Merge branch '58270-fj-fix-graphql-query-and-profile-status' into 'master'

Avoid listing snippets in GraphQL when user profile is private

See merge request gitlab-org/gitlab!58739

app/graphql/resolvers/users/snippets_resolver.rb

@@ -5,6 +5,7 @@ module Resolvers
   module Users
     class SnippetsResolver < BaseResolver
       include ResolvesSnippets
+      include Gitlab::Allowable
 
       alias_method :user, :object
 
@@ -14,6 +15,12 @@ module Resolvers
 
       private
 
+      def resolve_snippets(_args)
+        return Snippet.none unless Ability.allowed?(current_user, :read_user_profile, user)
+
+        super
+      end
+
       def snippet_finder_params(args)
         super.merge(author: user)
       end

changelogs/unreleased/58270-fj-fix-graphql-query-and-profile-status.yml

+---
+title: Avoid listing snippets through GraphQL when user profile is private
+merge_request: 58739
+author:
+type: fixed

spec/graphql/resolvers/users/snippets_resolver_spec.rb

@@ -75,9 +75,19 @@ RSpec.describe Resolvers::Users::SnippetsResolver do
         end.to raise_error(GraphQL::CoercionError)
       end
     end
+
+    context 'when user profile is private' do
+      it 'does not return snippets for that user' do
+        expect(resolve_snippets(obj: other_user)).to contain_exactly(other_personal_snippet, other_project_snippet)
+
+        other_user.update!(private_profile: true)
+
+        expect(resolve_snippets(obj: other_user)).to be_empty
+      end
+    end
   end
 
-  def resolve_snippets(args: {})
-    resolve(described_class, args: args, ctx: { current_user: current_user }, obj: current_user)
+  def resolve_snippets(args: {}, context_user: current_user, obj: current_user)
+    resolve(described_class, args: args, ctx: { current_user: context_user }, obj: obj)
   end
 end