1 files changed, 69 insertions, 21 deletions

diff --git a/spec/controllers/projects/jobs_controller_spec.rb b/spec/controllers/projects/jobs_controller_spec.rb
index 556dd23c135..3dc89365530 100644
--- a/spec/controllers/projects/jobs_controller_spec.rb
+++ b/spec/controllers/projects/jobs_controller_spec.rb
@@ -660,6 +660,38 @@ RSpec.describe Projects::JobsController, :clean_gitlab_redis_shared_state do
           end
         end
       end
+
+      context 'when CI_DEBUG_SERVICES enabled' do
+        let!(:variable) { create(:ci_instance_variable, key: 'CI_DEBUG_SERVICES', value: 'true') }
+
+        context 'with proper permissions on a project' do
+          let(:user) { developer }
+
+          before do
+            sign_in(user)
+          end
+
+          it 'returns response ok' do
+            get_trace
+
+            expect(response).to have_gitlab_http_status(:ok)
+          end
+        end
+
+        context 'without proper permissions for debug logging' do
+          let(:user) { guest }
+
+          before do
+            sign_in(user)
+          end
+
+          it 'returns response forbidden' do
+            get_trace
+
+            expect(response).to have_gitlab_http_status(:forbidden)
+          end
+        end
+      end
     end
 
     context 'when job has a live trace' do
@@ -1184,36 +1216,51 @@ RSpec.describe Projects::JobsController, :clean_gitlab_redis_shared_state do
         expect(response.header[Gitlab::Workhorse::DETECT_HEADER]).to eq "true"
       end
 
-      context 'when CI_DEBUG_TRACE enabled' do
-        before do
-          create(:ci_instance_variable, key: 'CI_DEBUG_TRACE', value: 'true')
+      context 'when CI_DEBUG_TRACE and/or CI_DEBUG_SERVICES are enabled' do
+        using RSpec::Parameterized::TableSyntax
+        where(:ci_debug_trace, :ci_debug_services) do
+          'true'  | 'true'
+          'true'  | 'false'
+          'false' | 'true'
+          'false' | 'false'
         end
 
-        context 'with proper permissions for debug logging on a project' do
-          let(:user) { developer }
-
+        with_them do
           before do
-            sign_in(user)
+            create(:ci_instance_variable, key: 'CI_DEBUG_TRACE', value: ci_debug_trace)
+            create(:ci_instance_variable, key: 'CI_DEBUG_SERVICES', value: ci_debug_services)
           end
 
-          it 'returns response ok' do
-            response = subject
+          context 'with proper permissions for debug logging on a project' do
+            let(:user) { developer }
 
-            expect(response).to have_gitlab_http_status(:ok)
-          end
-        end
+            before do
+              sign_in(user)
+            end
 
-        context 'without proper permissions for debug logging on a project' do
-          let(:user) { reporter }
+            it 'returns response ok' do
+              response = subject
 
-          before do
-            sign_in(user)
+              expect(response).to have_gitlab_http_status(:ok)
+            end
           end
 
-          it 'returns response forbidden' do
-            response = subject
+          context 'without proper permissions for debug logging on a project' do
+            let(:user) { reporter }
 
-            expect(response).to have_gitlab_http_status(:forbidden)
+            before do
+              sign_in(user)
+            end
+
+            it 'returns response forbidden if dev mode enabled' do
+              response = subject
+
+              if ci_debug_trace == 'true' || ci_debug_services == 'true'
+                expect(response).to have_gitlab_http_status(:forbidden)
+              else
+                expect(response).to have_gitlab_http_status(:ok)
+              end
+            end
           end
         end
       end
@@ -1380,7 +1427,7 @@ RSpec.describe Projects::JobsController, :clean_gitlab_redis_shared_state do
       {
         'Channel' => {
           'Subprotocols' => ["terminal.gitlab.com"],
-          'Url' => 'wss://localhost/proxy/build/default_port/',
+          'Url' => 'wss://gitlab.example.com/proxy/build/default_port/',
           'Header' => {
             'Authorization' => [nil]
           },
@@ -1536,7 +1583,8 @@ RSpec.describe Projects::JobsController, :clean_gitlab_redis_shared_state do
       allow(Gitlab::Workhorse).to receive(:verify_api_request!).and_return(nil)
 
       expect(job.runner_session_url).to start_with('https://')
-      expect(Gitlab::Workhorse).to receive(:channel_websocket).with(a_hash_including(url: "wss://localhost/proxy/build/default_port/"))
+      expect(Gitlab::Workhorse).to receive(:channel_websocket)
+        .with(a_hash_including(url: "wss://gitlab.example.com/proxy/build/default_port/"))
 
       make_request
     end