Merge branch 'kassio/group-avatar-api' into 'master'

Add Group Avatar endpoint

See merge request gitlab-org/gitlab!62596

doc/api/groups.md

@@ -725,6 +725,28 @@ Example response:
 }
 ```
 
+### Download a Group avatar
+
+Get a group avatar. This endpoint can be accessed without authentication if the
+group is publicly accessible.
+
+```plaintext
+GET /groups/:id/avatar
+```
+
+| Attribute | Type           | Required | Description           |
+| --------- | -------------- | -------- | --------------------- |
+| `id`      | integer/string | yes      | ID of the group       |
+
+Example:
+
+```shell
+curl --header "PRIVATE-TOKEN: $GITLAB_LOCAL_TOKEN" \
+  --remote-header-name \
+  --remote-name \
+  "https://gitlab.example.com/api/v4/groups/4/avatar"
+```
+
 ### Disable the results limit **(FREE SELF)**
 
 The 100 results limit can break integrations developed using GitLab 12.4 and earlier.

lib/api/api.rb

@@ -173,6 +173,7 @@ module API
       mount ::API::Features
       mount ::API::Files
       mount ::API::FreezePeriods
+      mount ::API::GroupAvatar
       mount ::API::GroupBoards
       mount ::API::GroupClusters
       mount ::API::GroupExport

lib/api/group_avatar.rb

+# frozen_string_literal: true
+
+module API
+  class GroupAvatar < ::API::Base
+    helpers Helpers::GroupsHelpers
+
+    feature_category :subgroups
+
+    resource :groups do
+      desc 'Download the group avatar' do
+        detail 'This feature was introduced in GitLab 14.0'
+      end
+      params do
+        requires :id, type: String, desc: 'The group id'
+      end
+      get ':id/avatar' do
+        present_carrierwave_file!(user_group.avatar)
+      end
+    end
+  end
+end

spec/requests/api/group_avatar_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe API::GroupAvatar do
+  def avatar_path(group)
+    "/groups/#{group.id}/avatar"
+  end
+
+  describe 'GET /groups/:id/avatar' do
+    context 'when the group is public' do
+      it 'retrieves the avatar successfully' do
+        group = create(:group, :public, :with_avatar)
+
+        get api(avatar_path(group))
+
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+
+      context 'when the group does not have avatar' do
+        it 'returns :not_found' do
+          group = create(:group, :public)
+
+          get api(avatar_path(group))
+
+          expect(response).to have_gitlab_http_status(:not_found)
+        end
+      end
+    end
+
+    context 'when the group is private' do
+      let(:group) { create(:group, :private, :with_avatar) }
+
+      context 'when the user is not authenticated' do
+        it 'returns :not_found' do
+          get api(avatar_path(group))
+
+          expect(response).to have_gitlab_http_status(:not_found)
+        end
+      end
+
+      context 'when the the group user is authenticated' do
+        context 'and have access to the group' do
+          it 'retrieves the avatar successfully' do
+            owner = create(:user)
+            group.add_owner(owner)
+
+            get api(avatar_path(group), owner)
+
+            expect(response).to have_gitlab_http_status(:ok)
+          end
+        end
+
+        context 'and does not have access to the group' do
+          it 'returns :not_found' do
+            get api(avatar_path(group), create(:user))
+
+            expect(response).to have_gitlab_http_status(:not_found)
+          end
+        end
+      end
+    end
+  end
+end