Ensure only commit comments relevant to target project are returned

changelogs/unreleased/27873-when-a-commit-appears-in-several-projects-commit-comments-are-shared-across-projects.yml

@@ -0,0 +1,4 @@
+---
+title: Only return target project's comments for a commit
+merge_request:
+author:

lib/api/commits.rb

@@ -114,7 +114,7 @@ module API
         commit = user_project.commit(params[:sha])
 
         not_found! 'Commit' unless commit
-        notes = Note.where(commit_id: commit.id).order(:created_at)
+        notes = user_project.notes.where(commit_id: commit.id).order(:created_at)
 
         present paginate(notes), with: Entities::CommitNote
       end

spec/requests/api/commits_spec.rb

@@ -464,6 +464,20 @@ describe API::Commits, api: true  do
         expect(response).to have_http_status(401)
       end
     end
+
+    context 'when the commit is present on two projects' do
+      let(:forked_project) { create(:project, :repository, creator: user2, namespace: user2.namespace) }
+      let!(:forked_project_note) { create(:note_on_commit, author: user2, project: forked_project, commit_id: forked_project.repository.commit.id, note: 'a comment on a commit for fork') }
+
+      it 'returns the comments for the target project' do
+        get api("/projects/#{forked_project.id}/repository/commits/#{forked_project.repository.commit.id}/comments", user2)
+
+        expect(response).to have_http_status(200)
+        expect(json_response.length).to eq(1)
+        expect(json_response.first['note']).to eq('a comment on a commit for fork')
+        expect(json_response.first['author']['id']).to eq(user2.id)
+      end
+    end
   end
 
   describe 'POST :id/repository/commits/:sha/cherry_pick' do