Merge branch 'master' into build-chunks-on-object-storage

10 files changed, 152 insertions, 30 deletions

diff --git a/spec/support/helpers/exclusive_lease_helpers.rb b/spec/support/helpers/exclusive_lease_helpers.rb
new file mode 100644
index 00000000000..383cc7dee81
--- /dev/null
+++ b/spec/support/helpers/exclusive_lease_helpers.rb
@@ -0,0 +1,36 @@
+module ExclusiveLeaseHelpers
+  def stub_exclusive_lease(key = nil, uuid = 'uuid', renew: false, timeout: nil)
+    key     ||= instance_of(String)
+    timeout ||= instance_of(Integer)
+
+    lease = instance_double(
+      Gitlab::ExclusiveLease,
+      try_obtain: uuid,
+      exists?: true,
+      renew: renew
+    )
+
+    allow(Gitlab::ExclusiveLease)
+      .to receive(:new)
+      .with(key, timeout: timeout)
+      .and_return(lease)
+
+    lease
+  end
+
+  def stub_exclusive_lease_taken(key = nil, timeout: nil)
+    stub_exclusive_lease(key, nil, timeout: timeout)
+  end
+
+  def expect_to_obtain_exclusive_lease(key, uuid = 'uuid', timeout: nil)
+    lease = stub_exclusive_lease(key, uuid, timeout: timeout)
+
+    expect(lease).to receive(:try_obtain)
+  end
+
+  def expect_to_cancel_exclusive_lease(key, uuid)
+    expect(Gitlab::ExclusiveLease)
+      .to receive(:cancel)
+      .with(key, uuid)
+  end
+end
diff --git a/spec/support/helpers/login_helpers.rb b/spec/support/helpers/login_helpers.rb
index 329f18cd288..87cfb6c04dc 100644
--- a/spec/support/helpers/login_helpers.rb
+++ b/spec/support/helpers/login_helpers.rb
@@ -46,8 +46,8 @@ module LoginHelpers
     @current_user = user
   end
 
-  def gitlab_sign_in_via(provider, user, uid)
-    mock_auth_hash(provider, uid, user.email)
+  def gitlab_sign_in_via(provider, user, uid, saml_response = nil)
+    mock_auth_hash(provider, uid, user.email, saml_response)
     visit new_user_session_path
     click_link provider
   end
@@ -87,7 +87,7 @@ module LoginHelpers
     click_link "oauth-login-#{provider}"
   end
 
-  def mock_auth_hash(provider, uid, email)
+  def mock_auth_hash(provider, uid, email, saml_response = nil)
     # The mock_auth configuration allows you to set per-provider (or default)
     # authentication hashes to return during integration testing.
     OmniAuth.config.mock_auth[provider.to_sym] = OmniAuth::AuthHash.new({
@@ -109,12 +109,21 @@ module LoginHelpers
             email: email,
             image: 'mock_user_thumbnail_url'
           }
+        },
+        response_object: {
+          document: saml_xml(saml_response)
         }
       }
     })
     Rails.application.env_config['omniauth.auth'] = OmniAuth.config.mock_auth[provider.to_sym]
   end
 
+  def saml_xml(raw_saml_response)
+    return '' if raw_saml_response.blank?
+
+    XMLSecurity::SignedDocument.new(raw_saml_response, [])
+  end
+
   def mock_saml_config
     OpenStruct.new(name: 'saml', label: 'saml', args: {
       assertion_consumer_service_url: 'https://localhost:3443/users/auth/saml/callback',
@@ -125,6 +134,14 @@ module LoginHelpers
     })
   end
 
+  def mock_saml_config_with_upstream_two_factor_authn_contexts
+    config = mock_saml_config
+    config.args[:upstream_two_factor_authn_contexts] = %w(urn:oasis:names:tc:SAML:2.0:ac:classes:CertificateProtectedTransport
+                                                          urn:oasis:names:tc:SAML:2.0:ac:classes:SecondFactorOTPSMS
+                                                          urn:oasis:names:tc:SAML:2.0:ac:classes:SecondFactorIGTOKEN)
+    config
+  end
+
   def stub_omniauth_provider(provider, context: Rails.application)
     env = env_from_context(context)
 
@@ -140,13 +157,16 @@ module LoginHelpers
     env['omniauth.error.strategy'] = strategy
   end
 
