diff options
Diffstat (limited to 'spec/requests')
76 files changed, 3615 insertions, 2171 deletions
diff --git a/spec/requests/api/admin/instance_clusters_spec.rb b/spec/requests/api/admin/instance_clusters_spec.rb index 1052080aad4..ab3b6b718e1 100644 --- a/spec/requests/api/admin/instance_clusters_spec.rb +++ b/spec/requests/api/admin/instance_clusters_spec.rb @@ -90,6 +90,8 @@ RSpec.describe ::API::Admin::InstanceClusters do expect(json_response['environment_scope']).to eq('*') expect(json_response['cluster_type']).to eq('instance_type') expect(json_response['domain']).to eq('example.com') + expect(json_response['enabled']).to be_truthy + expect(json_response['managed']).to be_truthy end it 'returns kubernetes platform information' do @@ -163,6 +165,7 @@ RSpec.describe ::API::Admin::InstanceClusters do name: 'test-instance-cluster', domain: 'domain.example.com', managed: false, + enabled: false, namespace_per_environment: false, platform_kubernetes_attributes: platform_kubernetes_attributes, clusterable: clusterable @@ -205,9 +208,9 @@ RSpec.describe ::API::Admin::InstanceClusters do expect(cluster_result.name).to eq('test-instance-cluster') expect(cluster_result.domain).to eq('domain.example.com') expect(cluster_result.environment_scope).to eq('*') - expect(cluster_result.enabled).to eq(true) - expect(platform_kubernetes.authorization_type).to eq('rbac') expect(cluster_result.managed).to be_falsy + expect(cluster_result.enabled).to be_falsy + expect(platform_kubernetes.authorization_type).to eq('rbac') expect(cluster_result.namespace_per_environment).to eq(false) expect(platform_kubernetes.api_url).to eq("https://example.com") expect(platform_kubernetes.token).to eq('sample-token') @@ -301,6 +304,8 @@ RSpec.describe ::API::Admin::InstanceClusters do let(:update_params) do { domain: domain, + managed: false, + enabled: false, platform_kubernetes_attributes: platform_kubernetes_attributes } end @@ -326,6 +331,8 @@ RSpec.describe ::API::Admin::InstanceClusters do it 'updates cluster attributes' do expect(cluster.domain).to eq('new-domain.com') + expect(cluster.managed).to be_falsy + expect(cluster.enabled).to be_falsy end end @@ -338,6 +345,8 @@ RSpec.describe ::API::Admin::InstanceClusters do it 'does not update cluster attributes' do expect(cluster.domain).to eq('old-domain.com') + expect(cluster.managed).to be_truthy + expect(cluster.enabled).to be_truthy end it 'returns validation errors' do diff --git a/spec/requests/api/api_guard/admin_mode_middleware_spec.rb b/spec/requests/api/api_guard/admin_mode_middleware_spec.rb index 4b477f829a7..63bcec4b52a 100644 --- a/spec/requests/api/api_guard/admin_mode_middleware_spec.rb +++ b/spec/requests/api/api_guard/admin_mode_middleware_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' -RSpec.describe API::APIGuard::AdminModeMiddleware, :do_not_mock_admin_mode, :request_store do +RSpec.describe API::APIGuard::AdminModeMiddleware, :request_store do let(:user) { create(:admin) } it 'is loaded' do diff --git a/spec/requests/api/broadcast_messages_spec.rb b/spec/requests/api/broadcast_messages_spec.rb index b5b6ce106e5..b023ec398a2 100644 --- a/spec/requests/api/broadcast_messages_spec.rb +++ b/spec/requests/api/broadcast_messages_spec.rb @@ -112,7 +112,7 @@ RSpec.describe API::BroadcastMessages do expect(response).to have_gitlab_http_status(:bad_request) end - it 'accepts an active dismissable value ' do + it 'accepts an active dismissable value' do attrs = { message: 'new message', dismissable: true } post api('/broadcast_messages', admin), params: attrs @@ -197,7 +197,7 @@ RSpec.describe API::BroadcastMessages do expect(response).to have_gitlab_http_status(:bad_request) end - it 'accepts a new dismissable value ' do + it 'accepts a new dismissable value' do attrs = { message: 'new message', dismissable: true } put api("/broadcast_messages/#{message.id}", admin), params: attrs diff --git a/spec/requests/api/ci/runner/jobs_artifacts_spec.rb b/spec/requests/api/ci/runner/jobs_artifacts_spec.rb index 71be0c30f5a..4d8da50f8f0 100644 --- a/spec/requests/api/ci/runner/jobs_artifacts_spec.rb +++ b/spec/requests/api/ci/runner/jobs_artifacts_spec.rb @@ -242,7 +242,7 @@ RSpec.describe API::Ci::Runner, :clean_gitlab_redis_shared_state do } expect { authorize_artifacts_with_token_in_headers(artifact_type: :lsif) } - .to change { Gitlab::UsageDataCounters::HLLRedisCounter.unique_events(tracking_params) } + .to change { Gitlab::UsageDataCounters::HLLRedisCounter.unique_events(**tracking_params) } .by(1) end end diff --git a/spec/requests/api/ci/runner/jobs_put_spec.rb b/spec/requests/api/ci/runner/jobs_put_spec.rb index cbefaa2c321..e9d793d5a22 100644 --- a/spec/requests/api/ci/runner/jobs_put_spec.rb +++ b/spec/requests/api/ci/runner/jobs_put_spec.rb @@ -61,6 +61,23 @@ RSpec.describe API::Ci::Runner, :clean_gitlab_redis_shared_state do expect(response.header).not_to have_key('X-GitLab-Trace-Update-Interval') end + context 'when runner sends an unrecognized field in a payload' do + ## + # This test case is here to ensure that the API used to communicate + # runner with GitLab can evolve. + # + # In case of adding new features on the Runner side we do not want + # GitLab-side to reject requests containing unrecognizable fields in + # a payload, because runners can be updated before a new version of + # GitLab is installed. + # + it 'ignores unrecognized fields' do + update_job(state: 'success', 'unknown': 'something') + + expect(job.reload).to be_success + end + end + context 'when failure_reason is script_failure' do before do update_job(state: 'failed', failure_reason: 'script_failure') diff --git a/spec/requests/api/ci/runner/jobs_trace_spec.rb b/spec/requests/api/ci/runner/jobs_trace_spec.rb index 1980c1a9f51..5b7a33d23d8 100644 --- a/spec/requests/api/ci/runner/jobs_trace_spec.rb +++ b/spec/requests/api/ci/runner/jobs_trace_spec.rb @@ -135,7 +135,7 @@ RSpec.describe API::Ci::Runner, :clean_gitlab_redis_shared_state do patch_the_trace end - it 'returns Forbidden ' do + it 'returns Forbidden' do expect(response).to have_gitlab_http_status(:forbidden) end end diff --git a/spec/requests/api/composer_packages_spec.rb b/spec/requests/api/composer_packages_spec.rb index ef4682466d5..06d4a2c6017 100644 --- a/spec/requests/api/composer_packages_spec.rb +++ b/spec/requests/api/composer_packages_spec.rb @@ -167,7 +167,8 @@ RSpec.describe API::ComposerPackages do describe 'GET /api/v4/group/:id/-/packages/composer/*package_name.json' do let(:package_name) { 'foobar' } - let(:url) { "/group/#{group.id}/-/packages/composer/#{package_name}.json" } + let(:sha) { '$1234' } + let(:url) { "/group/#{group.id}/-/packages/composer/#{package_name}#{sha}.json" } subject { get api(url), headers: headers } @@ -206,6 +207,16 @@ RSpec.describe API::ComposerPackages do it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member] end end + + context 'without a sha' do + let(:sha) { '' } + + include_context 'Composer api group access', 'PRIVATE', :developer, true do + include_context 'Composer user type', :developer, true do + it_behaves_like 'process Composer api request', :developer, :not_found, true + end + end + end end it_behaves_like 'rejects Composer access with unknown group id' diff --git a/spec/requests/api/discussions_spec.rb b/spec/requests/api/discussions_spec.rb index 720ea429c2c..bdfc1589c9e 100644 --- a/spec/requests/api/discussions_spec.rb +++ b/spec/requests/api/discussions_spec.rb @@ -61,6 +61,37 @@ RSpec.describe API::Discussions do expect(response).to have_gitlab_http_status(:bad_request) end end + + context "when a commit parameter is given" do + it "creates the discussion on that commit within the merge request" do + # SHAs of "feature" and its parent in spec/support/gitlab-git-test.git + mr_commit = '0b4bc9a49b562e85de7cc9e834518ea6828729b9' + parent_commit = 'ae73cb07c9eeaf35924a10f713b364d32b2dd34f' + file = "files/ruby/feature.rb" + line_range = { + "start_line_code" => Gitlab::Git.diff_line_code(file, 1, 1), + "end_line_code" => Gitlab::Git.diff_line_code(file, 1, 1), + "start_line_type" => "text", + "end_line_type" => "text" + } + position = build( + :text_diff_position, + :added, + file: file, + new_line: 1, + line_range: line_range, + base_sha: parent_commit, + head_sha: mr_commit, + start_sha: parent_commit + ) + + post api("/projects/#{project.id}/merge_requests/#{noteable['iid']}/discussions", user), + params: { body: 'MR discussion on commit', position: position.to_h, commit_id: mr_commit } + + expect(response).to have_gitlab_http_status(:created) + expect(json_response['notes'].first['commit_id']).to eq(mr_commit) + end + end end context 'when noteable is a Commit' do diff --git a/spec/requests/api/feature_flags_spec.rb b/spec/requests/api/feature_flags_spec.rb index 90d4a7b8b21..dd12648f4dd 100644 --- a/spec/requests/api/feature_flags_spec.rb +++ b/spec/requests/api/feature_flags_spec.rb @@ -65,26 +65,6 @@ RSpec.describe API::FeatureFlags do expect(json_response.map { |f| f['version'] }).to eq(%w[legacy_flag legacy_flag]) end - it 'does not return the legacy flag version when the feature flag is disabled' do - stub_feature_flags(feature_flags_new_version: false) - - subject - - expect(response).to have_gitlab_http_status(:ok) - expect(response).to match_response_schema('public_api/v4/feature_flags') - expect(json_response.select { |f| f.key?('version') }).to eq([]) - end - - it 'does not return strategies if the new flag is disabled' do - stub_feature_flags(feature_flags_new_version: false) - - subject - - expect(response).to have_gitlab_http_status(:ok) - expect(response).to match_response_schema('public_api/v4/feature_flags') - expect(json_response.select { |f| f.key?('strategies') }).to eq([]) - end - it 'does not have N+1 problem' do control_count = ActiveRecord::QueryRecorder.new { subject } @@ -134,16 +114,6 @@ RSpec.describe API::FeatureFlags do }] }]) end - - it 'does not return a version 2 flag when the feature flag is disabled' do - stub_feature_flags(feature_flags_new_version: false) - - subject - - expect(response).to have_gitlab_http_status(:ok) - expect(response).to match_response_schema('public_api/v4/feature_flags') - expect(json_response).to eq([]) - end end context 'with version 1 and 2 feature flags' do @@ -159,20 +129,6 @@ RSpec.describe API::FeatureFlags do expect(response).to match_response_schema('public_api/v4/feature_flags') expect(json_response.map { |f| f['name'] }).to eq(%w[legacy_flag new_version_flag]) end - - it 'returns only version 1 flags when the feature flag is disabled' do - stub_feature_flags(feature_flags_new_version: false) - create(:operations_feature_flag, project: project, name: 'legacy_flag') - feature_flag = create(:operations_feature_flag, :new_version_flag, project: project, name: 'new_version_flag') - strategy = create(:operations_strategy, feature_flag: feature_flag, name: 'default', parameters: {}) - create(:operations_scope, strategy: strategy, environment_scope: 'production') - - subject - - expect(response).to have_gitlab_http_status(:ok) - expect(response).to match_response_schema('public_api/v4/feature_flags') - expect(json_response.map { |f| f['name'] }).to eq(['legacy_flag']) - end end end @@ -224,18 +180,6 @@ RSpec.describe API::FeatureFlags do }] }) end - - it 'returns a 404 when the feature is disabled' do - stub_feature_flags(feature_flags_new_version: false) - feature_flag = create(:operations_feature_flag, :new_version_flag, project: project, name: 'feature1') - strategy = create(:operations_strategy, feature_flag: feature_flag, name: 'default', parameters: {}) - create(:operations_scope, strategy: strategy, environment_scope: 'production') - - get api("/projects/#{project.id}/feature_flags/feature1", user) - - expect(response).to have_gitlab_http_status(:not_found) - expect(json_response).to eq({ 'message' => '404 Not found' }) - end end end @@ -290,16 +234,6 @@ RSpec.describe API::FeatureFlags do expect(json_response['version']).to eq('legacy_flag') end - it 'does not return version when new version flags are disabled' do - stub_feature_flags(feature_flags_new_version: false) - - subject - - expect(response).to have_gitlab_http_status(:created) - expect(response).to match_response_schema('public_api/v4/feature_flag') - expect(json_response.key?