1 files changed, 118 insertions, 65 deletions
diff --git a/spec/features/merge_request/user_creates_merge_request_spec.rb b/spec/features/merge_request/user_creates_merge_request_spec.rb
index c8b22bb3125..0ae4ef18649 100644
--- a/spec/features/merge_request/user_creates_merge_request_spec.rb
+++ b/spec/features/merge_request/user_creates_merge_request_spec.rb
@@ -1,111 +1,164 @@
 # frozen_string_literal: true
 
-require "spec_helper"
+require 'spec_helper'
 
-RSpec.describe "User creates a merge request", :js do
+RSpec.describe 'User creates a merge request', :js do
   include ProjectForksHelper
 
-  let_it_be(:project) { create(:project, :repository) }
-  let_it_be(:user) { create(:user) }
-
-  let(:title) { "Some feature" }
-
-  before do
-    project.add_maintainer(user)
-    sign_in(user)
-  end
-
-  it "creates a merge request" do
-    visit(project_new_merge_request_path(project))
+  shared_examples 'creates a merge request' do
+    specify do
+      visit(project_new_merge_request_path(project))
 
-    find(".js-source-branch").click
-    click_link("fix")
+      compare_source_and_target('fix', 'feature')
 
-    find(".js-target-branch").click
-    click_link("feature")
+      page.within('.merge-request-form') do
+        expect(page.find('#merge_request_description')['placeholder']).to eq 'Describe the goal of the changes and what reviewers should be aware of.'
+      end
 
-    click_button("Compare branches")
+      fill_in('Title', with: title)
+      click_button('Create merge request')
 
-    page.within('.merge-request-form') do
-      expect(page.find('#merge_request_description')['placeholder']).to eq 'Describe the goal of the changes and what reviewers should be aware of.'
+      page.within('.merge-request') do
+        expect(page).to have_content(title)
+      end
     end
+  end
 
-    fill_in("Title", with: title)
-    click_button("Create merge request")
+  shared_examples 'renders not found' do
+    specify do
+      visit project_new_merge_request_path(project)
 
-    page.within(".merge-request") do
-      expect(page).to have_content(title)
+      expect(page).to have_title('Not Found')
+      expect(page).to have_content('Page Not Found')
     end
   end
 
-  context "XSS branch name exists" do
+  context 'when user is a direct project member' do
+    let_it_be(:project) { create(:project, :repository) }
+    let_it_be(:user) { create(:user) }
+
+    let(:title) { 'Some feature' }
+
     before do
-      project.repository.create_branch("<img/src='x'/onerror=alert('oops')>", "master")
+      project.add_maintainer(user)
+      sign_in(user)
     end
 
-    it "doesn't execute the dodgy branch name" do
-      visit(project_new_merge_request_path(project))
+    it_behaves_like 'creates a merge request'
 
-      find(".js-source-branch").click
-      click_link("<img/src='x'/onerror=alert('oops')>")
+    context 'with XSS branch name' do
+      before do
+        project.repository.create_branch("<img/src='x'/onerror=alert('oops')>", 'master')
+      end
 
-      find(".js-target-branch").click
-      click_link("feature")
+      it 'does not execute the suspicious branch name' do
+        visit(project_new_merge_request_path(project))
 
-      click_button("Compare branches")
+        compare_source_and_target("<img/src='x'/onerror=alert('oops')>", 'feature')
 
-      expect { page.driver.browser.switch_to.alert }.to raise_error(Selenium::WebDriver::Error::NoSuchAlertError)
+        expect { page.driver.browser.switch_to.alert }.to raise_error(Selenium::WebDriver::Error::NoSuchAlertError)
+      end
     end
-  end
 
-  context "to a forked project" do
-    let(:forked_project) { fork_project(project, user, namespace: user.namespace, repository: true) }
+    context 'to a forked project' do
+      let(:forked_project) { fork_project(project, user, namespace: user.namespace, repository: true) }
+
+      it 'creates a merge request', :sidekiq_might_not_need_inline do
+        visit(project_new_merge_request_path(forked_project))
+
+        expect(page).to have_content('Source branch').and have_content('Target branch')
+        expect(find('#merge_request_target_project_id', visible: false).value).to eq(project.id.to_s)
 
