diff options
author | Horatiu Eugen Vlad <horatiu@vlad.eu> | 2019-04-15 16:05:55 +0300 |
---|---|---|
committer | James Lopez <james@gitlab.com> | 2019-04-15 16:05:55 +0300 |
commit | 0aa56d895dba21d3a01b78d35c445107e224ed0c (patch) | |
tree | f97e1d6d289af84b5838db149a9208ae0f70b267 /spec/requests | |
parent | 922fae29ca100e7f7f30fcb62541305994430779 (diff) |
Added write_repository scope for personal access token
Diffstat (limited to 'spec/requests')
-rw-r--r-- | spec/requests/git_http_spec.rb | 51 | ||||
-rw-r--r-- | spec/requests/jwt_controller_spec.rb | 2 | ||||
-rw-r--r-- | spec/requests/openid_connect_spec.rb | 2 |
3 files changed, 48 insertions, 7 deletions
diff --git a/spec/requests/git_http_spec.rb b/spec/requests/git_http_spec.rb index bfa178f5cae..5c9a5b73ee5 100644 --- a/spec/requests/git_http_spec.rb +++ b/spec/requests/git_http_spec.rb @@ -549,14 +549,14 @@ describe 'Git HTTP requests' do it 'rejects pulls with personal access token error message' do download(path, user: user.username, password: user.password) do |response| expect(response).to have_gitlab_http_status(:unauthorized) - expect(response.body).to include('You must use a personal access token with \'api\' scope for Git over HTTP') + expect(response.body).to include('You must use a personal access token with \'read_repository\' or \'write_repository\' scope for Git over HTTP') end end it 'rejects the push attempt with personal access token error message' do upload(path, user: user.username, password: user.password) do |response| expect(response).to have_gitlab_http_status(:unauthorized) - expect(response.body).to include('You must use a personal access token with \'api\' scope for Git over HTTP') + expect(response.body).to include('You must use a personal access token with \'read_repository\' or \'write_repository\' scope for Git over HTTP') end end end @@ -566,6 +566,47 @@ describe 'Git HTTP requests' do it_behaves_like 'pulls are allowed' it_behaves_like 'pushes are allowed' + + it 'rejects the push attempt for read_repository scope' do + read_access_token = create(:personal_access_token, user: user, scopes: [:read_repository]) + + upload(path, user: user.username, password: read_access_token.token) do |response| + expect(response).to have_gitlab_http_status(:forbidden) + expect(response.body).to include('You are not allowed to upload code') + end + end + + it 'accepts the push attempt for write_repository scope' do + write_access_token = create(:personal_access_token, user: user, scopes: [:write_repository]) + + upload(path, user: user.username, password: write_access_token.token) do |response| + expect(response).to have_gitlab_http_status(:ok) + end + end + + it 'accepts the pull attempt for read_repository scope' do + read_access_token = create(:personal_access_token, user: user, scopes: [:read_repository]) + + download(path, user: user.username, password: read_access_token.token) do |response| + expect(response).to have_gitlab_http_status(:ok) + end + end + + it 'accepts the pull attempt for api scope' do + read_access_token = create(:personal_access_token, user: user, scopes: [:api]) + + download(path, user: user.username, password: read_access_token.token) do |response| + expect(response).to have_gitlab_http_status(:ok) + end + end + + it 'accepts the push attempt for api scope' do + write_access_token = create(:personal_access_token, user: user, scopes: [:api]) + + upload(path, user: user.username, password: write_access_token.token) do |response| + expect(response).to have_gitlab_http_status(:ok) + end + end end end @@ -577,14 +618,14 @@ describe 'Git HTTP requests' do it 'rejects pulls with personal access token error message' do download(path, user: 'foo', password: 'bar') do |response| expect(response).to have_gitlab_http_status(:unauthorized) - expect(response.body).to include('You must use a personal access token with \'api\' scope for Git over HTTP') + expect(response.body).to include('You must use a personal access token with \'read_repository\' or \'write_repository\' scope for Git over HTTP') end end it 'rejects pushes with personal access token error message' do upload(path, user: 'foo', password: 'bar') do |response| expect(response).to have_gitlab_http_status(:unauthorized) - expect(response.body).to include('You must use a personal access token with \'api\' scope for Git over HTTP') + expect(response.body).to include('You must use a personal access token with \'read_repository\' or \'write_repository\' scope for Git over HTTP') end end @@ -598,7 +639,7 @@ describe 'Git HTTP requests' do it 'does not display the personal access token error message' do upload(path, user: 'foo', password: 'bar') do |response| expect(response).to have_gitlab_http_status(:unauthorized) - expect(response.body).not_to include('You must use a personal access token with \'api\' scope for Git over HTTP') + expect(response.body).not_to include('You must use a personal access token with \'read_repository\' or \'write_repository\' scope for Git over HTTP') end end end diff --git a/spec/requests/jwt_controller_spec.rb b/spec/requests/jwt_controller_spec.rb index 4bb3b848e17..bba473f1c20 100644 --- a/spec/requests/jwt_controller_spec.rb +++ b/spec/requests/jwt_controller_spec.rb @@ -142,7 +142,7 @@ describe JwtController do end it 'allows read access' do - expect(service).to receive(:execute).with(authentication_abilities: Gitlab::Auth.read_authentication_abilities) + expect(service).to receive(:execute).with(authentication_abilities: Gitlab::Auth.read_only_authentication_abilities) get '/jwt/auth', params: parameters end diff --git a/spec/requests/openid_connect_spec.rb b/spec/requests/openid_connect_spec.rb index 2a455523e2c..86e41cbdf00 100644 --- a/spec/requests/openid_connect_spec.rb +++ b/spec/requests/openid_connect_spec.rb @@ -187,7 +187,7 @@ describe 'OpenID Connect requests' do expect(response).to have_gitlab_http_status(200) expect(json_response['issuer']).to eq('http://localhost') expect(json_response['jwks_uri']).to eq('http://www.example.com/oauth/discovery/keys') - expect(json_response['scopes_supported']).to eq(%w[api read_user sudo read_repository openid profile email]) + expect(json_response['scopes_supported']).to eq(%w[api read_user read_repository write_repository sudo openid profile email]) end end |