Add latest changes from gitlab-org/gitlab@master

2 files changed, 60 insertions, 0 deletions

diff --git a/spec/policies/project_hook_policy_spec.rb b/spec/policies/project_hook_policy_spec.rb
new file mode 100644
index 00000000000..cfa7b6ee4bf
--- /dev/null
+++ b/spec/policies/project_hook_policy_spec.rb
@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe ProjectHookPolicy do
+  let_it_be(:user) { create(:user) }
+
+  let(:hook) { create(:project_hook) }
+
+  subject(:policy) { described_class.new(user, hook) }
+
+  context 'when the user is not a maintainer' do
+    before do
+      hook.project.add_developer(user)
+    end
+
+    it "cannot read and destroy web-hooks" do
+      expect(policy).to be_disallowed(:read_web_hook, :destroy_web_hook)
+    end
+  end
+
+  context 'when the user is a maintainer' do
+    before do
+      hook.project.add_maintainer(user)
+    end
+
+    it "can read and destroy web-hooks" do
+      expect(policy).to be_allowed(:read_web_hook, :destroy_web_hook)
+    end
+  end
+end
diff --git a/spec/policies/system_hook_policy_spec.rb b/spec/policies/system_hook_policy_spec.rb
new file mode 100644
index 00000000000..37f97a8a3d1
--- /dev/null
+++ b/spec/policies/system_hook_policy_spec.rb
@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe SystemHookPolicy do
+  let(:hook) { create(:system_hook) }
+
+  subject(:policy) { described_class.new(user, hook) }
+
+  context 'when the user is not an admin' do
+    let(:user) { create(:user) }
+
+    %i[read_web_hook destroy_web_hook].each do |thing|
+      it "cannot #{thing}" do
+        expect(policy).to be_disallowed(thing)
+      end
+    end
+  end
+
+  context 'when the user is an admin', :enable_admin_mode do
+    let(:user) { create(:admin) }
+
+    %i[read_web_hook destroy_web_hook].each do |thing|
+      it "can #{thing}" do
+        expect(policy).to be_allowed(thing)
+      end
+    end
+  end
+end