Merge branch 'guests_cant_see_mrs' into 'master'

Make guests unable to view MRs

## What does this MR do?

Make guests unable to view MRs. This also fixes a bug when a non-member user could get notification if mentioned (in private project, it's OK for public project).

Now if you are a guest and you will be mentioned in one of the MRs you won't get a notification. 

## What are the relevant issue numbers?

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/1410

See merge request !6673

1 files changed, 11 insertions, 0 deletions

diff --git a/spec/models/event_spec.rb b/spec/models/event_spec.rb
index af5002487cc..06cac929bbf 100644
--- a/spec/models/event_spec.rb
+++ b/spec/models/event_spec.rb
@@ -135,6 +135,17 @@ describe Event, models: true do
       it { expect(event.visible_to_user?(member)).to eq true }
       it { expect(event.visible_to_user?(guest)).to eq true }
       it { expect(event.visible_to_user?(admin)).to eq true }
+
+      context 'private project' do
+        let(:project) { create(:project, :private) }
+
+        it { expect(event.visible_to_user?(non_member)).to eq false }
+        it { expect(event.visible_to_user?(author)).to eq true }
+        it { expect(event.visible_to_user?(assignee)).to eq true }
+        it { expect(event.visible_to_user?(member)).to eq true }
+        it { expect(event.visible_to_user?(guest)).to eq false }
+        it { expect(event.visible_to_user?(admin)).to eq true }
+      end
     end
   end