Add latest changes from gitlab-org/gitlab@master

7 files changed, 154 insertions, 59 deletions

diff --git a/spec/controllers/groups/settings/integrations_controller_spec.rb b/spec/controllers/groups/settings/integrations_controller_spec.rb
index beb2ad3afec..4887d68a243 100644
--- a/spec/controllers/groups/settings/integrations_controller_spec.rb
+++ b/spec/controllers/groups/settings/integrations_controller_spec.rb
@@ -24,16 +24,6 @@ RSpec.describe Groups::Settings::IntegrationsController do
         group.add_owner(user)
       end
 
-      context 'when group_level_integrations not enabled' do
-        it 'returns not_found' do
-          stub_feature_flags(group_level_integrations: false)
-
-          get :index, params: { group_id: group }
-
-          expect(response).to have_gitlab_http_status(:not_found)
-        end
-      end
-
       it 'successfully displays the template' do
         get :index, params: { group_id: group }
 
@@ -57,16 +47,6 @@ RSpec.describe Groups::Settings::IntegrationsController do
         group.add_owner(user)
       end
 
-      context 'when group_level_integrations not enabled' do
-        it 'returns not_found' do
-          stub_feature_flags(group_level_integrations: false)
-
-          get :edit, params: { group_id: group, id: Service.available_services_names(include_project_specific: false).sample }
-
-          expect(response).to have_gitlab_http_status(:not_found)
-        end
-      end
-
       Service.available_services_names(include_project_specific: false).each do |integration_name|
         context "#{integration_name}" do
           it 'successfully displays the template' do
diff --git a/spec/frontend/vue_shared/components/security_reports/__snapshots__/security_summary_spec.js.snap b/spec/frontend/vue_shared/components/security_reports/__snapshots__/security_summary_spec.js.snap
index 0336f4c0325..1e08394dd56 100644
--- a/spec/frontend/vue_shared/components/security_reports/__snapshots__/security_summary_spec.js.snap
+++ b/spec/frontend/vue_shared/components/security_reports/__snapshots__/security_summary_spec.js.snap
@@ -1,6 +1,6 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`Severity Summary given the message {"countMessage": "%{criticalStart}0 Critical%{criticalEnd} %{highStart}1 High%{highEnd} and %{otherStart}0 Others%{otherEnd}", "critical": 0, "high": 1, "message": "Security scanning detected %{totalStart}1%{totalEnd} potential vulnerability", "other": 0, "status": "", "total": 1} interpolates correctly 1`] = `
+exports[`SecuritySummary component given the message {"countMessage": "%{criticalStart}0 Critical%{criticalEnd} %{highStart}1 High%{highEnd} and %{otherStart}0 Others%{otherEnd}", "critical": 0, "high": 1, "message": "Security scanning detected %{totalStart}1%{totalEnd} potential vulnerability", "other": 0, "status": "", "total": 1} interpolates correctly 1`] = `
 <span>
   Security scanning detected 
   <strong>
@@ -43,7 +43,7 @@ exports[`Severity Summary given the message {"countMessage": "%{criticalStart}0
 </span>
 `;
 
-exports[`Severity Summary given the message {"countMessage": "%{criticalStart}1 Critical%{criticalEnd} %{highStart}0 High%{highEnd} and %{otherStart}0 Others%{otherEnd}", "critical": 1, "high": 0, "message": "Security scanning detected %{totalStart}1%{totalEnd} potential vulnerability", "other": 0, "status": "", "total": 1} interpolates correctly 1`] = `
+exports[`SecuritySummary component given the message {"countMessage": "%{criticalStart}1 Critical%{criticalEnd} %{highStart}0 High%{highEnd} and %{otherStart}0 Others%{otherEnd}", "critical": 1, "high": 0, "message": "Security scanning detected %{totalStart}1%{totalEnd} potential vulnerability", "other": 0, "status": "", "total": 1} interpolates correctly 1`] = `
 <span>
   Security scanning detected 
   <strong>
@@ -86,7 +86,7 @@ exports[`Severity Summary given the message {"countMessage": "%{criticalStart}1
 </span>
 `;
 
