diff options
Diffstat (limited to 'spec/controllers/search_controller_spec.rb')
| -rw-r--r-- | spec/controllers/search_controller_spec.rb | 392 |
1 files changed, 205 insertions, 187 deletions
diff --git a/spec/controllers/search_controller_spec.rb b/spec/controllers/search_controller_spec.rb index bbd39fd4c83..95cea10f0d0 100644 --- a/spec/controllers/search_controller_spec.rb +++ b/spec/controllers/search_controller_spec.rb @@ -5,278 +5,296 @@ require 'spec_helper' RSpec.describe SearchController do include ExternalAuthorizationServiceHelpers - let(:user) { create(:user) } + context 'authorized user' do + let(:user) { create(:user) } - before do - sign_in(user) - end - - shared_examples_for 'when the user cannot read cross project' do |action, params| before do - allow(Ability).to receive(:allowed?).and_call_original - allow(Ability).to receive(:allowed?) - .with(user, :read_cross_project, :global) { false } + sign_in(user) end - it 'blocks access without a project_id' do - get action, params: params - - expect(response).to have_gitlab_http_status(:forbidden) - end + shared_examples_for 'when the user cannot read cross project' do |action, params| + before do + allow(Ability).to receive(:allowed?).and_call_original + allow(Ability).to receive(:allowed?) + .with(user, :read_cross_project, :global) { false } + end - it 'allows access with a project_id' do - get action, params: params.merge(project_id: create(:project, :public).id) + it 'blocks access without a project_id' do + get action, params: params - expect(response).to have_gitlab_http_status(:ok) - end - end + expect(response).to have_gitlab_http_status(:forbidden) + end - shared_examples_for 'with external authorization service enabled' do |action, params| - let(:project) { create(:project, namespace: user.namespace) } - let(:note) { create(:note_on_issue, project: project) } + it 'allows access with a project_id' do + get action, params: params.merge(project_id: create(:project, :public).id) - before do - enable_external_authorization_service_check + expect(response).to have_gitlab_http_status(:ok) + end end - it 'renders a 403 when no project is given' do - get action, params: params + shared_examples_for 'with external authorization service enabled' do |action, params| + let(:project) { create(:project, namespace: user.namespace) } + let(:note) { create(:note_on_issue, project: project) } - expect(response).to have_gitlab_http_status(:forbidden) - end + before do + enable_external_authorization_service_check + end - it 'renders a 200 when a project was set' do - get action, params: params.merge(project_id: project.id) + it 'renders a 403 when no project is given' do + get action, params: params - expect(response).to have_gitlab_http_status(:ok) - end - end + expect(response).to have_gitlab_http_status(:forbidden) + end - describe 'GET #show' do - it_behaves_like 'when the user cannot read cross project', :show, { search: 'hello' } do - it 'still allows accessing the search page' do - get :show + it 'renders a 200 when a project was set' do + get action, params: params.merge(project_id: project.id) expect(response).to have_gitlab_http_status(:ok) end end - it_behaves_like 'with external authorization service enabled', :show, { search: 'hello' } + describe 'GET #show' do + it_behaves_like 'when the user cannot read cross project', :show, { search: 'hello' } do + it 'still allows accessing the search page' do + get :show - context 'uses the right partials depending on scope' do - using RSpec::Parameterized::TableSyntax - render_views - - let_it_be(:project) { create(:project, :public, :repository, :wiki_repo) } - - before do - expect(::Gitlab::GitalyClient).to receive(:allow_ref_name_caching).and_call_original + expect(response).to have_gitlab_http_status(:ok) + end end - subject { get(:show, params: { project_id: project.id, scope: scope, search: 'merge' }) } + it_behaves_like 'with external authorization service enabled', :show, { search: 'hello' } - where(:partial, :scope) do - '_blob' | :blobs - '_wiki_blob' | :wiki_blobs - '_commit' | :commits - end + context 'uses the right partials depending on scope' do + using RSpec::Parameterized::TableSyntax + render_views - with_them do - it