diff options
author | James Lopez <james@jameslopez.es> | 2018-12-04 13:55:34 +0300 |
---|---|---|
committer | James Lopez <james@jameslopez.es> | 2018-12-04 13:55:34 +0300 |
commit | 1c34a2a01497f9db4602794b1aa37ae54dcee740 (patch) | |
tree | f61e0629f087c844b8a2b9ab7df4cc5f8672c115 /spec/requests | |
parent | 403430968cf2a98a88d0c454501d883d6508e7e0 (diff) |
Use read_repository scope on read-only files API
Diffstat (limited to 'spec/requests')
-rw-r--r-- | spec/requests/api/files_spec.rb | 29 |
1 files changed, 29 insertions, 0 deletions
diff --git a/spec/requests/api/files_spec.rb b/spec/requests/api/files_spec.rb index 334dbb1c34c..280950b0577 100644 --- a/spec/requests/api/files_spec.rb +++ b/spec/requests/api/files_spec.rb @@ -121,6 +121,13 @@ describe API::Files do end end + context 'when PATs are used' do + it_behaves_like 'repository files' do + let(:token) { create(:personal_access_token, scopes: ['read_repository'], user: user) } + let(:current_user) { { personal_access_token: token } } + end + end + context 'when authenticated', 'as a developer' do it_behaves_like 'repository files' do let(:current_user) { user } @@ -217,6 +224,13 @@ describe API::Files do end end + context 'when PATs are used' do + it_behaves_like 'repository files' do + let(:token) { create(:personal_access_token, scopes: ['read_repository'], user: user) } + let(:current_user) { { personal_access_token: token } } + end + end + context 'when unauthenticated', 'and project is private' do it_behaves_like '404 response' do let(:request) { get api(route(file_path)), params } @@ -317,6 +331,21 @@ describe API::Files do let(:request) { get api(route(file_path), guest), params } end end + + context 'when PATs are used' do + it 'returns file by commit sha' do + token = create(:personal_access_token, scopes: ['read_repository'], user: user) + + # This file is deleted on HEAD + file_path = "files%2Fjs%2Fcommit%2Ejs%2Ecoffee" + params[:ref] = "6f6d7e7ed97bb5f0054f2b1df789b39ca89b6ff9" + expect(Gitlab::Workhorse).to receive(:send_git_blob) + + get api(route(file_path) + "/raw", personal_access_token: token), params + + expect(response).to have_gitlab_http_status(200) + end + end end describe "POST /projects/:id/repository/files/:file_path" do |