('version')).to eq(false) - end - context 'with active set to false in the params for a legacy flag' do let(:params) do { @@ -505,20 +439,6 @@ RSpec.describe API::FeatureFlags do environment_scope: 'staging' }]) end - - it 'returns a 422 when the feature flag is disabled' do - stub_feature_flags(feature_flags_new_version: false) - params = { - name: 'new-feature', - version: 'new_version_flag' - } - - post api("/projects/#{project.id}/feature_flags", user), params: params - - expect(response).to have_gitlab_http_status(:unprocessable_entity) - expect(json_response).to eq({ 'message' => 'Version 2 flags are not enabled for this project' }) - expect(project.operations_feature_flags.count).to eq(0) - end end context 'when given invalid parameters' do @@ -744,16 +664,6 @@ RSpec.describe API::FeatureFlags do name: 'feature1', description: 'old description') end - it 'returns a 404 if the feature is disabled' do - stub_feature_flags(feature_flags_new_version: false) - params = { description: 'new description' } - - put api("/projects/#{project.id}/feature_flags/feature1", user), params: params - - expect(response).to have_gitlab_http_status(:not_found) - expect(feature_flag.reload.description).to eq('old description') - end - it 'returns a 422' do params = { description: 'new description' } @@ -771,16 +681,6 @@ RSpec.describe API::FeatureFlags do name: 'feature1', description: 'old description') end - it 'returns a 404 if the feature is disabled' do - stub_feature_flags(feature_flags_new_version: false) - params = { description: 'new description' } - - put api("/projects/#{project.id}/feature_flags/feature1", user), params: params - - expect(response).to have_gitlab_http_status(:not_found) - expect(feature_flag.reload.description).to eq('old description') - end - it 'returns a 404 if the feature flag does not exist' do params = { description: 'new description' } @@ -1100,15 +1000,6 @@ RSpec.describe API::FeatureFlags do expect(json_response['version']).to eq('legacy_flag') end - it 'does not return version when new version flags are disabled' do - stub_feature_flags(feature_flags_new_version: false) - - subject - - expect(response).to have_gitlab_http_status(:ok) - expect(json_response.key?('version')).to eq(false) - end - context 'with a version 2 feature flag' do let!(:feature_flag) { create(:operations_feature_flag, :new_version_flag, project: project) } @@ -1117,14 +1008,6 @@ RSpec.describe API::FeatureFlags do expect(response).to have_gitlab_http_status(:ok) end - - it 'returns a 404 if the feature is disabled' do - stub_feature_flags(feature_flags_new_version: false) - - expect { subject }.not_to change { Operations::FeatureFlag.count } - - expect(response).to have_gitlab_http_status(:not_found) - end end end end diff --git a/spec/requests/api/features_spec.rb b/spec/requests/api/features_spec.rb index 3f443b4f92b..0e163ec2154 100644 --- a/spec/requests/api/features_spec.rb +++ b/spec/requests/api/features_spec.rb @@ -6,6 +6,18 @@ RSpec.describe API::Features, stub_feature_flags: false do let_it_be(:user) { create(:user) } let_it_be(:admin) { create(:admin) } + # Find any `development` feature flag name + let(:known_feature_flag) do + Feature::Definition.definitions + .values.find(&:development?) + end + + let(:known_feature_flag_definition_hash) do + a_hash_including( + 'type' => 'development' + ) + end + before do Feature.reset Flipper.unregister_groups @@ -22,12 +34,14 @@ RSpec.describe API::Features, stub_feature_flags: false do { 'name' => 'feature_1', 'state' => 'on', - 'gates' => [{ 'key' => 'boolean', 'value' => true }] + 'gates' => [{ 'key' => 'boolean', 'value' => true }], + 'definition' => nil }, { 'name' => 'feature_2', 'state' => 'off', - 'gates' => [{ 'key' => 'boolean', 'value' => false }] + 'gates' => [{ 'key' => 'boolean', 'value' => false }], + 'definition' => nil }, { 'name' => 'feature_3', @@ -35,7 +49,14 @@ RSpec.describe API::Features, stub_feature_flags: false do 'gates' => [ { 'key' => 'boolean', 'value' => false }, { 'key' => 'groups', 'value' => ['perf_team'] } - ] + ], + 'definition' => nil + }, + { + 'name' => known_feature_flag.name, + 'state' => 'on', + 'gates' => [{ 'key' => 'boolean', 'value' => true }], + 'definition' => known_feature_flag_definition_hash } ] end @@ -44,6 +65,7 @@ RSpec.describe API::Features, stub_feature_flags: false do Feature.enable('feature_1') Feature.disable('feature_2') Feature.enable('feature_3', Feature.group(:perf_team)) + Feature.enable(known_feature_flag.name) end it 'returns a 401 for anonymous users' do @@ -67,7 +89,7 @@ RSpec.describe API::Features, stub_feature_flags: false do end describe 'POST /feature' do - let(:feature_name) { 'my_feature' } + let(:feature_name) { known_feature_flag.name } context 'when the feature does not exist' do it 'returns a 401 for anonymous users' do @@ -87,43 +109,55 @@ RSpec.describe API::Features, stub_feature_flags: false do post api("/features/#{feature_name}", admin), params: { value: 'true' } expect(response).to have_gitlab_http_status(:created) - expect(json_response).to eq( - 'name' => 'my_feature', + expect(json_response).to match( + 'name' => feature_name, 'state' => 'on', - 'gates' => [{ 'key' => 'boolean', 'value' => true }]) + 'gates' => [{ 'key' => 'boolean', 'value' => true }], + 'definition' => known_feature_flag_definition_hash + ) + end + + it 'logs the event' do + expect(Feature.logger).to receive(:info).once + + post api("/features/#{feature_name}", admin), params: { value: 'true' } end it 'creates an enabled feature for the given Flipper group when passed feature_group=perf_team' do post api("/features/#{feature_name}", admin), params: { value: 'true', feature_group: 'perf_team' } expect(response).to have_gitlab_http_status(:created) - expect(json_response).to eq( - 'name' => 'my_feature', + expect(json_response).to match( + 'name' => feature_name, 'state' => 'conditional', 'gates' => [ { 'key' => 'boolean', 'value' => false }, { 'key' => 'groups', 'value' => ['perf_team'] } - ]) + ], + 'definition' => known_feature_flag_definition_hash + ) end it 'creates an enabled feature for the given user when passed user=username' do post api("/features/#{feature_name}", admin), params: { value: 'true', user: user.username } expect(response).to have_gitlab_http_status(:created) - expect(json_response).to eq( - 'name' => 'my_feature', + expect(json_response).to match( + 'name' => feature_name, 'state' => 'conditional', 'gates' => [ { 'key' => 'boolean', 'value' => false }, { 'key' => 'actors', 'value' => ["User:#{user.id}"] } - ]) + ], + 'definition' => known_feature_flag_definition_hash + ) end it 'creates an enabled feature for the given user and feature group when passed user=username and feature_group=perf_team' do post api("/features/#{feature_name}", admin), params: { value: 'true', user: user.username, feature_group: 'perf_team' } expect(response).to have_gitlab_http_status(:created) - expect(json_response['name']).to eq('my_feature') + expect(json_response['name']).to eq(feature_name) expect(json_response['state']).to eq('conditional') expect(json_response['gates']).to contain_exactly( { 'key' => 'boolean', 'value' => false }, @@ -141,13 +175,15 @@ RSpec.describe API::Features, stub_feature_flags: false do post api("/features/#{feature_name}", admin), params: { value: 'true', project: project.full_path } expect(response).to have_gitlab_http_status(:created) - expect(json_response).to eq( - 'name' => 'my_feature', + expect(json_response).to match( + 'name' => feature_name, 'state' => 'conditional', 'gates' => [ { 'key' => 'boolean', 'value' => false }, { 'key' => 'actors', 'value' => ["Project:#{project.id}"] } - ]) + ], + 'definition' => known_feature_flag_definition_hash + ) end end @@ -156,12 +192,13 @@ RSpec.describe API::Features, stub_feature_flags: false do post api("/features/#{feature_name}", admin), params: { value: 'true', project: 'mep/to/the/mep/mep' } expect(response).to have_gitlab_http_status(:created) - expect(json_response).to eq( - "name" => "my_feature", + expect(json_response).to match( + "name" => feature_name, "state" => "off", "gates" => [ { "key" => "boolean", "value" => false } - ] + ], + 'definition' => known_feature_flag_definition_hash ) end end @@ -175,13 +212,15 @@ RSpec.describe API::Features, stub_feature_flags: false do post api("/features/#{feature_name}", admin), params: { value: 'true', group: group.full_path } expect(response).to have_gitlab_http_status(:created) - expect(json_response).to eq( - 'name' => 'my_feature', + expect(json_response).to match( + 'name' => feature_name, 'state' => 'conditional', 'gates' => [ { 'key' => 'boolean', 'value' => false }, { 'key' => 'actors', 'value' => ["Group:#{group.id}"] } - ]) + ], + 'definition' => known_feature_flag_definition_hash + ) end end @@ -190,12 +229,13 @@ RSpec.describe API::Features, stub_feature_flags: false do post api("/features/#{feature_name}", admin), params: { value: 'true', group: 'not/a/group' } expect(response).to have_gitlab_http_status(:created) - expect(json_response).to eq( - "name" => "my_feature", + expect(json_response).to match( + "name" => feature_name, "state" => "off", "gates" => [ { "key" => "boolean", "value" => false } - ] + ], + 'definition' => known_feature_flag_definition_hash ) end end @@ -205,26 +245,30 @@ RSpec.describe API::Features, stub_feature_flags: false do post api("/features/#{feature_name}", admin), params: { value: '50' } expect(response).to have_gitlab_http_status(:created) - expect(json_response).to eq( - 'name' => 'my_feature', + expect(json_response).to match( + 'name' => feature_name, 'state' => 'conditional', 'gates' => [ { 'key' => 'boolean', 'value' => false }, { 'key' => 'percentage_of_time', 'value' => 50 } - ]) + ], + 'definition' => known_feature_flag_definition_hash + ) end it 'creates a feature with the given percentage of actors if passed an integer' do post api("/features/#{feature_name}", admin), params: { value: '50', key: 'percentage_of_actors' } expect(response).to have_gitlab_http_status(:created) - expect(json_response).to eq( - 'name' => 'my_feature', + expect(json_response).to match( + 'name' => feature_name, 'state' => 'conditional', 'gates' => [ { 'key' => 'boolean', 'value' => false }, { 'key' => 'percentage_of_actors', 'value' => 50 } - ]) + ], + 'definition' => known_feature_flag_definition_hash + ) end end @@ -238,36 +282,42 @@ RSpec.describe API::Features, stub_feature_flags: false do post api("/features/#{feature_name}", admin), params: { value: 'true' } expect(response).to have_gitlab_http_status(:created) - expect(json_response).to eq( - 'name' => 'my_feature', + expect(json_response).to match( + 'name' => feature_name, 'state' => 'on', - 'gates' => [{ 'key' => 'boolean', 'value' => true }]) + 'gates' => [{ 'key' => 'boolean', 'value' => true }], + 'definition' => known_feature_flag_definition_hash + ) end it 'enables the feature for the given Flipper group when passed feature_group=perf_team' do post api("/features/#{feature_name}", admin), params: { value: 'true', feature_group: 'perf_team' } expect(response).to have_gitlab_http_status(:created) - expect(json_response).to eq( - 'name' => 'my_feature', + expect(json_response).to match( + 'name' => feature_name, 'state' => 'conditional', 'gates' => [ { 'key' => 'boolean', 'value' => false }, { 'key' => 'groups', 'value' => ['perf_team'] } - ]) + ], + 'definition' => known_feature_flag_definition_hash + ) end it 'enables the feature for the given user when passed user=username' do post api("/features/#{feature_name}", admin), params: { value: 'true', user: user.username } expect(response).to have_gitlab_http_status(:created) - expect(json_response).to eq( - 'name' => 'my_feature', + expect(json_response).to match( + 'name' => feature_name, 'state' => 'conditional', 'gates' => [ { 'key' => 'boolean', 'value' => false }, { 'key' => 'actors', 'value' => ["User:#{user.id}"] } - ]) + ], + 'definition' => known_feature_flag_definition_hash + ) end end @@ -279,10 +329,12 @@ RSpec.describe API::Features, stub_feature_flags: false do post api("/features/#{feature_name}", admin), params: { value: 'false' } expect(response).to have_gitlab_http_status(:created) - expect(json_response).to eq( - 'name' => 'my_feature', + expect(json_response).to match( + 'name' => feature_name, 'state' => 'off', - 'gates' => [{ 'key' => 'boolean', 'value' => false }]) + 'gates' => [{ 'key' => 'boolean', 'value' => false }], + 'definition' => known_feature_flag_definition_hash + ) end it 'disables the feature for the given Flipper group when passed feature_group=perf_team' do @@ -292,10 +344,12 @@ RSpec.describe API::Features, stub_feature_flags: false do post api("/features/#{feature_name}", admin), params: { value: 'false', feature_group: 'perf_team' } expect(response).to have_gitlab_http_status(:created) - expect(json_response).to eq( - 'name' => 'my_feature', + expect(json_response).to match( + 'name' => feature_name, 'state' => 'off', - 'gates' => [{ 'key' => 'boolean', 'value' => false }]) + 'gates' => [{ 'key' => 'boolean', 'value' => false }], + 'definition' => known_feature_flag_definition_hash + ) end it 'disables the feature for the given user when passed user=username' do @@ -305,10 +359,12 @@ RSpec.describe API::Features, stub_feature_flags: false do post api("/features/#{feature_name}", admin), params: { value: 'false', user: user.username } expect(response).to have_gitlab_http_status(:created) - expect(json_response).to eq( - 'name' => 'my_feature', + expect(json_response).to match( + 'name' => feature_name, 'state' => 'off', - 'gates' => [{ 'key' => 'boolean', 'value' => false }]) + 'gates' => [{ 'key' => 'boolean', 'value' => false }], + 'definition' => known_feature_flag_definition_hash + ) end end @@ -321,13 +377,15 @@ RSpec.describe API::Features, stub_feature_flags: false do post api("/features/#{feature_name}", admin), params: { value: '30' } expect(response).to have_gitlab_http_status(:created) - expect(json_response).to eq( - 'name' => 'my_feature', + expect(json_response).to match( + 'name' => feature_name, 'state' => 'conditional', 'gates' => [ { 'key' => 'boolean', 'value' => false }, { 'key' => 'percentage_of_time', 'value' => 30 } - ]) + ], + 'definition' => known_feature_flag_definition_hash + ) end end @@ -340,13 +398,15 @@ RSpec.describe API::Features, stub_feature_flags: false do post api("/features/#{feature_name}", admin), params: { value: '74', key: 'percentage_of_actors' } expect(response).to have_gitlab_http_status(:created) - expect(json_response).to eq( - 'name' => 'my_feature', + expect(json_response).to match( + 'name' => feature_name, 'state' => 'conditional', 'gates' => [ { 'key' => 'boolean', 'value' => false }, { 'key' => 'percentage_of_actors', 'value' => 74 } - ]) + ], + 'definition' => known_feature_flag_definition_hash + ) end end end @@ -390,6 +450,12 @@ RSpec.describe API::Features, stub_feature_flags: false do expect(response).to have_gitlab_http_status(:no_content) end + + it 'logs the event' do + expect(Feature.logger).to receive(:info).once + + delete api("/features/#{feature_name}", admin) + end end end end diff --git a/spec/requests/api/go_proxy_spec.rb b/spec/requests/api/go_proxy_spec.rb index 9d422ebbce2..d45e24241b2 100644 --- a/spec/requests/api/go_proxy_spec.rb +++ b/spec/requests/api/go_proxy_spec.rb @@ -428,7 +428,7 @@ RSpec.describe API::GoProxy do context 'with a non-existent project' do def get_resource(user = nil, **params) - get api("/projects/not%2fa%2fproject/packages/go/#{base}/@v/list", user, params) + get api("/projects/not%2fa%2fproject/packages/go/#{base}/@v/list", user, **params) end describe 'GET /projects/:id/packages/go/*module_name/@v/list' do @@ -465,7 +465,7 @@ RSpec.describe API::GoProxy do end def get_resource(user = nil, headers: {}, **params) - get api("/projects/#{project.id}/packages/go/#{module_name}/@v/#{resource}", user, params), headers: headers + get api("/projects/#{project.id}/packages/go/#{module_name}/@v/#{resource}", user, **params), headers: headers end def fmt_pseudo_version(prefix, commit) diff --git a/spec/requests/api/graphql/boards/board_lists_query_spec.rb b/spec/requests/api/graphql/boards/board_lists_query_spec.rb index 5d5b963fed5..cd94ce91071 100644 --- a/spec/requests/api/graphql/boards/board_lists_query_spec.rb +++ b/spec/requests/api/graphql/boards/board_lists_query_spec.rb @@ -66,28 +66,22 @@ RSpec.describe 'get board lists' do describe 'sorting and pagination' do let_it_be(:current_user) { user } - let(:data_path) { [board_parent_type, :boards, :edges, 0, :node, :lists] } + let(:data_path) { [board_parent_type, :boards, :nodes, 0, :lists] } - def pagination_query(params, page_info) + def pagination_query(params) graphql_query_for( board_parent_type, { 'fullPath' => board_parent.full_path }, <<~BOARDS boards(first: 1) { - edges { - node { - #{query_graphql_field('lists', params, "#{page_info} edges { node { id } }")} - } + nodes { + #{query_graphql_field(:lists, params, "#{page_info} nodes { id }")} } } BOARDS ) end - def pagination_results_data(data) - data.map { |list| list.dig('node', 'id') } - end - context 'when using default sorting' do let!(:label_list) { create(:list, board: board, label: label, position: 10) } let!(:label_list2) { create(:list, board: board, label: label2, position: 2) } @@ -99,7 +93,7 @@ RSpec.describe 'get board lists' do it_behaves_like 'sorted paginated query' do let(:sort_param) { } let(:first_param) { 2 } - let(:expected_results) { lists.map { |list| list.to_global_id.to_s } } + let(:expected_results) { lists.map { |list| global_id_of(list) } } end end end diff --git a/spec/requests/api/graphql/ci/ci_cd_setting_spec.rb b/spec/requests/api/graphql/ci/ci_cd_setting_spec.rb new file mode 100644 index 00000000000..e086ce02942 --- /dev/null +++ b/spec/requests/api/graphql/ci/ci_cd_setting_spec.rb @@ -0,0 +1,50 @@ +# frozen_string_literal: true +require 'spec_helper' + +RSpec.describe 'Getting Ci Cd Setting' do + include GraphqlHelpers + + let_it_be_with_reload(:project) { create(:project, :repository) } + let_it_be(:current_user) { project.owner } + + let(:fields) do + <<~QUERY + #{all_graphql_fields_for('ProjectCiCdSetting')} + QUERY + end + + let(:query) do + graphql_query_for( + 'project', + { 'fullPath' => project.full_path }, + query_graphql_field('ciCdSettings', {}, fields) + ) + end + + let(:settings_data) { graphql_data['project']['ciCdSettings'] } + + context 'without permissions' do + let(:user) { create(:user) } + + before do + project.add_reporter(user) + post_graphql(query, current_user: user) + end + + it_behaves_like 'a working graphql query' + + specify { expect(settings_data).to be nil } + end + + context 'with project permissions' do + before do + post_graphql(query, current_user: current_user) + end + + it_behaves_like 'a working graphql query' + + specify { expect(settings_data['mergePipelinesEnabled']).to eql project.ci_cd_settings.merge_pipelines_enabled? } + specify { expect(settings_data['mergeTrainsEnabled']).to eql project.ci_cd_settings.merge_trains_enabled? } + specify { expect(settings_data['project']['id']).to eql "gid://gitlab/Project/#{project.id}" } + end +end diff --git a/spec/requests/api/graphql/ci/config_spec.rb b/spec/requests/api/graphql/ci/config_spec.rb new file mode 100644 index 00000000000..b682470e0a1 --- /dev/null +++ b/spec/requests/api/graphql/ci/config_spec.rb @@ -0,0 +1,91 @@ +# frozen_string_literal: true + +require 'spec_helper' + +RSpec.describe 'Query.ciConfig' do + include GraphqlHelpers + + subject(:post_graphql_query) { post_graphql(query, current_user: user) } + + let(:user) { create(:user) } + + let_it_be(:content) do + File.read(Rails.root.join('spec/support/gitlab_stubs/gitlab_ci_includes.yml')) + end + + let(:query) do + %( + query { + ciConfig(content: "#{content}") { + status + errors + stages { + name + groups { + name + size + jobs { + name + groupName + stage + needs { + name + } + } + } + } + } + } + ) + end + + before do + post_graphql_query + end + + it_behaves_like 'a working graphql query' + + it 'returns the correct structure' do + expect(graphql_data['ciConfig']).to eq( + "status" => "VALID", + "errors" => [], + "stages" => + [ + { + "name" => "build", + "groups" => + [ + { + "name" => "rspec", + "size" => 2, + "jobs" => + [ + { "name" => "rspec 0 1", "groupName" => "rspec", "stage" => "build", "needs" => [] }, + { "name" => "rspec 0 2", "groupName" => "rspec", "stage" => "build", "needs" => [] } + ] + }, + { + "name" => "spinach", "size" => 1, "jobs" => + [ + { "name" => "spinach", "groupName" => "spinach", "stage" => "build", "needs" => [] } + ] + } + ] + }, + { + "name" => "test", + "groups" => + [ + { + "name" => "docker", + "size" => 1, + "jobs" => [ + { "name" => "docker", "groupName" => "docker", "stage" => "test", "needs" => [{ "name" => "spinach" }, { "name" => "rspec 0 1" }] } + ] + } + ] + } + ] + ) + end +end diff --git a/spec/requests/api/graphql/ci/job_artifacts_spec.rb b/spec/requests/api/graphql/ci/job_artifacts_spec.rb new file mode 100644 index 00000000000..df6e398fbe5 --- /dev/null +++ b/spec/requests/api/graphql/ci/job_artifacts_spec.rb @@ -0,0 +1,52 @@ +# frozen_string_literal: true + +require 'spec_helper' + +RSpec.describe 'Query.project(fullPath).pipelines.jobs.artifacts' do + include GraphqlHelpers + + let_it_be(:project) { create(:project, :repository, :public) } + let_it_be(:pipeline) { create(:ci_pipeline, project: project) } + let_it_be(:user) { create(:user) } + + let_it_be(:query) do + %( + query { + project(fullPath: "#{project.full_path}") { + pipelines { + nodes { + jobs { + nodes { + artifacts { + nodes { + downloadPath + fileType + } + } + } + } + } + } + } + } + ) + end + + it 'returns the fields for the artifacts' do + job = create(:ci_build, pipeline: pipeline) + create(:ci_job_artifact, :junit, job: job) + + post_graphql(query, current_user: user) + + expect(response).to have_gitlab_http_status(:ok) + + pipelines_data = graphql_data.dig('project', 'pipelines', 'nodes') + jobs_data = pipelines_data.first.dig('jobs', 'nodes') + artifact_data = jobs_data.first.dig('artifacts', 'nodes').first + + expect(artifact_data['downloadPath']).to eq( + "/#{project.full_path}/-/jobs/#{job.id}/artifacts/download?file_type=junit" + ) + expect(artifact_data['fileType']).to eq('JUNIT') + end +end diff --git a/spec/requests/api/graphql/ci/jobs_spec.rb b/spec/requests/api/graphql/ci/jobs_spec.rb index 618705e5f94..19954c4e52f 100644 --- a/spec/requests/api/graphql/ci/jobs_spec.rb +++ b/spec/requests/api/graphql/ci/jobs_spec.rb @@ -1,41 +1,44 @@ # frozen_string_literal: true require 'spec_helper' -RSpec.describe 'Query.project.pipeline.stages.groups.jobs' do +RSpec.describe 'Query.project.pipeline' do include GraphqlHelpers - let(:project) { create(:project, :repository, :public) } - let(:user) { create(:user) } - let(:pipeline) do - pipeline = create(:ci_pipeline, project: project, user: user) - stage = create(:ci_stage_entity, pipeline: pipeline, name: 'first') - create(:commit_status, stage_id: stage.id, pipeline: pipeline, name: 'my test job') - - pipeline - end + let_it_be(:project) { create(:project, :repository, :public) } + let_it_be(:user) { create(:user) } def first(field) [field.pluralize, 'nodes', 0] end - let(:jobs_graphql_data) { graphql_data.dig(*%w[project pipeline], *first('stage'), *first('group'), 'jobs', 'nodes') } - - let(:query) do - %( - query { - project(fullPath: "#{project.full_path}") { - pipeline(iid: "#{pipeline.iid}") { - stages { - nodes { - name - groups { - nodes { - name - jobs { - nodes { - name - pipeline { - id + describe '.stages.groups.jobs' do + let(:pipeline) do + pipeline = create(:ci_pipeline, project: project, user: user) + stage = create(:ci_stage_entity, pipeline: pipeline, name: 'first') + create(:commit_status, stage_id: stage.id, pipeline: pipeline, name: 'my test job') + + pipeline + end + + let(:jobs_graphql_data) { graphql_data.dig(*%w[project pipeline], *first('stage'), *first('group'), 'jobs', 'nodes') } + + let(:query) do + %( + query { + project(fullPath: "#{project.full_path}") { + pipeline(iid: "#{pipeline.iid}") { + stages { + nodes { + name + groups { + nodes { + name + jobs { + nodes { + name + pipeline { + id + } } } } @@ -45,17 +48,15 @@ RSpec.describe 'Query.project.pipeline.stages.groups.jobs' do } } } - } - ) - end + ) + end - it 'returns the jobs of a pipeline stage' do - post_graphql(query, current_user: user) + it 'returns the jobs of a pipeline stage' do + post_graphql(query, current_user: user) - expect(jobs_graphql_data).to contain_exactly(a_hash_including('name' => 'my test job')) - end + expect(jobs_graphql_data).to contain_exactly(a_hash_including('name' => 'my test job')) + end - context 'when fetching jobs from the pipeline' do it 'avoids N+1 queries', :aggregate_failures do control_count = ActiveRecord::QueryRecorder.new do post_graphql(query, current_user: user) @@ -112,4 +113,50 @@ RSpec.describe 'Query.project.pipeline.stages.groups.jobs' do ]) end end + + describe '.jobs.artifacts' do + let_it_be(:pipeline) { create(:ci_pipeline, project: project) } + + let(:query) do + %( + query { + project(fullPath: "#{project.full_path}") { + pipeline(iid: "#{pipeline.iid}") { + jobs { + nodes { + artifacts { + nodes { + downloadPath + } + } + } + } + } + } + } + ) + end + + context 'when the job is a build' do + it "returns the build's artifacts" do + create(:ci_build, :artifacts, pipeline: pipeline) + + post_graphql(query, current_user: user) + + job_data = graphql_data.dig('project', 'pipeline', 'jobs', 'nodes').first + expect(job_data.dig('artifacts', 'nodes').count).to be(2) + end + end + + context 'when the job is not a build' do + it 'returns nil' do + create(:ci_bridge, pipeline: pipeline) + + post_graphql(query, current_user: user) + + job_data = graphql_data.dig('project', 'pipeline', 'jobs', 'nodes').first + expect(job_data['artifacts']).to be_nil + end + end + end end diff --git a/spec/requests/api/graphql/group/container_repositories_spec.rb b/spec/requests/api/graphql/group/container_repositories_spec.rb index bcf689a5e8f..4aa775eba0f 100644 --- a/spec/requests/api/graphql/group/container_repositories_spec.rb +++ b/spec/requests/api/graphql/group/container_repositories_spec.rb @@ -14,7 +14,7 @@ RSpec.describe 'getting container repositories in a group' do let_it_be(:container_repositories) { [container_repository, container_repositories_delete_scheduled, container_repositories_delete_failed].flatten } let_it_be(:container_expiration_policy) { project.container_expiration_policy } - let(:fields) do + let(:container_repositories_fields) do <<~GQL edges { node { @@ -24,17 +24,25 @@ RSpec.describe 'getting container repositories in a group' do GQL end + let(:fields) do + <<~GQL + #{query_graphql_field('container_repositories', {}, container_repositories_fields)} + containerRepositoriesCount + GQL + end + let(:query) do graphql_query_for( 'group', { 'fullPath' => group.full_path }, - query_graphql_field('container_repositories', {}, fields) + fields ) end let(:user) { owner } let(:variables) { {} } let(:container_repositories_response) { graphql_data.dig('group', 'containerRepositories', 'edges') } + let(:container_repositories_count_response) { graphql_data.dig('group', 'containerRepositoriesCount') } before do group.add_owner(owner) @@ -101,7 +109,7 @@ RSpec.describe 'getting container repositories in a group' do <<~GQL query($path: ID!, $n: Int) { group(fullPath: $path) { - containerRepositories(first: $n) { #{fields} } + containerRepositories(first: $n) { #{container_repositories_fields} } } } GQL @@ -122,7 +130,7 @@ RSpec.describe 'getting container repositories in a group' do <<~GQL query($path: ID!, $name: String) { group(fullPath: $path) { - containerRepositories(name: $name) { #{fields} } + containerRepositories(name: $name) { #{container_repositories_fields} } } } GQL @@ -143,4 +151,10 @@ RSpec.describe 'getting container repositories in a group' do expect(container_repositories_response.first.dig('node', 'id')).to eq(container_repository.to_global_id.to_s) end end + + it 'returns the total count of container repositories' do + subject + + expect(container_repositories_count_response).to eq(container_repositories.size) + end end diff --git a/spec/requests/api/graphql/group/group_members_spec.rb b/spec/requests/api/graphql/group/group_members_spec.rb index 84b2fd63d46..3554e22cdf2 100644 --- a/spec/requests/api/graphql/group/group_members_spec.rb +++ b/spec/requests/api/graphql/group/group_members_spec.rb @@ -5,44 +5,95 @@ require 'spec_helper' RSpec.describe 'getting group members information' do include GraphqlHelpers - let_it_be(:group) { create(:group, :public) } + let_it_be(:parent_group) { create(:group, :public) } let_it_be(:user) { create(:user) } let_it_be(:user_1) { create(:user, username: 'user') } let_it_be(:user_2) { create(:user, username: 'test') } let(:member_data) { graphql_data['group']['groupMembers']['edges'] } - before do - [user_1, user_2].each { |user| group.add_guest(user) } + before_all do + [user_1, user_2].each { |user| parent_group.add_guest(user) } end context 'when the request is correct' do it_behaves_like 'a working graphql query' do - before do - fetch_members(user) + before_all do + fetch_members end end it 'returns group members successfully' do - fetch_members(user) + fetch_members expect(graphql_errors).to be_nil - expect_array_response(user_1.to_global_id.to_s, user_2.to_global_id.to_s) + expect_array_response(user_1, user_2) end it 'returns members that match the search query' do - fetch_members(user, { search: 'test' }) + fetch_members(args: { search: 'test' }) expect(graphql_errors).to be_nil - expect_array_response(user_2.to_global_id.to_s) + expect_array_response(user_2) end end - def fetch_members(user = nil, args = {}) - post_graphql(members_query(args), current_user: user) + context 'member relations' do + let_it_be(:child_group) { create(:group, :public, parent: parent_group) } + let_it_be(:grandchild_group) { create(:group, :public, parent: child_group) } + let_it_be(:child_user) { create(:user) } + let_it_be(:grandchild_user) { create(:user) } + + before_all do + child_group.add_guest(child_user) + grandchild_group.add_guest(grandchild_user) + end + + it 'returns direct members' do + fetch_members(group: child_group, args: { relations: [:DIRECT] }) + + expect(graphql_errors).to be_nil + expect_array_response(child_user) + end + + it 'returns direct and inherited members' do + fetch_members(group: child_group, args: { relations: [:DIRECT, :INHERITED] }) + + expect(graphql_errors).to be_nil + expect_array_response(child_user, user_1, user_2) + end + + it 'returns direct, inherited, and descendant members' do + fetch_members(group: child_group, args: { relations: [:DIRECT, :INHERITED, :DESCENDANTS] }) + + expect(graphql_errors).to be_nil + expect_array_response(child_user, user_1, user_2, grandchild_user) + end + + it 'returns an error for an invalid member relation' do + fetch_members(group: child_group, args: { relations: [:OBLIQUE] }) + + expect(graphql_errors.first) + .to include('path' => %w[query group groupMembers relations], + 'message' => a_string_including('invalid value ([OBLIQUE])')) + end + end + + context 'when unauthenticated' do + it 'returns nothing' do + fetch_members(current_user: nil) + + expect(graphql_errors).to be_nil + expect(response).to have_gitlab_http_status(:success) + expect(member_data).to be_empty + end + end + + def fetch_members(group: parent_group, current_user: user, args: {}) + post_graphql(members_query(group.full_path, args), current_user: current_user) end - def members_query(args = {}) + def members_query(group_path, args = {}) members_node = <<~NODE edges { node { @@ -54,7 +105,7 @@ RSpec.describe 'getting group members information' do NODE graphql_query_for("group", - { full_path: group.full_path }, + { full_path: group_path }, [query_graphql_field("groupMembers", args, members_node)] ) end @@ -62,6 +113,7 @@ RSpec.describe 'getting group members information' do def expect_array_response(*items) expect(response).to have_gitlab_http_status(:success) expect(member_data).to be_an Array - expect(member_data.map { |node| node["node"]["user"]["id"] }).to match_array(items) + expect(member_data.map { |node| node["node"]["user"]["id"] }) + .to match_array(items.map { |u| global_id_of(u) }) end end diff --git a/spec/requests/api/graphql/group_query_spec.rb b/spec/requests/api/graphql/group_query_spec.rb index 83180c7d7a5..391bae4cfcf 100644 --- a/spec/requests/api/graphql/group_query_spec.rb +++ b/spec/requests/api/graphql/group_query_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' # Based on spec/requests/api/groups_spec.rb # Should follow closely in order to ensure all situations are covered -RSpec.describe 'getting group information', :do_not_mock_admin_mode do +RSpec.describe 'getting group information' do include GraphqlHelpers include UploadHelpers diff --git a/spec/requests/api/graphql/issue/issue_spec.rb b/spec/requests/api/graphql/issue/issue_spec.rb index d7fa680d29b..42c8e0cc9c0 100644 --- a/spec/requests/api/graphql/issue/issue_spec.rb +++ b/spec/requests/api/graphql/issue/issue_spec.rb @@ -125,7 +125,7 @@ RSpec.describe 'Query.issue(id)' do let(:issue_params) { { 'id' => confidential_issue.to_global_id.to_s } } context 'when the user cannot see confidential issues' do - it 'returns nil ' do + it 'returns nil' do post_graphql(query, current_user: current_user) expect(issue_data).to be nil diff --git a/spec/requests/api/graphql/mutations/admin/sidekiq_queues/delete_jobs_spec.rb b/spec/requests/api/graphql/mutations/admin/sidekiq_queues/delete_jobs_spec.rb index 4ad35e7f0d1..b8cde32877b 100644 --- a/spec/requests/api/graphql/mutations/admin/sidekiq_queues/delete_jobs_spec.rb +++ b/spec/requests/api/graphql/mutations/admin/sidekiq_queues/delete_jobs_spec.rb @@ -6,8 +6,9 @@ RSpec.describe 'Deleting Sidekiq jobs', :clean_gitlab_redis_queues do include GraphqlHelpers let_it_be(:admin) { create(:admin) } + let(:queue) { 'authorized_projects' } - let(:variables) { { user: admin.username, queue_name: 'authorized_projects' } } + let(:variables) { { user: admin.username, queue_name: queue } } let(:mutation) { graphql_mutation(:admin_sidekiq_queues_delete_jobs, variables) } def mutation_response @@ -26,18 +27,19 @@ RSpec.describe 'Deleting Sidekiq jobs', :clean_gitlab_redis_queues do context 'valid request' do around do |example| - Sidekiq::Queue.new('authorized_projects').clear + Sidekiq::Queue.new(queue).clear Sidekiq::Testing.disable!