From bbe0f5e0bd8a08d21eb4e964baf50df9a1a41f85 Mon Sep 17 00:00:00 2001
From: Bojan Marjanovic <bmarjanovic@gitlab.com>
Date: Mon, 11 Dec 2023 16:03:01 +0000
Subject: [PATCH] Unexpose `url_variables` from GET project_hooks

Changelog: changed
---
 lib/api/entities/hook.rb                      |  4 ++-
 lib/api/project_hooks.rb                      |  2 +-
 .../schemas/public_api/v4/project_hook.json   |  4 ++-
 spec/lib/api/entities/hook_spec.rb            | 25 +++++++++++++++++++
 .../requests/api/hooks_shared_examples.rb     |  2 +-
 5 files changed, 33 insertions(+), 4 deletions(-)
 create mode 100644 spec/lib/api/entities/hook_spec.rb

diff --git a/lib/api/entities/hook.rb b/lib/api/entities/hook.rb
index e24e201ac571..d92331f7dea4 100644
--- a/lib/api/entities/hook.rb
+++ b/lib/api/entities/hook.rb
@@ -14,7 +14,9 @@ class Hook < Grape::Entity
 
       expose :alert_status, documentation: { type: 'symbol', example: :executable }
       expose :disabled_until, documentation: { type: 'dateTime', example: '2012-05-28T04:42:42-07:00' }
-      expose :url_variables, documentation: { type: 'Hash', example: { "token" => "secr3t" }, is_array: true }
+      expose :url_variables,
+        if: ->(_, options) { options[:with_url_variables] != false },
+        documentation: { type: 'Hash', example: { "token" => "secr3t" }, is_array: true }
 
       def url_variables
         object.url_variables.keys.map { { key: _1 } }
diff --git a/lib/api/project_hooks.rb b/lib/api/project_hooks.rb
index c9cba397f5c1..011d5e69f006 100644
--- a/lib/api/project_hooks.rb
+++ b/lib/api/project_hooks.rb
@@ -57,7 +57,7 @@ def hook_scope
         use :pagination
       end
       get ":id/hooks" do
-        present paginate(user_project.hooks), with: Entities::ProjectHook
+        present paginate(user_project.hooks), with: Entities::ProjectHook, with_url_variables: false
       end
 
       desc 'Get project hook' do
diff --git a/spec/fixtures/api/schemas/public_api/v4/project_hook.json b/spec/fixtures/api/schemas/public_api/v4/project_hook.json
index b89f5af80784..c42a4cad7125 100644
--- a/spec/fixtures/api/schemas/public_api/v4/project_hook.json
+++ b/spec/fixtures/api/schemas/public_api/v4/project_hook.json
@@ -22,9 +22,11 @@
     "releases_events",
     "alert_status",
     "disabled_until",
-    "url_variables",
     "emoji_events"
   ],
+  "optional": [
+    "url_variables"
+  ],
   "properties": {
     "id": {
       "type": "integer"
diff --git a/spec/lib/api/entities/hook_spec.rb b/spec/lib/api/entities/hook_spec.rb
new file mode 100644
index 000000000000..45648d6fb645
--- /dev/null
+++ b/spec/lib/api/entities/hook_spec.rb
@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe API::Entities::Hook, feature_category: :webhooks do
+  let(:hook) { create(:project_hook) }
+  let(:with_url_variables) { true }
+  let(:entity) { described_class.new(hook, with_url_variables: with_url_variables) }
+
+  subject(:json) { entity.as_json }
+
+  it 'exposes correct attributes' do
+    expect(json.keys).to contain_exactly(:alert_status, :created_at, :disabled_until, :enable_ssl_verification, :id,
+      :merge_requests_events, :push_events, :repository_update_events, :tag_push_events, :url, :url_variables
+    )
+  end
+
+  context 'when `with_url_variables` is set to false' do
+    let(:with_url_variables) { false }
+
+    it 'does not expose `with_url_variables` field' do
+      expect(json.keys).not_to include(:url_variables)
+    end
+  end
+end
diff --git a/spec/support/shared_examples/requests/api/hooks_shared_examples.rb b/spec/support/shared_examples/requests/api/hooks_shared_examples.rb
index 7489dc7c1d6f..de458bc87db2 100644
--- a/spec/support/shared_examples/requests/api/hooks_shared_examples.rb
+++ b/spec/support/shared_examples/requests/api/hooks_shared_examples.rb
@@ -84,7 +84,7 @@ def hook_param_overrides
       end
     end
 
-    context 'the hook has URL variables' do
+    context 'the hook has URL variables', if: prefix != '/projects/:id' do
       before do
         hook.update!(url_variables: { 'token' => 'supers3cret' })
       end
-- 
GitLab