Defaults for pages access level

lib/gitlab/background_migration/fix_projects_without_project_feature.rb

@@ -31,12 +31,15 @@ module Gitlab
               snippets_access_level,
               builds_access_level,
               repository_access_level,
-              pages_access_level,
               forking_access_level,
+              pages_access_level,
               created_at,
               updated_at
             )
-              SELECT projects.id, 20, 20, 20, 20, 20, 20, 20, 20, NOW(), NOW()
+              SELECT projects.id,
+                20, 20, 20, 20, 20, 20, 20,
+                #{pages_access_level},
+                NOW(), NOW()
               FROM projects
               WHERE projects.id BETWEEN #{Integer(from_id)} AND #{Integer(to_id)}
               AND NOT EXISTS (
@@ -51,6 +54,14 @@ module Gitlab
         SQL
       end
 
+      def pages_access_level
+        if ::Gitlab::Pages.access_control_is_forced?
+          "10"
+        else
+          "GREATEST(projects.visibility_level, 10)"
+        end
+      end
+
       def log(count, from_id, to_id)
         logger = Gitlab::BackgroundMigration::Logger.build
 

spec/lib/gitlab/background_migration/fix_projects_without_project_feature_spec.rb

@@ -9,7 +9,15 @@ describe Gitlab::BackgroundMigration::FixProjectsWithoutProjectFeature, :migrati
 
   let(:namespace) { namespaces.create(name: 'foo', path: 'foo') }
   let!(:project) { projects.create!(namespace_id: namespace.id) }
-  let!(:projects_without_feature) { [projects.create!(namespace_id: namespace.id), projects.create!(namespace_id: namespace.id)] }
+  let!(:projects_without_feature) do
+    [
+      projects.create!(namespace_id: namespace.id, visibility_level: 0),
+      projects.create!(namespace_id: namespace.id, visibility_level: 20)
+    ]
+  end
+
+  let(:public_project_without_feature) { projects_without_feature.last }
+  let(:private_project_without_feature) { projects_without_feature.first }
 
   before do
     project_features.create({ project_id: project.id, pages_access_level: 20 })
@@ -29,10 +37,10 @@ describe Gitlab::BackgroundMigration::FixProjectsWithoutProjectFeature, :migrati
     expect { subject }.to change { project_feature_records }.from([project.id]).to([project.id, *projects_without_feature.map(&:id)])
   end
 
-  it 'creates ProjectFeature records with default values' do
+  it 'creates ProjectFeature records with default values for a public project' do
     subject
 
-    project_id = projects_without_feature.first.id
+    project_id = public_project_without_feature.id
     record = ActiveRecord::Base.connection.select_one("SELECT * FROM project_features WHERE id=#{project_id}")
 
     expect(record.except('id', 'project_id', 'created_at', 'updated_at')).to eq(
@@ -49,6 +57,52 @@ describe Gitlab::BackgroundMigration::FixProjectsWithoutProjectFeature, :migrati
     )
   end
 
+  it 'creates ProjectFeature records with default values for a private project' do
+    subject
+
+    project_id = private_project_without_feature.id
+    record = ActiveRecord::Base.connection.select_one("SELECT * FROM project_features WHERE id=#{project_id}")
+
+    expect(record.except('id', 'project_id', 'created_at', 'updated_at')).to eq(
+      {
+        "merge_requests_access_level" => 20,
+        "issues_access_level" => 20,
+        "wiki_access_level" => 20,
+        "snippets_access_level" => 20,
+        "builds_access_level" => 20,
+        "repository_access_level" => 20,
+        "pages_access_level" => 10,
+        "forking_access_level" => 20
+      }
+    )
+  end
+
+  context 'when access control to pages is forced' do
+    before do
+      allow(::Gitlab::Pages).to receive(:access_control_is_forced?).and_return(true)
+    end
+
+    it 'creates ProjectFeature records with default values for a public project' do
+      subject
+
+      project_id = public_project_without_feature.id
+      record = ActiveRecord::Base.connection.select_one("SELECT * FROM project_features WHERE id=#{project_id}")
+
+      expect(record.except('id', 'project_id', 'created_at', 'updated_at')).to eq(
+        {
+          "merge_requests_access_level" => 20,
+          "issues_access_level" => 20,
+          "wiki_access_level" => 20,
+          "snippets_access_level" => 20,
+          "builds_access_level" => 20,
+          "repository_access_level" => 20,
+          "pages_access_level" => 10,
+          "forking_access_level" => 20
+        }
+      )
+    end
+  end
+
   it 'sets created_at/updated_at timestamps' do
     subject