diff --git a/app/controllers/users/redirect_controller.rb b/app/controllers/users/redirect_controller.rb new file mode 100644 index 0000000000000000000000000000000000000000..507ac499252607a2bb442b6480cd3dcde199a596 --- /dev/null +++ b/app/controllers/users/redirect_controller.rb @@ -0,0 +1,25 @@ +# frozen_string_literal: true + +module Users + class RedirectController < ::ApplicationController + skip_before_action :authenticate_user! + + feature_category :user_management + + def redirect_from_id + # Unauthenticated users will receive a HTTP 403 Forbidden, matching the behavior in the Users API + if current_user + user = User.find(user_params[:id]) + redirect_to user + else + render_403 + end + end + + private + + def user_params + params.permit(:id) + end + end +end diff --git a/config/routes.rb b/config/routes.rb index 4b4ed57b5b2e9d258b1246f568966584f691a63f..8d1cec467641f55cc58af403af91ed27e1f7c6f9 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -342,6 +342,8 @@ root to: "root#index" + get '/-/u/:id' => 'users/redirect#redirect_from_id' + get '*unmatched_route', to: 'application#route_not_found', format: false # Load all custom URLs definitions via `direct' after the last route diff --git a/spec/requests/users/redirect_controller_spec.rb b/spec/requests/users/redirect_controller_spec.rb new file mode 100644 index 0000000000000000000000000000000000000000..7e669a27d87dc1cb2e094296dfde560e115e51c5 --- /dev/null +++ b/spec/requests/users/redirect_controller_spec.rb @@ -0,0 +1,40 @@ +# frozen_string_literal: true + +require 'spec_helper' + +RSpec.describe "Users::RedirectController requests", feature_category: :user_management do + using RSpec::Parameterized::TableSyntax + + let_it_be(:user) { create(:user) } + let_it_be(:another_user) { create(:user) } + + context 'when user is not logged in' do + it 'returns 403' do + get "/-/u/#{user.id}" + + expect(response).to have_gitlab_http_status(:forbidden) + end + end + + context 'when user is logged in' do + before do + sign_in(another_user) + end + + context 'with valid user id' do + it 'redirects to user profile page' do + get "/-/u/#{user.id}" + + expect(response).to redirect_to(user_path(user)) + end + end + + context 'with invalid user id' do + it 'returns 404 for non-existent user' do + get "/-/u/123" + + expect(response).to have_gitlab_http_status(:not_found) + end + end + end +end diff --git a/spec/routing/user_routing_spec.rb b/spec/routing/user_routing_spec.rb index 7aa6a8c731c92e46ccb5941558d29c50aaba2d3c..b6970fa39cbe827346185b4ab43305aa1d2edf88 100644 --- a/spec/routing/user_routing_spec.rb +++ b/spec/routing/user_routing_spec.rb @@ -27,3 +27,13 @@ end end end + +RSpec.describe "Users", "routing", feature_category: :user_management do + let!(:user) { create(:user) } + + describe 'GET /-/u/:id' do + it 'routes to users/redirect#redirect_from_id' do + expect(get('/-/u/1')).to route_to('users/redirect#redirect_from_id', id: '1') + end + end +end