diff --git a/app/graphql/resolvers/concerns/resolves_snippets.rb b/app/graphql/resolvers/concerns/resolves_snippets.rb index d5808cf96f89defa4075f503f389ec07fde21b40..3c0275588b264807c6f2b83ae3d1300f09db02cd 100644 --- a/app/graphql/resolvers/concerns/resolves_snippets.rb +++ b/app/graphql/resolvers/concerns/resolves_snippets.rb @@ -23,7 +23,8 @@ def resolve(**args) private def resolve_snippets(args) - SnippetsFinder.new(context[:current_user], snippet_finder_params(args)).execute + SnippetsFinder.new(context[:current_user], organization_id: Current.organization.id, + **snippet_finder_params(args)).execute end def snippet_finder_params(args) diff --git a/lib/api/project_snippets.rb b/lib/api/project_snippets.rb index 59f119d30e138811bfc8226040265e7e348700da..1bd625b498385c62c844a65e15bae9bf474de8cd 100644 --- a/lib/api/project_snippets.rb +++ b/lib/api/project_snippets.rb @@ -31,7 +31,7 @@ def handle_project_member_errors(errors) end def snippets_for_current_user - SnippetsFinder.new(current_user, project: user_project).execute + SnippetsFinder.new(current_user, organization_id: Current.organization.id, project: user_project).execute end end diff --git a/lib/api/snippets.rb b/lib/api/snippets.rb index 0dc7542f889bf3333ab73126c05f833c6f4811c4..f5b86c18a0a62b98904baf9ad4c13aca25a8b826 100644 --- a/lib/api/snippets.rb +++ b/lib/api/snippets.rb @@ -14,7 +14,7 @@ class Snippets < ::API::Base helpers do def find_snippets(user: current_user, params: {}) - SnippetsFinder.new(user, params).execute + SnippetsFinder.new(user, organization_id: Current.organization.id, **params).execute end def snippets_for_current_user diff --git a/spec/features/snippets/public_snippets_spec.rb b/spec/features/snippets/public_snippets_spec.rb index 0f3d5e479d63dc58b795f28e329af739f97bac36..302d7be92e1063cf40de1a310106045b9096f4e3 100644 --- a/spec/features/snippets/public_snippets_spec.rb +++ b/spec/features/snippets/public_snippets_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' -RSpec.describe 'Public Snippets', :js, feature_category: :source_code_management do +RSpec.describe 'Public Snippets', :js, :with_current_organization, feature_category: :source_code_management do let(:public_snippet) { create(:personal_snippet, :public, :repository) } let(:content) { public_snippet.blobs.first.data.strip! } diff --git a/spec/features/snippets/show_spec.rb b/spec/features/snippets/show_spec.rb index 12f03277ec4c333e9ea4dcf7c9ecdefa25638f9a..88aef01e96813b564f92803f60e0469df59c3930 100644 --- a/spec/features/snippets/show_spec.rb +++ b/spec/features/snippets/show_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' -RSpec.describe 'Snippet', :js, feature_category: :source_code_management do +RSpec.describe 'Snippet', :js, :with_current_organization, feature_category: :source_code_management do let_it_be(:owner) { create(:user) } let_it_be(:current_organization) { owner.organization } let_it_be(:snippet) { create(:personal_snippet, :public, :repository, author: owner) } diff --git a/spec/graphql/resolvers/projects/snippets_resolver_spec.rb b/spec/graphql/resolvers/projects/snippets_resolver_spec.rb index 47e4629a3cd780304921ea401c0ace881cf69b1b..0716124788e4961d3783168797a7fcb77cc0d03f 100644 --- a/spec/graphql/resolvers/projects/snippets_resolver_spec.rb +++ b/spec/graphql/resolvers/projects/snippets_resolver_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' -RSpec.describe Resolvers::Projects::SnippetsResolver, feature_category: :source_code_management do +RSpec.describe Resolvers::Projects::SnippetsResolver, :with_current_organization, feature_category: :source_code_management do include GraphqlHelpers describe '#resolve' do @@ -20,6 +20,11 @@ project.add_developer(user) end + before do + # Since this doesn't go through a request flow, we need to manually set Current.organization + Current.organization = current_organization + end + it 'calls SnippetsFinder' do expect_next_instance_of(SnippetsFinder) do |finder| expect(finder).to receive(:execute) diff --git a/spec/graphql/resolvers/snippets_resolver_spec.rb b/spec/graphql/resolvers/snippets_resolver_spec.rb index ee9a6e67243c6e65a44a09a468a2d660f9e21366..08a2c9fbe7f4d778152a52bef458a39b6194f143 100644 --- a/spec/graphql/resolvers/snippets_resolver_spec.rb +++ b/spec/graphql/resolvers/snippets_resolver_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' -RSpec.describe Resolvers::SnippetsResolver do +RSpec.describe Resolvers::SnippetsResolver, :with_current_organization, feature_category: :source_code_management do include GraphqlHelpers describe '#resolve' do @@ -17,6 +17,8 @@ before do project.add_developer(current_user) + # Since this doesn't go through a request flow, we need to manually set Current.organization + Current.organization = current_organization end it 'calls SnippetsFinder' do @@ -33,6 +35,26 @@ end end + context 'organization filtering' do + let_it_be(:other_organization) { create(:organization) } + let_it_be(:snippet_in_other_org) { create(:personal_snippet, :public, author: current_user, organization: other_organization) } + + it 'passes organization_id to SnippetsFinder' do + expect(SnippetsFinder).to receive(:new) + .with(current_user, hash_including(organization_id: current_organization.id)) + .and_call_original + + resolve_snippets + end + + it 'only returns snippets from the current organization' do + snippets = resolve_snippets.items + + expect(snippets).to contain_exactly(personal_snippet, other_personal_snippet, project_snippet, other_project_snippet) + expect(snippets).not_to include(snippet_in_other_org) + end + end + context 'when using filters' do context 'by author id' do it 'returns the snippets' do diff --git a/spec/graphql/resolvers/users/snippets_resolver_spec.rb b/spec/graphql/resolvers/users/snippets_resolver_spec.rb index 12baed2560ee29fa7eae4c358ffc9cb34f110067..c032c8c8d11c4eadba65f5579b085024ec92af03 100644 --- a/spec/graphql/resolvers/users/snippets_resolver_spec.rb +++ b/spec/graphql/resolvers/users/snippets_resolver_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' -RSpec.describe Resolvers::Users::SnippetsResolver do +RSpec.describe Resolvers::Users::SnippetsResolver, :with_current_organization, feature_category: :source_code_management do include GraphqlHelpers describe '#resolve' do @@ -18,6 +18,8 @@ before do project.add_developer(current_user) + # Since this doesn't go through a request flow, we need to manually set Current.organization + Current.organization = current_organization end it 'calls SnippetsFinder' do diff --git a/spec/graphql/types/snippet_type_spec.rb b/spec/graphql/types/snippet_type_spec.rb index 30368bf236104fa18b7cc29dbbaa8f197f6238da..62138a8a1db72d14b08d48c23b6cf2f483ecb81b 100644 --- a/spec/graphql/types/snippet_type_spec.rb +++ b/spec/graphql/types/snippet_type_spec.rb @@ -2,11 +2,16 @@ require 'spec_helper' -RSpec.describe GitlabSchema.types['Snippet'] do +RSpec.describe GitlabSchema.types['Snippet'], :with_current_organization do include GraphqlHelpers let_it_be(:user) { create(:user) } + before do + # Since this doesn't go through a request flow, we need to manually set Current.organization + Current.organization = current_organization + end + it 'has the correct fields' do expected_fields = [:id, :title, :project, :author, :hidden, :file_name, :description, diff --git a/spec/graphql/types/snippets/blob_viewer_type_spec.rb b/spec/graphql/types/snippets/blob_viewer_type_spec.rb index d934f77901d3dba56e6e24b975e2b6dad765fec8..9b9979ce4cff27cf3a1c31d1d1ce0e5b79870f01 100644 --- a/spec/graphql/types/snippets/blob_viewer_type_spec.rb +++ b/spec/graphql/types/snippets/blob_viewer_type_spec.rb @@ -2,10 +2,15 @@ require 'spec_helper' -RSpec.describe GitlabSchema.types['SnippetBlobViewer'], feature_category: :source_code_management do +RSpec.describe GitlabSchema.types['SnippetBlobViewer'], :with_current_organization, feature_category: :source_code_management do let_it_be(:snippet) { create(:personal_snippet, :repository) } let_it_be(:blob) { snippet.repository.blob_at('HEAD', 'files/images/6049019_460s.jpg') } + before do + # Since this doesn't go through a request flow, we need to manually set Current.organization + Current.organization = current_organization + end + it 'has the correct fields' do expected_fields = [:type, :load_async, :too_large, :collapsed, :render_error, :file_type, :loading_partial_name] diff --git a/spec/requests/api/graphql/snippets_spec.rb b/spec/requests/api/graphql/snippets_spec.rb index f2a7679bff585c815093c90ad739b1dd2a9f2433..1450b5b407f4f1d61a17b2a9e268fc3d1b66b90c 100644 --- a/spec/requests/api/graphql/snippets_spec.rb +++ b/spec/requests/api/graphql/snippets_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' -RSpec.describe 'snippets', feature_category: :source_code_management do +RSpec.describe 'snippets', :with_current_organization, feature_category: :source_code_management do include GraphqlHelpers let_it_be(:current_user) { create(:user) } diff --git a/spec/requests/api/project_snippets_spec.rb b/spec/requests/api/project_snippets_spec.rb index 91d7bc1e403e34859b4483366797a8732f826d10..0bda22b2d97e594a55ecb24893af4695ae6c567a 100644 --- a/spec/requests/api/project_snippets_spec.rb +++ b/spec/requests/api/project_snippets_spec.rb @@ -63,6 +63,18 @@ expect(json_response.last).to have_key('web_url') end + it 'passes organization_id to SnippetsFinder' do + project.add_developer(user) + + expect(SnippetsFinder).to receive(:new) + .with(user, hash_including(organization_id: current_organization.id, project: project)) + .and_call_original + + get api("/projects/#{project.id}/snippets", user) + + expect(response).to have_gitlab_http_status(:ok) + end + it 'hides private snippets from regular user' do create(:project_snippet, :private, project: project) diff --git a/spec/requests/api/snippets_spec.rb b/spec/requests/api/snippets_spec.rb index ecd5310e361d16c0cd2b37c62aa14ac229ec3994..6f7e74398f4d8fab5997ca0ed8797e180ffe30c0 100644 --- a/spec/requests/api/snippets_spec.rb +++ b/spec/requests/api/snippets_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' -RSpec.describe API::Snippets, :aggregate_failures, factory_default: :keep, feature_category: :source_code_management do +RSpec.describe API::Snippets, :aggregate_failures, :with_current_organization, factory_default: :keep, feature_category: :source_code_management do include SnippetHelpers let_it_be(:admin) { create(:user, :admin) } @@ -71,6 +71,16 @@ it_behaves_like "returns unauthorized when not authenticated" it_behaves_like "returns filtered snippets for user" + it 'passes organization_id to SnippetsFinder' do + expect(SnippetsFinder).to receive(:new) + .with(user, hash_including(organization_id: current_organization.id)) + .and_call_original + + get api(path, personal_access_token: user_token) + + expect(response).to have_gitlab_http_status(:ok) + end + it 'hides private snippets from regular user' do get api(path, personal_access_token: other_user_token)