do - project_wiki = create(:project_wiki, project: project, user: user) - create(:wiki_page, wiki: project_wiki, title: 'merge', content: 'merge') + let_it_be(:project) { create(:project, :public, :repository, :wiki_repo) } - expect(subject).to render_template("search/results/#{partial}") + before do + expect(::Gitlab::GitalyClient).to receive(:allow_ref_name_caching).and_call_original end - end - end - context 'global search' do - using RSpec::Parameterized::TableSyntax - render_views + subject { get(:show, params: { project_id: project.id, scope: scope, search: 'merge' }) } - context 'when block_anonymous_global_searches is disabled' do - before do - stub_feature_flags(block_anonymous_global_searches: false) + where(:partial, :scope) do + '_blob' | :blobs + '_wiki_blob' | :wiki_blobs + '_commit' | :commits end - it 'omits pipeline status from load' do - project = create(:project, :public) - expect(Gitlab::Cache::Ci::ProjectPipelineStatus).not_to receive(:load_in_batch_for_projects) + with_them do + it do + project_wiki = create(:project_wiki, project: project, user: user) + create(:wiki_page, wiki: project_wiki, title: 'merge', content: 'merge') - get :show, params: { scope: 'projects', search: project.name } - - expect(assigns[:search_objects].first).to eq project + expect(subject).to render_template("search/results/#{partial}") + end end + end - context 'check search term length' do - let(:search_queries) do - char_limit = SearchService::SEARCH_CHAR_LIMIT - term_limit = SearchService::SEARCH_TERM_LIMIT - { - chars_under_limit: ('a' * (char_limit - 1)), - chars_over_limit: ('a' * (char_limit + 1)), - terms_under_limit: ('abc ' * (term_limit - 1)), - terms_over_limit: ('abc ' * (term_limit + 1)) - } + context 'global search' do + using RSpec::Parameterized::TableSyntax + render_views + + context 'when block_anonymous_global_searches is disabled' do + before do + stub_feature_flags(block_anonymous_global_searches: false) end - where(:string_name, :expectation) do - :chars_under_limit | :not_to_set_flash - :chars_over_limit | :set_chars_flash - :terms_under_limit | :not_to_set_flash - :terms_over_limit | :set_terms_flash + it 'omits pipeline status from load' do + project = create(:project, :public) + expect(Gitlab::Cache::Ci::ProjectPipelineStatus).not_to receive(:load_in_batch_for_projects) + + get :show, params: { scope: 'projects', search: project.name } + + expect(assigns[:search_objects].first).to eq project end - with_them do - it do - get :show, params: { scope: 'projects', search: search_queries[string_name] } - - case expectation - when :not_to_set_flash - expect(controller).not_to set_flash[:alert] - when :set_chars_flash - expect(controller).to set_flash[:alert].to(/characters/) - when :set_terms_flash - expect(controller).to set_flash[:alert].to(/terms/) + context 'check search term length' do + let(:search_queries) do + char_limit = SearchService::SEARCH_CHAR_LIMIT + term_limit = SearchService::SEARCH_TERM_LIMIT + { + chars_under_limit: ('a' * (char_limit - 1)), + chars_over_limit: ('a' * (char_limit + 1)), + terms_under_limit: ('abc ' * (term_limit - 1)), + terms_over_limit: ('abc ' * (term_limit + 1)) + } + end + + where(:string_name, :expectation) do + :chars_under_limit | :not_to_set_flash + :chars_over_limit | :set_chars_flash + :terms_under_limit | :not_to_set_flash + :terms_over_limit | :set_terms_flash + end + + with_them do + it do + get :show, params: { scope: 'projects', search: search_queries[string_name] } + + case expectation + when :not_to_set_flash + expect(controller).not_to set_flash[:alert] + when :set_chars_flash + expect(controller).to set_flash[:alert].to(/characters/) + when :set_terms_flash + expect(controller).to set_flash[:alert].to(/terms/) + end end end end end - end - context 'when block_anonymous_global_searches is enabled' do - context 'for unauthenticated user' do - before do - sign_out(user) - end + context 'when block_anonymous_global_searches is enabled' do + context 'for unauthenticated user' do + before do + sign_out(user) + end - it 'redirects to login page' do - get :show, params: { scope: 'projects', search: '*' } + it 'redirects to login page' do + get :show, params: { scope: 'projects', search: '*' } - expect(response).to redirect_to new_user_session_path + expect(response).to redirect_to new_user_session_path + end end - end - context 'for authenticated user' do - it 'succeeds' do - get :show, params: { scope: 'projects', search: '*' } + context 'for authenticated user' do + it 'succeeds' do + get :show, params: { scope: 'projects', search: '*' } - expect(response).to have_gitlab_http_status(:ok) + expect(response).to have_gitlab_http_status(:ok) + end end end end - end - it 'finds issue comments' do - project = create(:project, :public) - note = create(:note_on_issue, project: project) + it 'finds issue comments' do + project = create(:project, :public) + note = create(:note_on_issue, project: project) - get :show, params: { project_id: project.id, scope: 'notes', search: note.note } - - expect(assigns[:search_objects].first).to eq note - end + get :show, params: { project_id: project.id, scope: 'notes', search: note.note } - context 'unique users tracking' do - before do - allow(Gitlab::UsageDataCounters::HLLRedisCounter).to receive(:track_event) + expect(assigns[:search_objects].first).to eq note end - it_behaves_like 'tracking unique hll events', :search_track_unique_users do - subject(:request) { get :show, params: { scope: 'projects', search: 'term' } } + context 'unique users tracking' do + before do + allow(Gitlab::UsageDataCounters::HLLRedisCounter).to receive(:track_event) + end + + it_behaves_like 'tracking unique hll events' do + subject(:request) { get :show, params: { scope: 'projects', search: 'term' } } - let(:target_id) { 'i_search_total' } - let(:expected_type) { instance_of(String) } + let(:target_id) { 'i_search_total' } + let(:expected_type) { instance_of(String) } + end end - end - context 'on restricted projects' do - context 'when signed out' do - before do - sign_out(user) + context 'on restricted projects' do + context 'when signed out' do + before do + sign_out(user) + end + + it "doesn't expose comments on issues" do + project = create(:project, :public, :issues_private) + note = create(:note_on_issue, project: project) + + get :show, params: { project_id: project.id, scope: 'notes', search: note.note } + + expect(assigns[:search_objects].count).to eq(0) + end end - it "doesn't expose comments on issues" do - project = create(:project, :public, :issues_private) - note = create(:note_on_issue, project: project) + it "doesn't expose comments on merge_requests" do + project = create(:project, :public, :merge_requests_private) + note = create(:note_on_merge_request, project: project) get :show, params: { project_id: project.id, scope: 'notes', search: note.note } expect(assigns[:search_objects].count).to eq(0) end - end - it "doesn't expose comments on merge_requests" do - project = create(:project, :public, :merge_requests_private) - note = create(:note_on_merge_request, project: project) + it "doesn't expose comments on snippets" do + project = create(:project, :public, :snippets_private) + note = create(:note_on_project_snippet, project: project) - get :show, params: { project_id: project.id, scope: 'notes', search: note.note } + get :show, params: { project_id: project.id, scope: 'notes', search: note.note } - expect(assigns[:search_objects].count).to eq(0) + expect(assigns[:search_objects].count).to eq(0) + end end + end - it "doesn't expose comments on snippets" do - project = create(:project, :public, :snippets_private) - note = create(:note_on_project_snippet, project: project) - - get :show, params: { project_id: project.id, scope: 'notes', search: note.note } + describe 'GET #count' do + it_behaves_like 'when the user cannot read cross project', :count, { search: 'hello', scope: 'projects' } + it_behaves_like 'with external authorization service enabled', :count, { search: 'hello', scope: 'projects' } - expect(assigns[:search_objects].count).to eq(0) - end - end - end + it 'returns the result count for the given term and scope' do + create(:project, :public, name: 'hello world') + create(:project, :public, name: 'foo bar') - describe 'GET #count' do - it_behaves_like 'when the user cannot read cross project', :count, { search: 'hello', scope: 'projects' } - it_behaves_like 'with external authorization