(&example) - Sidekiq::Queue.new('authorized_projects').clear + Sidekiq::Queue.new(queue).clear end def add_job(user, args) Sidekiq::Client.push( 'class' => 'AuthorizedProjectsWorker', - 'queue' => 'authorized_projects', + 'queue' => queue, 'args' => args, 'meta.user' => user.username ) + raise 'Not enqueued!' if Sidekiq::Queue.new(queue).size.zero? end it 'returns info about the deleted jobs' do @@ -55,7 +57,7 @@ RSpec.describe 'Deleting Sidekiq jobs', :clean_gitlab_redis_queues do end context 'when no required params are provided' do - let(:variables) { { queue_name: 'authorized_projects' } } + let(:variables) { { queue_name: queue } } it_behaves_like 'a mutation that returns errors in the response', errors: ['No metadata provided'] diff --git a/spec/requests/api/graphql/mutations/award_emojis/add_spec.rb b/spec/requests/api/graphql/mutations/award_emojis/add_spec.rb index 3aaebb5095a..b39062f2e71 100644 --- a/spec/requests/api/graphql/mutations/award_emojis/add_spec.rb +++ b/spec/requests/api/graphql/mutations/award_emojis/add_spec.rb @@ -56,10 +56,10 @@ RSpec.describe 'Adding an AwardEmoji' do it_behaves_like 'a mutation that does not create an AwardEmoji' it_behaves_like 'a mutation that returns top-level errors', - errors: ['Cannot award emoji to this resource'] + errors: ['You cannot award emoji to this resource.'] end - context 'when the given awardable an Awardable' do + context 'when the given awardable is an Awardable' do it 'creates an emoji' do expect do post_graphql_mutation(mutation, current_user: current_user) diff --git a/spec/requests/api/graphql/mutations/award_emojis/toggle_spec.rb b/spec/requests/api/graphql/mutations/award_emojis/toggle_spec.rb index 6910ad80a11..170e7ff3b44 100644 --- a/spec/requests/api/graphql/mutations/award_emojis/toggle_spec.rb +++ b/spec/requests/api/graphql/mutations/award_emojis/toggle_spec.rb @@ -55,7 +55,7 @@ RSpec.describe 'Toggling an AwardEmoji' do it_behaves_like 'a mutation that does not create or destroy an AwardEmoji' it_behaves_like 'a mutation that returns top-level errors', - errors: ['Cannot award emoji to this resource'] + errors: ['You cannot award emoji to this resource.'] end context 'when the given awardable is an Awardable' do diff --git a/spec/requests/api/graphql/mutations/container_repository/destroy_spec.rb b/spec/requests/api/graphql/mutations/container_repository/destroy_spec.rb index 645edfc2e43..c4121cfed42 100644 --- a/spec/requests/api/graphql/mutations/container_repository/destroy_spec.rb +++ b/spec/requests/api/graphql/mutations/container_repository/destroy_spec.rb @@ -22,7 +22,7 @@ RSpec.describe 'Destroying a container repository' do GQL end - let(:params) { { id: container_repository.to_global_id.to_s } } + let(:params) { { id: id } } let(:mutation) { graphql_mutation(:destroy_container_repository, params, query) } let(:mutation_response) { graphql_mutation_response(:destroyContainerRepository) } let(:container_repository_mutation_response) { mutation_response['containerRepository'] } diff --git a/spec/requests/api/graphql/mutations/container_repository/destroy_tags_spec.rb b/spec/requests/api/graphql/mutations/container_repository/destroy_tags_spec.rb new file mode 100644 index 00000000000..decb2e7bccc --- /dev/null +++ b/spec/requests/api/graphql/mutations/container_repository/destroy_tags_spec.rb @@ -0,0 +1,120 @@ +# frozen_string_literal: true + +require 'spec_helper' + +RSpec.describe 'Destroying a container repository tags' do + include_context 'container repository delete tags service shared context' + using RSpec::Parameterized::TableSyntax + + include GraphqlHelpers + + let(:id) { repository.to_global_id.to_s } + let(:tags) { %w[A C D E] } + + let(:query) do + <<~GQL + deletedTagNames + errors + GQL + end + + let(:params) { { id: id, tag_names: tags } } + let(:mutation) { graphql_mutation(:destroy_container_repository_tags, params, query) } + let(:mutation_response) { graphql_mutation_response(:destroyContainerRepositoryTags) } + let(:tag_names_response) { mutation_response['deletedTagNames'] } + let(:errors_response) { mutation_response['errors'] } + + shared_examples 'destroying the container repository tags' do + before do + stub_delete_reference_requests(tags) + expect_delete_tag_by_names(tags) + allow_next_instance_of(ContainerRegistry::Client) do |client| + allow(client).to receive(:supports_tag_delete?).and_return(true) + end + end + + it 'destroys the container repository tags' do + expect(Projects::ContainerRepository::DeleteTagsService) + .to receive(:new).and_call_original + expect { subject }.to change { ::Packages::Event.count }.by(1) + + expect(tag_names_response).to eq(tags) + expect(errors_response).to eq([]) + end + + it_behaves_like 'returning response status', :success + end + + shared_examples 'denying the mutation request' do + it 'does not destroy the container repository tags' do + expect(Projects::ContainerRepository::DeleteTagsService) + .not_to receive(:new) + + expect { subject }.not_to change { ::Packages::Event.count } + + expect(mutation_response).to be_nil + end + + it_behaves_like 'returning response status', :success + end + + describe 'post graphql mutation' do + subject { post_graphql_mutation(mutation, current_user: user) } + + context 'with valid id' do + where(:user_role, :shared_examples_name) do + :maintainer | 'destroying the container repository tags' + :developer | 'destroying the container repository tags' + :reporter | 'denying the mutation request' + :guest | 'denying the mutation request' + :anonymous | 'denying the mutation request' + end + + with_them do + before do + project.send("add_#{user_role}", user) unless user_role == :anonymous + end + + it_behaves_like params[:shared_examples_name] + end + end + + context 'with invalid id' do + let(:id) { 'gid://gitlab/ContainerRepository/5555' } + + it_behaves_like 'denying the mutation request' + end + + context 'with too many tags' do + let(:tags) { Array.new(Mutations::ContainerRepositories::DestroyTags::LIMIT + 1, 'x') } + + it 'returns too many tags error' do + expect { subject }.not_to change { ::Packages::Event.count } + + explanation = graphql_errors.dig(0, 'extensions', 'problems', 0, 'explanation') + expect(explanation).to eq(Mutations::ContainerRepositories::DestroyTags::TOO_MANY_TAGS_ERROR_MESSAGE) + end + end + + context 'with service error' do + before do + project.add_maintainer(user) + allow_next_instance_of(Projects::ContainerRepository::DeleteTagsService) do |service| + allow(service).to receive(:execute).and_return(message: 'could not delete tags', status: :error) + end + end + + it 'returns an error' do + subject + + expect(tag_names_response).to eq([]) + expect(errors_response).to eq(['could not delete tags']) + end + + it 'does not create a package event' do + expect(::Packages::CreateEventService).not_to receive(:new) + expect { subject }.not_to change { ::Packages::Event.count } + end + end + end +end diff --git a/spec/requests/api/graphql/mutations/environments/canary_ingress/update_spec.rb b/spec/requests/api/graphql/mutations/environments/canary_ingress/update_spec.rb new file mode 100644 index 00000000000..f25a49291a6 --- /dev/null +++ b/spec/requests/api/graphql/mutations/environments/canary_ingress/update_spec.rb @@ -0,0 +1,45 @@ +# frozen_string_literal: true + +require 'spec_helper' + +RSpec.describe 'Update Environment Canary Ingress', :clean_gitlab_redis_cache do + include GraphqlHelpers + include KubernetesHelpers + + let_it_be(:project) { create(:project, :repository) } + let_it_be(:cluster) { create(:cluster, :project, projects: [project]) } + let_it_be(:service) { create(:cluster_platform_kubernetes, :configured, cluster: cluster) } + let_it_be(:environment) { create(:environment, project: project) } + let_it_be(:deployment) { create(:deployment, :success, environment: environment, project: project) } + let_it_be(:maintainer) { create(:user) } + let_it_be(:developer) { create(:user) } + let(:environment_id) { environment.to_global_id.to_s } + let(:weight) { 25 } + let(:actor) { developer } + + let(:mutation) do + graphql_mutation(:environments_canary_ingress_update, id: environment_id, weight: weight) + end + + before_all do + project.add_maintainer(maintainer) + project.add_developer(developer) + end + + before do + stub_kubeclient_ingresses(environment.deployment_namespace, response: kube_ingresses_response(with_canary: true)) + end + + context 'when kubernetes accepted the patch request' do + before do + stub_kubeclient_ingresses(environment.deployment_namespace, method: :patch, resource_path: "/production-auto-deploy") + end + + it 'updates successfully' do + post_graphql_mutation(mutation, current_user: actor) + + expect(graphql_mutation_response(:environments_canary_ingress_update)['errors']) + .to be_empty + end + end +end diff --git a/spec/requests/api/graphql/mutations/releases/delete_spec.rb b/spec/requests/api/graphql/mutations/releases/delete_spec.rb new file mode 100644 index 00000000000..3710f118bf4 --- /dev/null +++ b/spec/requests/api/graphql/mutations/releases/delete_spec.rb @@ -0,0 +1,132 @@ +# frozen_string_literal: true + +require 'spec_helper' + +RSpec.describe 'Deleting a release' do + include GraphqlHelpers + include Presentable + + let_it_be(:public_user) { create(:user) } + let_it_be(:guest) { create(:user) } + let_it_be(:reporter) { create(:user) } + let_it_be(:developer) { create(:user) } + let_it_be(:maintainer) { create(:user) } + let_it_be(:project) { create(:project, :public, :repository) } + let_it_be(:tag_name) { 'v1.1.0' } + let_it_be(:release) { create(:release, project: project, tag: tag_name) } + + let(:mutation_name) { :release_delete } + + let(:project_path) { project.full_path } + let(:mutation_arguments) do + { + projectPath: project_path, + tagName: tag_name + } + end + + let(:mutation) do + graphql_mutation(mutation_name, mutation_arguments, <<~FIELDS) + release { + tagName + } + errors + FIELDS + end + + let(:delete_release) { post_graphql_mutation(mutation, current_user: current_user) } + let(:mutation_response) { graphql_mutation_response(mutation_name)&.with_indifferent_access } + + before do + project.add_guest(guest) + project.add_reporter(reporter) + project.add_developer(developer) + project.add_maintainer(maintainer) + end + + shared_examples 'unauthorized or not found error' do + it 'returns a top-level error with message' do + delete_release + + expect(mutation_response).to be_nil + expect(graphql_errors.count).to eq(1) + expect(graphql_errors.first['message']).to eq("The resource that you are attempting to access does not exist or you don't have permission to perform this action") + end + end + + context 'when the current user has access to update releases' do + let(:current_user) { maintainer } + + it 'deletes the release' do + expect { delete_release }.to change { Release.count }.by(-1) + end + + it 'returns the deleted release' do + delete_release + + expected_release = { tagName: tag_name }.with_indifferent_access + + expect(mutation_response[:release]).to eq(expected_release) + end + + it 'does not remove the Git tag associated with the deleted release' do + expect { delete_release }.not_to change { Project.find_by_id(project.id).repository.tag_count } + end + + it 'returns no errors' do + delete_release + + expect(mutation_response[:errors]).to eq([]) + end + + context 'validation' do + context 'when the release does not exist' do + let_it_be(:tag_name) { 'not-a-real-release' } + + it 'returns the release as null' do + delete_release + + expect(mutation_response[:release]).to be_nil + end + + it 'returns an errors-at-data message' do + delete_release + + expect(mutation_response[:errors]).to eq(['Release does not exist']) + end + end + + context 'when the project does not exist' do + let(:project_path) { 'not/a/real/path' } + + it_behaves_like 'unauthorized or not found error' + end + end + end + + context "when the current user doesn't have access to update releases" do + context 'when the current user is a Developer' do + let(:current_user) { developer } + + it_behaves_like 'unauthorized or not found error' + end + + context 'when the current user is a Reporter' do + let(:current_user) { reporter } + + it_behaves_like 'unauthorized or not found error' + end + + context 'when the current user is a Guest' do + let(:current_user) { guest } + + it_behaves_like 'unauthorized or not found error' + end + + context 'when the current user is a public user' do + let(:current_user) { public_user } + + it_behaves_like 'unauthorized or not found error' + end + end +end diff --git a/spec/requests/api/graphql/mutations/releases/update_spec.rb b/spec/requests/api/graphql/mutations/releases/update_spec.rb new file mode 100644 index 00000000000..19320c3393c --- /dev/null +++ b/spec/requests/api/graphql/mutations/releases/update_spec.rb @@ -0,0 +1,255 @@ +# frozen_string_literal: true + +require 'spec_helper' + +RSpec.describe 'Updating an existing release' do + include GraphqlHelpers + include Presentable + + let_it_be(:public_user) { create(:user) } + let_it_be(:guest) { create(:user) } + let_it_be(:reporter) { create(:user) } + let_it_be(:developer) { create(:user) } + let_it_be(:project) { create(:project, :public, :repository) } + let_it_be(:milestone_12_3) { create(:milestone, project: project, title: '12.3') } + let_it_be(:milestone_12_4) { create(:milestone, project: project, title: '12.4') } + + let_it_be(:tag_name) { 'v1.1.0' } + let_it_be(:name) { 'Version 7.12.5'} + let_it_be(:description) { 'Release 7.12.5 :rocket:' } + let_it_be(:released_at) { '2018-12-10' } + let_it_be(:created_at) { '2018-11-05' } + let_it_be(:milestones) { [milestone_12_3, milestone_12_4] } + + let_it_be(:release) do + create(:release, project: project, tag: tag_name, name: name, + description: description, released_at: Time.parse(released_at).utc, + created_at: Time.parse(created_at).utc, milestones: milestones) + end + + let(:mutation_name) { :release_update } + + let(:mutation_arguments) do + { + projectPath: project.full_path, + tagName: tag_name + } + end + + let(:mutation) do + graphql_mutation(mutation_name, mutation_arguments, <<~FIELDS) + release { + tagName + name + description + releasedAt + createdAt + milestones { + nodes { + title + } + } + } + errors + FIELDS + end + + let(:update_release) { post_graphql_mutation(mutation, current_user: current_user) } + let(:mutation_response) { graphql_mutation_response(mutation_name)&.with_indifferent_access } + + let(:expected_attributes) do + { + tagName: tag_name, + name: name, + description: description, + releasedAt: Time.parse(released_at).utc.iso8601, + createdAt: Time.parse(created_at).utc.iso8601, + milestones: { + nodes: milestones.map { |m| { title: m.title } } + } + }.with_indifferent_access + end + + around do |example| + freeze_time { example.run } + end + + before do + project.add_guest(guest) + project.add_reporter(reporter) + project.add_developer(developer) + + stub_default_url_options(host: 'www.example.com') + end + + shared_examples 'no errors' do + it 'returns no errors' do + update_release + + expect(graphql_errors).not_to be_present + end + end + + shared_examples 'top-level error with message' do |error_message| + it 'returns a top-level error with message' do + update_release + + expect(mutation_response).to be_nil + expect(graphql_errors.count).to eq(1) + expect(graphql_errors.first['message']).to eq(error_message) + end + end + + shared_examples 'errors-as-data with message' do |error_message| + it 'returns an error-as-data with message' do + update_release + + expect(mutation_response[:release]).to be_nil + expect(mutation_response[:errors].count).to eq(1) + expect(mutation_response[:errors].first).to match(error_message) + end + end + + shared_examples 'updates release fields' do |updates| + it_behaves_like 'no errors' + + it 'updates the correct field and returns the release' do + update_release + + expect(mutation_response[:release]).to include(expected_attributes.merge(updates).except(:milestones)) + + # Right now the milestones are returned in a non-deterministic order. + # Because of this, we need to test milestones separately to allow + # for them to be returned in any order. + # Once https://gitlab.com/gitlab-org/gitlab/-/issues/259012 has been + # fixed, this special milestone handling can be removed. + expected_milestones = expected_attributes.merge(updates)[:milestones] + expect(mutation_response[:release][:milestones][:nodes]).to match_array(expected_milestones[:nodes]) + end + end + + context 'when the current user has access to update releases' do + let(:current_user) { developer } + + context 'name' do + context 'when a new name is provided' do + let(:mutation_arguments) { super().merge(name: 'Updated name') } + + it_behaves_like 'updates release fields', name: 'Updated name' + end + + context 'when null is provided' do + let(:mutation_arguments) { super().merge(name: nil) } + + it_behaves_like 'updates release fields', name: 'v1.1.0' + end + end + + context 'description' do + context 'when a new description is provided' do + let(:mutation_arguments) { super().merge(description: 'Updated description') } + + it_behaves_like 'updates release fields', description: 'Updated description' + end + + context 'when null is provided' do + let(:mutation_arguments) { super().merge(description: nil) } + + it_behaves_like 'updates release fields', description: nil + end + end + + context 'releasedAt' do + context 'when no time zone is provided' do + let(:mutation_arguments) { super().merge(releasedAt: '2015-05-05') } + + it_behaves_like 'updates release fields', releasedAt: Time.parse('2015-05-05').utc.iso8601 + end + + context 'when a local time zone is provided' do + let(:mutation_arguments) { super().merge(releasedAt: Time.parse('2015-05-05').in_time_zone('Hawaii').iso8601) } + + it_behaves_like 'updates release fields', releasedAt: Time.parse('2015-05-05').utc.iso8601 + end + + context 'when null is provided' do + let(:mutation_arguments) { super().merge(releasedAt: nil) } + + it_behaves_like 'top-level error with message', 'if the releasedAt argument is provided, it cannot be null' + end + end + + context 'milestones' do + context 'when a new set of milestones is provided provided' do + let(:mutation_arguments) { super().merge(milestones: ['12.3']) } + + it_behaves_like 'updates release fields', milestones: { nodes: [{ title: '12.3' }] } + end + + context 'when an empty array is provided' do + let(:mutation_arguments) { super().merge(milestones: []) } + + it_behaves_like 'updates release fields', milestones: { nodes: [] } + end + + context 'when null is provided' do + let(:mutation_arguments) { super().merge(milestones: nil) } + + it_behaves_like 'top-level error with message', 'if the milestones argument is provided, it cannot be null' + end + + context 'when a non-existent milestone title is provided' do + let(:mutation_arguments) { super().merge(milestones: ['not real']) } + + it_behaves_like 'errors-as-data with message', 'Milestone(s) not found: not real' + end + + context 'when a milestone title from a different project is provided' do + let(:milestone_in_different_project) { create(:milestone, title: 'milestone in different project') } + let(:mutation_arguments) { super().merge(milestones: [milestone_in_different_project.title]) } + + it_behaves_like 'errors-as-data with message', 'Milestone(s) not found: milestone in different project' + end + end + + context 'validation' do + context 'when no updated fields are provided' do + it_behaves_like 'errors-as-data with message', 'params is empty' + end + + context 'when the tag does not exist' do + let(:mutation_arguments) { super().merge(tagName: 'not-a-real-tag') } + + it_behaves_like 'errors-as-data with message', 'Tag does not exist' + end + + context 'when the project does not exist' do + let(:mutation_arguments) { super().merge(projectPath: 'not/a/real/path') } + + it_behaves_like 'top-level error with message', "The resource that you are attempting to access does not exist or you don't have permission to perform this action" + end + end + end + + context "when the current user doesn't have access to update releases" do + expected_error_message = "The resource that you are attempting to access does not exist or you don't have permission to perform this action" + + context 'when the current user is a Reporter' do + let(:current_user) { reporter } + + it_behaves_like 'top-level error with message', expected_error_message + end + + context 'when the current user is a Guest' do + let(:current_user) { guest } + + it_behaves_like 'top-level error with message', expected_error_message + end + + context 'when the current user is a public user' do + let(:current_user) { public_user } + + it_behaves_like 'top-level error with message', expected_error_message + end + end +end diff --git a/spec/requests/api/graphql/mutations/snippets/create_spec.rb b/spec/requests/api/graphql/mutations/snippets/create_spec.rb index d2fa3cfc24f..fd0dc98a8d3 100644 --- a/spec/requests/api/graphql/mutations/snippets/create_spec.rb +++ b/spec/requests/api/graphql/mutations/snippets/create_spec.rb @@ -163,9 +163,15 @@ RSpec.describe 'Creating a Snippet' do context 'when there are uploaded files' do shared_examples 'expected files argument' do |file_value, expected_value| let(:uploaded_files) { file_value } + let(:snippet) { build(:snippet) } + let(:creation_response) do + ::ServiceResponse.error(message: 'urk', payload: { snippet: snippet }) + end it do - expect(::Snippets::CreateService).to receive(:new).with(nil, user, hash_including(files: expected_value)) + expect(::Snippets::CreateService).to receive(:new) + .with(nil, user, hash_including(files: expected_value)) + .and_return(double(execute: creation_response)) subject end diff --git a/spec/requests/api/graphql/mutations/snippets/mark_as_spam_spec.rb b/spec/requests/api/graphql/mutations/snippets/mark_as_spam_spec.rb index 97e6ae8fda8..4d499310591 100644 --- a/spec/requests/api/graphql/mutations/snippets/mark_as_spam_spec.rb +++ b/spec/requests/api/graphql/mutations/snippets/mark_as_spam_spec.rb @@ -2,8 +2,9 @@ require 'spec_helper' -RSpec.describe 'Mark snippet as spam', :do_not_mock_admin_mode do +RSpec.describe 'Mark snippet as spam' do include GraphqlHelpers + include AfterNextHelpers let_it_be(:admin) { create(:admin) } let_it_be(:other_user) { create(:user) } @@ -56,11 +57,12 @@ RSpec.describe 'Mark snippet as spam', :do_not_mock_admin_mode do end it 'marks snippet as spam' do - expect_next_instance_of(Spam::MarkAsSpamService) do |instance| - expect(instance).to receive(:execute) - end + expect_next(Spam::MarkAsSpamService, target: snippet) + .to receive(:execute).and_return(true) post_graphql_mutation(mutation, current_user: current_user) + + expect(graphql_errors).to be_blank end end end diff --git a/spec/requests/api/graphql/namespace/projects_spec.rb b/spec/requests/api/graphql/namespace/projects_spec.rb index 03160719389..3e68503b7fb 100644 --- a/spec/requests/api/graphql/namespace/projects_spec.rb +++ b/spec/requests/api/graphql/namespace/projects_spec.rb @@ -80,38 +80,34 @@ RSpec.describe 'getting projects' do end describe 'sorting and pagination' do + let_it_be(:ns) { create(:group) } + let_it_be(:current_user) { create(:user) } + let_it_be(:project_1) { create(:project, name: 'Project', path: 'project', namespace: ns) } + let_it_be(:project_2) { create(:project, name: 'Test Project', path: 'test-project', namespace: ns) } + let_it_be(:project_3) { create(:project, name: 'Test', path: 'test', namespace: ns) } + let_it_be(:project_4) { create(:project, name: 'Test Project Other', path: 'other-test-project', namespace: ns) } + let(:data_path) { [:namespace, :projects] } - def pagination_query(params, page_info) - graphql_query_for( - 'namespace', - { 'fullPath' => subject.full_path }, - <<~QUERY - projects(includeSubgroups: #{include_subgroups}, search: "#{search}", #{params}) { - #{page_info} edges { - node { - #{all_graphql_fields_for('Project')} - } - } - } - QUERY - ) + let(:ns_args) { { full_path: ns.full_path } } + let(:search) { 'test' } + + before do + ns.add_owner(current_user) end - def pagination_results_data(data) - data.map { |project| project.dig('node', 'name') } + def pagination_query(params) + arguments = params.merge(include_subgroups: include_subgroups, search: search) + graphql_query_for(:namespace, ns_args, query_graphql_field(:projects, arguments, <<~GQL)) + #{page_info} + nodes { name } + GQL end context 'when sorting by similarity' do - let!(:project_1) { create(:project, name: 'Project', path: 'project', namespace: subject) } - let!(:project_2) { create(:project, name: 'Test Project', path: 'test-project', namespace: subject) } - let!(:project_3) { create(:project, name: 'Test', path: 'test', namespace: subject) } - let!