Dry up routable lookups. Fixes #30317

Note: This changes the behavior of user lookups (see the spec change) so it acts the same way as groups and projects. Unauthenticated clients attempting to access a user page will be redirected to login whether the user exists and is publicly restricted, or does not exist at all.

1 files changed, 1 insertions, 10 deletions

diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 67783866c3f..ca89ed221c6 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -93,16 +93,7 @@ class UsersController < ApplicationController
   private
 
   def user
-    return @user if @user
-
-    @user = User.find_by_full_path(params[:username], follow_redirects: true)
-
-    return render_404 unless @user
-    return render_404 unless can?(current_user, :read_user, @user)
-
-    ensure_canonical_path(@user.namespace, params[:username])
-
-    @user
+    @user ||= find_routable!(User, params[:username])
   end
 
   def contributed_projects