Pass organization_id to SnippetsFinder in controllers

Chen Zhangrequested to merge
570399-your-work-snippets-organization-isolation into master

What does this MR do and why?

This MR updates all snippet controllers to pass organization_id to SnippetsFinder, positioning it immediately after the current_user parameter. This prepares for organization_id to become a required parameter in the future.

The organization_id is obtained from Current.organization.id and passed consistently across all controllers that use SnippetsFinder.

This is MR 1 of 3 in a planned rollout:

MR 1: Web Controllers (4 files) - THIS MR

Priority: HIGH - User-facing changes

Files:

  • app/controllers/dashboard/snippets_controller.rb
  • app/controllers/explore/snippets_controller.rb
  • app/controllers/projects/snippets_controller.rb
  • app/controllers/users_controller.rb

Why first? Most visible to users, easiest to test manually.

MR 2: API & GraphQL (3 files)

Priority: HIGH - External integrations

Files:

  • lib/api/snippets.rb
  • lib/api/project_snippets.rb
  • app/graphql/resolvers/concerns/resolves_snippets.rb

Why second? API changes affect external integrations and need careful testing.

MR 3: Internal Services (4 files)

Priority: MEDIUM - Backend functionality

Files:

  • app/finders/notes_finder.rb
  • app/services/projects/autocomplete_service.rb
  • app/services/snippets/count_service.rb
  • lib/gitlab/snippet_search_results.rb

Why last? Internal services with less direct user impact.

Specs updated in this MR:

  • Explore::SnippetsController - added :with_current_organization
  • Projects::SnippetsController - added :with_current_organization

Question for reviewer: Should Dashboard::SnippetsController spec also get the :with_current_organization metadata? Tests pass without it, but it might be safer to add it for consistency.

References

Related to #570399

Screenshots or screen recordings

N/A - Backend changes only

How to set up and validate locally

  1. Ensure the Current.organization middleware is enabled (should be default)
  2. Run the updated specs to verify they pass:
   bundle exec rspec spec/controllers/dashboard/snippets_controller_spec.rb
   bundle exec rspec spec/controllers/explore/snippets_controller_spec.rb
   bundle exec rspec spec/controllers/projects/snippets_controller_spec.rb
  1. Verify that snippet pages load correctly in the UI:
    • Dashboard snippets: http://127.0.0.1:3000/dashboard/snippets
    • Explore snippets: http://127.0.0.1:3000/explore/snippets
    • Project snippets: http://127.0.0.1:3000/<project-path>/-/snippets
    • User snippets: http://127.0.0.1:3000/users/<username>/snippets

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Chen Zhang

Merge request reports