From e8bdcdf0f89d88463f6fb8a67e85f315e6a9097d Mon Sep 17 00:00:00 2001
From: Camil Staps <info@camilstaps.nl>
Date: Sat, 2 Feb 2019 20:48:27 +0100
Subject: [PATCH] Expose time since starring on project/:id/starrers API
 endpoint; exclude private profiles here as well

---
 app/models/user.rb               |  9 +++++++++
 app/models/users_star_project.rb |  2 +-
 doc/api/projects.md              | 34 +++++++++++++++++++-------------
 lib/api/entities.rb              |  5 +++++
 lib/api/projects.rb              |  7 +++----
 5 files changed, 38 insertions(+), 19 deletions(-)

diff --git a/app/models/user.rb b/app/models/user.rb
index 4630552e02e..d671c291ec5 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -282,6 +282,15 @@ class User < ApplicationRecord
   scope :for_todos, -> (todos) { where(id: todos.select(:user_id)) }
   scope :with_emails, -> { preload(:emails) }
   scope :with_dashboard, -> (dashboard) { where(dashboard: dashboard) }
+  scope :with_visible_profile, -> (user) {
+    if user.nil?
+      where(private_profile: [false, nil])
+    elsif user.admin?
+      all
+    else
+      where(private_profile: [false, nil]).or where(id: user.id)
+    end
+  }
 
   # Limits the users to those that have TODOs, optionally in the given state.
   #
diff --git a/app/models/users_star_project.rb b/app/models/users_star_project.rb
index 6eabdebd89c..e171a8220d0 100644
--- a/app/models/users_star_project.rb
+++ b/app/models/users_star_project.rb
@@ -15,7 +15,7 @@ class UsersStarProject < ApplicationRecord
   scope :order_user_name_asc, -> { joins(:user).reorder('"users"."name" ASC') }
   scope :order_user_name_desc, -> { joins(:user).reorder('"users"."name" DESC') }
   scope :by_project, -> (project) { where(project_id: project.id) }
-  scope :with_visible_profile, -> (user) { joins(:user).where('"users"."private_profile" IS NULL OR "users"."private_profile" = ? OR "users"."id" = ?', false, user.id ) }
+  scope :with_visible_profile, -> (user) { joins(:user).merge(User.with_visible_profile(user)) }
 
   class << self
     def sort_by_attribute(method)
diff --git a/doc/api/projects.md b/doc/api/projects.md
index a9c7f2c66e0..1ce9912027c 100644
--- a/doc/api/projects.md
+++ b/doc/api/projects.md
@@ -1358,21 +1358,27 @@ Example responses:
 ```json
 [
   {
-    "id": 1,
-    "username": "jane_smith",
-    "name": "Jane Smith",
-    "state": "active",
-    "avatar_url": "http://localhost:3000/uploads/user/avatar/1/cd8.jpeg",
-    "web_url": "http://localhost:3000/jane_smith"
+    "starred_since": "2019-01-28T14:47:30.642Z",
+    "user":
+      {
+        "id": 1,
+        "username": "jane_smith",
+        "name": "Jane Smith",
+        "state": "active",
+        "avatar_url": "http://localhost:3000/uploads/user/avatar/1/cd8.jpeg",
+        "web_url": "http://localhost:3000/jane_smith"
+      }
   },
-  {
-    "id": 2,
-    "username": "janine_smith",
-    "name": "Janine Smith",
-    "state": "blocked",
-    "avatar_url": "http://gravatar.com/../e32131cd8.jpeg",
-    "web_url": "http://localhost:3000/janine_smith"
-  }
+    "starred_since": "2018-01-02T11:40:26.570Z",
+    "user":
+      {
+        "id": 2,
+        "username": "janine_smith",
+        "name": "Janine Smith",
+        "state": "blocked",
+        "avatar_url": "http://gravatar.com/../e32131cd8.jpeg",
+        "web_url": "http://localhost:3000/janine_smith"
+      }
 ]
 ```
 
diff --git a/lib/api/entities.rb b/lib/api/entities.rb
index 2f5ce3d4003..643b53f5e63 100644
--- a/lib/api/entities.rb
+++ b/lib/api/entities.rb
@@ -77,6 +77,11 @@ module API
       expose :last_activity_on, as: :last_activity_at # Back-compat
     end
 
+    class UserStarsProject < Grape::Entity
+      expose :starred_since
+      expose :user, using: Entities::UserBasic
+    end
+
     class Identity < Grape::Entity
       expose :provider, :extern_uid
     end
diff --git a/lib/api/projects.rb b/lib/api/projects.rb
index f8f0ff48be0..6d221200372 100644
--- a/lib/api/projects.rb
+++ b/lib/api/projects.rb
@@ -128,7 +128,7 @@ module API
         user = find_user(params[:user_id])
         not_found!('User') unless user
 
-        starred_projects = StarredProjectsFinder.new(user, current_user: current_user).execute
+        starred_projects = StarredProjectsFinder.new(user, params: project_finder_params, current_user: current_user).execute
         present_projects starred_projects
       end
     end
@@ -382,10 +382,9 @@ module API
         use :pagination
       end
       get ':id/starrers' do
-        users = DeclarativePolicy.subject_scope { user_project.starrers }
-        users = users.search(params[:search]) if params[:search].present?
+        starrers = UsersStarProjectsFinder.new(params, user_project, current_user: current_user).execute
 
-        present paginate(users), with: Entities::UserBasic
+        present paginate(starrers), with: Entities::UserStarsProject
       end
 
       desc 'Get languages in project repository'