diff options
author | GitLab Bot <gitlab-bot@gitlab.com> | 2022-01-10 23:36:29 +0300 |
---|---|---|
committer | GitLab Bot <gitlab-bot@gitlab.com> | 2022-01-10 23:36:29 +0300 |
commit | 1eef146c2d1de19d4e995d421e5787053e50db80 (patch) | |
tree | 2761efabea712248557826977a849e31e3fdb961 /spec/support/shared_examples/controllers | |
parent | 661d663ab2b7c69977ba8a0db02ef4afc2427e39 (diff) |
Add latest changes from gitlab-org/security/gitlab@14-6-stable-ee
Diffstat (limited to 'spec/support/shared_examples/controllers')
-rw-r--r-- | spec/support/shared_examples/controllers/sessionless_auth_controller_shared_examples.rb | 112 |
1 files changed, 0 insertions, 112 deletions
diff --git a/spec/support/shared_examples/controllers/sessionless_auth_controller_shared_examples.rb b/spec/support/shared_examples/controllers/sessionless_auth_controller_shared_examples.rb deleted file mode 100644 index 041695d8111..00000000000 --- a/spec/support/shared_examples/controllers/sessionless_auth_controller_shared_examples.rb +++ /dev/null @@ -1,112 +0,0 @@ -# frozen_string_literal: true - -# This controller shared examples will be migrated to -# spec/support/shared_examples/requests/sessionless_auth_request_shared_examples.rb -# See also https://gitlab.com/groups/gitlab-org/-/epics/5076 - -RSpec.shared_examples 'authenticates sessionless user' do |path, format, params| - params ||= {} - - before do - stub_authentication_activity_metrics(debug: false) - end - - let(:user) { create(:user) } - let(:personal_access_token) { create(:personal_access_token, user: user) } - let(:default_params) { { format: format }.merge(params.except(:public) || {}) } - - context "when the 'personal_access_token' param is populated with the personal access token" do - it 'logs the user in' do - expect(authentication_metrics) - .to increment(:user_authenticated_counter) - .and increment(:user_session_override_counter) - .and increment(:user_sessionless_authentication_counter) - - get path, params: default_params.merge(private_token: personal_access_token.token) - - expect(response).to have_gitlab_http_status(:ok) - expect(controller.current_user).to eq(user) - end - - it 'does not log the user in if page is public', if: params[:public] do - get path, params: default_params - - expect(response).to have_gitlab_http_status(:ok) - expect(controller.current_user).to be_nil - end - end - - context 'when the personal access token has no api scope', unless: params[:public] do - it 'does not log the user in' do - # Several instances of where these specs are shared route the request - # through ApplicationController#route_not_found which does not involve - # the usual auth code from Devise, so does not increment the - # :user_unauthenticated_counter - # - unless params[:ignore_incrementing] - expect(authentication_metrics) - .to increment(:user_unauthenticated_counter) - end - - personal_access_token.update!(scopes: [:read_user]) - - get path, params: default_params.merge(private_token: personal_access_token.token) - - expect(response).not_to have_gitlab_http_status(:ok) - end - end - - context "when the 'PERSONAL_ACCESS_TOKEN' header is populated with the personal access token" do - it 'logs the user in' do - expect(authentication_metrics) - .to increment(:user_authenticated_counter) - .and increment(:user_session_override_counter) - .and increment(:user_sessionless_authentication_counter) - - @request.headers['PRIVATE-TOKEN'] = personal_access_token.token - get path, params: default_params - - expect(response).to have_gitlab_http_status(:ok) - end - end - - context "when the 'feed_token' param is populated with the feed token", if: format == :rss do - it "logs the user in" do - expect(authentication_metrics) - .to increment(:user_authenticated_counter) - .and increment(:user_session_override_counter) - .and increment(:user_sessionless_authentication_counter) - - get path, params: default_params.merge(feed_token: user.feed_token) - - expect(response).to have_gitlab_http_status(:ok) - end - end - - context "when the 'feed_token' param is populated with an invalid feed token", if: format == :rss, unless: params[:public] do - it "logs the user" do - expect(authentication_metrics) - .to increment(:user_unauthenticated_counter) - - get path, params: default_params.merge(feed_token: 'token') - - expect(response).not_to have_gitlab_http_status(:ok) - end - end - - it "doesn't log the user in otherwise", unless: params[:public] do - # Several instances of where these specs are shared route the request - # through ApplicationController#route_not_found which does not involve - # the usual auth code from Devise, so does not increment the - # :user_unauthenticated_counter - # - unless params[:ignore_incrementing] - expect(authentication_metrics) - .to increment(:user_unauthenticated_counter) - end - - get path, params: default_params.merge(private_token: 'token') - - expect(response).not_to have_gitlab_http_status(:ok) - end -end |