Restrict user search to current project

app/assets/javascripts/alert_management/components/alert_details.vue

@@ -57,6 +57,10 @@ export default {
       type: String,
       required: true,
     },
+    projectId: {
+      type: String,
+      required: true,
+    },
     projectPath: {
       type: String,
       required: true,
@@ -327,6 +331,7 @@ export default {
       </gl-tabs>
       <alert-sidebar
         :project-path="projectPath"
+        :project-id="projectId"
         :alert="alert"
         :sidebar-collapsed="sidebarCollapsed"
         @alert-refresh="alertRefresh"

app/assets/javascripts/alert_management/components/alert_sidebar.vue

@@ -16,6 +16,10 @@ export default {
       type: Boolean,
       required: true,
     },
+    projectId: {
+      type: String,
+      required: true,
+    },
     projectPath: {
       type: String,
       required: true,
@@ -49,6 +53,7 @@ export default {
       />
       <sidebar-assignees
         :project-path="projectPath"
+        :project-id="projectId"
         :alert="alert"
         :sidebar-collapsed="sidebarCollapsed"
         @alert-refresh="$emit('alert-refresh')"

app/assets/javascripts/alert_management/components/sidebar/sidebar_assignees.vue

@@ -38,6 +38,10 @@ export default {
     SidebarAssignee,
   },
   props: {
+    projectId: {
+      type: String,
+      required: true,
+    },
     projectPath: {
       type: String,
       required: true,
@@ -128,7 +132,7 @@ export default {
             per_page: 20,
             active: true,
             current_user: true,
-            project_id: gon?.current_project_id,
+            project_id: this.projectId,
           },
         })
         .then(({ data }) => {

app/assets/javascripts/alert_management/details.js

@@ -8,7 +8,7 @@ Vue.use(VueApollo);
 
 export default selector => {
   const domEl = document.querySelector(selector);
-  const { alertId, projectPath, projectIssuesPath } = domEl.dataset;
+  const { alertId, projectPath, projectIssuesPath, projectId } = domEl.dataset;
 
   const apolloProvider = new VueApollo({
     defaultClient: createDefaultClient(
@@ -39,6 +39,7 @@ export default selector => {
         props: {
           alertId,
           projectPath,
+          projectId,
           projectIssuesPath,
         },
       });

app/helpers/projects/alert_management_helper.rb

@@ -15,6 +15,7 @@ module Projects::AlertManagementHelper
     {
       'alert-id' => alert_id,
       'project-path' => project.full_path,
+      'project-id' => project.id,
       'project-issues-path' => project_issues_path(project)
     }
   end

changelogs/unreleased/assign-alerts-permissions-hotfix.yml

+---
+title: Restrict alert assignee user search to current project in alert management details
+merge_request: 34649
+author:
+type: fixed

spec/frontend/alert_management/components/alert_management_detail_spec.js

@@ -19,6 +19,7 @@ describe('AlertDetails', () => {
   let mock;
   const projectPath = 'root/alerts';
   const projectIssuesPath = 'root/alerts/-/issues';
+  const projectId = '1';
 
   const findDetailsTable = () => wrapper.find(GlTable);
 
@@ -28,6 +29,7 @@ describe('AlertDetails', () => {
         alertId: 'alertId',
         projectPath,
         projectIssuesPath,
+        projectId,
       },
       data() {
         return { alert: { ...mockAlert }, ...data };

spec/frontend/alert_management/components/alert_managment_sidebar_assignees_spec.js

@@ -33,6 +33,7 @@ describe('Alert Details Sidebar Assignees', () => {
         ...data,
         sidebarCollapsed,
         projectPath: 'projectPath',
+        projectId: '1',
       },
       mocks: {
         $apollo: {

spec/frontend/alert_management/components/alert_sidebar_spec.js

@@ -22,6 +22,7 @@ describe('Alert Details Sidebar', () => {
         alert,
         sidebarCollapsed,
         projectPath: 'projectPath',
+        projectId: '1',
       },
       stubs,
     });

spec/helpers/projects/alert_management_helper_spec.rb

@@ -7,7 +7,8 @@ describe Projects::AlertManagementHelper do
 
   let_it_be(:project, reload: true) { create(:project) }
   let_it_be(:current_user) { create(:user) }
-  let_it_be(:project_path) { project.full_path }
+  let(:project_path) { project.full_path }
+  let(:project_id) { project.id }
 
   describe '#alert_management_data' do
     let(:user_can_enable_alert_management) { true }
@@ -75,6 +76,7 @@ describe Projects::AlertManagementHelper do
       expect(helper.alert_management_detail_data(project, alert_id)).to eq(
         'alert-id' => alert_id,
         'project-path' => project_path,
+        'project-id' => project_id,
         'project-issues-path' => issues_path
       )
     end