1 files changed, 34 insertions, 2 deletions
diff --git a/spec/policies/group_policy_spec.rb b/spec/policies/group_policy_spec.rb
index af6d6f084a9..34e9dbffee1 100644
--- a/spec/policies/group_policy_spec.rb
+++ b/spec/policies/group_policy_spec.rb
@@ -74,6 +74,38 @@ describe GroupPolicy do
     end
   end
 
+  context 'with no user and public project' do
+    let(:project) { create(:project, :public) }
+    let(:user) { create(:user) }
+    let(:current_user) { nil }
+
+    before do
+      Projects::GroupLinks::CreateService.new(
+        project,
+        user,
+        link_group_access: ProjectGroupLink::DEVELOPER
+      ).execute(group)
+    end
+
+    it { expect_disallowed(:read_group) }
+  end
+
+  context 'with foreign user and public project' do
+    let(:project) { create(:project, :public) }
+    let(:user) { create(:user) }
+    let(:current_user) { create(:user) }
+
+    before do
+      Projects::GroupLinks::CreateService.new(
+        project,
+        user,
+        link_group_access: ProjectGroupLink::DEVELOPER
+      ).execute(group)
+    end
+
+    it { expect_disallowed(:read_group) }
+  end
+
   context 'has projects' do
     let(:current_user) { create(:user) }
     let(:project) { create(:project, namespace: group) }
@@ -83,7 +115,7 @@ describe GroupPolicy do
     end
 
     it do
-      expect_allowed(:read_group, :read_list, :read_label)
+      expect_allowed(:read_list, :read_label)
     end
 
     context 'in subgroups', :nested_groups do
@@ -91,7 +123,7 @@ describe GroupPolicy do
       let(:project) { create(:project, namespace: subgroup) }
 
       it do
-        expect_allowed(:read_group, :read_list, :read_label)
+        expect_allowed(:read_list, :read_label)
       end
     end
   end