Add latest changes from gitlab-org/security/gitlab@15-2-stable-ee

1 files changed, 47 insertions, 24 deletions

diff --git a/spec/support/shared_examples/finders/issues_finder_shared_examples.rb b/spec/support/shared_examples/finders/issues_finder_shared_examples.rb
index 9d8f37a3e64..049ead9fb89 100644
--- a/spec/support/shared_examples/finders/issues_finder_shared_examples.rb
+++ b/spec/support/shared_examples/finders/issues_finder_shared_examples.rb
@@ -914,42 +914,65 @@ RSpec.shared_examples 'issues or work items finder' do |factory, execute_context
         end
       end
 
-      context 'filtering by crm contact' do
-        let_it_be(:contact1) { create(:contact, group: group) }
-        let_it_be(:contact2) { create(:contact, group: group) }
+      context 'crm filtering' do
+        let_it_be(:root_group) { create(:group) }
+        let_it_be(:group) { create(:group, parent: root_group) }
+        let_it_be(:project_crm) { create(:project, :public, group: group) }
+        let_it_be(:organization) { create(:organization, group: root_group) }
+        let_it_be(:contact1) { create(:contact, group: root_group, organization: organization) }
+        let_it_be(:contact2) { create(:contact, group: root_group, organization: organization) }
 
-        let_it_be(:contact1_item1) { create(factory, project: project1) }
-        let_it_be(:contact1_item2) { create(factory, project: project1) }
-        let_it_be(:contact2_item1) { create(factory, project: project1) }
+        let_it_be(:contact1_item1) { create(factory, project: project_crm) }
+        let_it_be(:contact1_item2) { create(factory, project: project_crm) }
+        let_it_be(:contact2_item1) { create(factory, project: project_crm) }
+        let_it_be(:item_no_contact) { create(factory, project: project_crm) }
 
-        let(:params) { { crm_contact_id: contact1.id } }
+        let_it_be(:all_project_issues) do
+          [contact1_item1, contact1_item2, contact2_item1, item_no_contact]
+        end
+
+        before do
+          create(:crm_settings, group: root_group, enabled: true)
 
-        it 'returns for that contact' do
           create(:issue_customer_relations_contact, issue: contact1_item1, contact: contact1)
           create(:issue_customer_relations_contact, issue: contact1_item2, contact: contact1)
           create(:issue_customer_relations_contact, issue: contact2_item1, contact: contact2)
-
-          expect(items).to contain_exactly(contact1_item1, contact1_item2)
         end
-      end
 
-      context 'filtering by crm organization' do
-        let_it_be(:organization) { create(:organization, group: group) }
-        let_it_be(:contact1) { create(:contact, group: group, organization: organization) }
-        let_it_be(:contact2) { create(:contact, group: group, organization: organization) }
+        context 'filtering by crm contact' do
+          let(:params) { { project_id: project_crm.id, crm_contact_id: contact1.id } }
 
-        let_it_be(:contact1_item1) { create(factory, project: project1) }
-        let_it_be(:contact1_item2) { create(factory, project: project1) }
-        let_it_be(:contact2_item1) { create(factory, project: project1) }
+          context 'when the user can read crm contacts' do
+            it 'returns for that contact' do
+              root_group.add_reporter(user)
 
-        let(:params) { { crm_organization_id: organization.id } }
+              expect(items).to contain_exactly(contact1_item1, contact1_item2)
+            end
+          end
 
-        it 'returns for that contact' do
-          create(:issue_customer_relations_contact, issue: contact1_item1, contact: contact1)
-          create(:issue_customer_relations_contact, issue: contact1_item2, contact: contact1)
-          create(:issue_customer_relations_contact, issue: contact2_item1, contact: contact2)
+          context 'when the user can not read crm contacts' do
+            it 'does not filter by contact' do
+              expect(items).to match_array(all_project_issues)
+            end
+          end
+        end
+
+        context 'filtering by crm organization' do
+          let(:params) { { project_id: project_crm.id, crm_organization_id: organization.id } }
+
+          context 'when the user can read crm organization' do
+            it 'returns for that organization' do
+              root_group.add_reporter(user)
 
-          expect(items).to contain_exactly(contact1_item1, contact1_item2, contact2_item1)
+              expect(items).to contain_exactly(contact1_item1, contact1_item2, contact2_item1)
+            end
+          end
+
+          context 'when the user can not read crm organization' do
+            it 'does not filter by organization' do
+              expect(items).to match_array(all_project_issues)
+            end
+          end
         end
       end