(:project_4) { create(:project, name: 'Test Project Other', path: 'other-test-project', namespace: subject) } - let(:search) { 'test' } - let(:current_user) { user } - it_behaves_like 'sorted paginated query' do - let(:sort_param) { 'SIMILARITY' } + let(:node_path) { %w[name] } + let(:sort_param) { :SIMILARITY } let(:first_param) { 2 } let(:expected_results) { [project_3.name, project_2.name, project_4.name] } end diff --git a/spec/requests/api/graphql/project/container_repositories_spec.rb b/spec/requests/api/graphql/project/container_repositories_spec.rb index 7e32f54bf1d..6b1c8689515 100644 --- a/spec/requests/api/graphql/project/container_repositories_spec.rb +++ b/spec/requests/api/graphql/project/container_repositories_spec.rb @@ -12,7 +12,7 @@ RSpec.describe 'getting container repositories in a project' do let_it_be(:container_repositories) { [container_repository, container_repositories_delete_scheduled, container_repositories_delete_failed].flatten } let_it_be(:container_expiration_policy) { project.container_expiration_policy } - let(:fields) do + let(:container_repositories_fields) do <<~GQL edges { node { @@ -22,17 +22,25 @@ RSpec.describe 'getting container repositories in a project' do GQL end + let(:fields) do + <<~GQL + #{query_graphql_field('container_repositories', {}, container_repositories_fields)} + containerRepositoriesCount + GQL + end + let(:query) do graphql_query_for( 'project', { 'fullPath' => project.full_path }, - query_graphql_field('container_repositories', {}, fields) + fields ) end let(:user) { project.owner } let(:variables) { {} } let(:container_repositories_response) { graphql_data.dig('project', 'containerRepositories', 'edges') } + let(:container_repositories_count_response) { graphql_data.dig('project', 'containerRepositoriesCount') } before do stub_container_registry_config(enabled: true) @@ -100,7 +108,7 @@ RSpec.describe 'getting container repositories in a project' do <<~GQL query($path: ID!, $n: Int) { project(fullPath: $path) { - containerRepositories(first: $n) { #{fields} } + containerRepositories(first: $n) { #{container_repositories_fields} } } } GQL @@ -121,7 +129,7 @@ RSpec.describe 'getting container repositories in a project' do <<~GQL query($path: ID!, $name: String) { project(fullPath: $path) { - containerRepositories(name: $name) { #{fields} } + containerRepositories(name: $name) { #{container_repositories_fields} } } } GQL @@ -142,4 +150,10 @@ RSpec.describe 'getting container repositories in a project' do expect(container_repositories_response.first.dig('node', 'id')).to eq(container_repository.to_global_id.to_s) end end + + it 'returns the total count of container repositories' do + subject + + expect(container_repositories_count_response).to eq(container_repositories.size) + end end diff --git a/spec/requests/api/graphql/project/issue/design_collection/version_spec.rb b/spec/requests/api/graphql/project/issue/design_collection/version_spec.rb index 4bce3c7fe0f..f544d78ecbb 100644 --- a/spec/requests/api/graphql/project/issue/design_collection/version_spec.rb +++ b/spec/requests/api/graphql/project/issue/design_collection/version_spec.rb @@ -42,7 +42,6 @@ RSpec.describe 'Query.project(fullPath).issue(iid).designCollection.version(sha) describe 'scalar fields' do let(:path) { path_prefix } - let(:version_fields) { query_graphql_field(:sha) } before do post_query @@ -50,7 +49,7 @@ RSpec.describe 'Query.project(fullPath).issue(iid).designCollection.version(sha) { id: ->(x) { x.to_global_id.to_s }, sha: ->(x) { x.sha } }.each do |field, value| describe ".#{field}" do - let(:version_fields) { query_graphql_field(field) } + let(:version_fields) { field } it "retrieves the #{field}" do expect(data).to match(a_hash_including(field.to_s => value[version])) diff --git a/spec/requests/api/graphql/project/issue_spec.rb b/spec/requests/api/graphql/project/issue_spec.rb index 5f368833181..ddf63a8f2c9 100644 --- a/spec/requests/api/graphql/project/issue_spec.rb +++ b/spec/requests/api/graphql/project/issue_spec.rb @@ -29,8 +29,8 @@ RSpec.describe 'Query.project(fullPath).issue(iid)' do let(:design_fields) do [ - query_graphql_field(:filename), - query_graphql_field(:project, nil, query_graphql_field(:id)) + :filename, + query_graphql_field(:project, :id) ] end @@ -173,7 +173,7 @@ RSpec.describe 'Query.project(fullPath).issue(iid)' do let(:result_fields) { { 'version' => id_hash(version) } } let(:object_fields) do - design_fields + [query_graphql_field(:version, nil, query_graphql_field(:id))] + design_fields + [query_graphql_field(:version, :id)] end let(:no_argument_error) { missing_required_argument(path, :id) } diff --git a/spec/requests/api/graphql/project/issues_spec.rb b/spec/requests/api/graphql/project/issues_spec.rb index 4f27f08bf98..9c915075c42 100644 --- a/spec/requests/api/graphql/project/issues_spec.rb +++ b/spec/requests/api/graphql/project/issues_spec.rb @@ -142,16 +142,14 @@ RSpec.describe 'getting an issue list for a project' do describe 'sorting and pagination' do let_it_be(:data_path) { [:project, :issues] } - def pagination_query(params, page_info) - graphql_query_for( - 'project', - { 'fullPath' => sort_project.full_path }, - query_graphql_field('issues', params, "#{page_info} edges { node { iid dueDate} }") + def pagination_query(params) + graphql_query_for(:project, { full_path: sort_project.full_path }, + query_graphql_field(:issues, params, "#{page_info} nodes { iid }") ) end def pagination_results_data(data) - data.map { |issue| issue.dig('node', 'iid').to_i } + data.map { |issue| issue.dig('iid').to_i } end context 'when sorting by due date' do @@ -164,7 +162,7 @@ RSpec.describe 'getting an issue list for a project' do context 'when ascending' do it_behaves_like 'sorted paginated query' do - let(:sort_param) { 'DUE_DATE_ASC' } + let(:sort_param) { :DUE_DATE_ASC } let(:first_param) { 2 } let(:expected_results) { [due_issue3.iid, due_issue5.iid, due_issue1.iid, due_issue4.iid, due_issue2.iid] } end @@ -172,7 +170,7 @@ RSpec.describe 'getting an issue list for a project' do context 'when descending' do it_behaves_like 'sorted paginated query' do - let(:sort_param) { 'DUE_DATE_DESC' } + let(:sort_param) { :DUE_DATE_DESC } let(:first_param) { 2 } let(:expected_results) { [due_issue1.iid, due_issue5.iid, due_issue3.iid, due_issue4.iid, due_issue2.iid] } end @@ -189,7 +187,7 @@ RSpec.describe 'getting an issue list for a project' do context 'when ascending' do it_behaves_like 'sorted paginated query' do - let(:sort_param) { 'RELATIVE_POSITION_ASC' } + let(:sort_param) { :RELATIVE_POSITION_ASC } let(:first_param) { 2 } let(:expected_results) { [relative_issue5.iid, relative_issue3.iid, relative_issue1.iid, relative_issue4.iid, relative_issue2.iid] } end @@ -209,7 +207,7 @@ RSpec.describe 'getting an issue list for a project' do context 'when ascending' do it_behaves_like 'sorted paginated query' do - let(:sort_param) { 'PRIORITY_ASC' } + let(:sort_param) { :PRIORITY_ASC } let(:first_param) { 2 } let(:expected_results) { [priority_issue3.iid, priority_issue1.iid, priority_issue2.iid, priority_issue4.iid] } end @@ -217,7 +215,7 @@ RSpec.describe 'getting an issue list for a project' do context 'when descending' do it_behaves_like 'sorted paginated query' do - let(:sort_param) { 'PRIORITY_DESC' } + let(:sort_param) { :PRIORITY_DESC } let(:first_param) { 2 } let(:expected_results) { [priority_issue1.iid, priority_issue3.iid, priority_issue2.iid, priority_issue4.iid] } end @@ -236,7 +234,7 @@ RSpec.describe 'getting an issue list for a project' do context 'when ascending' do it_behaves_like 'sorted paginated query' do - let(:sort_param) { 'LABEL_PRIORITY_ASC' } + let(:sort_param) { :LABEL_PRIORITY_ASC } let(:first_param) { 2 } let(:expected_results) { [label_issue3.iid, label_issue1.iid, label_issue2.iid, label_issue4.iid] } end @@ -244,7 +242,7 @@ RSpec.describe 'getting an issue list for a project' do context 'when descending' do it_behaves_like 'sorted paginated query' do - let(:sort_param) { 'LABEL_PRIORITY_DESC' } + let(:sort_param) { :LABEL_PRIORITY_DESC } let(:first_param) { 2 } let(:expected_results) { [label_issue2.iid, label_issue3.iid, label_issue1.iid, label_issue4.iid] } end @@ -261,7 +259,7 @@ RSpec.describe 'getting an issue list for a project' do context 'when ascending' do it_behaves_like 'sorted paginated query' do - let(:sort_param) { 'MILESTONE_DUE_ASC' } + let(:sort_param) { :MILESTONE_DUE_ASC } let(:first_param) { 2 } let(:expected_results) { [milestone_issue2.iid, milestone_issue3.iid, milestone_issue1.iid] } end @@ -269,7 +267,7 @@ RSpec.describe 'getting an issue list for a project' do context 'when descending' do it_behaves_like 'sorted paginated query' do - let(:sort_param) { 'MILESTONE_DUE_DESC' } + let(:sort_param) { :MILESTONE_DUE_DESC } let(:first_param) { 2 } let(:expected_results) { [milestone_issue3.iid, milestone_issue2.iid, milestone_issue1.iid] } end diff --git a/spec/requests/api/graphql/project/merge_request/pipelines_spec.rb b/spec/requests/api/graphql/project/merge_request/pipelines_spec.rb new file mode 100644 index 00000000000..ac0b18a37d6 --- /dev/null +++ b/spec/requests/api/graphql/project/merge_request/pipelines_spec.rb @@ -0,0 +1,63 @@ +# frozen_string_literal: true + +require 'spec_helper' + +RSpec.describe 'Query.project.mergeRequests.pipelines' do + include GraphqlHelpers + + let_it_be(:project) { create(:project, :public, :repository) } + let_it_be(:author) { create(:user) } + let_it_be(:merge_requests) do + %i[with_diffs with_image_diffs conflict].map do |trait| + create(:merge_request, trait, author: author, source_project: project) + end + end + + describe '.count' do + let(:query) do + <<~GQL + query($path: ID!, $first: Int) { + project(fullPath: $path) { + mergeRequests(first: $first) { + nodes { + iid + pipelines { + count + } + } + } + } + } + GQL + end + + def run_query(first = nil) + post_graphql(query, current_user: author, variables: { path: project.full_path, first: first }) + end + + before do + merge_requests.each do |mr| + shas = mr.all_commits.limit(2).pluck(:sha) + + shas.each do |sha| + create(:ci_pipeline, :success, project: project, ref: mr.source_branch, sha: sha) + end + end + end + + it 'produces correct results' do + run_query(2) + + p_nodes = graphql_data_at(:project, :merge_requests, :nodes) + + expect(p_nodes).to all(match('iid' => be_present, 'pipelines' => match('count' => 2))) + end + + it 'is scalable', :request_store, :use_clean_rails_memory_store_caching do + # warm up + run_query + + expect { run_query(2) }.to(issue_same_number_of_queries_as { run_query(1) }.ignoring_cached_queries) + end + end +end diff --git a/spec/requests/api/graphql/project/merge_requests_spec.rb b/spec/requests/api/graphql/project/merge_requests_spec.rb index 2b8d537f9fc..c05a620bb62 100644 --- a/spec/requests/api/graphql/project/merge_requests_spec.rb +++ b/spec/requests/api/graphql/project/merge_requests_spec.rb @@ -259,29 +259,19 @@ RSpec.describe 'getting merge request listings nested in a project' do describe 'sorting and pagination' do let(:data_path) { [:project, :mergeRequests] } - def pagination_query(params, page_info) - graphql_query_for( - :project, - { full_path: project.full_path }, + def pagination_query(params) + graphql_query_for(:project, { full_path: project.full_path }, <<~QUERY mergeRequests(#{params}) { - #{page_info} edges { - node { - id - } - } + #{page_info} nodes { id } } QUERY ) end - def pagination_results_data(data) - data.map { |project| project.dig('node', 'id') } - end - context 'when sorting by merged_at DESC' do it_behaves_like 'sorted paginated query' do - let(:sort_param) { 'MERGED_AT_DESC' } + let(:sort_param) { :MERGED_AT_DESC } let(:first_param) { 2 } let(:expected_results) do @@ -291,7 +281,7 @@ RSpec.describe 'getting merge request listings nested in a project' do merge_request_c, merge_request_e, merge_request_a - ].map(&:to_gid).map(&:to_s) + ].map { |mr| global_id_of(mr) } end before do @@ -304,33 +294,6 @@ RSpec.describe 'getting merge request listings nested in a project' do merge_request_b.metrics.update!(merged_at: 1.day.ago) end - - context 'when paginating backwards' do - let(:params) { 'first: 2, sort: MERGED_AT_DESC' } - let(:page_info) { 'pageInfo { startCursor endCursor }' } - - before do - post_graphql(pagination_query(params, page_info), current_user: current_user) - end - - it 'paginates backwards correctly' do - # first page - first_page_response_data = graphql_dig_at(Gitlab::Json.parse(response.body), :data, *data_path, :edges) - end_cursor = graphql_dig_at(Gitlab::Json.parse(response.body), :data, :project, :mergeRequests, :pageInfo, :endCursor) - - # second page - params = "first: 2, after: \"#{end_cursor}\", sort: MERGED_AT_DESC" - post_graphql(pagination_query(params, page_info), current_user: current_user) - start_cursor = graphql_dig_at(Gitlab::Json.parse(response.body), :data, :project, :mergeRequests, :pageInfo, :start_cursor) - - # going back to the first page - - params = "last: 2, before: \"#{start_cursor}\", sort: MERGED_AT_DESC" - post_graphql(pagination_query(params, page_info), current_user: current_user) - backward_paginated_response_data = graphql_dig_at(Gitlab::Json.parse(response.body), :data, *data_path, :edges) - expect(first_page_response_data).to eq(backward_paginated_response_data) - end - end end end end diff --git a/spec/requests/api/graphql/project/pipeline_spec.rb b/spec/requests/api/graphql/project/pipeline_spec.rb index fef0e7e160c..6179b43629b 100644 --- a/spec/requests/api/graphql/project/pipeline_spec.rb +++ b/spec/requests/api/graphql/project/pipeline_spec.rb @@ -5,12 +5,12 @@ require 'spec_helper' RSpec.describe 'getting pipeline information nested in a project' do include GraphqlHelpers - let(:project) { create(:project, :repository, :public) } - let(:pipeline) { create(:ci_pipeline, project: project) } - let(:current_user) { create(:user) } + let!