1 files changed, 33 insertions, 23 deletions
diff --git a/spec/services/groups/group_links/create_service_spec.rb b/spec/services/groups/group_links/create_service_spec.rb
index fb88433d8f6..df994b9f2a3 100644
--- a/spec/services/groups/group_links/create_service_spec.rb
+++ b/spec/services/groups/group_links/create_service_spec.rb
@@ -74,46 +74,56 @@ RSpec.describe Groups::GroupLinks::CreateService, '#execute' do
     end
   end
 
-  context 'group hierarchies' do
+  context 'project authorizations based on group hierarchies' do
     before do
       group_parent.add_owner(parent_group_user)
       group.add_owner(group_user)
       group_child.add_owner(child_group_user)
     end
 
-    context 'group user' do
-      let(:user) { group_user }
+    context 'project authorizations refresh' do
+      it 'is executed only for the direct members of the group' do
+        expect(UserProjectAccessChangedService).to receive(:new).with(contain_exactly(group_user.id)).and_call_original
 
-      it 'create proper authorizations' do
         subject.execute(shared_group)
-
-        expect(Ability.allowed?(user, :read_project, project_parent)).to be_falsey
-        expect(Ability.allowed?(user, :read_project, project)).to be_truthy
-        expect(Ability.allowed?(user, :read_project, project_child)).to be_truthy
       end
     end
 
-    context 'parent group user' do
-      let(:user) { parent_group_user }
+    context 'project authorizations' do
+      context 'group user' do
+        let(:user) { group_user }
 
-      it 'create proper authorizations' do
-        subject.execute(shared_group)
+        it 'create proper authorizations' do
+          subject.execute(shared_group)
 
-        expect(Ability.allowed?(user, :read_project, project_parent)).to be_falsey
-        expect(Ability.allowed?(user, :read_project, project)).to be_falsey
-        expect(Ability.allowed?(user, :read_project, project_child)).to be_falsey
+          expect(Ability.allowed?(user, :read_project, project_parent)).to be_falsey
+          expect(Ability.allowed?(user, :read_project, project)).to be_truthy
+          expect(Ability.allowed?(user, :read_project, project_child)).to be_truthy
+        end
       end
-    end
 
-    context 'child group user' do
-      let(:user) { child_group_user }
+      context 'parent group user' do
+        let(:user) { parent_group_user }
 
-      it 'create proper authorizations' do
-        subject.execute(shared_group)
+        it 'create proper authorizations' do
+          subject.execute(shared_group)
+
+          expect(Ability.allowed?(user, :read_project, project_parent)).to be_falsey
+          expect(Ability.allowed?(user, :read_project, project)).to be_falsey
+          expect(Ability.allowed?(user, :read_project, project_child)).to be_falsey
+        end
+      end
+
+      context 'child group user' do
+        let(:user) { child_group_user }
+
+        it 'create proper authorizations' do
+          subject.execute(shared_group)
 
-        expect(Ability.allowed?(user, :read_project, project_parent)).to be_falsey
-        expect(Ability.allowed?(user, :read_project, project)).to be_falsey
-        expect(Ability.allowed?(user, :read_project, project_child)).to be_falsey
+          expect(Ability.allowed?(user, :read_project, project_parent)).to be_falsey
+          expect(Ability.allowed?(user, :read_project, project)).to be_falsey
+          expect(Ability.allowed?(user, :read_project, project_child)).to be_falsey
+        end
       end
     end
   end