Merge branch 'custom-emoji-delete-gql-api' into 'master'

Custom emoji delete gql api

See merge request gitlab-org/gitlab!65387

app/graphql/mutations/custom_emoji/destroy.rb

+# frozen_string_literal: true
+
+module Mutations
+  module CustomEmoji
+    class Destroy < BaseMutation
+      graphql_name 'DestroyCustomEmoji'
+
+      authorize :delete_custom_emoji
+
+      field :custom_emoji,
+            Types::CustomEmojiType,
+            null: true,
+            description: 'Deleted custom emoji.'
+
+      argument :id, ::Types::GlobalIDType[::CustomEmoji],
+               required: true,
+               description: 'Global ID of the custom emoji to destroy.'
+
+      def resolve(id:)
+        custom_emoji = authorized_find!(id: id)
+
+        custom_emoji.destroy!
+
+        {
+          custom_emoji: custom_emoji
+        }
+      end
+
+      private
+
+      def find_object(id:)
+        GitlabSchema.object_from_id(id, expected_type: ::CustomEmoji)
+      end
+    end
+  end
+end

app/graphql/types/mutation_type.rb

@@ -33,6 +33,7 @@ module Types
     mount_mutation Mutations::Branches::Create, calls_gitaly: true
     mount_mutation Mutations::Commits::Create, calls_gitaly: true
     mount_mutation Mutations::CustomEmoji::Create, feature_flag: :custom_emoji
+    mount_mutation Mutations::CustomEmoji::Destroy, feature_flag: :custom_emoji
     mount_mutation Mutations::CustomerRelations::Organizations::Create
     mount_mutation Mutations::Discussions::ToggleResolve
     mount_mutation Mutations::DependencyProxy::ImageTtlGroupPolicy::Update

app/graphql/types/permission_types/custom_emoji.rb

@@ -5,7 +5,7 @@ module Types
     class CustomEmoji < BasePermissionType
       graphql_name 'CustomEmojiPermissions'
 
-      abilities :create_custom_emoji, :read_custom_emoji
+      abilities :create_custom_emoji, :read_custom_emoji, :delete_custom_emoji
     end
   end
 end

app/policies/custom_emoji_policy.rb

@@ -2,4 +2,14 @@
 
 class CustomEmojiPolicy < BasePolicy
   delegate { @subject.group }
+
+  condition(:author) { @subject.creator == @user }
+
+  rule { can?(:maintainer_access) }.policy do
+    enable :delete_custom_emoji
+  end
+
+  rule { author & can?(:create_custom_emoji) }.policy do
+    enable :delete_custom_emoji
+  end
 end

app/policies/group_policy.rb

@@ -89,6 +89,7 @@ class GroupPolicy < BasePolicy
   rule { guest }.policy do
     enable :read_group
     enable :upload_file
+    enable :guest_access
   end
 
   rule { admin }.policy do
@@ -132,6 +133,7 @@ class GroupPolicy < BasePolicy
     enable :create_custom_emoji
     enable :create_package
     enable :create_package_settings
+    enable :developer_access
   end
 
   rule { reporter }.policy do
@@ -161,6 +163,7 @@ class GroupPolicy < BasePolicy
     enable :read_deploy_token
     enable :create_jira_connect_subscription
     enable :update_runners_registration_token
+    enable :maintainer_access
   end
 
   rule { owner }.policy do
@@ -176,6 +179,7 @@ class GroupPolicy < BasePolicy
     enable :update_default_branch_protection
     enable :create_deploy_token
     enable :destroy_deploy_token
+    enable :owner_access
   end
 
   rule { can?(:read_nested_project_resources) }.policy do

doc/api/graphql/reference/index.md

@@ -1924,6 +1924,27 @@ Input type: `DestroyContainerRepositoryTagsInput`
 | <a id="mutationdestroycontainerrepositorytagsdeletedtagnames"></a>`deletedTagNames` | [`[String!]!`](#string) | Deleted container repository tags. |
 | <a id="mutationdestroycontainerrepositorytagserrors"></a>`errors` | [`[String!]!`](#string) | Errors encountered during execution of the mutation. |
 
+### `Mutation.destroyCustomEmoji`
+
+Available only when feature flag `custom_emoji` is enabled. This flag is disabled by default, because the feature is experimental and is subject to change without notice.
+
+Input type: `DestroyCustomEmojiInput`
+
+#### Arguments
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="mutationdestroycustomemojiclientmutationid"></a>`clientMutationId` | [`String`](#string) | A unique identifier for the client performing the mutation. |
+| <a id="mutationdestroycustomemojiid"></a>`id` | [`CustomEmojiID!`](#customemojiid) | Global ID of the custom emoji to destroy. |
+
+#### Fields
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="mutationdestroycustomemojiclientmutationid"></a>`clientMutationId` | [`String`](#string) | A unique identifier for the client performing the mutation. |
+| <a id="mutationdestroycustomemojicustomemoji"></a>`customEmoji` | [`CustomEmoji`](#customemoji) | Deleted custom emoji. |
+| <a id="mutationdestroycustomemojierrors"></a>`errors` | [`[String!]!`](#string) | Errors encountered during execution of the mutation. |
+
 ### `Mutation.destroyEpicBoard`
 
