1 files changed, 112 insertions, 87 deletions
diff --git a/spec/requests/api/graphql/milestone_spec.rb b/spec/requests/api/graphql/milestone_spec.rb
index f6835936418..78e7ec39ee3 100644
--- a/spec/requests/api/graphql/milestone_spec.rb
+++ b/spec/requests/api/graphql/milestone_spec.rb
@@ -5,8 +5,12 @@ require 'spec_helper'
 RSpec.describe 'Querying a Milestone' do
   include GraphqlHelpers
 
+  let_it_be(:group) { create(:group, :public) }
+  let_it_be(:project) { create(:project, group: group) }
   let_it_be(:guest) { create(:user) }
-  let_it_be(:project) { create(:project) }
+  let_it_be(:inherited_guest) { create(:user) }
+  let_it_be(:inherited_reporter) { create(:user) }
+  let_it_be(:inherited_developer) { create(:user) }
   let_it_be(:milestone) { create(:milestone, project: project) }
   let_it_be(:release_a) { create(:release, project: project) }
   let_it_be(:release_b) { create(:release, project: project) }
@@ -14,116 +18,137 @@ RSpec.describe 'Querying a Milestone' do
   before_all do
     milestone.releases << [release_a, release_b]
     project.add_guest(guest)
+    group.add_guest(inherited_guest)
+    group.add_reporter(inherited_reporter)
+    group.add_developer(inherited_developer)
   end
 
   let(:expected_release_nodes) do
     contain_exactly(a_graphql_entity_for(release_a), a_graphql_entity_for(release_b))
   end
 
-  context 'when we post the query' do
-    let(:current_user) { nil }
-    let(:query) do
-      graphql_query_for('milestone', { id: milestone.to_global_id.to_s }, all_graphql_fields_for('Milestone'))
-    end
+  shared_examples 'returns the milestone successfully' do
+    it_behaves_like 'a working graphql query'
 
-    subject { graphql_data['milestone'] }
+    it { is_expected.to include('title' => milestone.name) }
 
-    before do
-      post_graphql(query, current_user: current_user)
+    it 'contains release information' do
+      is_expected.to include('releases' => include('nodes' => expected_release_nodes))
     end
+  end
 
-    context 'when the user has access to the milestone' do
-      let(:current_user) { guest }
-
-      it_behaves_like 'a working graphql query'
-
-      it { is_expected.to include('title' => milestone.name) }
-
-      it 'contains release information' do
-        is_expected.to include('releases' => include('nodes' => expected_release_nodes))
+  context 'when we post the query' do
+    context 'and the project is private' do
+      let(:query) do
+        graphql_query_for('milestone', { id: milestone.to_global_id.to_s }, all_graphql_fields_for('Milestone'))
       end
-    end
 
-    context 'when the user does not have access to the milestone' do
-      it_behaves_like 'a working graphql query'
-
-      it { is_expected.to be_nil }
-    end
+      subject { graphql_data['milestone'] }
 
-    context 'when ID argument is missing' do
-      let(:query) do
-        graphql_query_for('milestone', {}, 'title')
+      before do
+        post_graphql(query, current_user: current_user)
       end
 
