3 files changed, 134 insertions, 6 deletions

diff --git a/spec/services/merge_requests/assign_issues_service_spec.rb b/spec/services/merge_requests/assign_issues_service_spec.rb
index fe75757dd29..d3556020d4d 100644
--- a/spec/services/merge_requests/assign_issues_service_spec.rb
+++ b/spec/services/merge_requests/assign_issues_service_spec.rb
@@ -15,14 +15,14 @@ describe MergeRequests::AssignIssuesService, services: true do
     expect(service.assignable_issues.map(&:id)).to include(issue.id)
   end
 
-  it 'ignores issues already assigned to any user' do
-    issue.update!(assignee: create(:user))
+  it 'ignores issues the user cannot update assignee on' do
+    project.team.truncate
 
     expect(service.assignable_issues).to be_empty
   end
 
-  it 'ignores issues the user cannot update assignee on' do
-    project.team.truncate
+  it 'ignores issues already assigned to any user' do
+    issue.assignees = [create(:user)]
 
     expect(service.assignable_issues).to be_empty
   end
@@ -44,7 +44,7 @@ describe MergeRequests::AssignIssuesService, services: true do
   end
 
   it 'assigns these to the merge request owner' do
-    expect { service.execute }.to change { issue.reload.assignee }.to(user)
+    expect { service.execute }.to change { issue.assignees.first }.to(user)
   end
 
   it 'ignores external issues' do
diff --git a/spec/services/merge_requests/create_service_spec.rb b/spec/services/merge_requests/create_service_spec.rb
index 0e16c7cc94b..ace82380cc9 100644
--- a/spec/services/merge_requests/create_service_spec.rb
+++ b/spec/services/merge_requests/create_service_spec.rb
@@ -84,7 +84,87 @@ describe MergeRequests::CreateService, services: true do
       end
     end
 
-    it_behaves_like 'issuable create service'
+    context 'Slash commands' do
+      context 'with assignee and milestone in params and command' do
+        let(:merge_request) { described_class.new(project, user, opts).execute }
+        let(:milestone) { create(:milestone, project: project) }
+
+        let(:opts) do
+          {
+            assignee_id: create(:user).id,
+            milestone_id: 1,
+            title: 'Title',
+            description: %(/assign @#{assignee.username}\n/milestone %"#{milestone.name}"),
+            source_branch: 'feature',
+            target_branch: 'master'
+          }
+        end
+
+        before do
+          project.team << [user, :master]
+          project.team << [assignee, :master]
+        end
+
+        it 'assigns and sets milestone to issuable from command' do
+          expect(merge_request).to be_persisted
+          expect(merge_request.assignee).to eq(assignee)
+          expect(merge_request.milestone).to eq(milestone)
+        end
+      end
+    end
+
+    context 'merge request create service' do
+      context 'asssignee_id' do
+        let(:assignee) { create(:user) }
+
+        before { project.team << [user, :master] }
+
+        it 'removes assignee_id when user id is invalid' do
+          opts = { title: 'Title', description: 'Description', assignee_id: -1 }
+
+          merge_request = described_class.new(project, user, opts).execute
+
+          expect(merge_request.assignee_id).to be_nil
+        end
+
+        it 'removes assignee_id when user id is 0' do
+          opts = { title: 'Title', description: 'Description',  assignee_id: 0 }
+
+          merge_request = described_class.new(project, user, opts).execute
+
+          expect(merge_request.assignee_id).to be_nil
+        end
+
+        it 'saves assignee when user id is valid' do
+          project.team << [assignee, :master]
+          opts = { title: 'Title', description: 'Description', assignee_id: assignee.id }
+
+          merge_request = described_class.new(project, user, opts).execute
+
+          expect(merge_request.assignee).to eq(assignee)
+        end
+
+        context "when issuable feature is private" do
+          before do
+            project.project_feature.update(issues_access_level: ProjectFeature::PRIVATE,
+                                           merge_requests_access_level: ProjectFeature::PRIVATE)
+          end
+
+          levels = [Gitlab::VisibilityLevel::INTERNAL, Gitlab::VisibilityLevel::PUBLIC]
+
+          levels.each do |level|
+            it "removes not authorized assignee when project is #{Gitlab::VisibilityLevel.level_name(level)}" do
+              project.update(visibility_level: level)
+              opts = { title: 'Title', description: 'Description', assignee_id: assignee.id }
+
+              merge_request = described_class.new(project, user, opts).execute
+
+              expect(merge_request.assignee_id).to be_nil
+            end
+          end
+        end
+      end
+    end
 
     context 'while saving references to issues that the created merge request closes' do
       let(:first_issue) { create(:issue, project: project) }
diff --git a/spec/services/merge_requests/update_service_spec.rb b/spec/services/merge_requests/update_service_spec.rb
index f2ca1e6fcbd..694ec3a579f 100644
--- a/spec/services/merge_requests/update_service_spec.rb
+++ b/spec/services/merge_requests/update_service_spec.rb
@@ -423,6 +423,54 @@ describe MergeRequests::UpdateService, services: true do
       end
     end
 
+    context 'updating asssignee_id' do
+      it 'does not update assignee when assignee_id is invalid' do
+        merge_request.update(assignee_id: user.id)
+
+        update_merge_request(assignee_id: -1)
+
+        expect(merge_request.reload.assignee).to eq(user)
+      end
+
+      it 'unassigns assignee when user id is 0' do
+        merge_request.update(assignee_id: user.id)
+
+        update_merge_request(assignee_id: 0)
+
+        expect(merge_request.assignee_id).to be_nil
+      end
+
+      it 'saves assignee when user id is valid' do
+        update_merge_request(assignee_id: user.id)
+
+        expect(merge_request.assignee_id).to eq(user.id)
+      end
+
+      it 'does not update assignee_id when user cannot read issue' do
+        non_member        = create(:user)
+        original_assignee = merge_request.assignee
+
+        update_merge_request(assignee_id: non_member.id)
+
+        expect(merge_request.assignee_id).to eq(original_assignee.id)
+      end
+
+      context "when issuable feature is private" do
+        levels = [Gitlab::VisibilityLevel::INTERNAL, Gitlab::VisibilityLevel::PUBLIC]
+
+        levels.each do |level|
+          it "does not update with unauthorized assignee when project is #{Gitlab::VisibilityLevel.level_name(level)}" do
+            assignee = create(:user)
+            project.update(visibility_level: level)
+            feature_visibility_attr = :"#{merge_request.model_name.plural}_access_level"
+            project.project_feature.update_attribute(feature_visibility_attr, ProjectFeature::PRIVATE)
+
+            expect{ update_merge_request(assignee_id: assignee) }.not_to change{ merge_request.assignee }
+          end
+        end
+      end
+    end
+
     include_examples 'issuable update service' do
       let(:open_issuable) { merge_request }
       let(:closed_issuable) { create(:closed_merge_request, source_project: project) }