diff options
author | Bob Van Landuyt <bob@vanlanduyt.co> | 2018-02-26 15:32:42 +0300 |
---|---|---|
committer | Bob Van Landuyt <bob@vanlanduyt.co> | 2018-03-07 17:12:31 +0300 |
commit | b2ef83856de8c175d384688d09023d16dcfef0c6 (patch) | |
tree | 01802b6678de41951dbd035a25219e77d6b48cf7 /spec | |
parent | 792ab0631c85098fbf92e727b77158fb9dae5219 (diff) |
Allow abilities on forks while MR is open
When an MR is created using `allow_maintainer_to_push`, we enable some
abilities while the MR is open.
This should allow every user with developer abilities on the target
project, to push to the source project.
Diffstat (limited to 'spec')
-rw-r--r-- | spec/lib/gitlab/checks/change_access_spec.rb | 6 | ||||
-rw-r--r-- | spec/lib/gitlab/import_export/all_models.yml | 1 | ||||
-rw-r--r-- | spec/models/project_spec.rb | 52 | ||||
-rw-r--r-- | spec/policies/project_policy_spec.rb | 37 |
4 files changed, 93 insertions, 3 deletions
diff --git a/spec/lib/gitlab/checks/change_access_spec.rb b/spec/lib/gitlab/checks/change_access_spec.rb index b49ddbfc780..2f173d2e75c 100644 --- a/spec/lib/gitlab/checks/change_access_spec.rb +++ b/spec/lib/gitlab/checks/change_access_spec.rb @@ -30,9 +30,9 @@ describe Gitlab::Checks::ChangeAccess do end end - context 'when the user is not allowed to push code' do + context 'when the user is not allowed to push to the repo' do it 'raises an error' do - expect(user_access).to receive(:can_do_action?).with(:push_code).and_return(false) + expect(user_access).to receive(:can_do_action?).with(:push_to_repo).and_return(false) expect { subject.exec }.to raise_error(Gitlab::GitAccess::UnauthorizedError, 'You are not allowed to push code to this project.') end @@ -42,7 +42,7 @@ describe Gitlab::Checks::ChangeAccess do let(:ref) { 'refs/tags/v1.0.0' } it 'raises an error if the user is not allowed to update tags' do - allow(user_access).to receive(:can_do_action?).with(:push_code).and_return(true) + allow(user_access).to receive(:can_do_action?).with(:push_to_repo).and_return(true) expect(user_access).to receive(:can_do_action?).with(:admin_project).and_return(false) expect { subject.exec }.to raise_error(Gitlab::GitAccess::UnauthorizedError, 'You are not allowed to change existing tags on this project.') diff --git a/spec/lib/gitlab/import_export/all_models.yml b/spec/lib/gitlab/import_export/all_models.yml index b20cc34dd5c..bece82e531a 100644 --- a/spec/lib/gitlab/import_export/all_models.yml +++ b/spec/lib/gitlab/import_export/all_models.yml @@ -278,6 +278,7 @@ project: - custom_attributes - lfs_file_locks - project_badges +- source_of_merge_requests award_emoji: - awardable - user diff --git a/spec/models/project_spec.rb b/spec/models/project_spec.rb index b1c9e6754b9..a95a4637234 100644 --- a/spec/models/project_spec.rb +++ b/spec/models/project_spec.rb @@ -1,6 +1,8 @@ require 'spec_helper' describe Project do + include ProjectForksHelper + describe 'associations' do it { is_expected.to belong_to(:group) } it { is_expected.to belong_to(:namespace) } @@ -3378,4 +3380,54 @@ describe Project do end end end + + describe '#branches_allowing_maintainer_access_to_user' do + let(:maintainer) { create(:user) } + let(:target_project) { create(:project) } + let(:project) { fork_project(target_project) } + let!(:merge_request) do + create( + :merge_request, + target_project: target_project, + source_project: project, + source_branch: 'awesome-feature-1', + allow_maintainer_to_push: true + ) + end + + before do + target_project.add_developer(maintainer) + end + + it 'includes branch names for merge requests allowing maintainer access to a user' do + expect(project.branches_allowing_maintainer_access_to_user(maintainer)) + .to include('awesome-feature-1') + end + + it 'does not include branches for closed MRs' do + create(:merge_request, :closed, + target_project: target_project, + source_project: project, + source_branch: 'rejected-feature-1', + allow_maintainer_to_push: true) + + expect(project.branches_allowing_maintainer_access_to_user(maintainer)) + .not_to include('rejected-feature-1') + end + + it 'only queries once per user' do + expect { 3.times { project.branches_allowing_maintainer_access_to_user(maintainer) } } + .not_to exceed_query_limit(1) + end + + context 'when the requeststore is active', :request_store do + it 'only queries once per user accross project instances' do + # limiting to 3 queries: + # 2 times loading the project + # once loading the accessible branches + expect { 2.times { described_class.find(project.id).branches_allowing_maintainer_access_to_user(maintainer) } } + .not_to exceed_query_limit(3) + end + end + end end diff --git a/spec/policies/project_policy_spec.rb b/spec/policies/project_policy_spec.rb index 129344f105f..f449fbd6b52 100644 --- a/spec/policies/project_policy_spec.rb +++ b/spec/policies/project_policy_spec.rb @@ -308,4 +308,41 @@ describe ProjectPolicy do it_behaves_like 'project policies as master' it_behaves_like 'project policies as owner' it_behaves_like 'project policies as admin' + + context 'when a public project has merge requests allowing access' do + include ProjectForksHelper + let(:user) { create(:user) } + let(:target_project) { create(:project, :public) } + let(:project) { fork_project(target_project) } + let!(:merge_request) do + create( + :merge_request, + target_project: target_project, + source_project: project, + allow_maintainer_to_push: true + ) + end + let(:maintainer_abilities) do + %w(push_single_branch create_build update_build create_pipeline update_pipeline) + end + + subject { described_class.new(user, project) } + + it 'does not allow pushing code' do + expect_disallowed(*maintainer_abilities) + end + + it 'allows pushing if the user is a member with push access to the target project' do + target_project.add_developer(user) + + expect_allowed(*maintainer_abilities) + end + + it 'dissallows abilities to a maintainer if the merge request was closed' do + target_project.add_developer(user) + merge_request.close! + + expect_disallowed(*maintainer_abilities) + end + end end |