Fix runners filtering in API

2 files changed, 27 insertions, 20 deletions

diff --git a/lib/api/runners.rb b/lib/api/runners.rb
index b7294258c7d..799c10a1897 100644
--- a/lib/api/runners.rb
+++ b/lib/api/runners.rb
@@ -121,11 +121,11 @@ module API
         return runners unless scope.present?
 
         available_scopes = ::Ci::Runner::AVAILABLE_SCOPES
-        unless (available_scopes && scope).empty?
-          runners.send(scope)
-        else
+        if (available_scopes & [scope]).empty?
           render_api_error!('Scope contains invalid value', 400)
         end
+
+        runners.send(scope)
       end
 
       def get_runner(id)
diff --git a/spec/requests/api/runners_spec.rb b/spec/requests/api/runners_spec.rb
index 9ffa59dac07..d600b2312c5 100644
--- a/spec/requests/api/runners_spec.rb
+++ b/spec/requests/api/runners_spec.rb
@@ -22,35 +22,42 @@ describe API::API, api: true  do
   let!(:two_projects_runner_project2) { create(:ci_runner_project, runner: two_projects_runner, project: project2) }
 
   describe 'GET /runners' do
-    context 'authorized user with admin privileges' do
-      it 'should return all runners' do
-        get api('/runners', admin)
-        shared = false || json_response.map{ |r| r['is_shared'] }.inject{ |sum, shr| sum || shr}
+    context 'authorized user' do
+      context 'authorized user with admin privileges' do
+        it 'should return all runners' do
+          get api('/runners', admin)
+          shared = false || json_response.map{ |r| r['is_shared'] }.inject{ |sum, shr| sum || shr}
 
-        expect(response.status).to eq(200)
-        expect(json_response).to be_an Array
-        expect(shared).to be_truthy
+          expect(response.status).to eq(200)
+          expect(json_response).to be_an Array
+          expect(shared).to be_truthy
+        end
       end
 
-      it 'should filter runners by scope' do
-        get api('/runners?scope=specific', admin)
-        shared = false || json_response.map{ |r| r['is_shared'] }.inject{ |sum, shr| sum || shr}
+      context 'authorized user without admin privileges' do
+        it 'should return user available runners' do
+          get api('/runners', user)
+          shared = false || json_response.map{ |r| r['is_shared'] }.inject{ |sum, shr| sum || shr}
 
-        expect(response.status).to eq(200)
-        expect(json_response).to be_an Array
-        expect(shared).to be_falsey
+          expect(response.status).to eq(200)
+          expect(json_response).to be_an Array
+          expect(shared).to be_falsey
+        end
       end
-    end
 
-    context 'authorized user without admin privileges' do
-      it 'should return user available runners' do
-        get api('/runners', user)
+      it 'should filter runners by scope' do
+        get api('/runners?scope=specific', user)
         shared = false || json_response.map{ |r| r['is_shared'] }.inject{ |sum, shr| sum || shr}
 
         expect(response.status).to eq(200)
         expect(json_response).to be_an Array
         expect(shared).to be_falsey
       end
+
+      it 'should avoid filtering if scope is invalid' do
+        get api('/runners?scope=unknown', user)
+        expect(response.status).to eq(400)
+      end
     end
 
     context 'unauthorized user' do