Merge branch '39068-gitlab-admin-merge-request-jira' into 'master'

Fixed GitLab admin not seeing merge requests

See merge request gitlab-org/gitlab!21467

ee/changelogs/unreleased/39068-gitlab-admin-merge-request-jira.yml

+---
+title: Fixed GitLab admin not seeing merge requests in Jira Development Panel Integration
+merge_request: 21467
+author:
+type: fixed

ee/lib/api/v3/github.rb

@@ -75,11 +75,11 @@ module API
         # rubocop: enable CodeReuse/ActiveRecord
 
         def authorized_merge_requests
-          MergeRequestsFinder.new(current_user, authorized_only: true).execute
+          MergeRequestsFinder.new(current_user, authorized_only: !current_user.admin?).execute
         end
 
         def authorized_merge_requests_for_project(project)
-          MergeRequestsFinder.new(current_user, authorized_only: true, project_id: project.id).execute
+          MergeRequestsFinder.new(current_user, authorized_only: !current_user.admin?, project_id: project.id).execute
         end
 
         # rubocop: disable CodeReuse/ActiveRecord

ee/spec/requests/api/v3/github_spec.rb

@@ -5,6 +5,7 @@ require 'spec_helper'
 describe API::V3::Github do
   let(:user) { create(:user) }
   let(:unauthorized_user) { create(:user) }
+  let(:admin) { create(:user, :admin) }
   let!(:project) { create(:project, :repository, creator: user) }
   let!(:project2) { create(:project, :repository, creator: user) }
 
@@ -230,11 +231,32 @@ describe API::V3::Github do
     end
 
     describe 'GET /repos/:namespace/:project/pulls/:id' do
-      it 'returns the requested merge request in github format' do
-        jira_get v3_api("/repos/#{project.namespace.path}/#{project.path}/pulls/#{merge_request.id}", user)
+      context 'when user has access to the merge requests' do
+        it 'returns the requested merge request in github format' do
+          jira_get v3_api("/repos/#{project.namespace.path}/#{project.path}/pulls/#{merge_request.id}", user)
 
-        expect(response).to have_gitlab_http_status(200)
-        expect(response).to match_response_schema('entities/github/pull_request', dir: 'ee')
+          expect(response).to have_gitlab_http_status(200)
+          expect(response).to match_response_schema('entities/github/pull_request', dir: 'ee')
+        end
+      end
+
+      context 'when user has no access to the merge request' do
+        it 'returns 404' do
+          project.add_guest(unauthorized_user)
+
+          jira_get v3_api("/repos/#{project.namespace.path}/#{project.path}/pulls/#{merge_request.id}", unauthorized_user)
+
+          expect(response).to have_gitlab_http_status(404)
+        end
+      end
+
+      context 'when instance admin' do
+        it 'returns the requested merge request in github format' do
+          jira_get v3_api("/repos/#{project.namespace.path}/#{project.path}/pulls/#{merge_request.id}", admin)
+
+          expect(response).to have_gitlab_http_status(200)
+          expect(response).to match_response_schema('entities/github/pull_request', dir: 'ee')
+        end
       end
     end
   end