Merge branch 'snippets-finder-visibility' into 'security'

Refactor snippets finder & dont return internal snippets for external users

See merge request !2094

app/controllers/dashboard/snippets_controller.rb

 class Dashboard::SnippetsController < Dashboard::ApplicationController
   def index
-    @snippets = SnippetsFinder.new.execute(
+    @snippets = SnippetsFinder.new(
       current_user,
-      filter: :by_user,
-      user: current_user,
+      author: current_user,
       scope: params[:scope]
-    )
+    ).execute
     @snippets = @snippets.page(params[:page])
   end
 end

app/controllers/explore/snippets_controller.rb

 class Explore::SnippetsController < Explore::ApplicationController
   def index
-    @snippets = SnippetsFinder.new.execute(current_user, filter: :all)
+    @snippets = SnippetsFinder.new(current_user).execute
     @snippets = @snippets.page(params[:page])
   end
 end

app/controllers/projects/snippets_controller.rb

@@ -23,12 +23,11 @@ class Projects::SnippetsController < Projects::ApplicationController
   respond_to :html
 
   def index
-    @snippets = SnippetsFinder.new.execute(
+    @snippets = SnippetsFinder.new(
       current_user,
-      filter: :by_project,
       project: @project,
       scope: params[:scope]
-    )
+    ).execute
     @snippets = @snippets.page(params[:page])
     if @snippets.out_of_range? && @snippets.total_pages != 0
       redirect_to namespace_project_snippets_path(page: @snippets.total_pages)

app/controllers/snippets_controller.rb

@@ -27,12 +27,8 @@ class SnippetsController < ApplicationController
 
       return render_404 unless @user
 
-      @snippets = SnippetsFinder.new.execute(current_user, {
-        filter: :by_user,
-        user: @user,
-        scope: params[:scope]
-      })
-      .page(params[:page])
+      @snippets = SnippetsFinder.new(current_user, author: @user, scope: params[:scope])
+        .execute.page(params[:page])
 
       render 'index'
     else

app/controllers/users_controller.rb

@@ -128,12 +128,11 @@ class UsersController < ApplicationController
   end
 
   def load_snippets
-    @snippets = SnippetsFinder.new.execute(
+    @snippets = SnippetsFinder.new(
       current_user,
-      filter: :by_user,
-      user: user,
+      author: user,
       scope: params[:scope]
-    ).page(params[:page])
+    ).execute.page(params[:page])
   end
 
   def projects_for_current_user

app/finders/notes_finder.rb

@@ -67,7 +67,7 @@ class NotesFinder
     when "merge_request"
       MergeRequestsFinder.new(@current_user, project_id: @project.id).execute
     when "snippet", "project_snippet"
-      SnippetsFinder.new.execute(@current_user, filter: :by_project, project: @project)
+      SnippetsFinder.new(@current_user, project: @project).execute
     when "personal_snippet"
       PersonalSnippet.all
     else

app/finders/snippets_finder.rb

-class SnippetsFinder
-  def execute(current_user, params = {})
-    filter = params[:filter]
-    user = params.fetch(:user, current_user)
-
-    case filter
-    when :all then
-      snippets(current_user).fresh
-    when :public then
-      Snippet.are_public.fresh
-    when :by_user then
-      by_user(current_user, user, params[:scope])
-    when :by_project
-      by_project(current_user, params[:project], params[:scope])
+class SnippetsFinder < UnionFinder
+  attr_accessor :current_user, :params
+
+  def initialize(current_user, params = {})
+    @current_user = current_user
+    @params = params
   end
+
+  def execute
+    items = init_collection
+    items = by_project(items)
+    items = by_author(items)
+    items = by_visibility(items)
+
+    items.fresh
   end
 
   private
 
-  def snippets(current_user)
-    if current_user
-      Snippet.public_and_internal
-    else
-      # Not authenticated
-      #
-      # Return only:
-      #   public snippets
-      Snippet.are_public
-    end
+  def init_collection
+    items = Snippet.all
+
+    accessible(items)
   end
 
