SONAR-15877 Ensure `canBrowseAllChildProjects` is present for subview components

2 files changed, 11 insertions, 1 deletions

diff --git a/server/sonar-webserver-auth/src/test/java/org/sonar/server/user/ServerUserSessionTest.java b/server/sonar-webserver-auth/src/test/java/org/sonar/server/user/ServerUserSessionTest.java
index 2c556e25f7b..29ce154d1bc 100644
--- a/server/sonar-webserver-auth/src/test/java/org/sonar/server/user/ServerUserSessionTest.java
+++ b/server/sonar-webserver-auth/src/test/java/org/sonar/server/user/ServerUserSessionTest.java
@@ -403,6 +403,7 @@ public class ServerUserSessionTest {
     ComponentDto project2 = db.components().insertPrivateProject();
     ComponentDto project3 = db.components().insertPrivateProject();
     ComponentDto project4 = db.components().insertPrivateProject();
+    ComponentDto project5 = db.components().insertPrivateProject();
 
     UserDto user = db.users().insertUser();
     UserSession session = newUserSession(user);
@@ -429,13 +430,22 @@ public class ServerUserSessionTest {
     db.components().insertComponent(newProjectCopy(project4, subPortfolio));
     db.components().addPortfolioReference(portfolio, subPortfolio.uuid());
 
+    // The predicate should work both on view and subview components
     assertThat(session.hasPortfolioChildProjectsPermission(USER, portfolio)).isTrue();
+    assertThat(session.hasPortfolioChildProjectsPermission(USER, subPortfolio)).isTrue();
 
     // Add private project3 without permissions to private portfolio
     db.components().addPortfolioProject(portfolio, project3);
     db.components().insertComponent(newProjectCopy(project3, portfolio));
 
     assertThat(session.hasChildProjectsPermission(USER, portfolio)).isFalse();
+
+    // Add private project5 without permissions to sub-portfolio
+    db.components().addPortfolioProject(subPortfolio, project5);
+    db.components().insertComponent(newProjectCopy(project5, subPortfolio));
+
+    assertThat(session.hasPortfolioChildProjectsPermission(USER, portfolio)).isFalse();
+    assertThat(session.hasPortfolioChildProjectsPermission(USER, subPortfolio)).isFalse();
   }
 
   @Test
diff --git a/server/sonar-webserver-webapi/src/main/java/org/sonar/server/ui/ws/ComponentAction.java b/server/sonar-webserver-webapi/src/main/java/org/sonar/server/ui/ws/ComponentAction.java
index 486681be01b..b97f9951878 100644
--- a/server/sonar-webserver-webapi/src/main/java/org/sonar/server/ui/ws/ComponentAction.java
+++ b/server/sonar-webserver-webapi/src/main/java/org/sonar/server/ui/ws/ComponentAction.java
@@ -217,7 +217,7 @@ public class ComponentAction implements NavigationWsAction {
     if (Qualifiers.APP.equals(component.qualifier())) {
       json.prop("canBrowseAllChildProjects", userSession.hasChildProjectsPermission(USER, component));
     }
-    if (Qualifiers.VIEW.equals(component.qualifier())) {
+    if (Qualifiers.VIEW.equals(component.qualifier()) || Qualifiers.SUBVIEW.equals(component.qualifier())) {
       json.prop("canBrowseAllChildProjects", userSession.hasPortfolioChildProjectsPermission(USER, component));
     }
     if (QUALIFIERS_WITH_VISIBILITY.contains(component.qualifier())) {