diff options
| -rw-r--r-- | app/services/members/destroy_service.rb | 6 | ||||
| -rw-r--r-- | spec/requests/api/access_requests_spec.rb | 2 |
2 files changed, 4 insertions, 4 deletions
diff --git a/app/services/members/destroy_service.rb b/app/services/members/destroy_service.rb index ee072065523..431da8372c9 100644 --- a/app/services/members/destroy_service.rb +++ b/app/services/members/destroy_service.rb @@ -17,7 +17,7 @@ module Members member = find_member!(scope) - raise Gitlab::Access::AccessDeniedError if cannot_destroy_member?(member) + raise Gitlab::Access::AccessDeniedError unless can_destroy_member?(member) AuthorizedDestroyService.new(member, current_user).execute end @@ -35,8 +35,8 @@ module Members end end - def cannot_destroy_member?(member) - !member || !can?(current_user, action_member_permission(:destroy, member), member) + def can_destroy_member?(member) + member && can?(current_user, action_member_permission(:destroy, member), member) end end end diff --git a/spec/requests/api/access_requests_spec.rb b/spec/requests/api/access_requests_spec.rb index b7e5c2af82a..b467890a403 100644 --- a/spec/requests/api/access_requests_spec.rb +++ b/spec/requests/api/access_requests_spec.rb @@ -213,7 +213,7 @@ describe API::AccessRequests, api: true do end.to change { source.requesters.count }.by(-1) end - context 'user_id matches a member' do + context 'user_id matches a member, not an access requester' do it 'returns 404' do expect do delete api("/#{source_type.pluralize}/#{source.id}/access_requests/#{developer.id}", master) |