Scope system hooks REST API by organization

Carla Dragorequested to merge
632591-scope-system-hooks-api-by-organization into master

What does this MR do and why?

Scopes the system hooks REST API (lib/api/system_hooks.rb) to the current organization.

  • GET /hooks lists only the current organization's hooks.
  • hook_scope is now Current.organization.system_hooks, so find_hook only finds hooks in the current organization. This covers show, update, delete, test, and the URL variables and custom headers endpoints.
  • A hook in another organization returns 404 Not Found.

Create was already scoped and is unchanged. On a single-organization instance, behavior does not change.

Details
  • The mounted Test, UrlVariables and CustomHeaders endpoints call find_hook, so they need no edits.
  • web_hooks is skipped by data isolation (it has multiple sharding keys), so the scope is explicit rather than automatic.
  • spec/requests/api/system_hooks_spec.rb now runs with :with_current_organization and creates the shared hook in that organization. A new organization scoping block covers each endpoint against a hook in another organization.
  • This mirrors the existing Admin::HooksController, which already uses admin_current_organization.system_hooks.

References

How to set up and validate locally

bundle exec rspec spec/requests/api/system_hooks_spec.rb spec/requests/api/project_hooks_spec.rb
MR acceptance checklist
- Tests added for the change
- Docs: none needed, no documentation change in this MR
Evaluate this MR against the [MR acceptance checklist](https://docs.gitlab.com/development/code_review/#acceptance-checklist).
It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

/assign me


Related to #632591

Merge request reports