-      it 'raises an exception' do
-        expect(graphql_errors).to include(a_hash_including('message' => "Field 'milestone' is missing required arguments: id"))
+      context 'when the user is a direct project member' do
+        context 'and the user is a guest' do
+          let(:current_user) { guest }
+
+          it_behaves_like 'returns the milestone successfully'
+
+          context 'when there are two milestones' do
+            let_it_be(:milestone_b) { create(:milestone, project: project) }
+
+            let(:milestone_fields) do
+              <<~GQL
+              fragment milestoneFields on Milestone {
+                #{all_graphql_fields_for('Milestone', max_depth: 1)}
+                releases { nodes { #{all_graphql_fields_for('Release', max_depth: 1)} } }
+              }
+              GQL
+            end
+
+            let(:single_query) do
+              <<~GQL
+              query ($id_a: MilestoneID!) {
+                a: milestone(id: $id_a) { ...milestoneFields }
+              }
+
+              #{milestone_fields}
+              GQL
+            end
+
+            let(:multi_query) do
+              <<~GQL
+              query ($id_a: MilestoneID!, $id_b: MilestoneID!) {
+                a: milestone(id: $id_a) { ...milestoneFields }
+                b: milestone(id: $id_b) { ...milestoneFields }
+              }
+              #{milestone_fields}
+              GQL
+            end
+
+            it 'returns the correct releases associated with each milestone' do
+              r = run_with_clean_state(multi_query,
+                                       context: { current_user: current_user },
+                                       variables: {
+                                         id_a: global_id_of(milestone).to_s,
+                                         id_b: milestone_b.to_global_id.to_s
+                                       })
+
+              expect(r.to_h['errors']).to be_blank
+              expect(graphql_dig_at(r.to_h, :data, :a, :releases, :nodes)).to match expected_release_nodes
+              expect(graphql_dig_at(r.to_h, :data, :b, :releases, :nodes)).to be_empty
+            end
+
+            it 'does not suffer from N+1 performance issues' do
+              baseline = ActiveRecord::QueryRecorder.new do
+                run_with_clean_state(single_query,
+                                     context: { current_user: current_user },
+                                     variables: { id_a: milestone.to_global_id.to_s })
+              end
+
+              multi = ActiveRecord::QueryRecorder.new do
+                run_with_clean_state(multi_query,
+                                     context: { current_user: current_user },
+                                     variables: {
+                                       id_a: milestone.to_global_id.to_s,
+                                       id_b: milestone_b.to_global_id.to_s
+                                     })
+              end
+
+              expect(multi).not_to exceed_query_limit(baseline)
+            end
+          end
+        end
       end
-    end
-  end
 
-  context 'when there are two milestones' do
-    let_it_be(:milestone_b) { create(:milestone, project: project) }
-
-    let(:current_user) { guest }
-    let(:milestone_fields) do
-      <<~GQL
-      fragment milestoneFields on Milestone {
-        #{all_graphql_fields_for('Milestone', max_depth: 1)}
-        releases { nodes { #{all_graphql_fields_for('Release', max_depth: 1)} } }
-      }
-      GQL
-    end
+      context 'when the user is an inherited member from the group' do
+        where(:user) { [ref(:inherited_guest), ref(:inherited_reporter), ref(:inherited_developer)] }
 
-    let(:single_query) do
-      <<~GQL
-      query ($id_a: MilestoneID!) {
-        a: milestone(id: $id_a) { ...milestoneFields }
-      }
+        with_them do
+          let(:current_user) { user }
 
-      #{milestone_fields}
-      GQL
-    end
+          it_behaves_like 'returns the milestone successfully'
+        end
+      end
 
-    let(:multi_query) do
-      <<~GQL
-      query ($id_a: MilestoneID!, $id_b: MilestoneID!) {
-        a: milestone(id: $id_a) { ...milestoneFields }
-        b: milestone(id: $id_b) { ...milestoneFields }
-      }
-      #{milestone_fields}
-      GQL
-    end
+      context 'when unauthenticated' do
+        let(:current_user) { nil }
 
-    it 'produces correct results' do
-      r = run_with_clean_state(multi_query,
-                           context: { current_user: current_user },
-                           variables: {
-                             id_a: global_id_of(milestone).to_s,
-                             id_b: milestone_b.to_global_id.to_s
-                           })
-
-      expect(r.to_h['errors']).to be_blank
-      expect(graphql_dig_at(r.to_h, :data, :a, :releases, :nodes)).to match expected_release_nodes
-      expect(graphql_dig_at(r.to_h, :data, :b, :releases, :nodes)).to be_empty
-    end
+        it_behaves_like 'a working graphql query'
 
-    it 'does not suffer from N+1 performance issues' do
-      baseline = ActiveRecord::QueryRecorder.new do
-        run_with_clean_state(single_query,
-                             context: { current_user: current_user },
-                             variables: { id_a: milestone.to_global_id.to_s })
-      end
+        it { is_expected.to be_nil }
 
-      multi = ActiveRecord::QueryRecorder.new do
-        run_with_clean_state(multi_query,
-                             context: { current_user: current_user },
-                             variables: {
-                               id_a: milestone.to_global_id.to_s,
-                               id_b: milestone_b.to_global_id.to_s
-                             })
-      end
+        context 'when ID argument is missing' do
+          let(:query) do
+            graphql_query_for('milestone', {}, 'title')
+          end
 
-      expect(multi).not_to exceed_query_limit(baseline)
+          it 'raises an exception' do
+            expect(graphql_errors).to include(a_hash_including('message' => "Field 'milestone' is missing required arguments: id"))
+          end
+        end
+      end
     end
   end
 end