Add latest changes from gitlab-org/gitlab@master

1 files changed, 42 insertions, 0 deletions

diff --git a/spec/controllers/admin/sessions_controller_spec.rb b/spec/controllers/admin/sessions_controller_spec.rb
index fabd79133ec..351148dbc65 100644
--- a/spec/controllers/admin/sessions_controller_spec.rb
+++ b/spec/controllers/admin/sessions_controller_spec.rb
@@ -176,6 +176,48 @@ describe Admin::SessionsController, :do_not_mock_admin_mode do
             expect(controller.current_user_mode.admin_mode?).to be(true)
           end
         end
+
+        context 'on a read-only instance' do
+          before do
+            allow(Gitlab::Database).to receive(:read_only?).and_return(true)
+          end
+
+          it 'does not attempt to write to the database with valid otp' do
+            expect_any_instance_of(User).not_to receive(:save)
+            expect_any_instance_of(User).not_to receive(:save!)
+
+            controller.store_location_for(:redirect, admin_root_path)
+            controller.current_user_mode.request_admin_mode!
+
+            authenticate_2fa(otp_attempt: user.current_otp)
+
+            expect(response).to redirect_to admin_root_path
+          end
+
+          it 'does not attempt to write to the database with invalid otp' do
+            expect_any_instance_of(User).not_to receive(:save)
+            expect_any_instance_of(User).not_to receive(:save!)
+
+            controller.current_user_mode.request_admin_mode!
+
+            authenticate_2fa(otp_attempt: 'invalid')
+
+            expect(response).to render_template('admin/sessions/two_factor')
+            expect(controller.current_user_mode.admin_mode?).to be(false)
+          end
+
+          it 'does not attempt to write to the database with backup code' do
+            expect_any_instance_of(User).not_to receive(:save)
+            expect_any_instance_of(User).not_to receive(:save!)
+
+            controller.current_user_mode.request_admin_mode!
+
+            authenticate_2fa(otp_attempt: user.otp_backup_codes.first)
+
+            expect(response).to render_template('admin/sessions/two_factor')
+            expect(controller.current_user_mode.admin_mode?).to be(false)
+          end
+        end
       end
 
       context 'when using two-factor authentication via U2F' do