-  def by_user(current_user, user, scope)
-    snippets = user.snippets.fresh
+  def accessible(items)
+    segments = []
+    segments << items.public_to_user(current_user)
+    segments << authorized_to_user(items)  if current_user
 
-    if current_user
-      include_private = user == current_user
-      by_scope(snippets, scope, include_private)
-    else
-      snippets.are_public
+    find_union(segments, Snippet)
   end
+
+  def authorized_to_user(items)
+    items.where(
+      'author_id = :author_id
+       OR project_id IN (:project_ids)',
+       author_id: current_user.id,
+       project_ids: current_user.authorized_projects.select(:id))
   end
 
-  def by_project(current_user, project, scope)
-    snippets = project.snippets.fresh
+  def by_visibility(items)
+    visibility = params[:visibility] || visibility_from_scope
 
-    if current_user
-      include_private = project.team.member?(current_user) || current_user.admin_or_auditor?
-      by_scope(snippets, scope, include_private)
-    else
-      snippets.are_public
+    return items unless visibility
+
+    items.where(visibility_level: visibility)
   end
+
+  def by_author(items)
+    return items unless params[:author]
+
+    items.where(author_id: params[:author].id)
+  end
+
+  def by_project(items)
+    return items unless params[:project]
+
+    items.where(project_id: params[:project].id)
   end
 
-  def by_scope(snippets, scope = nil, include_private = false)
-    case scope.to_s
+  def visibility_from_scope
+    case params[:scope].to_s
     when 'are_private'
-      include_private ? snippets.are_private : Snippet.none
+      Snippet::PRIVATE
     when 'are_internal'
-      snippets.are_internal
+      Snippet::INTERNAL
     when 'are_public'
-      snippets.are_public
+      Snippet::PUBLIC
     else
-      include_private ? snippets : snippets.public_and_internal
+      nil
     end
   end
 end

app/models/snippet.rb

@@ -153,18 +153,5 @@ class Snippet < ActiveRecord::Base
 
       where(table[:content].matches(pattern))
     end
-
-    def accessible_to(user)
-      return are_public unless user.present?
-      return all if user.admin?
-
-      where(
-        'visibility_level IN (:visibility_levels)
-         OR author_id = :author_id
-         OR project_id IN (:project_ids)',
-         visibility_levels: [Snippet::PUBLIC, Snippet::INTERNAL],
-         author_id: user.id,
-         project_ids: user.authorized_projects.select(:id))
-    end
   end
 end

app/policies/project_snippet_policy.rb

@@ -17,7 +17,7 @@ class ProjectSnippetPolicy < BasePolicy
       can! :read_project_snippet
     end
 
-    if @subject.private? && @subject.project.team.member?(@user)
+    if @subject.project.team.member?(@user)
       can! :read_project_snippet
     end
   end

app/services/search/snippet_service.rb

 module Search
   class SnippetService
-    include Gitlab::CurrentSettings
     attr_accessor :current_user, :params
 
     def initialize(user, params)
@@ -8,14 +7,10 @@ module Search
     end
 
     def execute
-      if current_application_settings.elasticsearch_search?
-        Gitlab::Elastic::SnippetSearchResults.new(current_user,
-                                                  params[:search])
-      else
-        snippets = Snippet.accessible_to(current_user)
+      snippets = SnippetsFinder.new(current_user).execute
+
       Gitlab::SnippetSearchResults.new(snippets, params[:search])
     end
-    end
 
     def scope
       @scope ||= %w[snippet_titles].delete(params[:scope]) { 'snippet_blobs' }

changelogs/unreleased/snippets-finder-visibility.yml

+---
+title: Refactor snippets finder & dont return internal snippets for external users
+merge_request:
+author:

