1 files changed, 20 insertions, 5 deletions
diff --git a/lib/api/helpers/notes_helpers.rb b/lib/api/helpers/notes_helpers.rb
index a068de4361c..6bf9057fad7 100644
--- a/lib/api/helpers/notes_helpers.rb
+++ b/lib/api/helpers/notes_helpers.rb
@@ -73,14 +73,29 @@ module API
         "read_#{noteable.class.to_s.underscore}".to_sym
       end
 
-      def find_noteable(parent, noteables_str, noteable_id)
-        noteable = public_send("find_#{parent}_#{noteables_str.singularize}", noteable_id) # rubocop:disable GitlabSecurity/PublicSend
+      def find_noteable(parent_type, parent_id, noteable_type, noteable_id)
+        params = finder_params_by_noteable_type_and_id(noteable_type, noteable_id, parent_id)
 
-        readable = can?(current_user, noteable_read_ability_name(noteable), noteable)
+        noteable = NotesFinder.new(current_user, params).target
+        noteable = nil unless can?(current_user, noteable_read_ability_name(noteable), noteable)
+        noteable || not_found!(noteable_type)
+      end
+
+      def finder_params_by_noteable_type_and_id(type, id, parent_id)
+        target_type = type.name.underscore
+        { target_type: target_type }.tap do |h|
+          if %w(issue merge_request).include?(target_type)
+            h[:target_iid] = id
+          else
+            h[:target_id] = id
+          end
 
-        return not_found!(noteables_str) unless readable
+          add_parent_to_finder_params(h, type, parent_id)
+        end
+      end
 
-        noteable
+      def add_parent_to_finder_params(finder_params, noteable_type, parent_id)
+        finder_params[:project] = user_project
       end
 
       def noteable_parent(noteable)