Add latest changes from gitlab-org/gitlab@14-7-stable-eev14.7.0-rc42

4 files changed, 297 insertions, 3 deletions

diff --git a/spec/support/shared_examples/features/access_tokens_shared_examples.rb b/spec/support/shared_examples/features/access_tokens_shared_examples.rb
new file mode 100644
index 00000000000..ae246a87bb6
--- /dev/null
+++ b/spec/support/shared_examples/features/access_tokens_shared_examples.rb
@@ -0,0 +1,165 @@
+# frozen_string_literal: true
+
+RSpec.shared_examples 'resource access tokens missing access rights' do
+  it 'does not show access token page' do
+    visit resource_settings_access_tokens_path
+
+    expect(page).to have_content("Page Not Found")
+  end
+end
+
+RSpec.shared_examples 'resource access tokens creation' do |resource_type|
+  def active_resource_access_tokens
+    find('.table.active-tokens')
+  end
+
+  def created_resource_access_token
+    find('#created-personal-access-token').value
+  end
+
+  it 'allows creation of an access token', :aggregate_failures do
+    name = 'My access token'
+
+    visit resource_settings_access_tokens_path
+    fill_in 'Token name', with: name
+
+    # Set date to 1st of next month
+    find_field('Expiration date').click
+    find('.pika-next').click
+    click_on '1'
+
+    # Scopes
+    check 'api'
+    check 'read_api'
+
+    click_on "Create #{resource_type} access token"
+
+    expect(active_resource_access_tokens).to have_text(name)
+    expect(active_resource_access_tokens).to have_text('in')
+    expect(active_resource_access_tokens).to have_text('api')
+    expect(active_resource_access_tokens).to have_text('read_api')
+    expect(active_resource_access_tokens).to have_text('Maintainer')
+    expect(created_resource_access_token).not_to be_empty
+  end
+end
+
+RSpec.shared_examples 'resource access tokens creation disallowed' do |error_message|
+  before do
+    group.namespace_settings.update_column(:resource_access_token_creation_allowed, false)
+  end
+
+  it 'does not show access token creation form' do
+    visit resource_settings_access_tokens_path
+
+    expect(page).not_to have_selector('#new_resource_access_token')
+  end
+
+  it 'shows access token creation disabled text' do
+    visit resource_settings_access_tokens_path
+
+    expect(page).to have_text(error_message)
+  end
+
+  context 'group settings link' do
+    context 'when user is not a group owner' do
+      before do
+        group.add_developer(user)
+      end
+
+      it 'does not show group settings link' do
+        visit resource_settings_access_tokens_path
+
+        expect(page).not_to have_link('group settings', href: edit_group_path(group))
+      end
+    end
+
+    context 'with nested groups' do
+      let(:parent_group) { create(:group) }
+      let(:group) { create(:group, parent: parent_group) }
+
+      context 'when user is not a top level group owner' do
+        before do
+          group.add_owner(user)
+        end
+
+        it 'does not show group settings link' do
+          visit resource_settings_access_tokens_path
+
+          expect(page).not_to have_link('group settings', href: edit_group_path(group))
+        end
+      end
+    end
+
+    context 'when user is a group owner' do
+      before do
+        group.add_owner(user)
+      end
+
+      it 'shows group settings link' do
+        visit resource_settings_access_tokens_path
+
+        expect(page).to have_link('group settings', href: edit_group_path(group))
+      end
+    end
+  end
+end
+
+RSpec.shared_examples 'active resource access tokens' do
+  def active_resource_access_tokens
+    find('.table.active-tokens')
+  end
+
+  it 'shows active access tokens' do
+    visit resource_settings_access_tokens_path
+
+    expect(active_resource_access_tokens).to have_text(resource_access_token.name)
+  end
+
+  context 'when User#time_display_relative is false' do
+    before do
+      user.update!(time_display_relative: false)
+    end
+
+    it 'shows absolute times for expires_at' do
+      visit resource_settings_access_tokens_path
+
+      expect(active_resource_access_tokens).to have_text(PersonalAccessToken.last.expires_at.strftime('%b %-d'))
+    end
+  end
+end
+
+RSpec.shared_examples 'inactive resource access tokens' do |no_active_tokens_text|
+  def no_resource_access_tokens_message
+    find('.settings-message')
+  end
+
+  it 'allows revocation of an active token' do
+    visit resource_settings_access_tokens_path
+    accept_confirm { click_on 'Revoke' }
+
+    expect(page).to have_selector('.settings-message')
+    expect(no_resource_access_tokens_message).to have_text(no_active_tokens_text)
+  end
+
+  it 'removes expired tokens from active section' do
+    resource_access_token.update!(expires_at: 5.days.ago)
+    visit resource_settings_access_tokens_path
+
+    expect(page).to have_selector('.settings-message')
+    expect(no_resource_access_tokens_message).to have_text(no_active_tokens_text)
+  end
+
+  context 'when resource access token creation is not allowed' do
+    before do
+      group.namespace_settings.update_column(:resource_access_token_creation_allowed, false)
+    end
+
+    it 'allows revocation of an active token' do
+      visit resource_settings_access_tokens_path
+      accept_confirm { click_on 'Revoke' }
+
+      expect(page).to have_selector('.settings-message')
+      expect(no_resource_access_tokens_message).to have_text(no_active_tokens_text)
+    end
+  end
+end
diff --git a/spec/support/shared_examples/features/packages_shared_examples.rb b/spec/support/shared_examples/features/packages_shared_examples.rb
index d14b4638ca5..ded30f32314 100644
--- a/spec/support/shared_examples/features/packages_shared_examples.rb
+++ b/spec/support/shared_examples/features/packages_shared_examples.rb
@@ -19,14 +19,12 @@ RSpec.shared_examples 'packages list' do |check_project_name: false|
 end
 