-    it "creates a merge request", :sidekiq_might_not_need_inline do
-      visit(project_new_merge_request_path(forked_project))
+        click_button('Compare branches and continue')
 
-      expect(page).to have_content("Source branch").and have_content("Target branch")
-      expect(find("#merge_request_target_project_id", visible: false).value).to eq(project.id.to_s)
+        expect(page).to have_content('You must select source and target branch')
 
-      click_button("Compare branches and continue")
+        first('.js-source-project').click
+        first('.dropdown-source-project a', text: forked_project.full_path)
 
-      expect(page).to have_content("You must select source and target branch")
+        first('.js-target-project').click
+        first('.dropdown-target-project a', text: project.full_path)
 
-      first(".js-source-project").click
-      first(".dropdown-source-project a", text: forked_project.full_path)
+        first('.js-source-branch').click
 
-      first(".js-target-project").click
-      first(".dropdown-target-project a", text: project.full_path)
+        wait_for_requests
 
-      first(".js-source-branch").click
+        source_branch = 'fix'
 
-      wait_for_requests
+        first('.js-source-branch-dropdown .dropdown-content a', text: source_branch).click
 
-      source_branch = "fix"
+        click_button('Compare branches and continue')
 
-      first(".js-source-branch-dropdown .dropdown-content a", text: source_branch).click
+        expect(page).to have_text _('New merge request')
 
-      click_button("Compare branches and continue")
+        page.within('form#new_merge_request') do
+          fill_in('Title', with: title)
+        end
 
-      expect(page).to have_text _('New merge request')
+        expect(find('.js-assignee-search')['data-project-id']).to eq(project.id.to_s)
+        find('.js-assignee-search').click
 
-      page.within("form#new_merge_request") do
-        fill_in("Title", with: title)
+        page.within('.dropdown-menu-user') do
+          expect(page).to have_content('Unassigned')
+                      .and have_content(user.name)
+                      .and have_content(project.users.first.name)
+        end
+        find('.js-assignee-search').click
+
+        click_button('Create merge request')
+
+        expect(page).to have_content(title).and have_content("requested to merge #{forked_project.full_path}:#{source_branch} into master")
+      end
+    end
+  end
+
+  context 'when user is an inherited member from the group' do
+    let_it_be(:group) { create(:group, :public) }
+
+    let(:user) { create(:user) }
+
+    context 'when project is public and merge requests are private' do
+      let_it_be(:project) do
+        create(:project,
+               :public,
+               :repository,
+               group: group,
+               merge_requests_access_level: ProjectFeature::DISABLED)
       end
 
-      expect(find(".js-assignee-search")["data-project-id"]).to eq(project.id.to_s)
-      find('.js-assignee-search').click
+      context 'and user is a guest' do
+        before do
+          group.add_guest(user)
+          sign_in(user)
+        end
 
-      page.within(".dropdown-menu-user") do
-        expect(page).to have_content("Unassigned")
-                   .and have_content(user.name)
-                   .and have_content(project.users.first.name)
+        it_behaves_like 'renders not found'
       end
-      find('.js-assignee-search').click
+    end
+
+    context 'when project is private' do
+      let_it_be(:project) { create(:project, :private, :repository, group: group) }
 
-      click_button("Create merge request")
+      context 'and user is a guest' do
+        before do
+          group.add_guest(user)
+          sign_in(user)
+        end
 
-      expect(page).to have_content(title).and have_content("requested to merge #{forked_project.full_path}:#{source_branch} into master")
+        it_behaves_like 'renders not found'
+      end
     end
   end
+
+  private
+
+  def compare_source_and_target(source_branch, target_branch)
+    find('.js-source-branch').click
+    click_link(source_branch)
+
+    find('.js-target-branch').click
+    click_link(target_branch)
+
+    click_button('Compare branches')
+  end
 end