Update code

5 files changed, 74 insertions, 48 deletions

diff --git a/doc/api/markdown.md b/doc/api/markdown.md
index 08628ed52d8..c5e7350307d 100644
--- a/doc/api/markdown.md
+++ b/doc/api/markdown.md
@@ -13,8 +13,8 @@ POST /api/v4/markdown
 | Attribute | Type    | Required      | Description                                |
 | --------- | ------- | ------------- | ------------------------------------------ |
 | `text`    | string  | yes           | The markdown text to render                |
-| `gfm`     | boolean | no (optional) | Render text using GitLab Flavored Markdown (default: `false`) |
-| `project` | string  | no if `gfm` is false<br>yes if `gfm` is true | The full path of a project to use as the context when creating references using GitLab Flavored Markdown |
+| `gfm`     | boolean | no (optional) | Render text using GitLab Flavored Markdown. Default is `false` |
+| `project` | string  | no (optional) | Use `project` as a context when creating references using GitLab Flavored Markdown. `PRIVATE-TOKEN` is required if a project is not public.  |
 
 ```bash
 curl -H Content-Type:application/json -d '{"text":"Hello world! :tada:", "gfm":true, "project":"group_example/project_example"}' https://gitlab.example.com/api/v4/markdown
diff --git a/lib/api/markdown.rb b/lib/api/markdown.rb
index 84b5dea8b35..3297cb8bf98 100644
--- a/lib/api/markdown.rb
+++ b/lib/api/markdown.rb
@@ -4,7 +4,6 @@ module API
       requires :text, type: String, desc: "The markdown text to render"
       optional :gfm, type: Boolean, desc: "Render text using GitLab Flavored Markdown"
       optional :project, type: String, desc: "The full path of a project to use as the context when creating references using GitLab Flavored Markdown"
-      all_or_none_of :gfm, :project
     end
     resource :markdown do
       desc "Render markdown text" do
@@ -15,16 +14,18 @@ module API
         # Remove this set when https://gitlab.com/gitlab-org/gitlab-ce/issues/43011 is done.
         context = { markdown_engine: :common_mark, only_path: false }
 
-        if params[:gfm]
+        if params[:project]
           project = Project.find_by_full_path(params[:project])
 
           not_found!("Project") unless can?(current_user, :read_project, project)
 
           context[:project] = project
         else
-          context[:pipeline] = :plain_markdown
+          context[:skip_project_check] = true
         end
 
+        context[:pipeline] = params[:gfm] ? :full : :plain_markdown
+
         content_type "text/html"
 
         present Banzai.render(params[:text], context)
diff --git a/lib/banzai/filter/reference_filter.rb b/lib/banzai/filter/reference_filter.rb
index b9d5ecf70ec..2f023f4f242 100644
--- a/lib/banzai/filter/reference_filter.rb
+++ b/lib/banzai/filter/reference_filter.rb
@@ -73,7 +73,7 @@ module Banzai
       #
       # Note that while the key might exist, its value could be nil!
       def validate
-        needs :project
+        needs :project unless skip_project_check?
       end
 
       # Iterates over all <a> and text() nodes in a document.
diff --git a/lib/banzai/filter/user_reference_filter.rb b/lib/banzai/filter/user_reference_filter.rb
index c7fa8a8119f..f3a4dacb3dc 100644
--- a/lib/banzai/filter/user_reference_filter.rb
+++ b/lib/banzai/filter/user_reference_filter.rb
@@ -24,7 +24,7 @@ module Banzai
       end
 
       def call
-        return doc if project.nil? && group.nil? && !skip_project_check?
+        return doc if skip_project_check? || (project.nil? && group.nil?)
 
         ref_pattern = User.reference_pattern
         ref_pattern_start = /\A#{ref_pattern}\z/
diff --git a/spec/requests/api/markdown_spec.rb b/spec/requests/api/markdown_spec.rb
index 1304871ee17..c818c8979b1 100644
--- a/spec/requests/api/markdown_spec.rb
+++ b/spec/requests/api/markdown_spec.rb
@@ -1,6 +1,8 @@
 require "spec_helper"
 
 describe API::Markdown do
+  RSpec::Matchers.define_negated_matcher :exclude, :include
+
   describe "POST /markdown" do
     let(:user) {} # No-op. It gets overwritten in the contexts below.