 RSpec.shared_examples 'package details link' do |property|
-  let(:package) { packages.first }
-
   it 'navigates to the correct url' do
     page.within(packages_table_selector) do
       click_link package.name
     end
 
-    expect(page).to have_current_path(project_package_path(package.project, package))
+    expect(page).to have_current_path(package_details_path)
 
     expect(page).to have_css('.packages-app h2[data-testid="title"]', text: package.name)
 
diff --git a/spec/support/shared_examples/features/sidebar/sidebar_labels_shared_examples.rb b/spec/support/shared_examples/features/sidebar/sidebar_labels_shared_examples.rb
new file mode 100644
index 00000000000..a9dac7a391f
--- /dev/null
+++ b/spec/support/shared_examples/features/sidebar/sidebar_labels_shared_examples.rb
@@ -0,0 +1,127 @@
+# frozen_string_literal: true
+
+RSpec.shared_examples 'labels sidebar widget' do
+  context 'editing labels' do
+    let_it_be(:development) { create(:group_label, group: group, name: 'Development') }
+    let_it_be(:stretch)     { create(:label, project: project, name: 'Stretch') }
+    let_it_be(:xss_label) { create(:label, project: project, title: '<script>alert("xss");</script>') }
+
+    let(:labels_widget) { find('[data-testid="sidebar-labels"]') }
+
+    before do
+      page.within(labels_widget) do
+        click_on 'Edit'
+      end
+
+      wait_for_all_requests
+    end
+
+    it 'shows labels list in the dropdown' do
+      expect(labels_widget.find('.gl-new-dropdown-contents')).to have_selector('li.gl-new-dropdown-item', count: 4)
+    end
+
+    it 'adds a label' do
+      within(labels_widget) do
+        adds_label(stretch)
+
+        page.within('[data-testid="value-wrapper"]') do
+          expect(page).to have_content(stretch.name)
+        end
+      end
+    end
+
+    it 'removes a label' do
+      within(labels_widget) do
+        adds_label(stretch)
+        page.within('[data-testid="value-wrapper"]') do
+          expect(page).to have_content(stretch.name)
+        end
+
+        click_on 'Remove label'
+
+        wait_for_requests
+
+        page.within('[data-testid="value-wrapper"]') do
+          expect(page).not_to have_content(stretch.name)
+        end
+      end
+    end
+
+    it 'adds first label by pressing enter when search' do
+      within(labels_widget) do
+        page.within('[data-testid="value-wrapper"]') do
+          expect(page).not_to have_content(development.name)
+        end
+
+        fill_in 'Search', with: 'Devel'
+        sleep 1
+        expect(page.all(:css, '[data-testid="dropdown-content"] .gl-new-dropdown-item').length).to eq(1)
+
+        find_field('Search').native.send_keys(:enter)
+        click_button 'Close'
+        wait_for_requests
+
+        page.within('[data-testid="value-wrapper"]') do
+          expect(page).to have_content(development.name)
+        end
+      end
+    end
+
+    it 'escapes XSS when viewing issuable labels' do
+      page.within(labels_widget) do
+        expect(page).to have_content '<script>alert("xss");</script>'
+      end
+    end
+
+    it 'shows option to create a label' do
+      page.within(labels_widget) do
+        expect(page).to have_content 'Create'
+      end
+    end
+
+    context 'creating a label', :js do
+      before do
+        page.within(labels_widget) do
+          page.find('[data-testid="create-label-button"]').click
+        end
+      end
+
+      it 'shows dropdown switches to "create label" section' do
+        page.within(labels_widget) do
+          expect(page.find('[data-testid="dropdown-header"]')).to have_content 'Create'
+        end
+      end
+
+      it 'creates new label' do
+        page.within(labels_widget) do
+          fill_in 'Name new label', with: 'wontfix'
+          page.find('.suggest-colors a', match: :first).click
+          page.find('button', text: 'Create').click
+          wait_for_requests
+
+          expect(page).to have_content 'wontfix'
+        end
+      end
+
+      it 'shows error message if label title is taken' do
+        page.within(labels_widget) do
+          fill_in 'Name new label', with: development.title
+          page.find('.suggest-colors a', match: :first).click
+          page.find('button', text: 'Create').click
+          wait_for_requests
+
+          page.within('.dropdown-input') do
+            expect(page.find('.gl-alert')).to have_content 'Title'
+          end
+        end
+      end
+    end
+  end
+
+  def adds_label(label)
+    click_button label.name
+    click_button 'Close'
+
+    wait_for_requests
+  end
+end
diff --git a/spec/support/shared_examples/features/sidebar_shared_examples.rb b/spec/support/shared_examples/features/sidebar_shared_examples.rb
index 615f568420e..11d216ff4b6 100644
--- a/spec/support/shared_examples/features/sidebar_shared_examples.rb
+++ b/spec/support/shared_examples/features/sidebar_shared_examples.rb
@@ -50,6 +50,10 @@ RSpec.shared_examples 'issue boards sidebar' do
     it_behaves_like 'date sidebar widget'
   end
 
+  context 'editing issue labels', :js do
+    it_behaves_like 'labels sidebar widget'
+  end
+
   context 'in notifications subscription' do
     it 'displays notifications toggle', :aggregate_failures do
       page.within('[data-testid="sidebar-notifications"]') do