Allow admins/auditors to read private personal snippets
This commit is contained in:
		
							parent
							
								
									16ab0050f6
								
							
						
					
					
						commit
						40900669b3
					
				| 
						 | 
				
			
			@ -29,4 +29,6 @@ class PersonalSnippetPolicy < BasePolicy
 | 
			
		|||
  rule { anonymous }.prevent :comment_personal_snippet
 | 
			
		||||
 | 
			
		||||
  rule { can?(:comment_personal_snippet) }.enable :award_emoji
 | 
			
		||||
 | 
			
		||||
  rule { full_private_access }.enable :read_personal_snippet
 | 
			
		||||
end
 | 
			
		||||
| 
						 | 
				
			
			
 | 
			
		|||
| 
						 | 
				
			
			@ -0,0 +1,5 @@
 | 
			
		|||
---
 | 
			
		||||
title: Allow users with full private access to read private personal snippets.
 | 
			
		||||
merge_request: 24560
 | 
			
		||||
author:
 | 
			
		||||
type: fixed
 | 
			
		||||
| 
						 | 
				
			
			@ -399,10 +399,7 @@ describe Event do
 | 
			
		|||
          expect(event.visible_to_user?(nil)).to be_falsy
 | 
			
		||||
          expect(event.visible_to_user?(non_member)).to be_falsy
 | 
			
		||||
          expect(event.visible_to_user?(author)).to be_truthy
 | 
			
		||||
 | 
			
		||||
          # It is very unexpected that a private personal snippet is not visible
 | 
			
		||||
          # to an instance administrator. This should be fixed in the future.
 | 
			
		||||
          expect(event.visible_to_user?(admin)).to be_falsy
 | 
			
		||||
          expect(event.visible_to_user?(admin)).to be_truthy
 | 
			
		||||
        end
 | 
			
		||||
      end
 | 
			
		||||
    end
 | 
			
		||||
| 
						 | 
				
			
			
 | 
			
		|||
| 
						 | 
				
			
			@ -128,6 +128,17 @@ describe PersonalSnippetPolicy do
 | 
			
		|||
      end
 | 
			
		||||
    end
 | 
			
		||||
 | 
			
		||||
    context 'admin user' do
 | 
			
		||||
      subject { permissions(admin_user) }
 | 
			
		||||
 | 
			
		||||
      it do
 | 
			
		||||
        is_expected.to be_allowed(:read_personal_snippet)
 | 
			
		||||
        is_expected.to be_disallowed(:comment_personal_snippet)
 | 
			
		||||
        is_expected.to be_disallowed(:award_emoji)
 | 
			
		||||
        is_expected.to be_disallowed(*author_permissions)
 | 
			
		||||
      end
 | 
			
		||||
    end
 | 
			
		||||
 | 
			
		||||
    context 'external user' do
 | 
			
		||||
      subject { permissions(external_user) }
 | 
			
		||||
 | 
			
		||||
| 
						 | 
				
			
			
 | 
			
		|||
		Loading…
	
		Reference in New Issue