Hide disabled project milestones in project settings on group level

2 files changed, 101 insertions, 2 deletions

diff --git a/spec/controllers/groups/milestones_controller_spec.rb b/spec/controllers/groups/milestones_controller_spec.rb
index 41927907fd1..e0a3605d50a 100644
--- a/spec/controllers/groups/milestones_controller_spec.rb
+++ b/spec/controllers/groups/milestones_controller_spec.rb
@@ -3,8 +3,8 @@
 require 'spec_helper'
 
 describe Groups::MilestonesController do
-  let(:group) { create(:group) }
-  let!(:project) { create(:project, group: group) }
+  let(:group) { create(:group, :public) }
+  let!(:project) { create(:project, :public, group: group) }
   let!(:project2) { create(:project, group: group) }
   let(:user)    { create(:user) }
   let(:title) { '肯定不是中文的问题' }
@@ -63,6 +63,73 @@ describe Groups::MilestonesController do
         expect(response.body).to include(group_milestone.title)
         expect(response.body).not_to include(milestone.title)
       end
+
+      context 'when anonymous user' do
+        before do
+          sign_out(user)
+        end
+
+        it 'shows group milestones page' do
+          milestone
+
+          get :index, params: { group_id: group.to_param }
+
+          expect(response).to have_gitlab_http_status(200)
+          expect(response.body).to include(milestone.title)
+        end
+      end
+
+      context 'when issues and merge requests are disabled in public project' do
+        shared_examples 'milestone not accessible' do
+          it 'does not return milestone' do
+            get :index, params: { group_id: public_group.to_param }
+
+            expect(response).to have_gitlab_http_status(200)
+            expect(response.body).not_to include(private_milestone.title)
+          end
+        end
+
+        let!(:public_group) { create(:group, :public) }
+
+        let!(:public_project_with_private_issues_and_mrs) do
+          create(:project, :public, :issues_private, :merge_requests_private, group: public_group)
+        end
+        let!(:private_milestone) { create(:milestone, project: public_project_with_private_issues_and_mrs, title: 'project milestone') }
+
+        context 'when anonymous user' do
+          before do
+            sign_out(user)
+          end
+
+          it_behaves_like 'milestone not accessible'
+        end
+
+        context 'when non project or group member user' do
+          let(:non_member) { create(:user) }
+
+          before do
+            sign_in(non_member)
+          end
+
+          it_behaves_like 'milestone not accessible'
+        end
+
+        context 'when group member user' do
+          let(:member) { create(:user) }
+
+          before do
+            sign_in(member)
+            public_group.add_guest(member)
+          end
+
+          it 'returns the milestone' do
+            get :index, params: { group_id: public_group.to_param }
+
+            expect(response).to have_gitlab_http_status(200)
+            expect(response.body).to include(private_milestone.title)
+          end
+        end
+      end
     end
 
     context 'as JSON' do
diff --git a/spec/requests/groups/milestones_controller_spec.rb b/spec/requests/groups/milestones_controller_spec.rb
new file mode 100644
index 00000000000..af19d931284
--- /dev/null
+++ b/spec/requests/groups/milestones_controller_spec.rb
@@ -0,0 +1,32 @@
+require 'spec_helper'
+
+describe Groups::MilestonesController do
+  context 'N+1 DB queries' do
+    let(:user) { create(:user) }
+    let!(:public_group) { create(:group, :public) }
+
+    let!(:public_project_with_private_issues_and_mrs) do
+      create(:project, :public, :issues_private, :merge_requests_private, group: public_group)
+    end
+    let!(:private_milestone) { create(:milestone, project: public_project_with_private_issues_and_mrs, title: 'project milestone') }
+
+    it 'avoids N+1 database queries' do
+      public_project = create(:project, :public, :merge_requests_enabled, :issues_enabled, group: public_group)
+      create(:milestone, project: public_project)
+
+      control_count = ActiveRecord::QueryRecorder.new(skip_cached: false) { get "/groups/#{public_group.to_param}/-/milestones.json" }.count
+
+      projects = create_list(:project, 2, :public, :merge_requests_enabled, :issues_enabled, group: public_group)
+      projects.each do |project|
+        create(:milestone, project: project)
+      end
+
+      expect { get "/groups/#{public_group.to_param}/-/milestones.json" }.not_to exceed_all_query_limit(control_count)
+      expect(response).to have_http_status(200)
+      milestones = json_response
+
+      expect(milestones.count).to eq(3)
+      expect(milestones.map {|x| x['title']}).not_to include(private_milestone.title)
+    end
+  end
+end