lib/api/project_snippets.rb

@@ -17,8 +17,7 @@ module API
         end
 
         def snippets_for_current_user
-          finder_params = { filter: :by_project, project: user_project }
-          SnippetsFinder.new.execute(current_user, finder_params)
+          SnippetsFinder.new(current_user, project: user_project).execute
         end
       end
 

lib/api/snippets.rb

@@ -8,11 +8,11 @@ module API
     resource :snippets do
       helpers do
         def snippets_for_current_user
-          SnippetsFinder.new.execute(current_user, filter: :by_user, user: current_user)
+          SnippetsFinder.new(current_user, author: current_user).execute
         end
 
         def public_snippets
-          SnippetsFinder.new.execute(current_user, filter: :public)
+          SnippetsFinder.new(current_user, visibility: Snippet::PUBLIC).execute
         end
       end
 

lib/api/v3/project_snippets.rb

@@ -18,8 +18,7 @@ module API
           end
 
           def snippets_for_current_user
-            finder_params = { filter: :by_project, project: user_project }
-            SnippetsFinder.new.execute(current_user, finder_params)
+            SnippetsFinder.new(current_user, project: user_project).execute
           end
         end
 

lib/api/v3/snippets.rb

@@ -8,11 +8,11 @@ module API
       resource :snippets do
         helpers do
           def snippets_for_current_user
-            SnippetsFinder.new.execute(current_user, filter: :by_user, user: current_user)
+            SnippetsFinder.new(current_user, author: current_user).execute
           end
 
           def public_snippets
-            SnippetsFinder.new.execute(current_user, filter: :public)
+            SnippetsFinder.new(current_user, visibility: Snippet::PUBLIC).execute
           end
         end
 

spec/controllers/snippets_controller_spec.rb

@@ -3,6 +3,34 @@ require 'spec_helper'
 describe SnippetsController do
   let(:user) { create(:user) }
 
+  describe 'GET #index' do
+    let(:user) { create(:user) }
+
+    context 'when username parameter is present' do
+      it 'renders snippets of a user when username is present' do
+        get :index, username: user.username
+
+        expect(response).to render_template(:index)
+      end
+    end
+
+    context 'when username parameter is not present' do
+      it 'redirects to explore snippets page when user is not logged in' do
+        get :index
+
+        expect(response).to redirect_to(explore_snippets_path)
+      end
+
+      it 'redirects to snippets dashboard page when user is logged in' do
+        sign_in(user)
+
+        get :index
+
+        expect(response).to redirect_to(dashboard_snippets_path)
+      end
+    end
+  end
+
   describe 'GET #new' do
     context 'when signed in' do
       before do

spec/features/dashboard/snippets_spec.rb

@@ -12,4 +12,51 @@ describe 'Dashboard snippets', feature: true do
 
     it_behaves_like 'paginated snippets'
   end
+
+  context 'filtering by visibility' do
+    let(:user) { create(:user) }
+    let!(:snippets) do
+      [
+        create(:personal_snippet, :public, author: user),
+        create(:personal_snippet, :internal, author: user),
+        create(:personal_snippet, :private, author: user),
+        create(:personal_snippet, :public)
+      ]
+    end
+
+    before do
+      login_as(user)
+
+      visit dashboard_snippets_path
+    end
+
+    it 'contains all snippets of logged user' do
+      expect(page).to have_selector('.snippet-row', count: 3)
+
+      expect(page).to have_content(snippets[0].title)
+      expect(page).to have_content(snippets[1].title)
+      expect(page).to have_content(snippets[2].title)
+    end
+
+    it 'contains all private snippets of logged user when clicking on private' do
+      click_link('Private')
+
+      expect(page).to have_selector('.snippet-row', count: 1)
+      expect(page).to have_content(snippets[2].title)
+    end
+
+    it 'contains all internal snippets of logged user when clicking on internal' do
+      click_link('Internal')
+
+      expect(page).to have_selector('.snippet-row', count: 1)
+      expect(page).to have_content(snippets[1].title)
+    end
+
+    it 'contains all public snippets of logged user when clicking on public' do
+      click_link('Public')
+
+      expect(page).to have_selector('.snippet-row', count: 1)
+      expect(page).to have_content(snippets[0].title)
+    end
+  end
 end

