Don't generate evidence summary in the factorybot

Asked on review

Also fixed evidences_controller_spec: some of examples
were contradicting the permissions logic and only worked
because of using let_it_be and caching permissions from
previous_examples

spec/controllers/projects/releases/evidences_controller_spec.rb

@@ -31,8 +31,8 @@ describe Projects::Releases::EvidencesController do
   end
 
   describe 'GET #show' do
-    let_it_be(:tag_name) { "v1.1.0-evidence" }
-    let!(:release) { create(:release, :with_evidence, project: project, tag: tag_name) }
+    let(:tag_name) { "v1.1.0-evidence" }
+    let!(:release) { create(:release, project: project, tag: tag_name) }
     let(:evidence) { release.evidences.first }
     let(:tag) { CGI.escape(release.tag) }
     let(:format) { :json }
@@ -48,6 +48,8 @@ describe Projects::Releases::EvidencesController do
     end
 
     before do
+      ::Releases::CreateEvidenceService.new(release).execute
+
       sign_in(user)
     end
 
@@ -84,10 +86,9 @@ describe Projects::Releases::EvidencesController do
     end
 
     context 'when release is associated to a milestone which includes an issue' do
-      let_it_be(:project) { create(:project, :repository, :public) }
-      let_it_be(:issue) { create(:issue, project: project) }
-      let_it_be(:milestone) { create(:milestone, project: project, issues: [issue]) }
-      let_it_be(:release) { create(:release, :with_evidence, project: project, tag: tag_name, milestones: [milestone]) }
+      let(:issue) { create(:issue, project: project) }
+      let(:milestone) { create(:milestone, project: project, issues: [issue]) }
+      let(:release) { create(:release, project: project, tag: tag_name, milestones: [milestone]) }
 
       shared_examples_for 'does not show the issue in evidence' do
         it do
@@ -107,7 +108,9 @@ describe Projects::Releases::EvidencesController do
         end
       end
 
-      shared_examples_for 'safely expose evidence' do
+      context 'when user is non-project member' do
+        let(:user) { create(:user) }
+
         it_behaves_like 'does not show the issue in evidence'
 
         context 'when the issue is confidential' do
@@ -123,28 +126,50 @@ describe Projects::Releases::EvidencesController do
         end
 
         context 'when project is private' do
-          let!(:project) { create(:project, :repository, :private) }
+          let(:project) { create(:project, :repository, :private) }
 
           it_behaves_like 'evidence not found'
         end
 
         context 'when project restricts the visibility of issues to project members only' do
-          let!(:project) { create(:project, :repository, :issues_private) }
+          let(:project) { create(:project, :repository, :issues_private) }
 
           it_behaves_like 'evidence not found'
         end
       end
 
-      context 'when user is non-project member' do
-        let(:user) { create(:user) }
-
-        it_behaves_like 'safely expose evidence'
-      end
-
       context 'when user is auditor', if: Gitlab.ee? do
         let(:user) { create(:user, :auditor) }
 
-        it_behaves_like 'safely expose evidence'
+        it_behaves_like 'does not show the issue in evidence'
+
+        context 'when the issue is confidential' do
+          let(:issue) { create(:issue, :confidential, project: project) }
+
+          it_behaves_like 'does not show the issue in evidence'
+        end
+
+        context 'when the user is the author of the confidential issue' do
+          let(:issue) { create(:issue, :confidential, project: project, author: user) }
+
+          it_behaves_like 'does not show the issue in evidence'
+        end
+
+        context 'when project is private' do
+          let(:project) { create(:project, :repository, :private) }
+
+          it 'returns evidence ' do
+            subject
+
+            expect(json_response).to eq(evidence.summary)
+          end
+        end
+
+        context 'when project restricts the visibility of issues to project members only' do
+          let(:project) { create(:project, :repository, :issues_private) }
+
+          it_behaves_like 'evidence not found'
+        end
       end
 
       context 'when external authorization control is enabled' do

spec/factories/releases.rb

@@ -17,7 +17,7 @@ FactoryBot.define do
 
     trait :with_evidence do
       after(:create) do |release, _|
-        ::Releases::CreateEvidenceService.new(release).execute
+        create(:evidence, release: release)
       end
     end
 

spec/features/projects/releases/user_views_releases_spec.rb

@@ -80,7 +80,7 @@ describe 'User views releases', :js do
 
     context 'with a tag containing a slash' do
       it 'sees the release' do
-        release = create :release, :with_evidence, project: project, tag: 'debian/2.4.0-1'
+        release = create :release, project: project, tag: 'debian/2.4.0-1'
         visit project_releases_path(project)
 
         expect(page).to have_content(release.name)

spec/lib/api/entities/release_spec.rb

@@ -4,11 +4,15 @@ require 'spec_helper'
 
 describe API::Entities::Release do
   let_it_be(:project) { create(:project) }
-  let_it_be(:release) { create(:release, :with_evidence, project: project) }
+  let(:release) { create(:release, project: project) }
   let(:evidence) { release.evidences.first }
   let(:user) { create(:user) }
   let(:entity) { described_class.new(release, current_user: user).as_json }
 
+  before do
+    ::Releases::CreateEvidenceService.new(release).execute
+  end
+
   describe 'evidences' do
     context 'when the current user can download code' do
       let(:entity_evidence) { entity[:evidences].first }

spec/models/release_spec.rb

@@ -94,14 +94,6 @@ RSpec.describe Release do
   describe 'evidence' do
     let(:release_with_evidence) { create(:release, :with_evidence, project: project) }
 
-    describe '#create_evidence!' do
-      context 'when a release is created' do
-        it 'creates one Evidence object too' do
-          expect { release_with_evidence }.to change(Releases::Evidence, :count).by(1)
-        end
-      end
-    end
-
     context 'when a release is deleted' do
       it 'also deletes the associated evidence' do
         release_with_evidence