diff options
author | GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com> | 2022-06-01 20:33:49 +0300 |
---|---|---|
committer | GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com> | 2022-06-01 20:33:49 +0300 |
commit | 9a8ae3b4e90e56f71bb770463b943512efdcd1d1 (patch) | |
tree | 4a791b23a3b7085fa89d2dc300ef1cf0228f01a5 /spec/requests | |
parent | 8a186dedfc1da12270ea77f2673b59fa08f770c1 (diff) | |
parent | 39b217000ded81fdbd7ff509dd27895d1952ffc1 (diff) |
Merge remote-tracking branch 'dev/15-0-stable' into 15-0-stable
Diffstat (limited to 'spec/requests')
-rw-r--r-- | spec/requests/api/members_spec.rb | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/spec/requests/api/members_spec.rb b/spec/requests/api/members_spec.rb index 0db42e7439c..63ef8643088 100644 --- a/spec/requests/api/members_spec.rb +++ b/spec/requests/api/members_spec.rb @@ -184,6 +184,21 @@ RSpec.describe API::Members do expect(json_response).to be_an Array expect(json_response.map { |u| u['id'] }).to match_array [maintainer.id, developer.id, nested_user.id] end + + context 'with a subgroup' do + let(:group) { create(:group, :private)} + let(:subgroup) { create(:group, :private, parent: group)} + let(:project) { create(:project, group: subgroup) } + + before do + subgroup.add_developer(developer) + end + + it 'subgroup member cannot get parent group members list' do + get api("/groups/#{group.id}/members/all", developer) + expect(response).to have_gitlab_http_status(:forbidden) + end + end end shared_examples 'GET /:source_type/:id/members/(all/):user_id' do |source_type, all| |