Support branch creation from confidential issue

Accept a `confidential_issue_project_id` param which will
be used for the system note target.

This also includes some refactoring on the spec to use
shared examples.

app/controllers/projects/branches_controller.rb

@@ -64,7 +64,7 @@ class Projects::BranchesController < Projects::ApplicationController
     success = (result[:status] == :success)
 
     if params[:issue_iid] && success
-      issue = IssuesFinder.new(current_user, project_id: @project.id).find_by(iid: params[:issue_iid])
+      issue = IssuesFinder.new(current_user, project_id: (confidential_issue_project || @project).id).find_by(iid: params[:issue_iid])
       SystemNoteService.new_issue_branch(issue, @project, current_user, branch_name) if issue
     end
 
@@ -162,4 +162,15 @@ class Projects::BranchesController < Projects::ApplicationController
       @branches = Kaminari.paginate_array(@branches).page(params[:page])
     end
   end
+
+  def confidential_issue_project
+    return unless Feature.enabled?(:create_confidential_merge_request, @project)
+    return if params[:confidential_issue_project_id].blank?
+
+    confidential_issue_project = Project.find(params[:confidential_issue_project_id])
+
+    return unless can?(current_user, :push_code, confidential_issue_project)
+
+    confidential_issue_project
+  end
 end

spec/controllers/projects/branches_controller_spec.rb

@@ -103,6 +103,75 @@ describe Projects::BranchesController do
              }
       end
 
+      context 'confidential_issue_project_id is present' do
+        let(:confidential_issue_project) { create(:project) }
+
+        def create_branch_with_confidential_issue_project
+          post(
+            :create,
+            params: {
+              namespace_id: project.namespace,
+              project_id: project,
+              branch_name: branch,
+              confidential_issue_project_id: confidential_issue_project.id,
+              issue_iid: issue.iid
+            }
+          )
+        end
+
+        context 'create_confidential_merge_request feature is enabled' do
+          before do
+            stub_feature_flags(create_confidential_merge_request: true)
+          end
+
+          context 'user cannot push code to issue project' do
+            let(:issue) { create(:issue, project: confidential_issue_project) }
+
+            it 'does not post a system note' do
+              expect(SystemNoteService).not_to receive(:new_issue_branch)
+
+              create_branch_with_confidential_issue_project
+            end
+          end
+
+          context 'user can push code to issue project' do
+            before do
+              confidential_issue_project.add_developer(user)
+            end
+
+            context 'issue is under the specified project' do
+              let(:issue) { create(:issue, project: confidential_issue_project) }
+
+              it 'posts a system note' do
+                expect(SystemNoteService).to receive(:new_issue_branch).with(issue, confidential_issue_project, user, "1-feature-branch", branch_project: project)
+
+                create_branch_with_confidential_issue_project
+              end
+            end
+
+            context 'issue is not under the specified project' do
+              it 'does not post a system note' do
+                expect(SystemNoteService).not_to receive(:new_issue_branch)
+
+                create_branch_with_confidential_issue_project
+              end
+            end
+          end
+        end
+
+        context 'create_confidential_merge_request feature is disabled' do
+          before do
+            stub_feature_flags(create_confidential_merge_request: false)
+          end
+
+          it 'posts a system note on project' do
+            expect(SystemNoteService).to receive(:new_issue_branch).with(issue, project, user, "1-feature-branch", branch_project: project)
+
+            create_branch_with_confidential_issue_project
+          end
+        end
+      end
+
       context 'repository-less project' do
         let(:project) { create :project }
 

spec/controllers/projects/issues_controller_spec.rb

@@ -3,6 +3,8 @@
 require 'spec_helper'
 
 describe Projects::IssuesController do
+  include ProjectForksHelper
+
   let(:project) { create(:project) }
   let(:user)    { create(:user) }
   let(:issue)   { create(:issue, project: project) }
@@ -1130,6 +1132,7 @@ describe Projects::IssuesController do
   end
 
   describe 'POST create_merge_request' do
+    let(:target_project_id) { nil }
     let(:project) { create(:project, :repository, :public) }
 
     before do
@@ -1163,13 +1166,42 @@ describe Projects::IssuesController do
       expect(response).to have_gitlab_http_status(404)
     end
 
+    context 'target_project_id is set' do
+      let(:target_project) { fork_project(project, user, repository: true) }
+      let(:target_project_id) { target_project.id }
+
+      context 'create_confidential_merge_request feature is enabled' do
+        before do
+          stub_feature_flags(create_confidential_merge_request: true)
+        end
+
+        it 'creates a new merge request' do
+          expect { create_merge_request }.to change(target_project.merge_requests, :count).by(1)
+        end
+      end
+
+      context 'create_confidential_merge_request feature is disabled' do
+        before do
+          stub_feature_flags(create_confidential_merge_request: false)
+        end
+
+        it 'creates a new merge request' do
+          expect { create_merge_request }.to change(project.merge_requests, :count).by(1)
+        end
+      end
+    end
+
     def create_merge_request
-      post :create_merge_request, params: {
-                                    namespace_id: project.namespace.to_param,
-                                    project_id: project.to_param,
-                                    id: issue.to_param
-                                  },
-                                  format: :json
+      post(
+        :create_merge_request,
+        params: {
+          namespace_id: project.namespace.to_param,
+          project_id: project.to_param,
+          id: issue.to_param,
+          target_project_id: target_project_id
+        },
+        format: :json
+      )
     end
   end