Merge branch '40855_remove_authentication_in_readonly_issue_api' into 'master'

Remove authentication for readonly endpoints in issues API

Closes #40855

See merge request gitlab-org/gitlab-ce!18638

changelogs/unreleased/40855_remove_authentication_in_readonly_issue_api.yml

+---
+title: made listing and showing public issue apis available without authentication
+merge_request: 18638
+author: haseebeqx
+type: changed

lib/api/issues.rb

@@ -2,7 +2,7 @@ module API
   class Issues < Grape::API
     include PaginationParams
 
-    before { authenticate! }
+    before { authenticate_non_get! }
 
     helpers ::Gitlab::IssuableMetadata
 
@@ -70,6 +70,7 @@ module API
                          desc: 'Return issues for the given scope: `created-by-me`, `assigned-to-me` or `all`'
       end
       get do
+        authenticate! unless params[:scope] == 'all'
         issues = paginate(find_issues)
 
         options = {

spec/requests/api/issues_spec.rb

@@ -64,12 +64,32 @@ describe API::Issues do
 
   describe "GET /issues" do
     context "when unauthenticated" do
-      it "returns authentication error" do
+      it "returns an array of all issues" do
+        get api("/issues"), scope: 'all'
+
+        expect(response).to have_http_status(200)
+        expect(json_response).to be_an Array
+      end
+
+      it "returns authentication error without any scope" do
         get api("/issues")
 
-        expect(response).to have_gitlab_http_status(401)
+        expect(response).to have_http_status(401)
+      end
+
+      it "returns authentication error when scope is assigned-to-me" do
+        get api("/issues"), scope: 'assigned-to-me'
+
+        expect(response).to have_http_status(401)
+      end
+
+      it "returns authentication error when scope is created-by-me" do
+        get api("/issues"), scope: 'created-by-me'
+
+        expect(response).to have_http_status(401)
       end
     end
+
     context "when authenticated" do
       let(:first_issue) { json_response.first }
 
@@ -379,9 +399,6 @@ describe API::Issues do
     end
     let!(:group_note) { create(:note_on_issue, author: user, project: group_project, noteable: group_issue) }
 
-    before do
-      group_project.add_reporter(user)
-    end
     let(:base_url) { "/groups/#{group.id}/issues" }
 
     context 'when group has subgroups', :nested_groups do
@@ -408,6 +425,19 @@ describe API::Issues do
       end
     end
 
+    context 'when user is unauthenticated' do
+      it 'lists all issues in public projects' do
+        get api(base_url)
+
+        expect_paginated_array_response(size: 2)
+      end
+    end
+
+    context 'when user is a group member' do
+      before do
+        group_project.add_reporter(user)
+      end
+
       it 'returns all group issues (including opened and closed)' do
         get api(base_url, admin)
 
@@ -576,10 +606,20 @@ describe API::Issues do
         expect(response_dates).to eq(response_dates.sort)
       end
     end
+  end
 
   describe "GET /projects/:id/issues" do
     let(:base_url) { "/projects/#{project.id}" }
 
+    context 'when unauthenticated' do
+      it 'returns public project issues' do
+        get api("/projects/#{project.id}/issues")
+
+        expect_paginated_array_response(size: 2)
+        expect(json_response.first['title']).to eq(issue.title)
+      end
+    end
+
     it 'avoids N+1 queries' do
       control_count = ActiveRecord::QueryRecorder.new do
         get api("/projects/#{project.id}/issues", user)
@@ -789,6 +829,14 @@ describe API::Issues do
   end
 
   describe "GET /projects/:id/issues/:issue_iid" do
+    context 'when unauthenticated' do
+      it 'returns public issues' do
+        get api("/projects/#{project.id}/issues/#{issue.iid}")
+
+        expect(response).to have_gitlab_http_status(200)
+      end
+    end
+
     it 'exposes known attributes' do
       get api("/projects/#{project.id}/issues/#{issue.iid}", user)
 
@@ -1581,6 +1629,14 @@ describe API::Issues do
       create(:merge_requests_closing_issues, issue: issue, merge_request: merge_request)
     end
 
+    context 'when unauthenticated' do
+      it 'return public project issues' do
+        get api("/projects/#{project.id}/issues/#{issue.iid}/closed_by")
+
+        expect_paginated_array_response(size: 1)
+      end
+    end
+
     it 'returns merge requests that will close issue on merge' do
       get api("/projects/#{project.id}/issues/#{issue.iid}/closed_by", user)
 
@@ -1605,6 +1661,14 @@ describe API::Issues do
   describe "GET /projects/:id/issues/:issue_iid/user_agent_detail" do
     let!(:user_agent_detail) { create(:user_agent_detail, subject: issue) }
 
+    context 'when unauthenticated' do
+      it "returns unautorized" do
+        get api("/projects/#{project.id}/issues/#{issue.iid}/user_agent_detail")
+
+        expect(response).to have_gitlab_http_status(401)
+      end
+    end
+
     it 'exposes known attributes' do
       get api("/projects/#{project.id}/issues/#{issue.iid}/user_agent_detail", admin)