service enabled', :count, { search: 'hello', scope: 'projects' } + get :count, params: { search: 'hello', scope: 'projects' } - it 'returns the result count for the given term and scope' do - create(:project, :public, name: 'hello world') - create(:project, :public, name: 'foo bar') + expect(response).to have_gitlab_http_status(:ok) + expect(json_response).to eq({ 'count' => '1' }) + end - get :count, params: { search: 'hello', scope: 'projects' } + it 'raises an error if search term is missing' do + expect do + get :count, params: { scope: 'projects' } + end.to raise_error(ActionController::ParameterMissing) + end - expect(response).to have_gitlab_http_status(:ok) - expect(json_response).to eq({ 'count' => '1' }) + it 'raises an error if search scope is missing' do + expect do + get :count, params: { search: 'hello' } + end.to raise_error(ActionController::ParameterMissing) + end end - it 'raises an error if search term is missing' do - expect do - get :count, params: { scope: 'projects' } - end.to raise_error(ActionController::ParameterMissing) + describe 'GET #autocomplete' do + it_behaves_like 'when the user cannot read cross project', :autocomplete, { term: 'hello' } + it_behaves_like 'with external authorization service enabled', :autocomplete, { term: 'hello' } end - it 'raises an error if search scope is missing' do - expect do - get :count, params: { search: 'hello' } - end.to raise_error(ActionController::ParameterMissing) - end - end + describe '#append_info_to_payload' do + it 'appends search metadata for logging' do + last_payload = nil + original_append_info_to_payload = controller.method(:append_info_to_payload) - describe 'GET #autocomplete' do - it_behaves_like 'when the user cannot read cross project', :autocomplete, { term: 'hello' } - it_behaves_like 'with external authorization service enabled', :autocomplete, { term: 'hello' } - end + expect(controller).to receive(:append_info_to_payload) do |payload| + original_append_info_to_payload.call(payload) + last_payload = payload + end - describe '#append_info_to_payload' do - it 'appends search metadata for logging' do - last_payload = nil - original_append_info_to_payload = controller.method(:append_info_to_payload) + get :show, params: { scope: 'issues', search: 'hello world', group_id: '123', project_id: '456', confidential: true, state: true, force_search_results: true } - expect(controller).to receive(:append_info_to_payload) do |payload| - original_append_info_to_payload.call(payload) - last_payload = payload + expect(last_payload[:metadata]['meta.search.group_id']).to eq('123') + expect(last_payload[:metadata]['meta.search.project_id']).to eq('456') + expect(last_payload[:metadata]).not_to have_key('meta.search.search') + expect(last_payload[:metadata]['meta.search.scope']).to eq('issues') + expect(last_payload[:metadata]['meta.search.force_search_results']).to eq('true') + expect(last_payload[:metadata]['meta.search.filters.confidential']).to eq('true') + expect(last_payload[:metadata]['meta.search.filters.state']).to eq('true') end + end + end - get :show, params: { scope: 'issues', search: 'hello world', group_id: '123', project_id: '456', confidential: true, state: true, force_search_results: true } + context 'unauthorized user' do + describe 'GET #opensearch' do + render_views + + it 'renders xml' do + get :opensearch, format: :xml + + doc = Nokogiri::XML.parse(response.body) - expect(last_payload[:metadata]['meta.search.group_id']).to eq('123') - expect(last_payload[:metadata]['meta.search.project_id']).to eq('456') - expect(last_payload[:metadata]).not_to have_key('meta.search.search') - expect(last_payload[:metadata]['meta.search.scope']).to eq('issues') - expect(last_payload[:metadata]['meta.search.force_search_results']).to eq('true') - expect(last_payload[:metadata]['meta.search.filters.confidential']).to eq('true') - expect(last_payload[:metadata]['meta.search.filters.state']).to eq('true') + expect(response).to have_gitlab_http_status(:ok) + expect(doc.css('OpenSearchDescription ShortName').text).to eq('GitLab') + expect(doc.css('OpenSearchDescription *').map(&:name)).to eq(%w[ShortName Description InputEncoding Image Url SearchForm]) + end end end end |