Add latest changes from gitlab-org/security/gitlab@13-3-stable-ee

2 files changed, 46 insertions, 0 deletions

diff --git a/spec/requests/api/graphql/mutations/snippets/destroy_spec.rb b/spec/requests/api/graphql/mutations/snippets/destroy_spec.rb
index 8ade72635af..c861564c66b 100644
--- a/spec/requests/api/graphql/mutations/snippets/destroy_spec.rb
+++ b/spec/requests/api/graphql/mutations/snippets/destroy_spec.rb
@@ -46,6 +46,31 @@ RSpec.describe 'Destroying a Snippet' do
         expect(mutation_response).to have_key('snippet')
         expect(mutation_response['snippet']).to be_nil
       end
+
+      context 'when a bad gid is given' do
+        let!(:project) { create(:project, :private) }
+        let!(:snippet) { create(:project_snippet, :private, project: project, author: create(:user)) }
+        let!(:snippet_gid) { project.to_gid.to_s }
+
+        it 'returns an error' do
+          post_graphql_mutation(mutation, current_user: current_user)
+
+          expect(graphql_errors)
+            .to include(a_hash_including('message' => "#{snippet_gid} is not a valid id for Snippet."))
+        end
+
+        it 'does not destroy the Snippet' do
+          expect do
+            post_graphql_mutation(mutation, current_user: current_user)
+          end.not_to change { Snippet.count }
+        end
+
+        it 'does not destroy the Project' do
+          expect do
+            post_graphql_mutation(mutation, current_user: current_user)
+          end.not_to change { Project.count }
+        end
+      end
     end
   end
 
diff --git a/spec/requests/api/helpers_spec.rb b/spec/requests/api/helpers_spec.rb
index fefa7105327..1fa705423d2 100644
--- a/spec/requests/api/helpers_spec.rb
+++ b/spec/requests/api/helpers_spec.rb
@@ -85,6 +85,27 @@ RSpec.describe API::Helpers do
           end
 
           it { is_expected.to eq(user) }
+
+          context 'when user should have 2fa enabled' do
+            before do
+              allow(user).to receive(:require_two_factor_authentication_from_group?).and_return(true)
+              allow_next_instance_of(Gitlab::Auth::TwoFactorAuthVerifier) do |verifier|
+                allow(verifier).to receive(:two_factor_grace_period_expired?).and_return(true)
+              end
+            end
+
+            context 'when 2fa is not enabled' do
+              it { is_expected.to be_nil }
+            end
+
+            context 'when 2fa is enabled' do
+              before do
+                allow(user).to receive(:two_factor_enabled?).and_return(true)
+              end
+
+              it { is_expected.to eq(user) }
+            end
+          end
         end
 
         context "PUT request" do