1 files changed, 117 insertions, 93 deletions

diff --git a/spec/services/groups/group_links/create_service_spec.rb b/spec/services/groups/group_links/create_service_spec.rb
index 03dac14be54..bfbaedbd06f 100644
--- a/spec/services/groups/group_links/create_service_spec.rb
+++ b/spec/services/groups/group_links/create_service_spec.rb
@@ -3,23 +3,13 @@
 require 'spec_helper'
 
 RSpec.describe Groups::GroupLinks::CreateService, '#execute' do
-  let(:parent_group_user) { create(:user) }
-  let(:group_user) { create(:user) }
-  let(:child_group_user) { create(:user) }
-  let(:prevent_sharing) { false }
+  let_it_be(:shared_with_group_parent) { create(:group, :private) }
+  let_it_be(:shared_with_group) { create(:group, :private, parent: shared_with_group_parent) }
+  let_it_be(:shared_with_group_child) { create(:group, :private, parent: shared_with_group) }
 
   let_it_be(:group_parent) { create(:group, :private) }
-  let_it_be(:group) { create(:group, :private, parent: group_parent) }
-  let_it_be(:group_child) { create(:group, :private, parent: group) }
 
-  let(:ns_for_parent) { create(:namespace_settings, prevent_sharing_groups_outside_hierarchy: prevent_sharing) }
-  let(:shared_group_parent) { create(:group, :private, namespace_settings: ns_for_parent) }
-  let(:shared_group) { create(:group, :private, parent: shared_group_parent) }
-  let(:shared_group_child) { create(:group, :private, parent: shared_group) }
-
-  let(:project_parent) { create(:project, group: shared_group_parent) }
-  let(:project) { create(:project, group: shared_group) }
-  let(:project_child) { create(:project, group: shared_group_child) }
+  let(:group) { create(:group, :private, parent: group_parent) }
 
   let(:opts) do
     {
@@ -28,127 +18,161 @@ RSpec.describe Groups::GroupLinks::CreateService, '#execute' do
     }
   end
 
-  let(:user) { group_user }
+  subject { described_class.new(group, shared_with_group, user, opts) }
 
-  subject { described_class.new(shared_group, group, user, opts) }
+  shared_examples_for 'not shareable' do
+    it 'does not share and returns an error' do
+      expect do
+        result = subject.execute
 
-  before do
-    group.add_guest(group_user)
-    shared_group.add_owner(group_user)
+        expect(result[:status]).to eq(:error)
+        expect(result[:http_status]).to eq(404)
+      end.not_to change { group.shared_with_group_links.count }
+    end
   end
 
-  it 'adds group to another group' do
-    expect { subject.execute }.to change { group.shared_group_links.count }.from(0).to(1)
-  end
+  shared_examples_for 'shareable' do
+    it 'adds group to another group' do
+      expect do
+        result = subject.execute
 
-  it 'returns false if shared group is blank' do
-    expect { described_class.new(nil, group, user, opts) }.not_to change { group.shared_group_links.count }
+        expect(result[:status]).to eq(:success)
+      end.to change { group.shared_with_group_links.count }.from(0).to(1)
+    end
   end
 
-  context 'user does not have access to group' do
-    let(:user) { create(:user) }
-
-    before do
-      shared_group.add_owner(user)
-    end
+  context 'when user has proper membership to share a group' do
+    let_it_be(:group_user) { create(:user) }
 
-    it 'returns error' do
-      result = subject.execute
+    let(:user) { group_user }
 
-      expect(result[:status]).to eq(:error)
-      expect(result[:http_status]).to eq(404)
+    before do
+      shared_with_group.add_guest(group_user)
+      group.add_owner(group_user)
     end
-  end
 
-  context 'user does not have admin access to shared group' do
-    let(:user) { create(:user) }
+    it_behaves_like 'shareable'
 
-    before do
-      group.add_guest(user)
-      shared_group.add_developer(user)
-    end
+    context 'when sharing outside the hierarchy is disabled' do
+      let_it_be(:group_parent) do
+        create(:group,
+               namespace_settings: create(:namespace_settings, prevent_sharing_groups_outside_hierarchy: true))
+      end
 
-    it 'returns error' do
-      result = subject.execute
+      it_behaves_like 'not shareable'
 
-      expect(result[:status]).to eq(:error)
-      expect(result[:http_status]).to eq(404)
-    end
-  end
+      context 'when group is inside hierarchy' do
+        let(:shared_with_group) { create(:group, :private, parent: group_parent) }
 
-  context 'project authorizations based on group hierarchies' do
-    before do
-      group_parent.add_owner(parent_group_user)
-      group.add_owner(group_user)
-      group_child.add_owner(child_group_user)
+        it_behaves_like 'shareable'
+      end
     end
 
-    context 'project authorizations refresh' do
-      it 'is executed only for the direct members of the group' do
-        expect(UserProjectAccessChangedService).to receive(:new).with(contain_exactly(group_user.id)).and_call_original
+    context 'project authorizations based on group hierarchies' do
+      let_it_be(:child_group_user) { create(:user) }
+      let_it_be(:parent_group_user) { create(:user) }
 
