Fix removing todos for confidential issues

- dont remove todos for authos & assignees
- remove todos for project guests

app/services/todos/destroy/confidential_issue_service.rb

@@ -14,6 +14,8 @@ module Todos
       override :todos
       def todos
         Todo.where(target: issue)
+          .where('user_id != ?', issue.author_id)
+          .where('user_id NOT IN (?)', issue.assignees.select(:id))
       end
 
       override :todos_to_remove?
@@ -25,6 +27,13 @@ module Todos
       def project_ids
         issue.project_id
       end
+
+      override :authorized_users
+      def authorized_users
+        ProjectAuthorization.select(:user_id)
+          .where(project_id: project_ids)
+          .where('access_level >= ?', Gitlab::Access::REPORTER)
+      end
     end
   end
 end

app/services/todos/destroy/entity_leave_service.rb

@@ -42,7 +42,11 @@ module Todos
       end
 
       def confidential_issues
+        assigned_ids = IssueAssignee.select(:issue_id).where(user_id: user_id)
+
         Issue.where(project_id: project_ids, confidential: true)
+          .where('author_id != ?', user_id)
+          .where('id NOT IN (?)', assigned_ids)
       end
     end
   end

spec/services/todos/destroy/confidential_issue_service_spec.rb

@@ -3,16 +3,23 @@ require 'spec_helper'
 describe Todos::Destroy::ConfidentialIssueService do
   let(:project)        { create(:project, :public) }
   let(:user)           { create(:user) }
+  let(:author)         { create(:user) }
+  let(:assignee)       { create(:user) }
+  let(:guest)          { create(:user) }
   let(:project_member) { create(:user) }
-  let(:issue)          { create(:issue, project: project) }
+  let(:issue)          { create(:issue, project: project, author: author, assignees: [assignee]) }
 
   let!(:todo_issue_non_member)   { create(:todo, user: user, target: issue, project: project) }
   let!(:todo_issue_member)       { create(:todo, user: project_member, target: issue, project: project) }
+  let!(:todo_issue_author)       { create(:todo, user: author, target: issue, project: project) }
+  let!(:todo_issue_asignee)      { create(:todo, user: assignee, target: issue, project: project) }
+  let!(:todo_issue_guest)        { create(:todo, user: guest, target: issue, project: project) }
   let!(:todo_another_non_member) { create(:todo, user: user, project: project) }
 
   describe '#execute' do
     before do
       project.add_developer(project_member)
+      project.add_guest(guest)
     end
 
     subject { described_class.new(issue.id).execute }
@@ -23,9 +30,10 @@ describe Todos::Destroy::ConfidentialIssueService do
       end
 
       it 'removes issue todos for a user who is not a project member' do
-        expect { subject }.to change { Todo.count }.from(3).to(2)
+        expect { subject }.to change { Todo.count }.from(6).to(4)
 
         expect(user.todos).to match_array([todo_another_non_member])
+        expect(author.todos).to match_array([todo_issue_author])
         expect(project_member.todos).to match_array([todo_issue_member])
       end
     end

spec/services/todos/destroy/entity_leave_service_spec.rb

@@ -29,13 +29,41 @@ describe Todos::Destroy::EntityLeaveService do
       end
 
       context 'when project is not private' do
-        before do
-          group.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
-          project.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
+        context 'when a user is not an author of confidential issue' do
+          before do
+            group.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
+            project.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
+          end
+
+          it 'removes only confidential issues todos' do
+            expect { subject }.to change { Todo.count }.from(3).to(2)
+          end
         end
 
-        it 'removes only confidential issues todos' do
-          expect { subject }.to change { Todo.count }.from(3).to(2)
+        context 'when a user is an author of confidential issue' do
+          before do
+            issue.update!(author: user)
+
+            group.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
+            project.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
+          end
+
+          it 'removes only confidential issues todos' do
+            expect { subject }.not_to change { Todo.count }
+          end
+        end
+
+        context 'when a user is an assignee of confidential issue' do
+          before do
+            issue.assignees << user
+
+            group.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
+            project.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
+          end
+
+          it 'removes only confidential issues todos' do
+            expect { subject }.not_to change { Todo.count }
+          end
         end
       end
     end