do
+      expect(authorizations.length).to eq(3)
+    end
 
-  it 'includes the correct access levels' do
-    mapping = map_access_levels(authorizations)
+    it 'includes the correct projects' do
+      expect(authorizations.pluck(:project_id))
+        .to include(owned_project.id, other_project.id, group_project.id)
+    end
+
+    it 'includes the correct access levels' do
+      mapping = map_access_levels(authorizations)
 
-    expect(mapping[owned_project.id]).to eq(Gitlab::Access::MAINTAINER)
-    expect(mapping[other_project.id]).to eq(Gitlab::Access::REPORTER)
-    expect(mapping[group_project.id]).to eq(Gitlab::Access::DEVELOPER)
+      expect(mapping[owned_project.id]).to eq(Gitlab::Access::MAINTAINER)
+      expect(mapping[other_project.id]).to eq(Gitlab::Access::REPORTER)
+      expect(mapping[group_project.id]).to eq(Gitlab::Access::DEVELOPER)
+    end
   end
 
   context 'with nested groups' do
+    let(:group) { create(:group) }
     let!(:nested_group) { create(:group, parent: group) }
     let!(:nested_project) { create(:project, namespace: nested_group) }
+    let(:user) { create(:user) }
+
+    before do
+      group.add_developer(user)
+    end
 
     it 'includes nested groups' do
       expect(authorizations.pluck(:project_id)).to include(nested_project.id)
@@ -64,4 +71,114 @@ describe Gitlab::ProjectAuthorizations do
       expect(mapping[nested_project.id]).to eq(Gitlab::Access::MAINTAINER)
     end
   end
+
+  context 'with shared groups' do
+    let(:parent_group_user) { create(:user) }
+    let(:group_user) { create(:user) }
+    let(:child_group_user) { create(:user) }
+
+    set(:group_parent) { create(:group, :private) }
+    set(:group) { create(:group, :private, parent: group_parent) }
+    set(:group_child) { create(:group, :private, parent: group) }
+
+    set(:shared_group_parent) { create(:group, :private) }
+    set(:shared_group) { create(:group, :private, parent: shared_group_parent) }
+    set(:shared_group_child) { create(:group, :private, parent: shared_group) }
+
+    set(:project_parent) { create(:project, group: shared_group_parent) }
+    set(:project) { create(:project, group: shared_group) }
+    set(:project_child) { create(:project, group: shared_group_child) }
+
+    before do
+      group_parent.add_owner(parent_group_user)
+      group.add_owner(group_user)
+      group_child.add_owner(child_group_user)
+
+      create(:group_group_link, shared_group: shared_group, shared_with_group: group)
+    end
+
+    context 'when feature flag share_group_with_group is enabled' do
+      before do
+        stub_feature_flags(share_group_with_group: true)
+      end
+
+      context 'group user' do
+        let(:user) { group_user }
+
+        it 'creates proper authorizations' do
+          mapping = map_access_levels(authorizations)
+
+          expect(mapping[project_parent.id]).to be_nil
+          expect(mapping[project.id]).to eq(Gitlab::Access::DEVELOPER)
+          expect(mapping[project_child.id]).to eq(Gitlab::Access::DEVELOPER)
+        end
+      end
+
+      context 'parent group user' do
+        let(:user) { parent_group_user }
+
+        it 'creates proper authorizations' do
+          mapping = map_access_levels(authorizations)
+
+          expect(mapping[project_parent.id]).to be_nil
+          expect(mapping[project.id]).to be_nil
+          expect(mapping[project_child.id]).to be_nil
+        end
+      end
+
+      context 'child group user' do
+        let(:user) { child_group_user }
+
+        it 'creates proper authorizations' do
+          mapping = map_access_levels(authorizations)
+
+          expect(mapping[project_parent.id]).to be_nil
+          expect(mapping[project.id]).to be_nil
+          expect(mapping[project_child.id]).to be_nil
+        end
+      end
+    end
+
+    context 'when feature flag share_group_with_group is disabled' do
+      before do
+        stub_feature_flags(share_group_with_group: false)
+      end
+
+      context 'group user' do
+        let(:user) { group_user }
+
+        it 'creates proper authorizations' do
+          mapping = map_access_levels(authorizations)
+
+          expect(mapping[project_parent.id]).to be_nil
+          expect(mapping[project.id]).to be_nil
+          expect(mapping[project_child.id]).to be_nil
+        end
+      end
+
+      context 'parent group user' do
+        let(:user) { parent_group_user }
+
+        it 'creates proper authorizations' do
+          mapping = map_access_levels(authorizations)
+
+          expect(mapping[project_parent.id]).to be_nil
+          expect(mapping[project.id]).to be_nil
+          expect(mapping[project_child.id]).to be_nil
+        end
+      end
+
+      context 'child group user' do
+        let(:user) { child_group_user }
+
+        it 'creates proper authorizations' do
+          mapping = map_access_levels(authorizations)
+
+          expect(mapping[project_parent.id]).to be_nil
+          expect(mapping[project.id]).to be_nil
+          expect(mapping[project_child.id]).to be_nil
+        end
+      end
+    end
+  end
 end