spec/features/projects/snippets_spec.rb

@@ -4,11 +4,27 @@ describe 'Project snippets', feature: true do
   context 'when the project has snippets' do
     let(:project) { create(:empty_project, :public) }
     let!(:snippets) { create_list(:project_snippet, 2, :public, author: project.owner, project: project) }
+    let!(:other_snippet) { create(:project_snippet) }
+
+    context 'pagination' do
       before do
         allow(Snippet).to receive(:default_per_page).and_return(1)
+
         visit namespace_project_snippets_path(project.namespace, project)
       end
 
       it_behaves_like 'paginated snippets'
     end
+
+    context 'list content' do
+      it 'contains all project snippets' do
+        visit namespace_project_snippets_path(project.namespace, project)
+
+        expect(page).to have_selector('.snippet-row', count: 2)
+
+        expect(page).to have_content(snippets[0].title)
+        expect(page).to have_content(snippets[1].title)
+      end
+    end
+  end
 end

spec/features/snippets/explore_spec.rb

 require 'rails_helper'
 
 feature 'Explore Snippets', feature: true do
-  scenario 'User should see snippets that are not private' do
-    public_snippet = create(:personal_snippet, :public)
-    internal_snippet = create(:personal_snippet, :internal)
-    private_snippet = create(:personal_snippet, :private)
+  let!(:public_snippet) { create(:personal_snippet, :public) }
+  let!(:internal_snippet) { create(:personal_snippet, :internal) }
+  let!(:private_snippet) { create(:personal_snippet, :private) }
 
+  scenario 'User should see snippets that are not private' do
     login_as create(:user)
     visit explore_snippets_path
 
@@ -13,4 +13,21 @@ feature 'Explore Snippets', feature: true do
     expect(page).to have_content(internal_snippet.title)
     expect(page).not_to have_content(private_snippet.title)
   end
+
+  scenario 'External user should see only public snippets' do
+    login_as create(:user, :external)
+    visit explore_snippets_path
+
+    expect(page).to have_content(public_snippet.title)
+    expect(page).not_to have_content(internal_snippet.title)
+    expect(page).not_to have_content(private_snippet.title)
+  end
+
+  scenario 'Not authenticated user should see only public snippets' do
+    visit explore_snippets_path
+
+    expect(page).to have_content(public_snippet.title)
+    expect(page).not_to have_content(internal_snippet.title)
+    expect(page).not_to have_content(private_snippet.title)
+  end
 end

spec/features/users/snippets_spec.rb

@@ -3,7 +3,10 @@ require 'spec_helper'
 describe 'Snippets tab on a user profile', feature: true, js: true do
   context 'when the user has snippets' do
     let(:user) { create(:user) }
+
+    context 'pagination' do
       let!(:snippets) { create_list(:snippet, 2, :public, author: user) }
+
       before do
         allow(Snippet).to receive(:default_per_page).and_return(1)
         visit user_path(user)
@@ -13,4 +16,33 @@ describe 'Snippets tab on a user profile', feature: true, js: true do
 
       it_behaves_like 'paginated snippets', remote: true
     end
+
+    context 'list content' do
+      let!(:public_snippet) { create(:snippet, :public, author: user) }
+      let!(:internal_snippet) { create(:snippet, :internal, author: user) }
+      let!(:private_snippet) { create(:snippet, :private, author: user) }
+      let!(:other_snippet) { create(:snippet, :public) }
+
+      it 'contains only internal and public snippets of a user when a user is logged in' do
+        login_as(:user)
+        visit user_path(user)
+        page.within('.user-profile-nav') { click_link 'Snippets' }
+        wait_for_ajax
+
+        expect(page).to have_selector('.snippet-row', count: 2)
+
+        expect(page).to have_content(public_snippet.title)
+        expect(page).to have_content(internal_snippet.title)
+      end
+
+      it 'contains only public snippets of a user when a user is not logged in' do
+        visit user_path(user)
+        page.within('.user-profile-nav') { click_link 'Snippets' }
+        wait_for_ajax
+
+        expect(page).to have_selector('.snippet-row', count: 1)
+        expect(page).to have_content(public_snippet.title)
+      end
+    end
+  end
 end

