diff options
Diffstat (limited to 'spec/requests/api/graphql/organizations/organization_query_spec.rb')
-rw-r--r-- | spec/requests/api/graphql/organizations/organization_query_spec.rb | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/spec/requests/api/graphql/organizations/organization_query_spec.rb b/spec/requests/api/graphql/organizations/organization_query_spec.rb index c243e0613ad..c485e3b170d 100644 --- a/spec/requests/api/graphql/organizations/organization_query_spec.rb +++ b/spec/requests/api/graphql/organizations/organization_query_spec.rb @@ -23,7 +23,8 @@ RSpec.describe 'getting organization information', feature_category: :cell do let_it_be(:organization_user) { create(:organization_user) } let_it_be(:organization) { organization_user.organization } let_it_be(:user) { organization_user.user } - let_it_be(:public_group) { create(:group, name: 'public-group', organization: organization) } + let_it_be(:parent_group) { create(:group, name: 'parent-group', organization: organization) } + let_it_be(:public_group) { create(:group, name: 'public-group', parent: parent_group, organization: organization) } let_it_be(:other_group) { create(:group, name: 'other-group', organization: organization) } let_it_be(:outside_organization_group) { create(:group) } @@ -74,6 +75,12 @@ RSpec.describe 'getting organization information', feature_category: :cell do end end + it 'does not return ancestors of authorized groups' do + request_organization + + expect(groups.pluck('id')).not_to include(parent_group.to_global_id.to_s) + end + context 'when requesting organization user' do let(:organization_fields) do <<~FIELDS |