diff options
Diffstat (limited to 'spec/requests/api/users_spec.rb')
| -rw-r--r-- | spec/requests/api/users_spec.rb | 144 |
1 files changed, 94 insertions, 50 deletions
diff --git a/spec/requests/api/users_spec.rb b/spec/requests/api/users_spec.rb index 806b586ef49..7330c89fe77 100644 --- a/spec/requests/api/users_spec.rb +++ b/spec/requests/api/users_spec.rb @@ -1460,39 +1460,47 @@ RSpec.describe API::Users, :do_not_mock_admin_mode do end describe 'GET /user/:id/gpg_keys' do - context 'when unauthenticated' do - it 'returns authentication error' do - get api("/users/#{user.id}/gpg_keys") + it 'returns 404 for non-existing user' do + get api('/users/0/gpg_keys') - expect(response).to have_gitlab_http_status(:unauthorized) - end + expect(response).to have_gitlab_http_status(:not_found) + expect(json_response['message']).to eq('404 User Not Found') end - context 'when authenticated' do - it 'returns 404 for non-existing user' do - get api('/users/0/gpg_keys', admin) + it 'returns array of GPG keys' do + user.gpg_keys << gpg_key - expect(response).to have_gitlab_http_status(:not_found) - expect(json_response['message']).to eq('404 User Not Found') - end + get api("/users/#{user.id}/gpg_keys") - it 'returns 404 error if key not foud' do - delete api("/users/#{user.id}/gpg_keys/#{non_existing_record_id}", admin) + expect(response).to have_gitlab_http_status(:ok) + expect(response).to include_pagination_headers + expect(json_response).to be_an Array + expect(json_response.first['key']).to eq(gpg_key.key) + end + end - expect(response).to have_gitlab_http_status(:not_found) - expect(json_response['message']).to eq('404 GPG Key Not Found') - end + describe 'GET /user/:id/gpg_keys/:key_id' do + it 'returns 404 for non-existing user' do + get api('/users/0/gpg_keys/1') - it 'returns array of GPG keys' do - user.gpg_keys << gpg_key + expect(response).to have_gitlab_http_status(:not_found) + expect(json_response['message']).to eq('404 User Not Found') + end - get api("/users/#{user.id}/gpg_keys", admin) + it 'returns 404 for non-existing key' do + get api("/users/#{user.id}/gpg_keys/0") - expect(response).to have_gitlab_http_status(:ok) - expect(response).to include_pagination_headers - expect(json_response).to be_an Array - expect(json_response.first['key']).to eq(gpg_key.key) - end + expect(response).to have_gitlab_http_status(:not_found) + expect(json_response['message']).to eq('404 GPG Key Not Found') + end + + it 'returns a single GPG key' do + user.gpg_keys << gpg_key + + get api("/users/#{user.id}/gpg_keys/#{gpg_key.id}") + + expect(response).to have_gitlab_http_status(:ok) + expect(json_response['key']).to eq(gpg_key.key) end end @@ -2308,23 +2316,31 @@ RSpec.describe API::Users, :do_not_mock_admin_mode do end describe 'POST /users/:id/activate' do + subject(:activate) { post api("/users/#{user_id}/activate", api_user) } + + let(:user_id) { user.id } + context 'performed by a non-admin user' do + let(:api_user) { user } + it 'is not authorized to perform the action' do - post api("/users/#{user.id}/activate", user) + activate expect(response).to have_gitlab_http_status(:forbidden) end end context 'performed by an admin user' do + let(:api_user) { admin } + context 'for a deactivated user' do before do user.deactivate - - post api("/users/#{user.id}/activate", admin) end it 'activates a deactivated user' do + activate + expect(response).to have_gitlab_http_status(:created) expect(user.reload.state).to eq('active') end @@ -2333,11 +2349,11 @@ RSpec.describe API::Users, :do_not_mock_admin_mode do context 'for an active user' do before do user.activate - - post api("/users/#{user.id}/activate", admin) end it 'returns 201' do + activate + expect(response).to have_gitlab_http_status(:created) expect(user.reload.state).to eq('active') end @@ -2346,11 +2362,11 @@ RSpec.describe API::Users, :do_not_mock_admin_mode do context 'for a blocked user' do before do user.block - - post api("/users/#{user.id}/activate", admin) end it 'returns 403' do + activate + expect(response).to have_gitlab_http_status(:forbidden) expect(json_response['message']).to eq('403 Forbidden - A blocked user must be unblocked to be activated') expect(user.reload.state).to eq('blocked') @@ -2360,11 +2376,11 @@ RSpec.describe API::Users, :do_not_mock_admin_mode do context 'for a ldap blocked user' do before do user.ldap_block - - post