 
@@ -8,45 +10,39 @@ describe API::Markdown do
       post api("/markdown", user), params
     end
 
-    shared_examples "400 Bad Request" do
-      it "responses with 400 Bad Request" do
-        expect(response).to have_http_status(400)
+    shared_examples "rendered markdown text without GFM" do
+      it "renders markdown text" do
+        expect(response).to have_http_status(201)
+        expect(response.headers["Content-Type"]).to eq("text/html")
+        expect(response.body).to eq("<p>#{text}</p>")
+      end
+    end
+
+    shared_examples "404 Project Not Found" do
+      it "responses with 404 Not Found" do
+        expect(response).to have_http_status(404)
         expect(response.headers["Content-Type"]).to eq("application/json")
         expect(json_response).to be_a(Hash)
-        expect(json_response["error"]).to eq(error_message)
+        expect(json_response["message"]).to eq("404 Project Not Found")
       end
     end
 
     context "when arguments are invalid" do
       context "when text is missing" do
-        let(:error_message) { "text is missing" }
         let(:params) { {} }
 
-        it_behaves_like "400 Bad Request"
-      end
-
-      context "when gfm is missing" do
-        let(:error_message) { "gfm, project provide all or none of parameters" }
-        let(:params) { { text: "Hello world!", project: "Dummy project" } }
-
-        it_behaves_like "400 Bad Request"
-      end
-
-      context "when project is missing" do
-        let(:error_message) { "gfm, project provide all or none of parameters" }
-        let(:params) { { text: "Hello world!", gfm: true } }
-
-        it_behaves_like "400 Bad Request"
+        it "responses with 400 Bad Request" do
+          expect(response).to have_http_status(400)
+          expect(response.headers["Content-Type"]).to eq("application/json")
+          expect(json_response).to be_a(Hash)
+          expect(json_response["error"]).to eq("text is missing")
+        end
       end
 
       context "when project is not found" do
         let(:params) { { text: "Hello world!", gfm: true, project: "Dummy project" } }
 
-        it "responses with 404 Not Found" do
-          expect(response).to have_http_status(404)
-          expect(json_response).to be_a(Hash)
-          expect(json_response["message"]).to eq("404 Project Not Found")
-        end
+        it_behaves_like "404 Project Not Found"
       end
     end
 
@@ -56,27 +52,56 @@ describe API::Markdown do
       let(:text) { ":tada: Hello world! :100: #{issue.to_reference}" }
 
       context "when not using gfm" do
-        let(:params) { { text: text } }
+        context "without project" do
+          let(:params) { { text: text } }
+
+          it_behaves_like "rendered markdown text without GFM"
+        end
 
-        it "renders markdown text" do
-          expect(response).to have_http_status(201)
-          expect(response.headers["Content-Type"]).to eq("text/html")
-          expect(response.body).to eq("<p>#{text}</p>")
+        context "with project" do
+          let(:params) { { text: text, project: project.full_path } }
+
+          context "when not authorized" do
+            it_behaves_like "404 Project Not Found"
+          end
+
+          context "when authorized" do
+            let(:user) { project.owner }
+
+            it_behaves_like "rendered markdown text without GFM"
+          end
         end
       end
 
       context "when using gfm" do
-        let(:params) { { text: text, gfm: true, project: project.full_path } }
-        let(:user) { project.owner }
-
-        it "renders markdown text" do
-          expect(response).to have_http_status(201)
-          expect(response.headers["Content-Type"]).to eq("text/html")
-          expect(response.body).to include("Hello world!")
-                              .and include('data-name="tada"')
-                              .and include('data-name="100"')
-                              .and include("<a href=\"#{IssuesHelper.url_for_issue(issue.iid, project)}\"")
-                              .and include("#1</a>")
+        context "without project" do
+          let(:params) { { text: text, gfm: true } }
+
+          it "renders markdown text" do
+            expect(response).to have_http_status(201)
+            expect(response.headers["Content-Type"]).to eq("text/html")
+            expect(response.body).to include("Hello world!")
+                                .and include('data-name="tada"')
+                                .and include('data-name="100"')
+                                .and include("#1")
+                                .and exclude("<a href=\"#{IssuesHelper.url_for_issue(issue.iid, project)}\"")
+                                .and exclude("#1</a>")
+          end
+        end
+
+        context "with project" do
+          let(:params) { { text: text, gfm: true, project: project.full_path } }
+          let(:user) { project.owner }
+
+          it "renders markdown text" do
+            expect(response).to have_http_status(201)
+            expect(response.headers["Content-Type"]).to eq("text/html")
+            expect(response.body).to include("Hello world!")
+                                .and include('data-name="tada"')
+                                .and include('data-name="100"')
+                                .and include("<a href=\"#{IssuesHelper.url_for_issue(issue.iid, project)}\"")
+                                .and include("#1</a>")
+          end
         end
       end
     end