spec/models/snippet_spec.rb

@@ -131,46 +131,6 @@ describe Snippet, models: true do
     end
   end
 
-  describe '.accessible_to' do
-    let(:author)  { create(:author) }
-    let(:project) { create(:empty_project) }
-
-    let!(:public_snippet)   { create(:snippet, :public) }
-    let!(:internal_snippet) { create(:snippet, :internal) }
-    let!(:private_snippet)  { create(:snippet, :private, author: author) }
-
-    let!(:project_public_snippet)   { create(:snippet, :public, project: project) }
-    let!(:project_internal_snippet) { create(:snippet, :internal, project: project) }
-    let!(:project_private_snippet)  { create(:snippet, :private, project: project) }
-
-    it 'returns only public snippets when user is blank' do
-      expect(described_class.accessible_to(nil)).to match_array [public_snippet, project_public_snippet]
-    end
-
-    it 'returns only public, and internal snippets for regular users' do
-      user = create(:user)
-
-      expect(described_class.accessible_to(user)).to match_array [public_snippet, internal_snippet, project_public_snippet, project_internal_snippet]
-    end
-
-    it 'returns public, internal snippets and project private snippets for project members' do
-      member = create(:user)
-      project.team << [member, :developer]
-
-      expect(described_class.accessible_to(member)).to match_array [public_snippet, internal_snippet, project_public_snippet, project_internal_snippet, project_private_snippet]
-    end
-
-    it 'returns private snippets where the user is the author' do
-      expect(described_class.accessible_to(author)).to match_array [public_snippet, internal_snippet, private_snippet, project_public_snippet, project_internal_snippet]
-    end
-
-    it 'returns all snippets when for admins' do
-      admin = create(:admin)
-
-      expect(described_class.accessible_to(admin)).to match_array [public_snippet, internal_snippet, private_snippet, project_public_snippet, project_internal_snippet, project_private_snippet]
-    end
-  end
-
   describe '#participants' do
     let(:project) { create(:empty_project, :public) }
     let(:snippet) { create(:snippet, content: 'foo', project: project) }

spec/policies/project_snippet_policy_spec.rb

 require 'spec_helper'
 
 describe ProjectSnippetPolicy, models: true do
-  let(:current_user) { create(:user) }
+  let(:regular_user) { create(:user) }
+  let(:external_user) { create(:user, :external) }
+  let(:project) { create(:empty_project) }
 
   let(:author_permissions) do
     [
@@ -10,13 +12,15 @@ describe ProjectSnippetPolicy, models: true do
     ]
   end
 
-  subject { described_class.abilities(current_user, project_snippet).to_set }
+  def abilities(user, snippet_visibility)
+    snippet = create(:project_snippet, snippet_visibility, project: project)
 
-  context 'public snippet' do
-    let(:project_snippet) { create(:project_snippet, :public) }
+    described_class.abilities(user, snippet).to_set
+  end
 
