summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--app/services/todos/destroy/confidential_issue_service.rb9
-rw-r--r--app/services/todos/destroy/entity_leave_service.rb4
-rw-r--r--spec/services/todos/destroy/confidential_issue_service_spec.rb12
-rw-r--r--spec/services/todos/destroy/entity_leave_service_spec.rb38
4 files changed, 56 insertions, 7 deletions
diff --git a/app/services/todos/destroy/confidential_issue_service.rb b/app/services/todos/destroy/confidential_issue_service.rb
index 06cf308a3cd..c5b66df057a 100644
--- a/app/services/todos/destroy/confidential_issue_service.rb
+++ b/app/services/todos/destroy/confidential_issue_service.rb
@@ -14,6 +14,8 @@ module Todos
override :todos
def todos
Todo.where(target: issue)
+ .where('user_id != ?', issue.author_id)
+ .where('user_id NOT IN (?)', issue.assignees.select(:id))
end
override :todos_to_remove?
@@ -25,6 +27,13 @@ module Todos
def project_ids
issue.project_id
end
+
+ override :authorized_users
+ def authorized_users
+ ProjectAuthorization.select(:user_id)
+ .where(project_id: project_ids)
+ .where('access_level >= ?', Gitlab::Access::REPORTER)
+ end
end
end
end
diff --git a/app/services/todos/destroy/entity_leave_service.rb b/app/services/todos/destroy/entity_leave_service.rb
index 328a8b39e7b..129e5505a21 100644
--- a/app/services/todos/destroy/entity_leave_service.rb
+++ b/app/services/todos/destroy/entity_leave_service.rb
@@ -42,7 +42,11 @@ module Todos
end
def confidential_issues
+ assigned_ids = IssueAssignee.select(:issue_id).where(user_id: user_id)
+
Issue.where(project_id: project_ids, confidential: true)
+ .where('author_id != ?', user_id)
+ .where('id NOT IN (?)', assigned_ids)
end
end
end
diff --git a/spec/services/todos/destroy/confidential_issue_service_spec.rb b/spec/services/todos/destroy/confidential_issue_service_spec.rb
index 5c214df49bc..54d1d7e83f1 100644
--- a/spec/services/todos/destroy/confidential_issue_service_spec.rb
+++ b/spec/services/todos/destroy/confidential_issue_service_spec.rb
@@ -3,16 +3,23 @@ require 'spec_helper'
describe Todos::Destroy::ConfidentialIssueService do
let(:project) { create(:project, :public) }
let(:user) { create(:user) }
+ let(:author) { create(:user) }
+ let(:assignee) { create(:user) }
+ let(:guest) { create(:user) }
let(:project_member) { create(:user) }
- let(:issue) { create(:issue, project: project) }
+ let(:issue) { create(:issue, project: project, author: author, assignees: [assignee]) }
let!(:todo_issue_non_member) { create(:todo, user: user, target: issue, project: project) }
let!(:todo_issue_member) { create(:todo, user: project_member, target: issue, project: project) }
+ let!(:todo_issue_author) { create(:todo, user: author, target: issue, project: project) }
+ let!(:todo_issue_asignee) { create(:todo, user: assignee, target: issue, project: project) }
+ let!(:todo_issue_guest) { create(:todo, user: guest, target: issue, project: project) }
let!(:todo_another_non_member) { create(:todo, user: user, project: project) }
describe '#execute' do
before do
project.add_developer(project_member)
+ project.add_guest(guest)
end
subject { described_class.new(issue.id).execute }
@@ -23,9 +30,10 @@ describe Todos::Destroy::ConfidentialIssueService do
end
it 'removes issue todos for a user who is not a project member' do
- expect { subject }.to change { Todo.count }.from(3).to(2)
+ expect { subject }.to change { Todo.count }.from(6).to(4)
expect(user.todos).to match_array([todo_another_non_member])
+ expect(author.todos).to match_array([todo_issue_author])
expect(project_member.todos).to match_array([todo_issue_member])
end
end
diff --git a/spec/services/todos/destroy/entity_leave_service_spec.rb b/spec/services/todos/destroy/entity_leave_service_spec.rb
index e5673383df8..52175ed9032 100644
--- a/spec/services/todos/destroy/entity_leave_service_spec.rb
+++ b/spec/services/todos/destroy/entity_leave_service_spec.rb
@@ -29,13 +29,41 @@ describe Todos::Destroy::EntityLeaveService do
end
context 'when project is not private' do
- before do
- group.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
- project.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
+ context 'when a user is not an author of confidential issue' do
+ before do
+ group.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
+ project.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
+ end
+
+ it 'removes only confidential issues todos' do
+ expect { subject }.to change { Todo.count }.from(3).to(2)
+ end
end
- it 'removes only confidential issues todos' do
- expect { subject }.to change { Todo.count }.from(3).to(2)
+ context 'when a user is an author of confidential issue' do
+ before do
+ issue.update!(author: user)
+
+ group.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
+ project.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
+ end
+
+ it 'removes only confidential issues todos' do
+ expect { subject }.not_to change { Todo.count }
+ end
+ end
+
+ context 'when a user is an assignee of confidential issue' do
+ before do
+ issue.assignees << user
+
+ group.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
+ project.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
+ end
+
+ it 'removes only confidential issues todos' do
+ expect { subject }.not_to change { Todo.count }
+ end
end
end
end