Merge branch 'pl-status-page-redact-fields' into 'master'

Post process status page incidents

See merge request gitlab-org/gitlab!29207

ee/app/serializers/status_page/incident_comment_entity.rb

@@ -2,7 +2,7 @@
 
 module StatusPage
   class IncidentCommentEntity < Grape::Entity
-    expose :note_html, as: :note
+    expose(:note) { |entity| StatusPage::Renderer.markdown(entity, :note) }
     expose :created_at
   end
 end

ee/app/serializers/status_page/incident_entity.rb

@@ -6,8 +6,8 @@ module StatusPage
   class IncidentEntity < Grape::Entity
     expose :iid, as: :id
     expose :state, as: :status
-    expose :title_html, as: :title
-    expose :description_html, as: :description
+    expose(:title) { |entity| StatusPage::Renderer.markdown(entity, :title) }
+    expose(:description) { |entity| StatusPage::Renderer.markdown(entity, :description) }
     expose :updated_at
     expose :created_at
     expose :user_notes, as: :comments, using: IncidentCommentEntity

ee/app/serializers/status_page/renderer.rb

+# frozen_string_literal: true
+
+module StatusPage
+  module Renderer
+    def self.markdown(object, field)
+      MarkupHelper.markdown_field(object, field)
+    end
+  end
+end

ee/spec/serializers/status_page/incident_comment_entity_spec.rb

@@ -3,7 +3,7 @@
 require 'spec_helper'
 
 describe StatusPage::IncidentCommentEntity do
-  let_it_be(:note) { create(:note, note: ':ok:') }
+  let_it_be(:note, reload: true) { create(:note, note: ':ok:') }
   let(:json) { subject.as_json }
 
   subject { described_class.new(note) }
@@ -14,4 +14,12 @@ describe StatusPage::IncidentCommentEntity do
       created_at: note.created_at
     )
   end
+
+  describe 'field #note' do
+    it_behaves_like 'reference links for status page' do
+      let(:object) { note }
+      let(:field) { :note }
+      let(:value) { json[:note] }
+    end
+  end
 end

ee/spec/serializers/status_page/incident_entity_spec.rb

@@ -3,8 +3,10 @@
 require 'spec_helper'
 
 describe StatusPage::IncidentEntity do
-  let_it_be(:issue) do
-    create(:issue, title: ':ok:', description: ':tada:')
+  let_it_be(:user) { create(:user) }
+
+  let_it_be(:issue, reload: true) do
+    create(:issue, title: ':ok:', description: ':tada:', author: user)
   end
 
   let(:json) { subject.as_json }
@@ -24,6 +26,22 @@ describe StatusPage::IncidentEntity do
     )
   end
 
+  describe 'field #title' do
+    it_behaves_like 'reference links for status page' do
+      let(:object) { issue }
+      let(:field) { :title }
+      let(:value) { json[:title] }
+    end
+  end
+
+  describe 'field #description' do
+    it_behaves_like 'reference links for status page' do
+      let(:object) { issue }
+      let(:field) { :description }
+      let(:value) { json[:description] }
+    end
+  end
+
   context 'with user notes' do
     let(:user_notes) do
       create_list(:note, 1, noteable: issue, project: issue.project)

ee/spec/serializers/status_page/renderer_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe StatusPage::Renderer do
+  describe '.markdown' do
+    it 'delegates to MarkupHelper.markdown_field' do
+      object = Object.new
+      field = :field
+
+      expect(MarkupHelper)
+        .to receive(:markdown_field)
+        .with(object, field)
+
+      described_class.markdown(object, field)
+    end
+  end
+end

ee/spec/support/shared_examples/status_page/reference_links_examples.rb

+# frozen_string_literal: true
+
+# This shared_example requires the following variables:
+# - object: The AR object
+# - field: The entity field/AR attribute which contains the GFM reference
+# - value: The resulting JSON value
+RSpec.shared_examples 'reference links for status page' do
+  let_it_be(:project, reload: true) { create(:project) }
+  let(:gfm_reference) { reference.to_reference(full: true) }
+
+  before do
+    project.update!(visibility_level: project_visibility)
+    object.update!(field => gfm_reference)
+
+    expect(StatusPage::Renderer)
+      .to receive(:markdown)
+      .at_least(:once)
+      .and_call_original
+  end
+
+  shared_examples 'html reference' do
+    it 'shows link anchor with HTML data attributes' do
+      aggregate_failures do
+        expect(value).to include(gfm_reference)
+        expect(value).to include('<a ')
+        expect(value).to include(%{title="#{reference.title}"})
+      end
+    end
+  end
+
+  shared_examples 'plain reference' do
+    it 'redacts link anchor and HTML data attributes' do
+      aggregate_failures do
+        expect(value).to include(gfm_reference)
+        expect(value).not_to include('<a ')
+        expect(value).not_to include(%{title="#{reference.title}"})
+      end
+    end
+  end
+
+  context 'with public project' do
+    let(:project_visibility) { Project::PUBLIC }
+
+    context 'with public issue' do
+      let(:reference) { create(:issue, project: project) }
+
+      include_examples 'html reference'
+    end
+
+    context 'with confidential issue' do
+      let(:reference) { create(:issue, :confidential, project: project) }
+
+      include_examples 'plain reference'
+    end
+  end
+
+  context 'with private project' do
+    let(:project_visibility) { Project::PRIVATE }
+
+    context 'with public issue' do
+      let(:reference) { create(:issue, project: project) }
+
+      include_examples 'plain reference'
+    end
+  end
+end