Commit 40900669 authored by Patrick Bajao's avatar Patrick Bajao Committed by Nick Thomas

Allow admins/auditors to read private personal snippets

parent 16ab0050
...@@ -29,4 +29,6 @@ class PersonalSnippetPolicy < BasePolicy ...@@ -29,4 +29,6 @@ class PersonalSnippetPolicy < BasePolicy
rule { anonymous }.prevent :comment_personal_snippet rule { anonymous }.prevent :comment_personal_snippet
rule { can?(:comment_personal_snippet) }.enable :award_emoji rule { can?(:comment_personal_snippet) }.enable :award_emoji
rule { full_private_access }.enable :read_personal_snippet
end end
---
title: Allow users with full private access to read private personal snippets.
merge_request: 24560
author:
type: fixed
...@@ -399,10 +399,7 @@ describe Event do ...@@ -399,10 +399,7 @@ describe Event do
expect(event.visible_to_user?(nil)).to be_falsy expect(event.visible_to_user?(nil)).to be_falsy
expect(event.visible_to_user?(non_member)).to be_falsy expect(event.visible_to_user?(non_member)).to be_falsy
expect(event.visible_to_user?(author)).to be_truthy expect(event.visible_to_user?(author)).to be_truthy
expect(event.visible_to_user?(admin)).to be_truthy
# It is very unexpected that a private personal snippet is not visible
# to an instance administrator. This should be fixed in the future.
expect(event.visible_to_user?(admin)).to be_falsy
end end
end end
end end
......
...@@ -128,6 +128,17 @@ describe PersonalSnippetPolicy do ...@@ -128,6 +128,17 @@ describe PersonalSnippetPolicy do
end end
end end
context 'admin user' do
subject { permissions(admin_user) }
it do
is_expected.to be_allowed(:read_personal_snippet)
is_expected.to be_disallowed(:comment_personal_snippet)
is_expected.to be_disallowed(:award_emoji)
is_expected.to be_disallowed(*author_permissions)
end
end
context 'external user' do context 'external user' do
subject { permissions(external_user) } subject { permissions(external_user) }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment