Add latest changes from gitlab-org/gitlab@master

4 files changed, 124 insertions, 4 deletions

diff --git a/spec/features/incidents/user_views_incident_spec.rb b/spec/features/incidents/user_views_incident_spec.rb
new file mode 100644
index 00000000000..9615abebfde
--- /dev/null
+++ b/spec/features/incidents/user_views_incident_spec.rb
@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+RSpec.describe "User views incident" do
+  let_it_be(:project) { create(:project_empty_repo, :public) }
+  let_it_be(:user) { create(:user) }
+  let_it_be(:incident) { create(:incident, project: project, description: "# Description header\n\n**Lorem** _ipsum_ dolor sit [amet](https://example.com)", author: user) }
+  let_it_be(:note) { create(:note, noteable: incident, project: project, author: user) }
+
+  before_all do
+    project.add_developer(user)
+  end
+
+  before do
+    sign_in(user)
+
+    visit(project_issues_incident_path(project, incident))
+  end
+
+  it { expect(page).to have_header_with_correct_id_and_link(1, "Description header", "description-header") }
+
+  it_behaves_like 'page meta description', ' Description header Lorem ipsum dolor sit amet'
+
+  it 'shows the merge request and incident actions', :aggregate_failures do
+    expect(page).to have_link('New incident')
+    expect(page).to have_button('Create merge request')
+    expect(page).to have_link('Close incident')
+  end
+
+  context 'when the project is archived' do
+    before do
+      project.update!(archived: true)
+      visit(project_issues_incident_path(project, incident))
+    end
+
+    it 'hides the merge request and incident actions', :aggregate_failures do
+      expect(page).not_to have_link('New incident')
+      expect(page).not_to have_button('Create merge request')
+      expect(page).not_to have_link('Close incident')
+    end
+  end
+
+  describe 'user status' do
+    subject { visit(project_issues_incident_path(project, incident)) }
+
+    context 'when showing status of the author of the incident' do
+      it_behaves_like 'showing user status' do
+        let(:user_with_status) { user }
+      end
+    end
+
+    context 'when showing status of a user who commented on an incident', :js do
+      it_behaves_like 'showing user status' do
+        let(:user_with_status) { user }
+      end
+    end
+
+    context 'when status message has an emoji', :js do
+      let_it_be(:message) { 'My status with an emoji' }
+      let_it_be(:message_emoji) { 'basketball' }
+      let_it_be(:status) { create(:user_status, user: user, emoji: 'smirk', message: "#{message} :#{message_emoji}:") }
+
+      it 'correctly renders the emoji' do
+        wait_for_requests
+
+        tooltip_span = page.first(".user-status-emoji[title^='#{message}']")
+        tooltip_span.hover
+
+        wait_for_requests
+
+        tooltip = page.find('.tooltip .tooltip-inner')
+
+        page.within(tooltip) do
+          expect(page).to have_emoji(message_emoji)
+        end
+      end
+    end
+  end
+end
diff --git a/spec/features/issues/user_interacts_with_awards_spec.rb b/spec/features/issues/user_interacts_with_awards_spec.rb
index 7db72f2cd05..bb9bce9eccf 100644
--- a/spec/features/issues/user_interacts_with_awards_spec.rb
+++ b/spec/features/issues/user_interacts_with_awards_spec.rb
@@ -68,7 +68,7 @@ RSpec.describe 'User interacts with awards' do
       page.within('.awards') do
         expect(page).to have_selector('.js-emoji-btn')
         expect(page.find('.js-emoji-btn.active .js-counter')).to have_content('1')
-        expect(page).to have_css(".js-emoji-btn.active[data-original-title='You']")
+        expect(page).to have_css(".js-emoji-btn.active[title='You']")
 
         expect do
           page.find('.js-emoji-btn.active').click
diff --git a/spec/features/search/user_uses_header_search_field_spec.rb b/spec/features/search/user_uses_header_search_field_spec.rb
index 5cbfacf4e48..c2d5b0acda6 100644
--- a/spec/features/search/user_uses_header_search_field_spec.rb
+++ b/spec/features/search/user_uses_header_search_field_spec.rb
@@ -34,7 +34,7 @@ RSpec.describe 'User uses header search field', :js do
         wait_for_all_requests
       end
 
-      it 'shows the category search dropdown' do
+      it 'shows the category search dropdown', quarantine: 'https://gitlab.com/gitlab-org/gitlab/-/issues/250285' do
         expect(page).to have_selector('.dropdown-header', text: /#{scope_name}/i)
       end
     end
@@ -44,7 +44,7 @@ RSpec.describe 'User uses header search field', :js do
         page.find('#search').click
       end
 
-      it 'shows category search dropdown' do
+      it 'shows category search dropdown', quarantine: 'https://gitlab.com/gitlab-org/gitlab/-/issues/250285' do
         expect(page).to have_selector('.dropdown-header', text: /#{scope_name}/i)
       end
 
@@ -104,7 +104,7 @@ RSpec.describe 'User uses header search field', :js do
       let(:scope_name) { 'All GitLab' }
     end
 
-    it 'displays search options' do
+    it 'displays search options', quarantine: 'https://gitlab.com/gitlab-org/gitlab/-/issues/251076' do
       fill_in_search('test')
 
       expect(page).to have_selector(scoped_search_link('test'))
diff --git a/spec/features/static_site_editor_spec.rb b/spec/features/static_site_editor_spec.rb
index 03085917d67..a47579582e2 100644
--- a/spec/features/static_site_editor_spec.rb
+++ b/spec/features/static_site_editor_spec.rb
@@ -73,4 +73,44 @@ RSpec.describe 'Static Site Editor' do
       expect(node['data-static-site-generator']).to eq('middleman')
     end
   end
+
+  describe 'Static Site Editor Content Security Policy' do
+    subject { response_headers['Content-Security-Policy'] }
+
+    context 'when no global CSP config exists' do
+      before do
+        expect_next_instance_of(Projects::StaticSiteEditorController) do |controller|
+          expect(controller).to receive(:current_content_security_policy)
+            .and_return(ActionDispatch::ContentSecurityPolicy.new)
+        end
+      end
+
+      it 'does not add CSP directives' do
+        visit sse_path
+
+        is_expected.to be_blank
+      end
+    end
+
+    context 'when a global CSP config exists' do
+      let_it_be(:cdn_url) { 'https://some-cdn.test' }
+      let_it_be(:youtube_url) { 'https://www.youtube.com' }
+
+      before do
+        csp = ActionDispatch::ContentSecurityPolicy.new do |p|
+          p.frame_src :self, cdn_url
+        end
+
+        expect_next_instance_of(Projects::StaticSiteEditorController) do |controller|
+          expect(controller).to receive(:current_content_security_policy).and_return(csp)
+        end
+      end
+
+      it 'appends youtube to the CSP frame-src policy' do
+        visit sse_path
+
+        is_expected.to eql("frame-src 'self' #{cdn_url} #{youtube_url}")
+      end
+    end
+  end
 end