 Input type: `DestroyEpicBoardInput`

spec/graphql/mutations/custom_emoji/destroy_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Mutations::CustomEmoji::Destroy do
+  let_it_be(:group) { create(:group) }
+  let_it_be(:user) { create(:user) }
+  let_it_be_with_reload(:custom_emoji) { create(:custom_emoji, group: group) }
+
+  let(:args) { { id: custom_emoji.to_global_id } }
+  let(:mutation) { described_class.new(object: nil, context: { current_user: user }, field: nil) }
+
+  context 'field tests' do
+    subject { described_class }
+
+    it { is_expected.to have_graphql_arguments(:id) }
+    it { is_expected.to have_graphql_field(:custom_emoji) }
+  end
+
+  shared_examples 'does not delete custom emoji' do
+    it 'raises exception' do
+      expect { subject }
+        .to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
+    end
+  end
+
+  shared_examples 'deletes custom emoji' do
+    it 'returns deleted custom emoji' do
+      result = subject
+
+      expect(result[:custom_emoji][:name]).to eq(custom_emoji.name)
+    end
+  end
+
+  describe '#resolve' do
+    subject { mutation.resolve(**args) }
+
+    context 'when the user' do
+      context 'has no permissions' do
+        it_behaves_like 'does not delete custom emoji'
+      end
+
+      context 'when the user is developer and not the owner of custom emoji' do
+        before do
+          group.add_developer(user)
+        end
+
+        it_behaves_like 'does not delete custom emoji'
+      end
+    end
+
+    context 'when user' do
+      context 'is maintainer' do
+        before do
+          group.add_maintainer(user)
+        end
+
+        it_behaves_like 'deletes custom emoji'
+      end
+
+      context 'is owner' do
+        before do
+          group.add_owner(user)
+        end
+
+        it_behaves_like 'deletes custom emoji'
+      end
+
+      context 'is developer and creator of the emoji' do
+        before do
+          group.add_developer(user)
+          custom_emoji.update_attribute(:creator, user)
+        end
+
+        it_behaves_like 'deletes custom emoji'
+      end
+    end
+  end
+end

spec/policies/custom_emoji_policy_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe CustomEmojiPolicy do
+  let(:user) { create(:user) }
+  let(:group) { create(:group) }
+  let(:custom_emoji) { create(:custom_emoji, group: group) }
+
+  let(:custom_emoji_permissions) do
+    [
+      :create_custom_emoji,
+      :delete_custom_emoji
+    ]
+  end
+
+  context 'custom emoji permissions' do
+    subject { described_class.new(user, custom_emoji) }
+
+    context 'when user is' do
+      context 'a developer' do
+        before do
+          group.add_developer(user)
+        end
+
+        it do
+          expect_allowed(:create_custom_emoji)
+        end
+      end
+
+      context 'is maintainer' do
+        before do
+          group.add_maintainer(user)
+        end
+
+        it do
+          expect_allowed(*custom_emoji_permissions)
+        end
+      end
+
+      context 'is owner' do
+        before do
+          group.add_owner(user)
+        end
+
+        it do
+          expect_allowed(*custom_emoji_permissions)
+        end
+      end
+
+      context 'is developer and emoji creator' do
+        before do
+          group.add_developer(user)
+          custom_emoji.update_attribute(:creator, user)
+        end
+
+        it do
+          expect_allowed(*custom_emoji_permissions)
+        end
+      end
+
+      context 'is emoji creator but not a member of the group' do
+        before do
+          custom_emoji.update_attribute(:creator, user)
+        end
+
+        it do
+          expect_disallowed(*custom_emoji_permissions)
+        end
+      end
+    end
+  end
+end

spec/requests/api/graphql/mutations/custom_emoji/destroy_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Deletion of custom emoji' do
+  include GraphqlHelpers
+
+  let_it_be(:group) { create(:group) }
+  let_it_be(:current_user) { create(:user) }
+  let_it_be(:user2) { create(:user) }
+  let_it_be_with_reload(:custom_emoji) { create(:custom_emoji, group: group, creator: user2) }
+
+  let(:mutation) do
+    variables = {
+      id: GitlabSchema.id_from_object(custom_emoji).to_s
+    }
+
+    graphql_mutation(:destroy_custom_emoji, variables)
+  end
+
+  shared_examples 'does not delete custom emoji' do
+    it 'does not change count' do
+      expect { post_graphql_mutation(mutation, current_user: current_user) }.not_to change(CustomEmoji, :count)
+    end
+  end
+
+  shared_examples 'deletes custom emoji' do
+    it 'changes count' do
+      expect { post_graphql_mutation(mutation, current_user: current_user) }.to change(CustomEmoji, :count).by(-1)
+    end
+  end
+
+  context 'when the user' do
+    context 'has no permissions' do
+      it_behaves_like 'does not delete custom emoji'
+    end
+
+    context 'when the user is developer and not creator of custom emoji' do
+      before do
+        group.add_developer(current_user)
+      end
+
+      it_behaves_like 'does not delete custom emoji'
+    end
+  end
+
+  context 'when user' do
+    context 'is maintainer' do
+      before do
+        group.add_maintainer(current_user)
+      end
+
+      it_behaves_like 'deletes custom emoji'
+    end
+
+    context 'is owner' do
+      before do
+        group.add_owner(current_user)
+      end
+
+      it_behaves_like 'deletes custom emoji'
+    end
+
+    context 'is developer and creator of the emoji' do
+      before do
+        group.add_developer(current_user)
+        custom_emoji.update_attribute(:creator, current_user)
+      end
+
+      it_behaves_like 'deletes custom emoji'
+    end
+  end
+end