merge master into issue_3359_3

9 files changed, 675 insertions, 21 deletions

diff --git a/spec/controllers/application_controller_spec.rb b/spec/controllers/application_controller_spec.rb
index 186239d3096..ff5b3916273 100644
--- a/spec/controllers/application_controller_spec.rb
+++ b/spec/controllers/application_controller_spec.rb
@@ -30,4 +30,75 @@ describe ApplicationController do
       controller.send(:check_password_expiration)
     end
   end
+
+  describe "#authenticate_user_from_token!" do
+    describe "authenticating a user from a private token" do
+      controller(ApplicationController) do
+        def index
+          render text: "authenticated"
+        end
+      end
+
+      let(:user) { create(:user) }
+
+      context "when the 'private_token' param is populated with the private token" do
+        it "logs the user in" do
+          get :index, private_token: user.private_token
+          expect(response.status).to eq(200)
+          expect(response.body).to eq("authenticated")
+        end
+      end
+
+
+      context "when the 'PRIVATE-TOKEN' header is populated with the private token" do
+        it "logs the user in" do
+          @request.headers['PRIVATE-TOKEN'] = user.private_token
+          get :index
+          expect(response.status).to eq(200)
+          expect(response.body).to eq("authenticated")
+        end
+      end
+
+      it "doesn't log the user in otherwise" do
+        @request.headers['PRIVATE-TOKEN'] = "token"
+        get :index, private_token: "token", authenticity_token: "token"
+        expect(response.status).not_to eq(200)
+        expect(response.body).not_to eq("authenticated")
+      end
+    end
+
+    describe "authenticating a user from a personal access token" do
+      controller(ApplicationController) do
+        def index
+          render text: 'authenticated'
+        end
+      end
+
+      let(:user) { create(:user) }
+      let(:personal_access_token) { create(:personal_access_token, user: user) }
+
+      context "when the 'personal_access_token' param is populated with the personal access token" do
+        it "logs the user in" do
+          get :index, private_token: personal_access_token.token
+          expect(response.status).to eq(200)
+          expect(response.body).to eq('authenticated')
+        end
+      end
+
+      context "when the 'PERSONAL_ACCESS_TOKEN' header is populated with the personal access token" do
+        it "logs the user in" do
+          @request.headers["PRIVATE-TOKEN"] = personal_access_token.token
+          get :index
+          expect(response.status).to eq(200)
+          expect(response.body).to eq('authenticated')
+        end
+      end
+
+      it "doesn't log the user in otherwise" do
+        get :index, private_token: "token"
+        expect(response.status).not_to eq(200)
+        expect(response.body).not_to eq('authenticated')
+      end
+    end
+  end
 end
diff --git a/spec/controllers/blob_controller_spec.rb b/spec/controllers/blob_controller_spec.rb
index eb91e577b87..465013231f9 100644
--- a/spec/controllers/blob_controller_spec.rb
+++ b/spec/controllers/blob_controller_spec.rb
@@ -38,6 +38,11 @@ describe Projects::BlobController do
       let(:id) { 'invalid-branch/README.md' }
       it { is_expected.to respond_with(:not_found) }
     end
+
+    context "binary file" do
+      let(:id) { 'binary-encoding/encoding/binary-1.bin' }
+      it { is_expected.to respond_with(:success) }
+    end
   end
 
   describe 'GET show with tree path' do
diff --git a/spec/controllers/groups/group_members_controller_spec.rb b/spec/controllers/groups/group_members_controller_spec.rb
index a5986598715..c8601341d54 100644
--- a/spec/controllers/groups/group_members_controller_spec.rb
+++ b/spec/controllers/groups/group_members_controller_spec.rb
@@ -4,17 +4,209 @@ describe Groups::GroupMembersController do
   let(:user)  { create(:user) }
   let(:group) { create(:group) }
 
-  context "index" do
+  describe '#index' do
     before do
       group.add_owner(user)
       stub_application_setting(restricted_visibility_levels: [Gitlab::VisibilityLevel::PUBLIC])
     end
 
     it 'renders index with group members' do
-      get :index, group_id: group.path
+      get :index, group_id: group
 
       expect(response.status).to eq(200)
       expect(response).to render_template(:index)
     end
   end
+
+  describe '#destroy' do
+    let(:group) { create(:group, :public) }
+
+    context 'when member is not found' do
+      it 'returns 403' do
+        delete :destroy, group_id: group,
+                         id: 42
+
+        expect(response.status).to eq(403)
+      end
+    end
+
+    context 'when member is found' do
+      let(:user) { create(:user) }
+      let(:group_user) { create(:user) }
+      let(:member) do
+        group.add_developer(group_user)
+        group.members.find_by(user_id: group_user)
+      end
+
+      context 'when user does not have enough rights' do
+        before do
+          group.add_developer(user)
+          sign_in(user)
+        end
+
+        it 'returns 403' do
+          delete :destroy, group_id: group,
+                           id: member
+
+          expect(response.status).to eq(403)
+          expect(group.users).to include group_user
+        end
+      end
+
+      context 'when user has enough rights' do
+        before do
+          group.add_owner(user)
+          sign_in(user)
+        end
+
+        it '[HTML] removes user from members' do
+          delete :destroy, group_id: group,
+                           id: member
+
+          expect(response).to set_flash.to 'User was successfully removed from group.'
+          expect(response).to redirect_to(group_group_members_path(group))
+          expect(group.users).not_to include group_user
+        end
+
+        it '[JS] removes user from members' do
+          xhr :delete, :destroy, group_id: group,
+                                 id: member
+
+          expect(response).to be_success
+          expect(group.users).not_to include group_user
+        end
+      end
+    end
+  end
+
+  describe '#leave' do
+    let(:group) { create(:group, :public) }
+    let(:user) { create(:user) }
+
+    context 'when member is not found' do
+      before { sign_in(user) }
+
+      it 'returns 403' do
+        delete :leave, group_id: group
+
+        expect(response.status).to eq(403)
+      end
+    end
+
+    context 'when member is found' do
+      context 'and is not an owner' do
+        before do
+          group.add_developer(user)
+          sign_in(user)
+        end
+
+        it 'removes user from members' do
+          delete :leave, group_id: group
+
+          expect(response).to set_flash.to "You left the \"#{group.name}\" group."
+          expect(response).to redirect_to(dashboard_groups_path)
+          expect(group.users).not_to include user
+        end
+      end
+
+      context 'and is an owner' do
+        before do
+          group.add_owner(user)
+          sign_in(user)
+        end
+
+        it 'cannot removes himself from the group' do
+          delete :leave, group_id: group
+
+          expect(response.status).to eq(403)
+        end
+      end
+
+      context 'and is a requester' do
+        before do
+          group.request_access(user)
+          sign_in(user)
+        end
+
+        it 'removes user from members' do
+          delete :leave, group_id: group
+
+          expect(response).to set_flash.to 'Your access request to the group has been withdrawn.'
+          expect(response).to redirect_to(group_path(group))
+          expect(group.members.request).to be_empty
+          expect(group.users).not_to include user
+        end
+      end
+    end
+  end
+
+  describe '#request_access' do
+    let(:group) { create(:group, :public) }
+    let(:user) { create(:user) }
+
+    before do
+      sign_in(user)
+    end
+
+    it 'creates a new GroupMember that is not a team member' do
+      post :request_access, group_id: group
+
+      expect(response).to set_flash.to 'Your request for access has been queued for review.'
+      expect(response).to redirect_to(group_path(group))
+      expect(group.members.request.exists?(user_id: user)).to be_truthy
+      expect(group.users).not_to include user
+    end
+  end
+
+  describe '#approve_access_request' do
+    let(:group) { create(:group, :public) }
+
+    context 'when member is not found' do
+      it 'returns 403' do
+        post :approve_access_request, group_id: group,
+                                      id: 42
+
+        expect(response.status).to eq(403)
+      end
+    end
+
+    context 'when member is found' do
+      let(:user) { create(:user) }
+      let(:group_requester) { create(:user) }
+      let(:member) do
+        group.request_access(group_requester)
+        group.members.request.find_by(user_id: group_requester)
+      end
+
+      context 'when user does not have enough rights' do
+        before do
+          group.add_developer(user)
+          sign_in(user)
+        end
+
+        it 'returns 403' do
+          post :approve_access_request, group_id: group,
+                                        id: member
+
+          expect(response.status).to eq(403)
+          expect(group.users).not_to include group_requester
+        end
+      end
+
+      context 'when user has enough rights' do
+        before do
+          group.add_owner(user)
+          sign_in(user)
+        end
+
+        it 'adds user to members' do
+          post :approve_access_request, group_id: group,
+                                        id: member
+
+          expect(response).to redirect_to(group_group_members_path(group))
+          expect(group.users).to include group_requester
+        end
+      end
+    end
+  end
 end
diff --git a/spec/controllers/profiles/accounts_controller_spec.rb b/spec/controllers/profiles/accounts_controller_spec.rb
new file mode 100644
index 00000000000..4eafc11abaa
--- /dev/null
+++ b/spec/controllers/profiles/accounts_controller_spec.rb
@@ -0,0 +1,26 @@
+require 'spec_helper'
+
+describe Profiles::AccountsController do
+
+  let(:user) { create(:omniauth_user, provider: 'saml') }
+
+  before do
+    sign_in(user)
+  end
+
+  it 'does not allow to unlink SAML connected account' do
+    identity = user.identities.last
+    delete :unlink, provider: 'saml'
+    updated_user = User.find(user.id)
+
+    expect(response.status).to eq(302)
+    expect(updated_user.identities.size).to eq(1)
+    expect(updated_user.identities).to include(identity)
+  end
+
+  it 'does allow to delete other linked accounts' do
+    user.identities.create(provider: 'twitter', extern_uid: 'twitter_123')
+
+    expect { delete :unlink, provider: 'twitter' }.to change(Identity.all, :size).by(-1)
+  end
+end
diff --git a/spec/controllers/projects/commit_controller_spec.rb b/spec/controllers/projects/commit_controller_spec.rb
index 438e776ec4b..6e3db10e451 100644
--- a/spec/controllers/projects/commit_controller_spec.rb
+++ b/spec/controllers/projects/commit_controller_spec.rb
@@ -2,6 +2,8 @@ require 'rails_helper'
 
 describe Projects::CommitController do
   describe 'GET show' do
+    render_views
+
     let(:project) { create(:project) }
 
     before do
@@ -27,6 +29,16 @@ describe Projects::CommitController do
       end
     end
 
+    it 'handles binary files' do
+      get(:show,
+          namespace_id: project.namespace.to_param,
+          project_id: project.to_param,
+          id: TestEnv::BRANCH_SHA['binary-encoding'],
+          format: "html")
+
+      expect(response).to be_success
+    end
+
     def go(id:)
       get :show,
         namespace_id: project.namespace.to_param,
diff --git a/spec/controllers/projects/issues_controller_spec.rb b/spec/controllers/projects/issues_controller_spec.rb
index 78be7e3dc35..cbaa3e0b7b2 100644
--- a/spec/controllers/projects/issues_controller_spec.rb
+++ b/spec/controllers/projects/issues_controller_spec.rb
@@ -105,6 +105,15 @@ describe Projects::IssuesController do
         expect(assigns(:issues)).to eq [issue]
       end
 
+      it 'should not list confidential issues for project members with guest role' do
+        sign_in(member)
+        project.team << [member, :guest]
+
+        get_issues
+
+        expect(assigns(:issues)).to eq [issue]
+      end
+
       it 'should list confidential issues for author' do
         sign_in(author)
         get_issues
@@ -148,7 +157,7 @@ describe Projects::IssuesController do
 
     shared_examples_for 'restricted action' do |http_status|
       it 'returns 404 for guests' do
-        sign_out :user
+        sign_out(:user)
         go(id: unescaped_parameter_value.to_param)
 
         expect(response).to have_http_status :not_found
@@ -161,6 +170,14 @@ describe Projects::IssuesController do
         expect(response).to have_http_status :not_found
       end
 
+      it 'returns 404 for project members with guest role' do
+        sign_in(member)
+        project.team << [member, :guest]
+        go(id: unescaped_parameter_value.to_param)
+
+        expect(response).to have_http_status :not_found
+      end
+
       it "returns #{http_status[:success]} for author" do
         sign_in(author)
         go(id: unescaped_parameter_value.to_param)
diff --git a/spec/controllers/projects/project_members_controller_spec.rb b/spec/controllers/projects/project_members_controller_spec.rb
index 750fbecdd07..e5e750c855f 100644
--- a/spec/controllers/projects/project_members_controller_spec.rb
+++ b/spec/controllers/projects/project_members_controller_spec.rb
@@ -1,22 +1,22 @@
 require('spec_helper')
 
 describe Projects::ProjectMembersController do
-  let(:project) { create(:project) }
-  let(:another_project) { create(:project, :private) }
-  let(:user) { create(:user) }
-  let(:member) { create(:user) }
-
-  before do
-    project.team << [user, :master]
-    another_project.team << [member, :guest]
-    sign_in(user)
-  end
-
   describe '#apply_import' do
+    let(:project) { create(:project) }
+    let(:another_project) { create(:project, :private) }
+    let(:user) { create(:user) }
+    let(:member) { create(:user) }
+
+    before do
+      project.team << [user, :master]
+      another_project.team << [member, :guest]
+      sign_in(user)
+    end
+
     shared_context 'import applied' do
       before do
-        post(:apply_import, namespace_id: project.namespace.to_param,
-                            project_id: project.to_param,
+        post(:apply_import, namespace_id: project.namespace,
+                            project_id: project,
                             source_project_id: another_project.id)
       end
     end
@@ -48,18 +48,227 @@ describe Projects::ProjectMembersController do
   end
 
   describe '#index' do
-    let(:project) { create(:project, :private) }
-
     context 'when user is member' do
-      let(:member) { create(:user) }
-
       before do
+        project = create(:project, :private)
+        member = create(:user)
         project.team << [member, :guest]
         sign_in(member)
-        get :index, namespace_id: project.namespace.to_param, project_id: project.to_param
+
+        get :index, namespace_id: project.namespace, project_id: project
       end
 
       it { expect(response.status).to eq(200) }
     end
   end
+
+  describe '#destroy' do
+    let(:project) { create(:project, :public) }
+
+    context 'when member is not found' do
+      it 'returns 404' do
+        delete :destroy, namespace_id: project.namespace,
+                         project_id: project,
+                         id: 42
+
+        expect(response.status).to eq(404)
+      end
+    end
+
+    context 'when member is found' do
+      let(:user) { create(:user) }
+      let(:team_user) { create(:user) }
+      let(:member) do
+        project.team << [team_user, :developer]
+        project.members.find_by(user_id: team_user.id)
+      end
+
+      context 'when user does not have enough rights' do
+        before do
+          project.team << [user, :developer]
+          sign_in(user)
+        end
+
+        it 'returns 404' do
+          delete :destroy, namespace_id: project.namespace,
+                           project_id: project,
+                           id: member
+
+          expect(response.status).to eq(404)
+          expect(project.users).to include team_user
+        end
+      end
+
+      context 'when user has enough rights' do
+        before do
+          project.team << [user, :master]
+          sign_in(user)
+        end
+
+        it '[HTML] removes user from members' do
+          delete :destroy, namespace_id: project.namespace,
+                           project_id: project,
+                           id: member
+
+          expect(response).to redirect_to(
+            namespace_project_project_members_path(project.namespace, project)
+          )
+          expect(project.users).not_to include team_user
+        end
+
+        it '[JS] removes user from members' do
+          xhr :delete, :destroy, namespace_id: project.namespace,
+                                 project_id: project,
+                                 id: member
+
+          expect(response).to be_success
+          expect(project.users).not_to include team_user
+        end
+      end
+    end
+  end
+
+  describe '#leave' do
+    let(:project) { create(:project, :public) }
+    let(:user) { create(:user) }
+
+    context 'when member is not found' do
+      before { sign_in(user) }
+
+      it 'returns 403' do
+        delete :leave, namespace_id: project.namespace,
+                       project_id: project
+
+        expect(response.status).to eq(403)
+      end
+    end
+
+    context 'when member is found' do
+      context 'and is not an owner' do
+        before do
+          project.team << [user, :developer]
+          sign_in(user)
+        end
+
+        it 'removes user from members' do
+          delete :leave, namespace_id: project.namespace,
+                         project_id: project
+
+          expect(response).to set_flash.to "You left the \"#{project.human_name}\" project."
+          expect(response).to redirect_to(dashboard_projects_path)
+          expect(project.users).not_to include user
+        end
+      end
+
+      context 'and is an owner' do
+        before do
+          project.update(namespace_id: user.namespace_id)
+          project.team << [user, :master, user]
+          sign_in(user)
+        end
+
+        it 'cannot remove himself from the project' do
+          delete :leave, namespace_id: project.namespace,
+                         project_id: project
+
+          expect(response.status).to eq(403)
+        end
+      end
+
+      context 'and is a requester' do
+        before do
+          project.request_access(user)
+          sign_in(user)
+        end
+
+        it 'removes user from members' do
+          delete :leave, namespace_id: project.namespace,
+                         project_id: project
+
+          expect(response).to set_flash.to 'Your access request to the project has been withdrawn.'
+          expect(response).to redirect_to(namespace_project_path(project.namespace, project))
+          expect(project.members.request).to be_empty
+          expect(project.users).not_to include user
+        end
+      end
+    end
+  end
+
+  describe '#request_access' do
+    let(:project) { create(:project, :public) }
+    let(:user) { create(:user) }
+
+    before do
+      sign_in(user)
+    end
+
+    it 'creates a new ProjectMember that is not a team member' do
+      post :request_access, namespace_id: project.namespace,
+                            project_id: project
+
+      expect(response).to set_flash.to 'Your request for access has been queued for review.'
+      expect(response).to redirect_to(
+        namespace_project_path(project.namespace, project)
+      )
+      expect(project.members.request.exists?(user_id: user)).to be_truthy
+      expect(project.users).not_to include user
+    end
+  end
+
+  describe '#approve' do
+    let(:project) { create(:project, :public) }
+
+    context 'when member is not found' do
+      it 'returns 404' do
+        post :approve_access_request, namespace_id: project.namespace,
+                                      project_id: project,
+                                      id: 42
+
+        expect(response.status).to eq(404)
+      end
+    end
+
+    context 'when member is found' do
+      let(:user) { create(:user) }
+      let(:team_requester) { create(:user) }
+      let(:member) do
+        project.request_access(team_requester)
+        project.members.request.find_by(user_id: team_requester.id)
+      end
+
+      context 'when user does not have enough rights' do
+        before do
+          project.team << [user, :developer]
+          sign_in(user)
+        end
+
+        it 'returns 404' do
+          post :approve_access_request, namespace_id: project.namespace,
+                                        project_id: project,
+                                        id: member
+
+          expect(response.status).to eq(404)
+          expect(project.users).not_to include team_requester
+        end
+      end
+
+      context 'when user has enough rights' do
+        before do
+          project.team << [user, :master]
+          sign_in(user)
+        end
+
+        it 'adds user to members' do
+          post :approve_access_request, namespace_id: project.namespace,
+                                        project_id: project,
+                                        id: member
+
+          expect(response).to redirect_to(
+            namespace_project_project_members_path(project.namespace, project)
+          )
+          expect(project.users).to include team_requester
+        end
+      end
+    end
+  end
 end
diff --git a/spec/controllers/projects/todo_controller_spec.rb b/spec/controllers/projects/todo_controller_spec.rb
new file mode 100644
index 00000000000..40a3403b660
--- /dev/null
+++ b/spec/controllers/projects/todo_controller_spec.rb
@@ -0,0 +1,102 @@
+require('spec_helper')
+
+describe Projects::TodosController do
+  let(:user)          { create(:user) }
+  let(:project)       { create(:project) }
+  let(:issue)         { create(:issue, project: project) }
+  let(:merge_request) { create(:merge_request, source_project: project) }
+
+  context 'Issues' do
+    describe 'POST create' do
+      context 'when authorized' do
+        before do
+          sign_in(user)
+          project.team << [user, :developer]
+        end
+
+        it 'should create todo for issue' do
+          expect do
+            post(:create, namespace_id: project.namespace.path,
+                          project_id: project.path,
+                          issuable_id: issue.id,
+                          issuable_type: 'issue')
+          end.to change { user.todos.count }.by(1)
+
+          expect(response.status).to eq(200)
+        end
+      end
+
+      context 'when not authorized' do
+        it 'should not create todo for issue that user has no access to' do
+          sign_in(user)
+          expect do
+            post(:create, namespace_id: project.namespace.path,
+                          project_id: project.path,
+                          issuable_id: issue.id,
+                          issuable_type: 'issue')
+          end.to change { user.todos.count }.by(0)
+
+          expect(response.status).to eq(404)
+        end
+
+        it 'should not create todo for issue when user not logged in' do
+          expect do
+            post(:create, namespace_id: project.namespace.path,
+                          project_id: project.path,
+                          issuable_id: issue.id,
+                          issuable_type: 'issue')
+          end.to change { user.todos.count }.by(0)
+
+          expect(response.status).to eq(302)
+        end
+      end
+    end
+  end
+
+  context 'Merge Requests' do
+    describe 'POST create' do
+      context 'when authorized' do
+        before do
+          sign_in(user)
+          project.team << [user, :developer]
+        end
+
+        it 'should create todo for merge request' do
+          expect do
+            post(:create, namespace_id: project.namespace.path,
+                          project_id: project.path,
+                          issuable_id: merge_request.id,
+                          issuable_type: 'merge_request')
+          end.to change { user.todos.count }.by(1)
+
+          expect(response.status).to eq(200)
+        end
+      end
+
+      context 'when not authorized' do
+        it 'should not create todo for merge request user has no access to' do
+          sign_in(user)
+          expect do
+            post(:create, namespace_id: project.namespace.path,
+                          project_id: project.path,
+                          issuable_id: merge_request.id,
+                          issuable_type: 'merge_request')
+          end.to change { user.todos.count }.by(0)
+
+          expect(response.status).to eq(404)
+        end
+
+        it 'should not create todo for merge request user has no access to' do
+          expect do
+            post(:create, namespace_id: project.namespace.path,
+                          project_id: project.path,
+                          issuable_id: merge_request.id,
+                          issuable_type: 'merge_request')
+          end.to change { user.todos.count }.by(0)
+
+          expect(response.status).to eq(302)
+        end
+      end
+    end
+  end
+end
diff --git a/spec/controllers/projects_controller_spec.rb b/spec/controllers/projects_controller_spec.rb
index fba545560c7..146b2c2e131 100644
--- a/spec/controllers/projects_controller_spec.rb
+++ b/spec/controllers/projects_controller_spec.rb
@@ -237,4 +237,24 @@ describe ProjectsController do
       expect(response.status).to eq(401)
     end
   end
+
+  describe "GET refs" do
+    it "should get a list of branches and tags" do
+      get :refs, namespace_id: public_project.namespace.path, id: public_project.path
+
+      parsed_body = JSON.parse(response.body)
+      expect(parsed_body["Branches"]).to include("master")
+      expect(parsed_body["Tags"]).to include("v1.0.0")
+      expect(parsed_body["Commits"]).to be_nil
+    end
+
+    it "should get a list of branches, tags and commits" do
+      get :refs, namespace_id: public_project.namespace.path, id: public_project.path, ref: "123456"
+
+      parsed_body = JSON.parse(response.body)
+      expect(parsed_body["Branches"]).to include("master")
+      expect(parsed_body["Tags"]).to include("v1.0.0")
+      expect(parsed_body["Commits"]).to include("123456")
+    end
+  end
 end