Commit 2c744594 authored by Ash McKenzie's avatar Ash McKenzie

Merge branch 'environment-filter-anonymous' into 'master'

Fix filtering project MRs by environments

See merge request gitlab-org/gitlab!45551
parents 0276568e 978c29e5
...@@ -15,7 +15,7 @@ class ProjectsController < Projects::ApplicationController ...@@ -15,7 +15,7 @@ class ProjectsController < Projects::ApplicationController
around_action :allow_gitaly_ref_name_caching, only: [:index, :show] around_action :allow_gitaly_ref_name_caching, only: [:index, :show]
before_action :whitelist_query_limiting, only: [:create] before_action :whitelist_query_limiting, only: [:create]
before_action :authenticate_user!, except: [:index, :show, :activity, :refs, :resolve] before_action :authenticate_user!, except: [:index, :show, :activity, :refs, :resolve, :unfoldered_environment_names]
before_action :redirect_git_extension, only: [:show] before_action :redirect_git_extension, only: [:show]
before_action :project, except: [:index, :new, :create, :resolve] before_action :project, except: [:index, :new, :create, :resolve]
before_action :repository, except: [:index, :new, :create, :resolve] before_action :repository, except: [:index, :new, :create, :resolve]
......
...@@ -13,7 +13,7 @@ ...@@ -13,7 +13,7 @@
class EnvironmentNamesFinder class EnvironmentNamesFinder
attr_reader :project_or_group, :current_user attr_reader :project_or_group, :current_user
def initialize(project_or_group, current_user) def initialize(project_or_group, current_user = nil)
@project_or_group = project_or_group @project_or_group = project_or_group
@current_user = current_user @current_user = current_user
end end
...@@ -38,7 +38,7 @@ class EnvironmentNamesFinder ...@@ -38,7 +38,7 @@ class EnvironmentNamesFinder
end end
def project_environments def project_environments
if current_user.can?(:read_environment, project_or_group) if Ability.allowed?(current_user, :read_environment, project_or_group)
project_or_group.environments project_or_group.environments
else else
Environment.none Environment.none
......
...@@ -1213,4 +1213,60 @@ RSpec.describe GroupsController, factory_default: :keep do ...@@ -1213,4 +1213,60 @@ RSpec.describe GroupsController, factory_default: :keep do
it_behaves_like 'disabled when using an external authorization service' it_behaves_like 'disabled when using an external authorization service'
end end
end end
describe 'GET #unfoldered_environment_names' do
it 'shows the environment names of a public project to an anonymous user' do
public_project = create(:project, :public, namespace: group)
create(:environment, project: public_project, name: 'foo')
get(
:unfoldered_environment_names,
params: { id: group, format: :json }
)
expect(response).to have_gitlab_http_status(:ok)
expect(json_response).to eq(%w[foo])
end
it 'does not show environment names of private projects to anonymous users' do
create(:environment, project: project, name: 'foo')
get(
:unfoldered_environment_names,
params: { id: group, format: :json }
)
expect(response).to have_gitlab_http_status(:ok)
expect(json_response).to be_empty
end
it 'shows environment names of a private project to a group member' do
create(:environment, project: project, name: 'foo')
sign_in(developer)
get(
:unfoldered_environment_names,
params: { id: group, format: :json }
)
expect(response).to have_gitlab_http_status(:ok)
expect(json_response).to eq(%w[foo])
end
it 'does not show environment names of private projects to a logged-in non-member' do
alice = create(:user)
create(:environment, project: project, name: 'foo')
sign_in(alice)
get(
:unfoldered_environment_names,
params: { id: group, format: :json }
)
expect(response).to have_gitlab_http_status(:ok)
expect(json_response).to be_empty
end
end
end end
...@@ -1437,4 +1437,55 @@ RSpec.describe ProjectsController do ...@@ -1437,4 +1437,55 @@ RSpec.describe ProjectsController do
def project_moved_message(redirect_route, project) def project_moved_message(redirect_route, project)
"Project '#{redirect_route.path}' was moved to '#{project.full_path}'. Please update any links and bookmarks that may still have the old path." "Project '#{redirect_route.path}' was moved to '#{project.full_path}'. Please update any links and bookmarks that may still have the old path."
end end
describe 'GET #unfoldered_environment_names' do
it 'shows the environment names of a public project to an anonymous user' do
create(:environment, project: public_project, name: 'foo')
get(
:unfoldered_environment_names,
params: { namespace_id: public_project.namespace, id: public_project, format: :json }
)
expect(response).to have_gitlab_http_status(:ok)
expect(json_response).to eq(%w[foo])
end
it 'does not show environment names of a private project to anonymous users' do
create(:environment, project: project, name: 'foo')
get(
:unfoldered_environment_names,
params: { namespace_id: project.namespace, id: project, format: :json }
)
expect(response).to redirect_to(new_user_session_path)
end
it 'shows environment names of a private project to a project member' do
create(:environment, project: project, name: 'foo')
project.add_developer(user)
sign_in(user)
get(
:unfoldered_environment_names,
params: { namespace_id: project.namespace, id: project, format: :json }
)
expect(response).to have_gitlab_http_status(:ok)
expect(json_response).to eq(%w[foo])
end
it 'does not show environment names of a private project to a logged-in non-member' do
create(:environment, project: project, name: 'foo')
sign_in(user)
get(
:unfoldered_environment_names,
params: { namespace_id: project.namespace, id: project, format: :json }
)
expect(response).to have_gitlab_http_status(:not_found)
end
end
end end
...@@ -59,5 +59,21 @@ RSpec.describe EnvironmentNamesFinder do ...@@ -59,5 +59,21 @@ RSpec.describe EnvironmentNamesFinder do
expect(names).to be_empty expect(names).to be_empty
end end
end end
context 'using a public project without a user' do
it 'returns all the unique environment names' do
names = described_class.new(project1).execute
expect(names).to eq(%w[gprd gstg])
end
end
context 'using a private project without a user' do
it 'does not return any environment names' do
names = described_class.new(project2).execute
expect(names).to eq([])
end
end
end end
end end
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment