diff options
author | haseeb <haseebeqx@gmail.com> | 2017-09-18 20:29:17 +0300 |
---|---|---|
committer | Rémy Coutable <remy@rymai.me> | 2017-09-18 20:29:17 +0300 |
commit | ff4e81e0aec38c26e75d960c3d2af9329576ca32 (patch) | |
tree | 6903ef4fa30d5d467af3a9386423fcb7aeabb731 /spec/requests | |
parent | 8d568fe324dbf753e99e8f63df8f4cb1b484270d (diff) |
fix #35290 Make read-only API for public merge requests available without authentication
Diffstat (limited to 'spec/requests')
-rw-r--r-- | spec/requests/api/merge_requests_spec.rb | 37 |
1 files changed, 32 insertions, 5 deletions
diff --git a/spec/requests/api/merge_requests_spec.rb b/spec/requests/api/merge_requests_spec.rb index 21d2c9644fb..c4f6e97b915 100644 --- a/spec/requests/api/merge_requests_spec.rb +++ b/spec/requests/api/merge_requests_spec.rb @@ -28,10 +28,29 @@ describe API::MergeRequests do describe 'GET /merge_requests' do context 'when unauthenticated' do - it 'returns authentication error' do - get api('/merge_requests') + it 'returns an array of all merge requests' do + get api('/merge_requests', user), scope: 'all' + + expect(response).to have_http_status(200) + expect(json_response).to be_an Array + end + + it "returns authentication error without any scope" do + get api("/merge_requests") + + expect(response).to have_http_status(401) + end + + it "returns authentication error when scope is assigned-to-me" do + get api("/merge_requests"), scope: 'assigned-to-me' - expect(response).to have_gitlab_http_status(401) + expect(response).to have_http_status(401) + end + + it "returns authentication error when scope is created-by-me" do + get api("/merge_requests"), scope: 'created-by-me' + + expect(response).to have_http_status(401) end end @@ -134,10 +153,18 @@ describe API::MergeRequests do describe "GET /projects/:id/merge_requests" do context "when unauthenticated" do - it "returns authentication error" do + it 'returns merge requests for public projects' do + get api("/projects/#{project.id}/merge_requests") + + expect(response).to have_http_status(200) + expect(json_response).to be_an Array + end + + it "returns 404 for non public projects" do + project = create(:project, :private) get api("/projects/#{project.id}/merge_requests") - expect(response).to have_gitlab_http_status(401) + expect(response).to have_http_status(404) end end |