Improve specs for feature flag issues controller

Improve permissions checks

ee/app/services/feature_flag_issues/create_service.rb

@@ -7,7 +7,7 @@ module FeatureFlagIssues
     end
 
     def linkable_issuables(issues)
-      issues
+      issues.select { |issue| can?(current_user, :read_issue, issue) }
     end
 
     def relate_issuables(referenced_issue)

ee/app/views/projects/feature_flags/edit.html.haml

@@ -8,4 +8,4 @@
                       project_id: @project.id,
                       feature_flags_path: project_feature_flags_path(@project),
                       environments_endpoint: search_project_environments_path(@project, format: :json),
-                      feature_flag_issues_endpoint: Feature.enabled?(:feature_flags_issue_links, @project) ? project_feature_flag_issues_path(@project, @feature_flag) : ''} }
+                      feature_flag_issues_endpoint: Feature.enabled?(:feature_flags_issue_links, @project) && can?(current_user, :read_issue_link, @project) ? project_feature_flag_issues_path(@project, @feature_flag) : ''} }

ee/spec/controllers/projects/feature_flag_issues_controller_spec.rb

@@ -172,6 +172,16 @@ RSpec.describe Projects::FeatureFlagIssuesController do
       expect(response).to have_gitlab_http_status(:not_found)
     end
 
+    it 'returns not found when related issues feature is unavailable' do
+      stub_licensed_features(related_issues: false)
+      feature_flag, _issue = setup
+      sign_in(developer)
+
+      get_request(project, feature_flag)
+
+      expect(response).to have_gitlab_http_status(:not_found)
+    end
+
     context 'when feature flags are unlicensed' do
       before do
         stub_licensed_features(feature_flags: false)
@@ -201,7 +211,7 @@ RSpec.describe Projects::FeatureFlagIssuesController do
         namespace_id: project.namespace,
         project_id: project,
         feature_flag_iid: feature_flag,
-        issuable_references: [issue.to_reference],
+        issuable_references: [issue.to_reference(full: true)],
         link_type: 'relates_to'
       }
 
@@ -241,6 +251,40 @@ RSpec.describe Projects::FeatureFlagIssuesController do
       }))
     end
 
+    it 'creates a cross project link for a project in the same namespace' do
+      other_project = create(:project, namespace: project.namespace)
+      other_project.add_developer(developer)
+      feature_flag = create(:operations_feature_flag, project: project)
+      issue = create(:issue, project: other_project)
+      sign_in(developer)
+
+      post_request(project, feature_flag, issue)
+
+      expect(response).to have_gitlab_http_status(:ok)
+      expect(json_response).to match(a_hash_including({
+        'issuables' => [a_hash_including({
+          'id' => issue.id
+        })]
+      }))
+    end
+
+    it 'creates a cross project link for a project in another namespace' do
+      other_project = create(:project)
+      other_project.add_developer(developer)
+      feature_flag = create(:operations_feature_flag, project: project)
+      issue = create(:issue, project: other_project)
+      sign_in(developer)
+
+      post_request(project, feature_flag, issue)
+
+      expect(response).to have_gitlab_http_status(:ok)
+      expect(json_response).to match(a_hash_including({
+        'issuables' => [a_hash_including({
+          'id' => issue.id
+        })]
+      }))
+    end
+
     it 'does not create a link for a reporter' do
       feature_flag, issue = setup
       sign_in(reporter)
@@ -248,18 +292,55 @@ RSpec.describe Projects::FeatureFlagIssuesController do
       post_request(project, feature_flag, issue)
 
       expect(response).to have_gitlab_http_status(:not_found)
+      expect(::FeatureFlagIssue.count).to eq(0)
     end
 
-    it 'does not create a cross project link' do
-      other_project = create(:project)
-      other_project.add_developer(developer)
+    it "does not create a cross project link when the user is not a member of the issue's project" do
+      other_project = create(:project, namespace: project.namespace)
       feature_flag = create(:operations_feature_flag, project: project)
-      issue = create(:issue, project: other_project)
+      issue = create(:issue, project: other_project, confidential: true)
       sign_in(developer)
 
       post_request(project, feature_flag, issue)
 
       expect(response).to have_gitlab_http_status(:not_found)
+      expect(::FeatureFlagIssue.count).to eq(0)
+    end
+
+    it "does not create a cross project link when the user is a guest of the issue's project" do
+      other_project = create(:project, namespace: project.namespace)
+      other_project.add_guest(developer)
+      feature_flag = create(:operations_feature_flag, project: project)
+      issue = create(:issue, project: other_project, confidential: true)
+      sign_in(developer)
+
+      post_request(project, feature_flag, issue)
+
+      expect(response).to have_gitlab_http_status(:not_found)
+      expect(::FeatureFlagIssue.count).to eq(0)
+    end
+
+    it 'does not create a link when the user cannot read the issue' do
+      feature_flag, issue = setup
+      sign_in(developer)
+      allow(Ability).to receive(:allowed?).and_call_original
+      allow(Ability).to receive(:allowed?).with(developer, :read_issue, issue).and_return(false)
+
+      post_request(project, feature_flag, issue)
+
+      expect(response).to have_gitlab_http_status(:not_found)
+      expect(::FeatureFlagIssue.count).to eq(0)
+    end
+
+    it 'does not create a link when the related issues feature is unavailable' do
+      stub_licensed_features(related_issues: false)
+      feature_flag, issue = setup
+      sign_in(developer)
+
+      post_request(project, feature_flag, issue)
+
+      expect(response).to have_gitlab_http_status(:not_found)
+      expect(::FeatureFlagIssue.count).to eq(0)
     end
 
     context 'when feature flags are unlicensed' do
@@ -274,6 +355,7 @@ RSpec.describe Projects::FeatureFlagIssuesController do
         post_request(project, feature_flag, issue)
 
         expect(response).to have_gitlab_http_status(:not_found)
+        expect(::FeatureFlagIssue.count).to eq(0)
       end
     end
   end
@@ -317,5 +399,16 @@ RSpec.describe Projects::FeatureFlagIssuesController do
       expect(response).to have_gitlab_http_status(:not_found)
       expect(feature_flag.reload.issues).to eq([issue])
     end
+
+    it 'does not unlink the issue when the related issues feature is unavailable' do
+      stub_licensed_features(related_issues: false)
+      feature_flag, issue, link = setup
+      sign_in(developer)
+
+      delete_request(project, feature_flag, link)
+
+      expect(response).to have_gitlab_http_status(:not_found)
+      expect(feature_flag.reload.issues).to eq([issue])
+    end
   end
 end

ee/spec/features/projects/feature_flags/feature_flag_issues_spec.rb

@@ -72,6 +72,19 @@ RSpec.describe 'Feature flag issue links', :js do
         expect(page).not_to have_selector '#related-issues'
       end
     end
+
+    context 'when the related issues feature is unavailable' do
+      before do
+        stub_licensed_features(related_issues: false, feature_flags: true)
+      end
+
+      it 'does not show the related issues widget' do
+        visit(edit_project_feature_flag_path(project, feature_flag))
+
+        expect(page).to have_text 'Strategies'
+        expect(page).not_to have_selector '#related-issues'
+      end
+    end
   end
 
   describe 'unlinking a feature flag from an issue' do