28acd2b087
We're filtering the events using `Event#visible_to_user?`. At most we're loading 100 events at once. Pagination is also dealt with in the finder, but the resulting array is wrapped in a `Kaminari.paginate_array` so the API's pagination helpers keep working. We're passing the total count into that paginatable array, which would include confidential events. But we're not disclosing anything.
69 lines
3.6 KiB
Ruby
69 lines
3.6 KiB
Ruby
require 'spec_helper'
|
|
|
|
describe EventsFinder do
|
|
let(:user) { create(:user) }
|
|
let(:other_user) { create(:user) }
|
|
let(:project1) { create(:project, :private, creator_id: user.id, namespace: user.namespace) }
|
|
let(:project2) { create(:project, :private, creator_id: user.id, namespace: user.namespace) }
|
|
let(:closed_issue) { create(:closed_issue, project: project1, author: user) }
|
|
let(:opened_merge_request) { create(:merge_request, source_project: project2, author: user) }
|
|
let!(:closed_issue_event) { create(:event, project: project1, author: user, target: closed_issue, action: Event::CLOSED, created_at: Date.new(2016, 12, 30)) }
|
|
let!(:opened_merge_request_event) { create(:event, project: project2, author: user, target: opened_merge_request, action: Event::CREATED, created_at: Date.new(2017, 1, 31)) }
|
|
let(:closed_issue2) { create(:closed_issue, project: project1, author: user) }
|
|
let(:opened_merge_request2) { create(:merge_request, source_project: project2, author: user) }
|
|
let!(:closed_issue_event2) { create(:event, project: project1, author: user, target: closed_issue, action: Event::CLOSED, created_at: Date.new(2016, 2, 2)) }
|
|
let!(:opened_merge_request_event2) { create(:event, project: project2, author: user, target: opened_merge_request, action: Event::CREATED, created_at: Date.new(2017, 2, 2)) }
|
|
|
|
let(:public_project) { create(:project, :public, creator_id: user.id, namespace: user.namespace) }
|
|
let(:confidential_issue) { create(:closed_issue, confidential: true, project: public_project, author: user) }
|
|
let!(:confidential_event) { create(:event, project: public_project, author: user, target: confidential_issue, action: Event::CLOSED) }
|
|
|
|
context 'when targeting a user' do
|
|
it 'returns events between specified dates filtered on action and type' do
|
|
events = described_class.new(source: user, current_user: user, action: 'created', target_type: 'merge_request', after: Date.new(2017, 1, 1), before: Date.new(2017, 2, 1)).execute
|
|
|
|
expect(events).to eq([opened_merge_request_event])
|
|
end
|
|
|
|
it 'does not return events the current_user does not have access to' do
|
|
events = described_class.new(source: user, current_user: other_user).execute
|
|
|
|
expect(events).not_to include(opened_merge_request_event)
|
|
end
|
|
|
|
it 'does not include events on confidential issues the user does not have access to' do
|
|
events = described_class.new(source: user, current_user: other_user).execute
|
|
|
|
expect(events).not_to include(confidential_event)
|
|
end
|
|
|
|
it 'includes confidential events user has access to' do
|
|
public_project.add_developer(other_user)
|
|
events = described_class.new(source: user, current_user: other_user).execute
|
|
|
|
expect(events).to include(confidential_event)
|
|
end
|
|
|
|
it 'returns nothing when the current user cannot read cross project' do
|
|
expect(Ability).to receive(:allowed?).with(user, :read_cross_project) { false }
|
|
|
|
events = described_class.new(source: user, current_user: user).execute
|
|
|
|
expect(events).to be_empty
|
|
end
|
|
end
|
|
|
|
context 'when targeting a project' do
|
|
it 'returns project events between specified dates filtered on action and type' do
|
|
events = described_class.new(source: project1, current_user: user, action: 'closed', target_type: 'issue', after: Date.new(2016, 12, 1), before: Date.new(2017, 1, 1)).execute
|
|
|
|
expect(events).to eq([closed_issue_event])
|
|
end
|
|
|
|
it 'does not return events the current_user does not have access to' do
|
|
events = described_class.new(source: project2, current_user: other_user).execute
|
|
|
|
expect(events).to be_empty
|
|
end
|
|
end
|
|
end
|