-        subject.execute
+      before do
+        shared_with_group_parent.add_owner(parent_group_user)
+        shared_with_group.add_owner(group_user)
+        shared_with_group_child.add_owner(child_group_user)
       end
-    end
 
-    context 'project authorizations' do
-      context 'group user' do
-        let(:user) { group_user }
+      context 'project authorizations refresh' do
+        it 'is executed only for the direct members of the group' do
+          expect(UserProjectAccessChangedService).to receive(:new).with(contain_exactly(group_user.id))
+                                                                  .and_call_original
 
-        it 'create proper authorizations' do
           subject.execute
-
-          expect(Ability.allowed?(user, :read_project, project_parent)).to be_falsey
-          expect(Ability.allowed?(user, :read_project, project)).to be_truthy
-          expect(Ability.allowed?(user, :read_project, project_child)).to be_truthy
         end
       end
 
-      context 'parent group user' do
-        let(:user) { parent_group_user }
+      context 'project authorizations' do
+        let(:group_child) { create(:group, :private, parent: group) }
+        let(:project_parent) { create(:project, group: group_parent) }
+        let(:project) { create(:project, group: group) }
+        let(:project_child) { create(:project, group: group_child) }
 
-        it 'create proper authorizations' do
-          subject.execute
+        context 'group user' do
+          let(:user) { group_user }
+
+          it 'create proper authorizations' do
+            subject.execute
 
-          expect(Ability.allowed?(user, :read_project, project_parent)).to be_falsey
-          expect(Ability.allowed?(user, :read_project, project)).to be_falsey
-          expect(Ability.allowed?(user, :read_project, project_child)).to be_falsey
+            expect(Ability.allowed?(user, :read_project, project_parent)).to be_falsey
+            expect(Ability.allowed?(user, :read_project, project)).to be_truthy
+            expect(Ability.allowed?(user, :read_project, project_child)).to be_truthy
+          end
         end
-      end
 
-      context 'child group user' do
-        let(:user) { child_group_user }
+        context 'parent group user' do
+          let(:user) { parent_group_user }
 
-        it 'create proper authorizations' do
-          subject.execute
+          it 'create proper authorizations' do
+            subject.execute
+
+            expect(Ability.allowed?(user, :read_project, project_parent)).to be_falsey
+            expect(Ability.allowed?(user, :read_project, project)).to be_falsey
+            expect(Ability.allowed?(user, :read_project, project_child)).to be_falsey
+          end
+        end
 
-          expect(Ability.allowed?(user, :read_project, project_parent)).to be_falsey
-          expect(Ability.allowed?(user, :read_project, project)).to be_falsey
-          expect(Ability.allowed?(user, :read_project, project_child)).to be_falsey
+        context 'child group user' do
+          let(:user) { child_group_user }
+
+          it 'create proper authorizations' do
+            subject.execute
+
+            expect(Ability.allowed?(user, :read_project, project_parent)).to be_falsey
+            expect(Ability.allowed?(user, :read_project, project)).to be_falsey
+            expect(Ability.allowed?(user, :read_project, project_child)).to be_falsey
+          end
         end
       end
     end
   end
 
-  context 'sharing outside the hierarchy is disabled' do
-    let(:prevent_sharing) { true }
+  context 'user does not have access to group' do
+    let(:user) { create(:user) }
 
-    it 'prevents sharing with a group outside the hierarchy' do
-      result = subject.execute
+    before do
+      group.add_owner(user)
+    end
 
-      expect(group.reload.shared_group_links.count).to eq(0)
-      expect(result[:status]).to eq(:error)
-      expect(result[:http_status]).to eq(404)
+    it_behaves_like 'not shareable'
+  end
+
+  context 'user does not have admin access to shared group' do
+    let(:user) { create(:user) }
+
+    before do
+      shared_with_group.add_guest(user)
+      group.add_developer(user)
     end
 
-    it 'allows sharing with a group within the hierarchy' do
-      sibling_group = create(:group, :private, parent: shared_group_parent)
-      sibling_group.add_guest(group_user)
+    it_behaves_like 'not shareable'
+  end
+
+  context 'when group is blank' do
+    let(:group_user) { create(:user) }
+    let(:user) { group_user }
+    let(:group) { nil }
 
-      result = described_class.new(shared_group, sibling_group, user, opts).execute
+    it 'does not share and returns an error' do
+      expect do
+        result = subject.execute
 
-      expect(sibling_group.reload.shared_group_links.count).to eq(1)
-      expect(result[:status]).to eq(:success)
+        expect(result[:status]).to eq(:error)
+        expect(result[:http_status]).to eq(404)
+      end.not_to change { shared_with_group.shared_group_links.count }
     end
   end
+
+  context 'when shared_with_group is blank' do
+    let(:group_user) { create(:user) }
+    let(:user) { group_user }
+    let(:shared_with_group) { nil }
+
+    it_behaves_like 'not shareable'
+  end
 end