api("/users/#{user.id}/activate", admin) end it 'returns 403' do + activate + expect(response).to have_gitlab_http_status(:forbidden) expect(json_response['message']).to eq('403 Forbidden - A blocked user must be unblocked to be activated') expect(user.reload.state).to eq('ldap_blocked') @@ -2372,8 +2388,10 @@ RSpec.describe API::Users, :do_not_mock_admin_mode do end context 'for a user that does not exist' do + let(:user_id) { 0 } + before do - post api("/users/0/activate", admin) + activate end it_behaves_like '404' @@ -2382,15 +2400,23 @@ RSpec.describe API::Users, :do_not_mock_admin_mode do end describe 'POST /users/:id/deactivate' do + subject(:deactivate) { post api("/users/#{user_id}/deactivate", api_user) } + + let(:user_id) { user.id } + context 'performed by a non-admin user' do + let(:api_user) { user } + it 'is not authorized to perform the action' do - post api("/users/#{user.id}/deactivate", user) + deactivate expect(response).to have_gitlab_http_status(:forbidden) end end context 'performed by an admin user' do + let(:api_user) { admin } + context 'for an active user' do let(:activity) { {} } let(:user) { create(:user, **activity) } @@ -2398,11 +2424,9 @@ RSpec.describe API::Users, :do_not_mock_admin_mode do context 'with no recent activity' do let(:activity) { { last_activity_on: ::User::MINIMUM_INACTIVE_DAYS.next.days.ago } } - before do - post api("/users/#{user.id}/deactivate", admin) - end - it 'deactivates an active user' do + deactivate + expect(response).to have_gitlab_http_status(:created) expect(user.reload.state).to eq('deactivated') end @@ -2411,11 +2435,9 @@ RSpec.describe API::Users, :do_not_mock_admin_mode do context 'with recent activity' do let(:activity) { { last_activity_on: ::User::MINIMUM_INACTIVE_DAYS.pred.days.ago } } - before do - post api("/users/#{user.id}/deactivate", admin) - end - it 'does not deactivate an active user' do + deactivate + expect(response).to have_gitlab_http_status(:forbidden) expect(json_response['message']).to eq("403 Forbidden - The user you are trying to deactivate has been active in the past #{::User::MINIMUM_INACTIVE_DAYS} days and cannot be deactivated") expect(user.reload.state).to eq('active') @@ -2426,11 +2448,11 @@ RSpec.describe API::Users, :do_not_mock_admin_mode do context 'for a deactivated user' do before do user.deactivate - - post api("/users/#{user.id}/deactivate", admin) end it 'returns 201' do + deactivate + expect(response).to have_gitlab_http_status(:created) expect(user.reload.state).to eq('deactivated') end @@ -2439,11 +2461,11 @@ RSpec.describe API::Users, :do_not_mock_admin_mode do context 'for a blocked user' do before do user.block - - post api("/users/#{user.id}/deactivate", admin) end it 'returns 403' do + deactivate + expect(response).to have_gitlab_http_status(:forbidden) expect(json_response['message']).to eq('403 Forbidden - A blocked user cannot be deactivated by the API') expect(user.reload.state).to eq('blocked') @@ -2453,20 +2475,33 @@ RSpec.describe API::Users, :do_not_mock_admin_mode do context 'for a ldap blocked user' do before do user.ldap_block - - post api("/users/#{user.id}/deactivate", admin) end it 'returns 403' do + deactivate + expect(response).to have_gitlab_http_status(:forbidden) expect(json_response['message']).to eq('403 Forbidden - A blocked user cannot be deactivated by the API') expect(user.reload.state).to eq('ldap_blocked') end end + context 'for an internal user' do + let(:user) { User.alert_bot } + + it 'returns 403' do + deactivate + + expect(response).to have_gitlab_http_status(:forbidden) + expect(json_response['message']).to eq('403 Forbidden - An internal user cannot be deactivated by the API') + end + end + context 'for a user that does not exist' do + let(:user_id) { 0 } + before do - post api("/users/0/deactivate", admin) + deactivate end it_behaves_like '404' @@ -2506,6 +2541,15 @@ RSpec.describe API::Users, :do_not_mock_admin_mode do expect(json_response['message']).to eq('404 User Not Found') end + it 'returns a 403 error if user is internal' do + internal_user = create(:user, :bot) + + post api("/users/#{internal_user.id}/block", admin) + + expect(response).to have_gitlab_http_status(:forbidden) + expect(json_response['message']).to eq('An internal user cannot be blocked') + end + it 'returns a 201 if user is already blocked' do post api("/users/#{blocked_user.id}/block", admin) |