Add latest changes from gitlab-org/gitlab@14-7-stable-eev14.7.0-rc42

1 files changed, 72 insertions, 0 deletions

diff --git a/spec/uploaders/ci/secure_file_uploader_spec.rb b/spec/uploaders/ci/secure_file_uploader_spec.rb
new file mode 100644
index 00000000000..3be4f742a24
--- /dev/null
+++ b/spec/uploaders/ci/secure_file_uploader_spec.rb
@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Ci::SecureFileUploader do
+  subject { ci_secure_file.file }
+
+  let(:project) { create(:project) }
+  let(:ci_secure_file) { create(:ci_secure_file) }
+  let(:sample_file) { fixture_file('ci_secure_files/upload-keystore.jks') }
+
+  before do
+    stub_ci_secure_file_object_storage
+  end
+
+  describe '#key' do
+    it 'creates a digest with a secret key and the project id' do
+      expect(OpenSSL::HMAC)
+        .to receive(:digest)
+        .with('SHA256', Gitlab::Application.secrets.db_key_base, ci_secure_file.project_id.to_s)
+        .and_return('digest')
+
+      expect(subject.key).to eq('digest')
+    end
+  end
+
+  describe '.checksum' do
+    it 'returns a SHA256 checksum for the unencrypted file' do
+      expect(subject.checksum).to eq(Digest::SHA256.hexdigest(sample_file))
+    end
+  end
+
+  describe 'encryption' do
+    it 'encrypts the stored file' do
+      expect(Base64.encode64(subject.file.read)).not_to eq(Base64.encode64(sample_file))
+    end
+
+    it 'decrypts the file when reading' do
+      expect(Base64.encode64(subject.read)).to eq(Base64.encode64(sample_file))
+    end
+  end
+
+  describe '.direct_upload_enabled?' do
+    it 'returns false' do
+      expect(described_class.direct_upload_enabled?).to eq(false)
+    end
+  end
+
+  describe '.background_upload_enabled?' do
+    it 'returns false' do
+      expect(described_class.background_upload_enabled?).to eq(false)
+    end
+  end
+
+  describe '.default_store' do
+    context 'when object storage is enabled' do
+      it 'returns REMOTE' do
+        expect(described_class.default_store).to eq(ObjectStorage::Store::REMOTE)
+      end
+    end
+
+    context 'when object storage is disabled' do
+      before do
+        stub_ci_secure_file_object_storage(enabled: false)
+      end
+
+      it 'returns LOCAL' do
+        expect(described_class.default_store).to eq(ObjectStorage::Store::LOCAL)
+      end
+    end
+  end
+end