1 files changed, 108 insertions, 0 deletions

diff --git a/spec/requests/api/graphql/packages/package_spec.rb b/spec/requests/api/graphql/packages/package_spec.rb
index 42927634119..82fcc5254ad 100644
--- a/spec/requests/api/graphql/packages/package_spec.rb
+++ b/spec/requests/api/graphql/packages/package_spec.rb
@@ -41,6 +41,7 @@ RSpec.describe 'package details', feature_category: :package_registry do
   context 'with unauthorized user' do
     before do
       project.update!(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
+      project.add_guest(user)
     end
 
     it 'returns no packages' do
@@ -48,6 +49,47 @@ RSpec.describe 'package details', feature_category: :package_registry do
 
       expect(graphql_data_at(:package)).to be_nil
     end
+
+    context 'with access to package registry for everyone' do
+      before do
+        project.project_feature.update!(package_registry_access_level: ProjectFeature::PUBLIC)
+        subject
+      end
+
+      it_behaves_like 'a working graphql query' do
+        it 'matches the JSON schema' do
+          expect(package_details).to match_schema('graphql/packages/package_details')
+        end
+      end
+
+      it '`public_package` returns true' do
+        expect(graphql_data_at(:package, :public_package)).to eq(true)
+      end
+    end
+  end
+
+  context 'when project is public' do
+    let_it_be(:public_project) { create(:project, :public, group: group) }
+    let_it_be(:composer_package) { create(:composer_package, project: public_project) }
+    let(:package_global_id) { global_id_of(composer_package) }
+
+    before do
+      subject
+    end
+
+    it_behaves_like 'a working graphql query' do
+      before do
+        subject
+      end
+
+      it 'matches the JSON schema' do
+        expect(package_details).to match_schema('graphql/packages/package_details')
+      end
+    end
+
+    it '`public_package` returns true' do
+      expect(graphql_data_at(:package, :public_package)).to eq(true)
+    end
   end
 
   context 'with authorized user' do
@@ -113,6 +155,29 @@ RSpec.describe 'package details', feature_category: :package_registry do
       end
     end
 
+    context 'versions field', :aggregate_failures do
+      let_it_be(:composer_package2) { create(:composer_package, project: project, name: composer_package.name) }
+      let_it_be(:composer_package3) { create(:composer_package, :error, project: project, name: composer_package.name) }
+      let_it_be(:pending_destruction) { create(:composer_package, :pending_destruction, project: project, name: composer_package.name) }
+
+      def run_query
+        versions_nodes = <<~QUERY
+        nodes { id }
+        QUERY
+
+        query = graphql_query_for(:package, { id: package_global_id }, query_graphql_field("versions", {}, versions_nodes))
+        post_graphql(query, current_user: user)
+      end
+
+      it 'returns other versions' do
+        run_query
+        versions_ids = graphql_data.dig('package', 'versions', 'nodes').pluck('id')
+        expected_ids = [composer_package2, composer_package3].map(&:to_gid).map(&:to_s)
+
+        expect(versions_ids).to contain_exactly(*expected_ids)
+      end
+    end
+
     context 'pipelines field', :aggregate_failures do
       let(:pipelines) { create_list(:ci_pipeline, 6, project: project) }
       let(:pipeline_gids) { pipelines.sort_by(&:id).map(&:to_gid).map(&:to_s).reverse }
@@ -227,6 +292,49 @@ RSpec.describe 'package details', feature_category: :package_registry do
       end
     end
 
+    context 'public_package' do
+      context 'when project is private' do
+        let_it_be(:private_project) { create(:project, :private, group: group) }
+        let_it_be(:composer_package) { create(:composer_package, project: private_project) }
+        let(:package_global_id) { global_id_of(composer_package) }
+
+        before do
+          private_project.add_developer(user)
+        end
+
+        it 'returns false' do
+          subject
+
+          expect(graphql_data_at(:package, :public_package)).to eq(false)
+        end
+
+        context 'with access to package registry for everyone' do
+          before do
+            private_project.project_feature.update!(package_registry_access_level: ProjectFeature::PUBLIC)
+            subject
+          end
+
+          it 'returns true' do
+            expect(graphql_data_at(:package, :public_package)).to eq(true)
+          end
+        end
+      end
+
+      context 'when project is public' do
+        let_it_be(:public_project) { create(:project, :public, group: group) }
+        let_it_be(:composer_package) { create(:composer_package, project: public_project) }
+        let(:package_global_id) { global_id_of(composer_package) }
+
+        before do
+          subject
+        end
+
+        it 'returns true' do
+          expect(graphql_data_at(:package, :public_package)).to eq(true)
+        end
+      end
+    end
+
     context 'with package that has no default status' do
       before do
         composer_package.update!(status: :error)