diff --git a/lib/gitlab/graphql/authorize/connection_filter_extension.rb b/lib/gitlab/graphql/authorize/connection_filter_extension.rb index 20526e19c2a5079fd14b29408ed52557aad92c9e..c75510df3e30a5694882641519c863cb0fa071e9 100644 --- a/lib/gitlab/graphql/authorize/connection_filter_extension.rb +++ b/lib/gitlab/graphql/authorize/connection_filter_extension.rb @@ -37,6 +37,8 @@ def remove_unauthorized(nodes) end def after_resolve(value:, context:, **rest) + return value if value.is_a?(GraphQL::Execution::Execute::Skip) + if @field.connection? redact_connection(value, context) elsif @field.type.list? diff --git a/spec/graphql/features/authorization_spec.rb b/spec/graphql/features/authorization_spec.rb index d2a6b91d1c2350a7124f9b0f2d310b408c87d8e3..64e423e2bf8f681ab5303f9d9041957dd4ab7ae5 100644 --- a/spec/graphql/features/authorization_spec.rb +++ b/spec/graphql/features/authorization_spec.rb @@ -376,6 +376,26 @@ end end + describe 'Authorization on GraphQL::Execution::Execute::SKIP' do + let(:type) do + type_factory do |type| + type.authorize permission_single + end + end + + let(:query_type) do + query_factory do |query| + query.field :item, [type], null: true, resolver: new_resolver(GraphQL::Execution::Execute::SKIP) + end + end + + it 'skips redaction' do + expect(Ability).not_to receive(:allowed?) + + result + end + end + private def permit(*permissions) diff --git a/spec/graphql/resolvers/namespace_projects_resolver_spec.rb b/spec/graphql/resolvers/namespace_projects_resolver_spec.rb index 147a02e1d79d7cf62f74de0f4067a553a1c60238..618d012bd6df7b78ed4547c1dc7c8012c433ebe2 100644 --- a/spec/graphql/resolvers/namespace_projects_resolver_spec.rb +++ b/spec/graphql/resolvers/namespace_projects_resolver_spec.rb @@ -112,7 +112,7 @@ subject(:projects) { resolve_projects(args) } let(:include_subgroups) { false } - let(:project_3) { create(:project, name: 'Project', path: 'project', namespace: namespace) } + let!(:project_3) { create(:project, name: 'Project', path: 'project', namespace: namespace) } context 'when ids is provided' do let(:ids) { [project_3.to_global_id.to_s] }