Merge branch '216342-fix-get-release-by-tag' into 'master'

Fix return codes for getting an inexistent release by tag

See merge request gitlab-org/gitlab!64591

lib/api/releases.rb

@@ -62,6 +62,8 @@ module API
       get ':id/releases/:tag_name', requirements: RELEASE_ENDPOINT_REQUIREMENTS do
         authorize_download_code!
 
+        not_found! unless release
+
         present release, with: Entities::Release, current_user: current_user, include_html_description: params[:include_html_description]
       end
 
@@ -177,7 +179,7 @@ module API
       end
 
       def authorize_download_code!
-        authorize! :download_code, release
+        authorize! :download_code, user_project
       end
 
       def authorize_create_evidence!

spec/requests/api/releases_spec.rb

@@ -463,9 +463,23 @@ RSpec.describe API::Releases do
     end
 
     context 'when specified tag is not found in the project' do
-      it 'cannot find the release entry' do
+      it 'returns 404 for maintater' do
         get api("/projects/#{project.id}/releases/non_exist_tag", maintainer)
 
+        expect(response).to have_gitlab_http_status(:not_found)
+        expect(json_response['message']).to eq('404 Not Found')
+      end
+
+      it 'returns project not found for no user' do
+        get api("/projects/#{project.id}/releases/non_exist_tag", nil)
+
+        expect(response).to have_gitlab_http_status(:not_found)
+        expect(json_response['message']).to eq('404 Project Not Found')
+      end
+
+      it 'returns forbidden for guest' do
+        get api("/projects/#{project.id}/releases/non_existing_tag", guest)
+
         expect(response).to have_gitlab_http_status(:forbidden)
       end
     end