-  def stub_omniauth_saml_config(messages)
-    set_devise_mapping(context: Rails.application)
-    Rails.application.routes.disable_clear_and_finalize = true
-    Rails.application.routes.draw do
+  def stub_omniauth_saml_config(messages,  context: Rails.application)
+    set_devise_mapping(context: context)
+    routes = Rails.application.routes
+    routes.disable_clear_and_finalize = true
+    routes.formatter.clear
+    routes.draw do
       post '/users/auth/saml' => 'omniauth_callbacks#saml'
     end
-    allow(Gitlab::Auth::OAuth::Provider).to receive_messages(providers: [:saml], config_for: mock_saml_config)
+    saml_config = messages.key?(:providers) ? messages[:providers].first : mock_saml_config
+    allow(Gitlab::Auth::OAuth::Provider).to receive_messages(providers: [:saml], config_for: saml_config)
     stub_omniauth_setting(messages)
     stub_saml_authorize_path_helpers
   end
diff --git a/spec/support/helpers/stub_object_storage.rb b/spec/support/helpers/stub_object_storage.rb
index be122f9578c..58b5c6a6435 100644
--- a/spec/support/helpers/stub_object_storage.rb
+++ b/spec/support/helpers/stub_object_storage.rb
@@ -15,9 +15,14 @@ module StubObjectStorage
 
     return unless enabled
 
+    stub_object_storage(connection_params: uploader.object_store_credentials,
+                        remote_directory: remote_directory)
+  end
+
+  def stub_object_storage(connection_params:, remote_directory:)
     Fog.mock!
 
-    ::Fog::Storage.new(uploader.object_store_credentials).tap do |connection|
+    ::Fog::Storage.new(connection_params).tap do |connection|
       begin
         connection.directories.create(key: remote_directory)
 
diff --git a/spec/support/matchers/graphql_matchers.rb b/spec/support/matchers/graphql_matchers.rb
index d23cbaf4beb..be6fa4c71a0 100644
--- a/spec/support/matchers/graphql_matchers.rb
+++ b/spec/support/matchers/graphql_matchers.rb
@@ -7,9 +7,24 @@ RSpec::Matchers.define :require_graphql_authorizations do |*expected|
 end
 
 RSpec::Matchers.define :have_graphql_fields do |*expected|
+  def expected_field_names
+    expected.map { |name| GraphqlHelpers.fieldnamerize(name) }
+  end
+
   match do |kls|
-    field_names = expected.map { |name| GraphqlHelpers.fieldnamerize(name) }
-    expect(kls.fields.keys).to contain_exactly(*field_names)
+    expect(kls.fields.keys).to contain_exactly(*expected_field_names)
+  end
+
+  failure_message do |kls|
+    missing = expected_field_names - kls.fields.keys
+    extra = kls.fields.keys - expected_field_names
+
+    message = []
+
+    message << "is missing fields: <#{missing.inspect}>" if missing.any?
+    message << "contained unexpected fields: <#{extra.inspect}>" if extra.any?
+
+    message.join("\n")
   end
 end
 
@@ -44,3 +59,13 @@ RSpec::Matchers.define :have_graphql_resolver do |expected|
     end
   end
 end
+
+RSpec::Matchers.define :expose_permissions_using do |expected|
+  match do |type|
+    permission_field = type.fields['userPermissions']
+
+    expect(permission_field).not_to be_nil
+    expect(permission_field.type).to be_non_null
+    expect(permission_field.type.of_type.graphql_name).to eq(expected.graphql_name)
+  end
+end
diff --git a/spec/support/shared_examples/ci_trace_shared_examples.rb b/spec/support/shared_examples/ci_trace_shared_examples.rb
index 6dbe0f6f980..db723a323f8 100644
--- a/spec/support/shared_examples/ci_trace_shared_examples.rb
+++ b/spec/support/shared_examples/ci_trace_shared_examples.rb
@@ -247,8 +247,10 @@ shared_examples_for 'common trace features' do
         end
 
         context 'when another process has already been archiving', :clean_gitlab_redis_shared_state do
+          include ExclusiveLeaseHelpers
+
           before do
-            Gitlab::ExclusiveLease.new("trace:archive:#{trace.job.id}", timeout: 1.hour).try_obtain
+            stub_exclusive_lease_taken("trace:archive:#{trace.job.id}", timeout: 1.hour)
           end
 
           it 'blocks concurrent archiving' do
diff --git a/spec/support/shared_examples/features/protected_branches_access_control_ce.rb b/spec/support/shared_examples/features/protected_branches_access_control_ce.rb
index 5241c0fa6f1..a8f2c2e7a5a 100644
--- a/spec/support/shared_examples/features/protected_branches_access_control_ce.rb
+++ b/spec/support/shared_examples/features/protected_branches_access_control_ce.rb
@@ -5,6 +5,12 @@ shared_examples "protected branches > access control > CE" do
 
       set_protected_branch_name('master')
 
