Merge branch 'hide-inoperable-group-search-releases-filter-backend' into 'master'

Resolve "Hide inoperable group search Releases filter - backend"

See merge request gitlab-org/gitlab!50457

app/finders/issuable_finder.rb

@@ -4,6 +4,9 @@
 #
 # Used to filter Issues and MergeRequests collections by set of params
 #
+# Note: This class is NOT meant to be instantiated. Instead you should
+#       look at IssuesFinder or EpicsFinder, which inherit from this.
+#
 # Arguments:
 #   klass - actual class like Issue or MergeRequest
 #   current_user - which user use
@@ -92,6 +95,10 @@ class IssuableFinder
     IssuableFinder::Params
   end
 
+  def klass
+    raise NotImplementedError
+  end
+
   def initialize(current_user, params = {})
     @current_user = current_user
     @params = params_class.new(params, current_user, klass)
@@ -451,6 +458,7 @@ class IssuableFinder
 
   def by_release(items)
     return items unless params.releases?
+    return items if params.group? # don't allow release filtering at group level
 
     if params.filter_by_no_release?
       items.without_release

app/finders/issuable_finder/params.rb

@@ -108,16 +108,8 @@ class IssuableFinder
       project_id.present?
     end
 
-    def group
-      strong_memoize(:group) do
-        if params[:group_id].is_a?(Group)
-          params[:group_id]
-        elsif params[:group_id].present?
-          Group.find(params[:group_id])
-        else
-          nil
-        end
-      end
+    def group?
+      group_id.present?
     end
 
     def related_groups
@@ -143,10 +135,25 @@ class IssuableFinder
       end
     end
 
+    def group
+      strong_memoize(:group) do
+        next nil unless group?
+
+        group = group_id.is_a?(Group) ? group_id : Group.find(group_id)
+        group = nil unless Ability.allowed?(current_user, :read_group, group)
+
+        group
+      end
+    end
+
     def project_id
       params[:project_id]
     end
 
+    def group_id
+      params[:group_id]
+    end
+
     def projects
       strong_memoize(:projects) do
         next [project] if project?
@@ -216,14 +223,14 @@ class IssuableFinder
       strong_memoize(:milestones) do
         if milestones?
           if project?
-            group_id = project.group&.id
+            project_group_id = project.group&.id
             project_id = project.id
           end
 
-          group_id = group.id if group
+          project_group_id = group.id if group
 
           search_params =
-            { title: params[:milestone_title], project_ids: project_id, group_ids: group_id }
+            { title: params[:milestone_title], project_ids: project_id, group_ids: project_group_id }
 
           MilestonesFinder.new(search_params).execute # rubocop: disable CodeReuse/Finder
         else

changelogs/unreleased/hide-inoperable-group-search-releases-filter-backend.yml

+---
+title: Don't allow filtering by release tag on groups.
+merge_request: 50457
+author:
+type: fixed

ee/spec/finders/issues_finder_spec.rb

@@ -18,7 +18,7 @@ RSpec.describe IssuesFinder do
           let(:params) { { weight: Issue::WEIGHT_NONE } }
 
           it 'returns all issues' do
-            expect(issues).to contain_exactly(issue1, issue2, issue3, issue4)
+            expect(issues).to contain_exactly(issue1, issue2, issue3, issue4, issue5)
           end
         end
 
@@ -88,7 +88,7 @@ RSpec.describe IssuesFinder do
           let(:params) { { epic_id: ::IssuableFinder::Params::FILTER_NONE } }
 
           it 'returns filtered issues' do
-            expect(issues).to contain_exactly(issue1, issue2, issue3, issue4)
+            expect(issues).to contain_exactly(issue1, issue2, issue3, issue4, issue5)
           end
         end
 
@@ -124,7 +124,7 @@ RSpec.describe IssuesFinder do
           let(:params) { { not: { epic_id: epic_1.id } } }
 
           it 'returns issues not assigned to the epic' do
-            expect(issues).to contain_exactly(issue1, issue2, issue3, issue4, issue_2, issue_subepic)
+            expect(issues).to contain_exactly(issue1, issue2, issue3, issue4, issue5, issue_2, issue_subepic)
           end
         end
       end
@@ -140,7 +140,7 @@ RSpec.describe IssuesFinder do
           let(:params) { { iteration_id: ::IssuableFinder::Params::FILTER_NONE } }
 
           it 'returns all issues without iterations' do
-            expect(issues).to contain_exactly(issue1, issue2, issue3, issue4)
+            expect(issues).to contain_exactly(issue1, issue2, issue3, issue4, issue5)
           end
         end
 
