Merge branch 'eggerd-master-patch-56208' into 'master'

Fix some private contributions being hidden on the contribution calendar

See merge request gitlab-org/gitlab!74826

lib/gitlab/contributions_calendar.rb

@@ -21,6 +21,7 @@ module Gitlab
 
     # rubocop: disable CodeReuse/ActiveRecord
     def activity_dates
+      return {} if @projects.empty?
       return @activity_dates if @activity_dates.present?
 
       date_interval = "INTERVAL '#{@contributor_time_instance.now.utc_offset} seconds'"
@@ -84,11 +85,19 @@ module Gitlab
       # use IN(project_ids...) instead. It's the intersection of two users so
       # the list will be (relatively) short
       @contributed_project_ids ||= projects.distinct.pluck(:id)
-      authed_projects = ProjectFeature
+
+      # no need to check feature access of current user, if the contributor opted-in
+      # to show all private events anyway - otherwise they would get filtered out again
+      authed_projects = if @contributor.include_private_contributions?
+                          @contributed_project_ids.join(",")
+                        else
+                          ProjectFeature
                             .with_feature_available_for_user(feature, current_user)
                             .where(project_id: @contributed_project_ids)
                             .reorder(nil)
                             .select(:project_id)
+                            .to_sql
+                        end
 
       conditions = t[:created_at].gteq(date_from.beginning_of_day)
         .and(t[:created_at].lteq(@contributor_time_instance.today.end_of_day))
@@ -97,7 +106,7 @@ module Gitlab
       Event.reorder(nil)
         .select(:created_at)
         .where(conditions)
-        .where("events.project_id in (#{authed_projects.to_sql})") # rubocop:disable GitlabSecurity/SqlInjection
+        .where("events.project_id in (#{authed_projects})") # rubocop:disable GitlabSecurity/SqlInjection
     end
     # rubocop: enable CodeReuse/ActiveRecord
   end

spec/lib/gitlab/contributions_calendar_spec.rb

@@ -66,8 +66,11 @@ RSpec.describe Gitlab::ContributionsCalendar do
     end
 
     context "when the user has opted-in for private contributions" do
-      it "shows private and public events to all users" do
+      before do
         contributor.update_column(:include_private_contributions, true)
+      end
+
+      it "shows private and public events to all users" do
         create_event(private_project, today)
         create_event(public_project, today)
 
@@ -75,6 +78,23 @@ RSpec.describe Gitlab::ContributionsCalendar do
         expect(calendar(user).activity_dates[today]).to eq(2)
         expect(calendar(contributor).activity_dates[today]).to eq(2)
       end
+
+      # tests for bug https://gitlab.com/gitlab-org/gitlab/-/merge_requests/74826
+      it "still counts correct with feature access levels set to private" do
+        create_event(private_project, today)
+
+        private_project.project_feature.update_attribute(:issues_access_level, ProjectFeature::PRIVATE)
+        private_project.project_feature.update_attribute(:repository_access_level, ProjectFeature::PRIVATE)
+        private_project.project_feature.update_attribute(:merge_requests_access_level, ProjectFeature::PRIVATE)
+
+        expect(calendar.activity_dates[today]).to eq(1)
+        expect(calendar(user).activity_dates[today]).to eq(1)
+        expect(calendar(contributor).activity_dates[today]).to eq(1)
+      end
+
+      it "does not fail if there are no contributed projects" do
+        expect(calendar.activity_dates[today]).to eq(nil)
+      end
     end
 
     it "counts the diff notes on merge request" do