+  context 'public snippet' do
     context 'no user' do
-      let(:current_user) { nil }
+      subject { abilities(nil, :public) }
 
       it do
         is_expected.to include(:read_project_snippet)
@@ -25,6 +29,17 @@ describe ProjectSnippetPolicy, models: true do
     end
 
     context 'regular user' do
+      subject { abilities(regular_user, :public) }
+
+      it do
+        is_expected.to include(:read_project_snippet)
+        is_expected.not_to include(*author_permissions)
+      end
+    end
+
+    context 'external user' do
+      subject { abilities(external_user, :public) }
+
       it do
         is_expected.to include(:read_project_snippet)
         is_expected.not_to include(*author_permissions)
@@ -33,10 +48,8 @@ describe ProjectSnippetPolicy, models: true do
   end
 
   context 'internal snippet' do
-    let(:project_snippet) { create(:project_snippet, :internal) }
-
     context 'no user' do
-      let(:current_user) { nil }
+      subject { abilities(nil, :internal) }
 
       it do
         is_expected.not_to include(:read_project_snippet)
@@ -45,6 +58,28 @@ describe ProjectSnippetPolicy, models: true do
     end
 
     context 'regular user' do
+      subject { abilities(regular_user, :internal) }
+
+      it do
+        is_expected.to include(:read_project_snippet)
+        is_expected.not_to include(*author_permissions)
+      end
+    end
+
+    context 'external user' do
+      subject { abilities(external_user, :internal) }
+
+      it do
+        is_expected.not_to include(:read_project_snippet)
+        is_expected.not_to include(*author_permissions)
+      end
+    end
+
+    context 'project team member external user' do
+      subject { abilities(external_user, :internal) }
+
+      before { project.team << [external_user, :developer] }
+
       it do
         is_expected.to include(:read_project_snippet)
         is_expected.not_to include(*author_permissions)
@@ -53,6 +88,7 @@ describe ProjectSnippetPolicy, models: true do
 
     context 'external user' do
       let(:current_user) { create(:user, :external) }
+      subject { abilities(current_user, :private) }
 
       it do
         is_expected.not_to include(:read_project_snippet)
@@ -62,10 +98,8 @@ describe ProjectSnippetPolicy, models: true do
   end
 
   context 'private snippet' do
-    let(:project_snippet) { create(:project_snippet, :private) }
-
     context 'no user' do
-      let(:current_user) { nil }
+      subject { abilities(nil, :private) }
 
       it do
         is_expected.not_to include(:read_project_snippet)
@@ -74,6 +108,8 @@ describe ProjectSnippetPolicy, models: true do
     end
 
     context 'regular user' do
+      subject { abilities(regular_user, :private) }
+
       it do
         is_expected.not_to include(:read_project_snippet)
         is_expected.not_to include(*author_permissions)
@@ -81,7 +117,9 @@ describe ProjectSnippetPolicy, models: true do
     end
 
     context 'snippet author' do
-      let(:project_snippet) { create(:project_snippet, :private, author: current_user) }
+      let(:snippet) { create(:project_snippet, :private, author: regular_user) }
+
+      subject { described_class.abilities(regular_user, snippet).to_set }
 
       it do
         is_expected.to include(:read_project_snippet)
@@ -89,8 +127,21 @@ describe ProjectSnippetPolicy, models: true do
       end
     end
 
-    context 'project team member' do
-      before { project_snippet.project.team << [current_user, :developer] }
+    context 'project team member normal user' do
+      subject { abilities(regular_user, :private) }
+
+      before { project.team << [regular_user, :developer] }
+
+      it do
+        is_expected.to include(:read_project_snippet)
+        is_expected.not_to include(*author_permissions)
+      end
+    end
+
+    context 'project team member external user' do
+      subject { abilities(external_user, :private) }
+
+      before { project.team << [external_user, :developer] }
 
       it do
         is_expected.to include(:read_project_snippet)
@@ -100,6 +151,7 @@ describe ProjectSnippetPolicy, models: true do
 
     context 'auditor user' do
       let(:current_user) { create(:user, :auditor) }
+      subject { abilities(current_user, :private) }
 
       it do
         is_expected.to include(:read_project_snippet)
@@ -108,7 +160,7 @@ describe ProjectSnippetPolicy, models: true do
     end
 
     context 'admin user' do
-      let(:current_user) { create(:admin) }
+      subject { abilities(create(:admin), :private) }
 
       it do
         is_expected.to include(:read_project_snippet)