-exports[`Severity Summary given the message {"countMessage": "%{criticalStart}1 Critical%{criticalEnd} %{highStart}2 High%{highEnd} and %{otherStart}0 Others%{otherEnd}", "critical": 1, "high": 2, "message": "Security scanning detected %{totalStart}3%{totalEnd} potential vulnerabilities", "other": 0, "status": "", "total": 3} interpolates correctly 1`] = `
+exports[`SecuritySummary component given the message {"countMessage": "%{criticalStart}1 Critical%{criticalEnd} %{highStart}2 High%{highEnd} and %{otherStart}0 Others%{otherEnd}", "critical": 1, "high": 2, "message": "Security scanning detected %{totalStart}3%{totalEnd} potential vulnerabilities", "other": 0, "status": "", "total": 3} interpolates correctly 1`] = `
 <span>
   Security scanning detected 
   <strong>
@@ -129,14 +129,14 @@ exports[`Severity Summary given the message {"countMessage": "%{criticalStart}1
 </span>
 `;
 
-exports[`Severity Summary given the message {"message": ""} interpolates correctly 1`] = `
+exports[`SecuritySummary component given the message {"message": ""} interpolates correctly 1`] = `
 <span>
    
   <!---->
 </span>
 `;
 
-exports[`Severity Summary given the message {"message": "foo"} interpolates correctly 1`] = `
+exports[`SecuritySummary component given the message {"message": "foo"} interpolates correctly 1`] = `
 <span>
   foo 
   <!---->
diff --git a/spec/frontend/vue_shared/components/security_reports/security_summary_spec.js b/spec/frontend/vue_shared/components/security_reports/security_summary_spec.js
index 4217fef9fbf..e57152c3cbf 100644
--- a/spec/frontend/vue_shared/components/security_reports/security_summary_spec.js
+++ b/spec/frontend/vue_shared/components/security_reports/security_summary_spec.js
@@ -3,7 +3,7 @@ import { shallowMount } from '@vue/test-utils';
 import SecuritySummary from '~/vue_shared/security_reports/components/security_summary.vue';
 import { groupedTextBuilder } from '~/vue_shared/security_reports/store/utils';
 
-describe('Severity Summary', () => {
+describe('SecuritySummary component', () => {
   let wrapper;
 
   const createWrapper = message => {
diff --git a/spec/helpers/services_helper_spec.rb b/spec/helpers/services_helper_spec.rb
index 29c83b7c4da..ae3a4301fd8 100644
--- a/spec/helpers/services_helper_spec.rb
+++ b/spec/helpers/services_helper_spec.rb
@@ -28,38 +28,6 @@ RSpec.describe ServicesHelper do
     end
   end
 
-  describe '#group_level_integrations?' do
-    subject { helper.group_level_integrations? }
-
-    context 'when no group is present' do
-      it { is_expected.to eq(false) }
-    end
-
-    context 'when group is present' do
-      let(:group) { build_stubbed(:group) }
-
-      before do
-        assign(:group, group)
-      end
-
-      context 'when `group_level_integrations` is not enabled' do
-        it 'returns false' do
-          stub_feature_flags(group_level_integrations: false)
-
-          is_expected.to eq(false)
-        end
-      end
-
-      context 'when `group_level_integrations` is enabled for the group' do
-        it 'returns true' do
-          stub_feature_flags(group_level_integrations: group)
-
-          is_expected.to eq(true)
-        end
-      end
-    end
-  end
-
   describe '#scoped_reset_integration_path' do
     let(:integration) { build_stubbed(:jira_service) }
     let(:group) { nil }
diff --git a/spec/lib/gitlab/auth/otp/session_enforcer_spec.rb b/spec/lib/gitlab/auth/otp/session_enforcer_spec.rb
new file mode 100644
index 00000000000..928aade4008
--- /dev/null
+++ b/spec/lib/gitlab/auth/otp/session_enforcer_spec.rb
@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::Auth::Otp::SessionEnforcer, :clean_gitlab_redis_shared_state do
+  let_it_be(:key) { create(:key)}
+
+  describe '#update_session' do
+    it 'registers a session in Redis' do
+      redis = double(:redis)
+      expect(Gitlab::Redis::SharedState).to receive(:with).and_yield(redis)
+
+      expect(redis).to(
+        receive(:setex)
+          .with("#{described_class::OTP_SESSIONS_NAMESPACE}:#{key.id}",
+                described_class::DEFAULT_EXPIRATION,
+                true)
+          .once)
+
+      described_class.new(key).update_session
+    end
+  end
+
+  describe '#access_restricted?' do
+    subject { described_class.new(key).access_restricted? }
+
+    context 'with existing session' do
+      before do
+        Gitlab::Redis::SharedState.with do |redis|
+          redis.set("#{described_class::OTP_SESSIONS_NAMESPACE}:#{key.id}", true )
+        end
+      end
+
+      it { is_expected.to be_falsey }
+    end
+
+    context 'without an existing session' do
+      it { is_expected.to be_truthy }
+    end
+  end
+end
diff --git a/spec/lib/gitlab/git_access_spec.rb b/spec/lib/gitlab/git_access_spec.rb
index cd465a92fec..780f4329bcc 100644
--- a/spec/lib/gitlab/git_access_spec.rb
+++ b/spec/lib/gitlab/git_access_spec.rb
@@ -387,6 +387,108 @@ RSpec.describe Gitlab::GitAccess do
     end
   end
 
