diff options
author | Vratislav Kalenda <v.kalenda@gmail.com> | 2017-10-08 21:36:45 +0300 |
---|---|---|
committer | Vratislav Kalenda <v.kalenda@gmail.com> | 2017-10-08 21:40:01 +0300 |
commit | 74d37438d5361fd4e77993dbc9590b20f7c32100 (patch) | |
tree | 3487de9aab0d82382491cbad38dbde8c4987130b /spec/services | |
parent | 91f1d652f5a0ab82784fed6d81501d03113d2cd7 (diff) |
Issue JWT token with registry:catalog:* scope when requested by GitLab admin
Diffstat (limited to 'spec/services')
-rw-r--r-- | spec/services/auth/container_registry_authentication_service_spec.rb | 45 |
1 files changed, 45 insertions, 0 deletions
diff --git a/spec/services/auth/container_registry_authentication_service_spec.rb b/spec/services/auth/container_registry_authentication_service_spec.rb index 1c2d0b3e0dc..6145f72df43 100644 --- a/spec/services/auth/container_registry_authentication_service_spec.rb +++ b/spec/services/auth/container_registry_authentication_service_spec.rb @@ -42,6 +42,19 @@ describe Auth::ContainerRegistryAuthenticationService do end end end + + shared_examples 'a browsable' do + let(:access) do + [{ 'type' => 'registry', + 'name' => 'catalog', + 'actions' => ['*'] + }] + end + + it_behaves_like 'a valid token' + it_behaves_like 'not a container repository factory' + it { expect(payload).to include('access' => access) } + end shared_examples 'an accessible' do let(:access) do @@ -117,6 +130,19 @@ describe Auth::ContainerRegistryAuthenticationService do context 'user authorization' do let(:current_user) { create(:user) } + context 'for registry catalog' do + let(:current_params) do + { scope: "registry:catalog:*" } + end + + context 'disallow browsing for users without Gitlab admin rights' do + it_behaves_like 'an inaccessible' + it_behaves_like 'not a container repository factory' + end + end + + + context 'for private project' do let(:project) { create(:project) } @@ -490,6 +516,16 @@ describe Auth::ContainerRegistryAuthenticationService do end end + context 'registry catalog browsing authorized as admin' do + let(:current_user) { create(:user, :admin) } + let(:current_params) do + { scope: "registry:catalog:*" } + end + + it_behaves_like 'a browsable' + + end + context 'unauthorized' do context 'disallow to use scope-less authentication' do it_behaves_like 'a forbidden' @@ -536,5 +572,14 @@ describe Auth::ContainerRegistryAuthenticationService do it_behaves_like 'not a container repository factory' end end + + context 'for registry catalog' do + let(:current_params) do + { scope: "registry:catalog:*" } + end + it_behaves_like 'a forbidden' + it_behaves_like 'not a container repository factory' + end + end end |