@@ -174,7 +174,7 @@ RSpec.describe IssuesFinder do
               let(:params) { { group_id: group, not: { iteration_id: ::Iteration::Predefined::Current.title } } }
 
               it 'returns filtered issues' do
-                expect(issues).to contain_exactly(issue1, iteration_1_issue, iteration_2_issue)
+                expect(issues).to contain_exactly(issue1, issue5, iteration_1_issue, iteration_2_issue)
               end
             end
           end
@@ -208,7 +208,7 @@ RSpec.describe IssuesFinder do
           let(:params) { { not: { iteration_title: iteration_1.title } } }
 
           it 'returns all issues that do not match the iteration title' do
-            expect(issues).to contain_exactly(issue1, issue2, issue3, issue4, iteration_2_issue)
+            expect(issues).to contain_exactly(issue1, issue2, issue3, issue4, issue5, iteration_2_issue)
           end
         end
 
@@ -216,7 +216,7 @@ RSpec.describe IssuesFinder do
           let(:params) { { iteration_id: nil } }
 
           it 'returns unfiltered issues' do
-            expect(issues).to contain_exactly(issue1, issue2, issue3, issue4, iteration_1_issue, iteration_2_issue)
+            expect(issues).to contain_exactly(issue1, issue2, issue3, issue4, issue5, iteration_1_issue, iteration_2_issue)
           end
         end
       end

spec/support/shared_contexts/finders/issues_finder_shared_contexts.rb

@@ -8,13 +8,53 @@ RSpec.shared_context 'IssuesFinder context' do
   let_it_be(:project1, reload: true) { create(:project, group: group) }
   let_it_be(:project2, reload: true) { create(:project) }
   let_it_be(:project3, reload: true) { create(:project, group: subgroup) }
-  let_it_be(:milestone) { create(:milestone, project: project1) }
+  let_it_be(:release) { create(:release, project: project1, tag: 'v1.0.0') }
+  let_it_be(:milestone) { create(:milestone, project: project1, releases: [release]) }
   let_it_be(:label) { create(:label, project: project2) }
   let_it_be(:label2) { create(:label, project: project2) }
-  let_it_be(:issue1, reload: true) { create(:issue, author: user, assignees: [user], project: project1, milestone: milestone, title: 'gitlab', created_at: 1.week.ago, updated_at: 1.week.ago) }
-  let_it_be(:issue2, reload: true) { create(:issue, author: user, assignees: [user], project: project2, description: 'gitlab', created_at: 1.week.from_now, updated_at: 1.week.from_now) }
-  let_it_be(:issue3, reload: true) { create(:issue, author: user2, assignees: [user2], project: project2, title: 'tanuki', description: 'tanuki', created_at: 2.weeks.from_now, updated_at: 2.weeks.from_now) }
+  let_it_be(:issue1, reload: true) do
+    create(:issue,
+           author: user,
+           assignees: [user],
+           project: project1,
+           milestone: milestone,
+           title: 'gitlab',
+           created_at: 1.week.ago,
+           updated_at: 1.week.ago)
+  end
+
+  let_it_be(:issue2, reload: true) do
+    create(:issue,
+           author: user,
+           assignees: [user],
+           project: project2,
+           description: 'gitlab',
+           created_at: 1.week.from_now,
+           updated_at: 1.week.from_now)
+  end
+
+  let_it_be(:issue3, reload: true) do
+    create(:issue,
+           author: user2,
+           assignees: [user2],
+           project: project2,
+           title: 'tanuki',
+           description: 'tanuki',
+           created_at: 2.weeks.from_now,
+           updated_at: 2.weeks.from_now)
+  end
+
   let_it_be(:issue4, reload: true) { create(:issue, project: project3) }
+  let_it_be(:issue5, reload: true) do
+    create(:issue,
+           author: user,
+           assignees: [user],
+           project: project1,
+           title: 'wotnot',
+           created_at: 3.days.ago,
+           updated_at: 3.days.ago)
+  end
+
   let_it_be(:award_emoji1) { create(:award_emoji, name: 'thumbsup', user: user, awardable: issue1) }
   let_it_be(:award_emoji2) { create(:award_emoji, name: 'thumbsup', user: user2, awardable: issue2) }
   let_it_be(:award_emoji3) { create(:award_emoji, name: 'thumbsdown', user: user, awardable: issue3) }