+  describe '#check_otp_session!' do
+    let_it_be(:user) { create(:user, :two_factor_via_otp)}
+    let_it_be(:key) { create(:key, user: user) }
+    let_it_be(:actor) { key }
+
+    before do
+      project.add_developer(user)
+      stub_feature_flags(two_factor_for_cli: true)
+    end
+
+    context 'with an OTP session', :clean_gitlab_redis_shared_state do
+      before do
+        Gitlab::Redis::SharedState.with do |redis|
+          redis.set("#{Gitlab::Auth::Otp::SessionEnforcer::OTP_SESSIONS_NAMESPACE}:#{key.id}", true)
+        end
+      end
+
+      it 'allows push and pull access' do
+        aggregate_failures do
+          expect { push_access_check }.not_to raise_error
+          expect { pull_access_check }.not_to raise_error
+        end
+      end
+    end
+
+    context 'without OTP session' do
+      it 'does not allow push or pull access' do
+        user = 'jane.doe'
+        host = 'fridge.ssh'
+        port = 42
+
+        stub_config(
+          gitlab_shell: {
+            ssh_user: user,
+            ssh_host: host,
+            ssh_port: port
+          }
+        )
+
+        error_message = "OTP verification is required to access the repository.\n\n"\
+                        "   Use: ssh #{user}@#{host} -p #{port} 2fa_verify"
+
+        aggregate_failures do
+          expect { push_access_check }.to raise_forbidden(error_message)
+          expect { pull_access_check }.to raise_forbidden(error_message)
+        end
+      end
+
+      context 'when protocol is HTTP' do
+        let(:protocol) { 'http' }
+
+        it 'allows push and pull access' do
+          aggregate_failures do
+            expect { push_access_check }.not_to raise_error
+            expect { pull_access_check }.not_to raise_error
+          end
+        end
+      end
+
+      context 'when actor is not an SSH key' do
+        let(:deploy_key) { create(:deploy_key, user: user) }
+        let(:actor) { deploy_key }
+
+        before do
+          deploy_key.deploy_keys_projects.create(project: project, can_push: true)
+        end
+
+        it 'allows push and pull access' do
+          aggregate_failures do
+            expect { push_access_check }.not_to raise_error
+            expect { pull_access_check }.not_to raise_error
+          end
+        end
+      end
+
+      context 'when 2FA is not enabled for the user' do
+        let(:user) { create(:user)}
+        let(:actor) { create(:key, user: user) }
+
+        it 'allows push and pull access' do
+          aggregate_failures do
+            expect { push_access_check }.not_to raise_error
+            expect { pull_access_check }.not_to raise_error
+          end
+        end
+      end
+
+      context 'when feature flag is disabled' do
+        before do
+          stub_feature_flags(two_factor_for_cli: false)
+        end
+
+        it 'allows push and pull access' do
+          aggregate_failures do
+            expect { push_access_check }.not_to raise_error
+            expect { pull_access_check }.not_to raise_error
+          end
+        end
+      end
+    end
+  end
+
   describe '#check_db_accessibility!' do
     context 'when in a read-only GitLab instance' do
       before do
diff --git a/spec/requests/api/internal/base_spec.rb b/spec/requests/api/internal/base_spec.rb
index c079ee3da32..a540c85d4c7 100644
--- a/spec/requests/api/internal/base_spec.rb
+++ b/spec/requests/api/internal/base_spec.rb
@@ -1336,9 +1336,13 @@ RSpec.describe API::Internal::Base do
       end
 
       context 'when the OTP is valid' do
-        it 'returns success' do
+        it 'registers a new OTP session and returns success' do
           allow_any_instance_of(Users::ValidateOtpService).to receive(:execute).with(otp).and_return(status: :success)
 
+          expect_next_instance_of(::Gitlab::Auth::Otp::SessionEnforcer) do |session_enforcer|
+            expect(session_enforcer).to receive(:update_session).once
+          end
+
           subject
 
           expect(json_response['success']).to be_truthy