b2da8042b4
Due to a bug in `BoardPolicy`, users were getting back a 403 error when trying to assign users to an assignee list and seeing "Something went wrong while fetching assignees list". For some reason, the declarative policy runtime was ignoring the ternary condition. To work around the issue, we make the project board an explicit condition check. Closes https://gitlab.com/gitlab-org/gitlab-ee/issues/9727
67 lines
1.4 KiB
Ruby
67 lines
1.4 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
require 'spec_helper'
|
|
|
|
describe BoardPolicy do
|
|
let(:user) { create(:user) }
|
|
let(:project) { create(:project, :private) }
|
|
let(:group) { create(:group, :private) }
|
|
let(:group_board) { create(:board, group: group) }
|
|
let(:project_board) { create(:board, project: project) }
|
|
|
|
let(:board_permissions) do
|
|
[
|
|
:read_parent,
|
|
:read_milestone,
|
|
:read_issue
|
|
]
|
|
end
|
|
|
|
def expect_allowed(*permissions)
|
|
permissions.each { |p| is_expected.to be_allowed(p) }
|
|
end
|
|
|
|
def expect_disallowed(*permissions)
|
|
permissions.each { |p| is_expected.not_to be_allowed(p) }
|
|
end
|
|
|
|
context 'group board' do
|
|
subject { described_class.new(user, group_board) }
|
|
|
|
context 'user has access' do
|
|
before do
|
|
group.add_developer(user)
|
|
end
|
|
|
|
it do
|
|
expect_allowed(*board_permissions)
|
|
end
|
|
end
|
|
|
|
context 'user does not have access' do
|
|
it do
|
|
expect_disallowed(*board_permissions)
|
|
end
|
|
end
|
|
end
|
|
|
|
context 'project board' do
|
|
subject { described_class.new(user, project_board) }
|
|
|
|
context 'user has access' do
|
|
before do
|
|
project.add_developer(user)
|
|
end
|
|
|
|
it do
|
|
expect_allowed(*board_permissions)
|
|
end
|
|
end
|
|
|
|
context 'user does not have access' do
|
|
it do
|
|
expect_disallowed(*board_permissions)
|
|
end
|
|
end
|
|
end
|
|
end
|