+      find(".js-allowed-to-merge").click
+      within('.qa-allowed-to-merge-dropdown') do
+        expect(first("li")).to have_content("Roles")
+        find(:link, 'No one').click
+      end
+
       within('.js-new-protected-branch') do
         allowed_to_push_button = find(".js-allowed-to-push")
 
@@ -25,6 +31,18 @@ shared_examples "protected branches > access control > CE" do
 
       set_protected_branch_name('master')
 
+      find(".js-allowed-to-merge").click
+      within('.qa-allowed-to-merge-dropdown') do
+        expect(first("li")).to have_content("Roles")
+        find(:link, 'No one').click
+      end
+
+      find(".js-allowed-to-push").click
+      within('.qa-allowed-to-push-dropdown') do
+        expect(first("li")).to have_content("Roles")
+        find(:link, 'No one').click
+      end
+
       click_on "Protect"
 
       expect(ProtectedBranch.count).to eq(1)
@@ -59,6 +77,12 @@ shared_examples "protected branches > access control > CE" do
         end
       end
 
+      find(".js-allowed-to-push").click
+      within('.qa-allowed-to-push-dropdown') do
+        expect(first("li")).to have_content("Roles")
+        find(:link, 'No one').click
+      end
+
       click_on "Protect"
 
       expect(ProtectedBranch.count).to eq(1)
@@ -70,6 +94,18 @@ shared_examples "protected branches > access control > CE" do
 
       set_protected_branch_name('master')
 
+      find(".js-allowed-to-merge").click
+      within('.qa-allowed-to-merge-dropdown') do
+        expect(first("li")).to have_content("Roles")
+        find(:link, 'No one').click
+      end
+
+      find(".js-allowed-to-push").click
+      within('.qa-allowed-to-push-dropdown') do
+        expect(first("li")).to have_content("Roles")
+        find(:link, 'No one').click
+      end
+
       click_on "Protect"
 
       expect(ProtectedBranch.count).to eq(1)
diff --git a/spec/support/shared_examples/requests/api/merge_requests_list.rb b/spec/support/shared_examples/requests/api/merge_requests_list.rb
index d5e22b8cb56..a401f7541f0 100644
--- a/spec/support/shared_examples/requests/api/merge_requests_list.rb
+++ b/spec/support/shared_examples/requests/api/merge_requests_list.rb
@@ -29,7 +29,7 @@ shared_examples 'merge requests list' do
       expect(response).to have_gitlab_http_status(200)
       expect(response).to include_pagination_headers
       expect(json_response).to be_an Array
-      expect(json_response.length).to eq(3)
+      expect(json_response.length).to eq(4)
       expect(json_response.last['title']).to eq(merge_request.title)
       expect(json_response.last).to have_key('web_url')
       expect(json_response.last['sha']).to eq(merge_request.diff_head_sha)
@@ -53,7 +53,7 @@ shared_examples 'merge requests list' do
       expect(response).to include_pagination_headers
       expect(json_response.last.keys).to match_array(%w(id iid title web_url created_at description project_id state updated_at))
       expect(json_response).to be_an Array
-      expect(json_response.length).to eq(3)
+      expect(json_response.length).to eq(4)
       expect(json_response.last['iid']).to eq(merge_request.iid)
       expect(json_response.last['title']).to eq(merge_request.title)
       expect(json_response.last).to have_key('web_url')
@@ -70,7 +70,7 @@ shared_examples 'merge requests list' do
       expect(response).to have_gitlab_http_status(200)
       expect(response).to include_pagination_headers
       expect(json_response).to be_an Array
-      expect(json_response.length).to eq(3)
+      expect(json_response.length).to eq(4)
       expect(json_response.last['title']).to eq(merge_request.title)
     end
 
@@ -216,7 +216,7 @@ shared_examples 'merge requests list' do
         expect(response).to have_gitlab_http_status(200)
         expect(response).to include_pagination_headers
         expect(json_response).to be_an Array
-        expect(json_response.length).to eq(3)
+        expect(json_response.length).to eq(4)
         response_dates = json_response.map { |merge_request| merge_request['created_at'] }
         expect(response_dates).to eq(response_dates.sort)
       end
@@ -229,7 +229,7 @@ shared_examples 'merge requests list' do
         expect(response).to have_gitlab_http_status(200)
         expect(response).to include_pagination_headers
         expect(json_response).to be_an Array
-        expect(json_response.length).to eq(3)
+        expect(json_response.length).to eq(4)
         response_dates = json_response.map { |merge_request| merge_request['created_at'] }
         expect(response_dates).to eq(response_dates.sort.reverse)
       end
@@ -242,7 +242,7 @@ shared_examples 'merge requests list' do
         expect(response).to have_gitlab_http_status(200)
         expect(response).to include_pagination_headers
         expect(json_response).to be_an Array
-        expect(json_response.length).to eq(3)
+        expect(json_response.length).to eq(4)
         response_dates = json_response.map { |merge_request| merge_request['updated_at'] }
         expect(response_dates).to eq(response_dates.sort.reverse)
       end
@@ -255,7 +255,7 @@ shared_examples 'merge requests list' do
         expect(response).to have_gitlab_http_status(200)
         expect(response).to include_pagination_headers
         expect(json_response).to be_an Array
-        expect(json_response.length).to eq(3)
+        expect(json_response.length).to eq(4)
         response_dates = json_response.map { |merge_request| merge_request['created_at'] }
         expect(response_dates).to eq(response_dates.sort)
       end
@@ -265,7 +265,7 @@ shared_examples 'merge requests list' do
       it 'returns merge requests with the given source branch' do
         get api(endpoint_path, user), source_branch: merge_request_closed.source_branch, state: 'all'
 
