Add latest changes from gitlab-org/gitlab@master

1 files changed, 61 insertions, 4 deletions

diff --git a/spec/requests/api/rubygem_packages_spec.rb b/spec/requests/api/rubygem_packages_spec.rb
index 75aa7954ca3..d6ad8186063 100644
--- a/spec/requests/api/rubygem_packages_spec.rb
+++ b/spec/requests/api/rubygem_packages_spec.rb
@@ -108,11 +108,68 @@ RSpec.describe API::RubygemPackages do
   end
 
   describe 'GET /api/v4/projects/:project_id/packages/rubygems/gems/:file_name' do
-    let(:url) { api("/projects/#{project.id}/packages/rubygems/gems/my_gem-1.0.0.gem") }
+    let_it_be(:package_name) { 'package' }
+    let_it_be(:version) { '0.0.1' }
+    let_it_be(:package) { create(:rubygems_package, project: project, name: package_name, version: version) }
+    let_it_be(:file_name) { "#{package_name}-#{version}.gem" }
+
+    let(:url) { api("/projects/#{project.id}/packages/rubygems/gems/#{file_name}") }
 
     subject { get(url, headers: headers) }
 
-    it_behaves_like 'an unimplemented route'
+    context 'with valid project' do
+      where(:visibility, :user_role, :member, :token_type, :valid_token, :shared_examples_name, :expected_status) do
+        :public  | :developer  | true  | :personal_access_token | true  | 'Rubygems gem download'            | :success
+        :public  | :guest      | true  | :personal_access_token | true  | 'Rubygems gem download'            | :success
+        :public  | :developer  | true  | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :guest      | true  | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :developer  | false | :personal_access_token | true  | 'Rubygems gem download'            | :success
+        :public  | :guest      | false | :personal_access_token | true  | 'Rubygems gem download'            | :success
+        :public  | :developer  | false | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :guest      | false | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :anonymous  | false | :personal_access_token | true  | 'Rubygems gem download'            | :success
+        :private | :developer  | true  | :personal_access_token | true  | 'Rubygems gem download'            | :success
+        :private | :guest      | true  | :personal_access_token | true  | 'rejects rubygems packages access' | :forbidden
+        :private | :developer  | true  | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :guest      | true  | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :developer  | false | :personal_access_token | true  | 'rejects rubygems packages access' | :not_found
+        :private | :guest      | false | :personal_access_token | true  | 'rejects rubygems packages access' | :not_found
+        :private | :developer  | false | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :guest      | false | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :anonymous  | false | :personal_access_token | true  | 'rejects rubygems packages access' | :not_found
+        :public  | :developer  | true  | :job_token             | true  | 'Rubygems gem download'            | :success
+        :public  | :guest      | true  | :job_token             | true  | 'Rubygems gem download'            | :success
+        :public  | :developer  | true  | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :guest      | true  | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :developer  | false | :job_token             | true  | 'Rubygems gem download'            | :success
+        :public  | :guest      | false | :job_token             | true  | 'Rubygems gem download'            | :success
+        :public  | :developer  | false | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :guest      | false | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :developer  | true  | :job_token             | true  | 'Rubygems gem download'            | :success
+        :private | :guest      | true  | :job_token             | true  | 'rejects rubygems packages access' | :forbidden
+        :private | :developer  | true  | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :guest      | true  | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :developer  | false | :job_token             | true  | 'rejects rubygems packages access' | :not_found
+        :private | :guest      | false | :job_token             | true  | 'rejects rubygems packages access' | :not_found
+        :private | :developer  | false | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :guest      | false | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :developer  | true  | :deploy_token          | true  | 'Rubygems gem download'            | :success
+        :public  | :developer  | true  | :deploy_token          | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :developer  | true  | :deploy_token          | true  | 'Rubygems gem download'            | :success
+        :private | :developer  | true  | :deploy_token          | false | 'rejects rubygems packages access' | :unauthorized
+      end
+
+      with_them do
+        let(:token) { valid_token ? tokens[token_type] : 'invalid-token123' }
+        let(:headers) { user_role == :anonymous ? {} : { 'HTTP_AUTHORIZATION' => token } }
+
+        before do
+          project.update_column(:visibility_level, Gitlab::VisibilityLevel.level_value(visibility.to_s))
+        end
+
+        it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
+      end
+    end
   end
 
   describe 'POST /api/v4/projects/:project_id/packages/rubygems/api/v1/gems/authorize' do
@@ -171,7 +228,7 @@ RSpec.describe API::RubygemPackages do
         let(:headers) { user_headers.merge(workhorse_headers) }
 
         before do
-          project.update!(visibility: visibility.to_s)
+          project.update_column(:visibility_level, Gitlab::VisibilityLevel.level_value(visibility.to_s))
         end
 
         it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
@@ -249,7 +306,7 @@ RSpec.describe API::RubygemPackages do
         let(:headers) { user_headers.merge(workhorse_headers) }
 
         before do
-          project.update!(visibility: visibility.to_s)
+          project.update_column(:visibility_level, Gitlab::VisibilityLevel.level_value(visibility.to_s))
         end
 
         it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]