-        expect_response_contain_exactly(merge_request_closed, merge_request_merged)
+        expect_response_contain_exactly(merge_request_closed, merge_request_merged, merge_request_locked)
       end
     end
 
@@ -273,7 +273,7 @@ shared_examples 'merge requests list' do
       it 'returns merge requests with the given target branch' do
         get api(endpoint_path, user), target_branch: merge_request_closed.target_branch, state: 'all'
 
-        expect_response_contain_exactly(merge_request_closed, merge_request_merged)
+        expect_response_contain_exactly(merge_request_closed, merge_request_merged, merge_request_locked)
       end
     end
   end
diff --git a/spec/support/shared_examples/requests/graphql_shared_examples.rb b/spec/support/shared_examples/requests/graphql_shared_examples.rb
index 9b2b74593a5..fe7b7bc306f 100644
--- a/spec/support/shared_examples/requests/graphql_shared_examples.rb
+++ b/spec/support/shared_examples/requests/graphql_shared_examples.rb
@@ -3,8 +3,8 @@ require 'spec_helper'
 shared_examples 'a working graphql query' do
   include GraphqlHelpers
 
-  it 'is returns a successfull response', :aggregate_failures do
-    expect(response).to be_success
+  it 'returns a successful response', :aggregate_failures do
+    expect(response).to have_gitlab_http_status(:success)
     expect(graphql_errors['errors']).to be_nil
     expect(json_response.keys).to include('data')
   end
diff --git a/spec/support/shared_examples/throttled_touch.rb b/spec/support/shared_examples/throttled_touch.rb
index 4a25bb9b750..eba990d4037 100644
--- a/spec/support/shared_examples/throttled_touch.rb
+++ b/spec/support/shared_examples/throttled_touch.rb
@@ -3,7 +3,7 @@ shared_examples_for 'throttled touch' do
     it 'updates the updated_at timestamp' do
       Timecop.freeze do
         subject.touch
-        expect(subject.updated_at).to eq(Time.zone.now)
+        expect(subject.updated_at).to be_like_time(Time.zone.now)
       end
     end
 
@@ -14,7 +14,7 @@ shared_examples_for 'throttled touch' do
       Timecop.freeze(first_updated_at) { subject.touch }
       Timecop.freeze(second_updated_at) { subject.touch }
 
-      expect(subject.updated_at).to eq(first_updated_at)
+      expect(subject.updated_at).to be_like_time(first_updated_at)
     end
   end
 end
diff --git a/spec/support/shared_examples/uploaders/object_storage_shared_examples.rb b/spec/support/shared_examples/uploaders/object_storage_shared_examples.rb
index 19800c6638f..1bd176280c5 100644
--- a/spec/support/shared_examples/uploaders/object_storage_shared_examples.rb
+++ b/spec/support/shared_examples/uploaders/object_storage_shared_examples.rb
@@ -76,8 +76,10 @@ shared_examples "migrates" do |to_store:, from_store: nil|
   end
 
   context 'when migrate! is occupied by another process' do
+    include ExclusiveLeaseHelpers
+
     before do
-      @uuid = Gitlab::ExclusiveLease.new(subject.exclusive_lease_key, timeout: 1.hour.to_i).try_obtain
+      stub_exclusive_lease_taken(subject.exclusive_lease_key, timeout: 1.hour.to_i)
     end
 
     it 'does not execute migrate!' do
@@ -91,10 +93,6 @@ shared_examples "migrates" do |to_store:, from_store: nil|
 
       expect { subject.use_file }.to raise_error(ObjectStorage::ExclusiveLeaseTaken)
     end
-
-    after do
-      Gitlab::ExclusiveLease.cancel(subject.exclusive_lease_key, @uuid)
-    end
   end
 
   context 'migration is unsuccessful' do