(:project) { create(:project, :repository, :public) } + let!(:pipeline) { create(:ci_pipeline, project: project) } + let!(:current_user) { create(:user) } let(:pipeline_graphql_data) { graphql_data['project']['pipeline'] } - let(:query) do + let!(:query) do graphql_query_for( 'project', { 'fullPath' => project.full_path }, @@ -35,4 +35,45 @@ RSpec.describe 'getting pipeline information nested in a project' do expect(pipeline_graphql_data.dig('configSource')).to eq('UNKNOWN_SOURCE') end + + context 'batching' do + let!(:pipeline2) { create(:ci_pipeline, project: project, user: current_user, builds: [create(:ci_build, :success)]) } + let!(:pipeline3) { create(:ci_pipeline, project: project, user: current_user, builds: [create(:ci_build, :success)]) } + let!(:query) { build_query_to_find_pipeline_shas(pipeline, pipeline2, pipeline3) } + + it 'executes the finder once' do + mock = double(Ci::PipelinesFinder) + opts = { iids: [pipeline.iid, pipeline2.iid, pipeline3.iid].map(&:to_s) } + + expect(Ci::PipelinesFinder).to receive(:new).once.with(project, current_user, opts).and_return(mock) + expect(mock).to receive(:execute).once.and_return(Ci::Pipeline.none) + + post_graphql(query, current_user: current_user) + end + + it 'keeps the queries under the threshold' do + control = ActiveRecord::QueryRecorder.new do + single_pipeline_query = build_query_to_find_pipeline_shas(pipeline) + + post_graphql(single_pipeline_query, current_user: current_user) + end + + aggregate_failures do + expect(response).to have_gitlab_http_status(:success) + expect do + post_graphql(query, current_user: current_user) + end.not_to exceed_query_limit(control) + end + end + end + + private + + def build_query_to_find_pipeline_shas(*pipelines) + pipeline_fields = pipelines.map.each_with_index do |pipeline, idx| + "pipeline#{idx}: pipeline(iid: \"#{pipeline.iid}\") { sha }" + end.join(' ') + + graphql_query_for('project', { 'fullPath' => project.full_path }, pipeline_fields) + end end diff --git a/spec/requests/api/graphql/project/project_members_spec.rb b/spec/requests/api/graphql/project/project_members_spec.rb new file mode 100644 index 00000000000..cb937432ef7 --- /dev/null +++ b/spec/requests/api/graphql/project/project_members_spec.rb @@ -0,0 +1,121 @@ +# frozen_string_literal: true + +require 'spec_helper' + +RSpec.describe 'getting project members information' do + include GraphqlHelpers + + let_it_be(:parent_group) { create(:group, :public) } + let_it_be(:parent_project) { create(:project, :public, group: parent_group) } + let_it_be(:user) { create(:user) } + let_it_be(:user_1) { create(:user, username: 'user') } + let_it_be(:user_2) { create(:user, username: 'test') } + + let(:member_data) { graphql_data['project']['projectMembers']['edges'] } + + before_all do + [user_1, user_2].each { |user| parent_group.add_guest(user) } + end + + context 'when the request is correct' do + it_behaves_like 'a working graphql query' do + before_all do + fetch_members(project: parent_project) + end + end + + it 'returns project members successfully' do + fetch_members(project: parent_project) + + expect(graphql_errors).to be_nil + expect_array_response(user_1, user_2) + end + + it 'returns members that match the search query' do + fetch_members(project: parent_project, args: { search: 'test' }) + + expect(graphql_errors).to be_nil + expect_array_response(user_2) + end + end + + context 'member relations' do + let_it_be(:child_group) { create(:group, :public, parent: parent_group) } + let_it_be(:child_project) { create(:project, :public, group: child_group) } + let_it_be(:invited_group) { create(:group, :public) } + let_it_be(:child_user) { create(:user) } + let_it_be(:invited_user) { create(:user) } + let_it_be(:group_link) { create(:project_group_link, project: child_project, group: invited_group) } + + before_all do + child_project.add_guest(child_user) + invited_group.add_guest(invited_user) + end + + it 'returns direct members' do + fetch_members(project: child_project, args: { relations: [:DIRECT] }) + + expect(graphql_errors).to be_nil + expect_array_response(child_user) + end + + it 'returns invited members plus inherited members' do + fetch_members(project: child_project, args: { relations: [:INVITED_GROUPS] }) + + expect(graphql_errors).to be_nil + expect_array_response(invited_user, user_1, user_2) + end + + it 'returns direct, inherited, descendant, and invited members' do + fetch_members(project: child_project, args: { relations: [:DIRECT, :INHERITED, :DESCENDANTS, :INVITED_GROUPS] }) + + expect(graphql_errors).to be_nil + expect_array_response(child_user, user_1, user_2, invited_user) + end + + it 'returns an error for an invalid member relation' do + fetch_members(project: child_project, args: { relations: [:OBLIQUE] }) + + expect(graphql_errors.first) + .to include('path' => %w[query project projectMembers relations], + 'message' => a_string_including('invalid value ([OBLIQUE])')) + end + end + + context 'when unauthenticated' do + it 'returns members' do + fetch_members(current_user: nil, project: parent_project) + + expect(graphql_errors).to be_nil + expect_array_response(user_1, user_2) + end + end + + def fetch_members(project:, current_user: user, args: {}) + post_graphql(members_query(project.full_path, args), current_user: current_user) + end + + def members_query(group_path, args = {}) + members_node = <<~NODE + edges { + node { + user { + id + } + } + } + NODE + + graphql_query_for('project', + { full_path: group_path }, + [query_graphql_field('projectMembers', args, members_node)] + ) + end + + def expect_array_response(*items) + expect(response).to have_gitlab_http_status(:success) + expect(member_data).to be_an Array + expect(member_data.map { |node| node['node']['user']['id'] }) + .to match_array(items.map { |u| global_id_of(u) }) + end +end diff --git a/spec/requests/api/graphql/project/project_pipeline_statistics_spec.rb b/spec/requests/api/graphql/project/project_pipeline_statistics_spec.rb new file mode 100644 index 00000000000..0f495f3e671 --- /dev/null +++ b/spec/requests/api/graphql/project/project_pipeline_statistics_spec.rb @@ -0,0 +1,58 @@ +# frozen_string_literal: true + +require 'spec_helper' + +RSpec.describe 'rendering project pipeline statistics' do + include GraphqlHelpers + + let_it_be(:project) { create(:project) } + let(:user) { create(:user) } + + let(:fields) do + <<~QUERY + weekPipelinesTotals + weekPipelinesLabels + monthPipelinesLabels + monthPipelinesTotals + yearPipelinesLabels + yearPipelinesTotals + QUERY + end + + let(:query) do + graphql_query_for('project', + { 'fullPath' => project.full_path }, + query_graphql_field('pipelineAnalytics', {}, fields)) + end + + before do + project.add_maintainer(user) + end + + it_behaves_like 'a working graphql query' do + before do + post_graphql(query, current_user: user) + end + end + + it "contains two arrays of 8 elements each for the week pipelines" do + post_graphql(query, current_user: user) + + expect(graphql_data_at(:project, :pipelineAnalytics, :weekPipelinesTotals).length).to eq(8) + expect(graphql_data_at(:project, :pipelineAnalytics, :weekPipelinesLabels).length).to eq(8) + end + + it "contains two arrays of 31 elements each for the month pipelines" do + post_graphql(query, current_user: user) + + expect(graphql_data_at(:project, :pipelineAnalytics, :monthPipelinesTotals).length).to eq(31) + expect(graphql_data_at(:project, :pipelineAnalytics, :monthPipelinesLabels).length).to eq(31) + end + + it "contains two arrays of 13 elements each for the year pipelines" do + post_graphql(query, current_user: user) + + expect(graphql_data_at(:project, :pipelineAnalytics, :yearPipelinesTotals).length).to eq(13) + expect(graphql_data_at(:project, :pipelineAnalytics, :yearPipelinesLabels).length).to eq(13) + end +end diff --git a/spec/requests/api/graphql/project/release_spec.rb b/spec/requests/api/graphql/project/release_spec.rb index 57dbe258ce4..99b15ff00b1 100644 --- a/spec/requests/api/graphql/project/release_spec.rb +++ b/spec/requests/api/graphql/project/release_spec.rb @@ -36,7 +36,7 @@ RSpec.describe 'Query.project(fullPath).release(tagName)' do let(:path) { path_prefix } let(:release_fields) do - query_graphql_field(%{ + %{ tagName tagPath description @@ -45,7 +45,7 @@ RSpec.describe 'Query.project(fullPath).release(tagName)' do createdAt releasedAt upcomingRelease - }) + } end before do @@ -233,7 +233,7 @@ RSpec.describe 'Query.project(fullPath).release(tagName)' do let(:path) { path_prefix } let(:release_fields) do - query_graphql_field('description') + 'description' end before do @@ -394,10 +394,10 @@ RSpec.describe 'Query.project(fullPath).release(tagName)' do let(:current_user) { developer } let(:release_fields) do - query_graphql_field(%{ + %{ releasedAt upcomingRelease - }) + } end before do diff --git a/spec/requests/api/graphql/project/terraform/states_spec.rb b/spec/requests/api/graphql/project/terraform/states_spec.rb index 8b67b549efa..2879530acc5 100644 --- a/spec/requests/api/graphql/project/terraform/states_spec.rb +++ b/spec/requests/api/graphql/project/terraform/states_spec.rb @@ -4,6 +4,7 @@ require 'spec_helper' RSpec.describe 'query terraform states' do include GraphqlHelpers + include ::API::Helpers::RelatedResourcesHelpers let_it_be(:project) { create(:project) } let_it_be(:terraform_state) { create(:terraform_state, :with_version, :locked, project: project) } @@ -23,6 +24,8 @@ RSpec.describe 'query terraform states' do latestVersion { id + downloadPath + serial createdAt updatedAt @@ -50,22 +53,32 @@ RSpec.describe 'query terraform states' do post_graphql(query, current_user: current_user) end - it 'returns terraform state data', :aggregate_failures do - state = data.dig('nodes', 0) - version = state['latestVersion'] - - expect(state['id']).to eq(terraform_state.to_global_id.to_s) - expect(state['name']).to eq(terraform_state.name) - expect(state['lockedAt']).to eq(terraform_state.locked_at.iso8601) - expect(state['createdAt']).to eq(terraform_state.created_at.iso8601) - expect(state['updatedAt']).to eq(terraform_state.updated_at.iso8601) - expect(state.dig('lockedByUser', 'id')).to eq(terraform_state.locked_by_user.to_global_id.to_s) - - expect(version['id']).to eq(latest_version.to_global_id.to_s) - expect(version['createdAt']).to eq(latest_version.created_at.iso8601) - expect(version['updatedAt']).to eq(latest_version.updated_at.iso8601) - expect(version.dig('createdByUser', 'id')).to eq(latest_version.created_by_user.to_global_id.to_s) - expect(version.dig('job', 'name')).to eq(latest_version.build.name) + it 'returns terraform state data' do + download_path = expose_path( + api_v4_projects_terraform_state_versions_path( + id: project.id, + name: terraform_state.name, + serial: latest_version.version + ) + ) + + expect(data['nodes']).to contain_exactly({ + 'id' => global_id_of(terraform_state), + 'name' => terraform_state.name, + 'lockedAt' => terraform_state.locked_at.iso8601, + 'createdAt' => terraform_state.created_at.iso8601, + 'updatedAt' => terraform_state.updated_at.iso8601, + 'lockedByUser' => { 'id' => global_id_of(terraform_state.locked_by_user) }, + 'latestVersion' => { + 'id' => eq(global_id_of(latest_version)), + 'serial' => eq(latest_version.version), + 'downloadPath' => eq(download_path), + 'createdAt' => eq(latest_version.created_at.iso8601), + 'updatedAt' => eq(latest_version.updated_at.iso8601), + 'createdByUser' => { 'id' => eq(global_id_of(latest_version.created_by_user)) }, + 'job' => { 'name' => eq(latest_version.build.name) } + } + }) end it 'returns count of terraform states' do diff --git a/spec/requests/api/graphql/project_query_spec.rb b/spec/requests/api/graphql/project_query_spec.rb index 4b8ffb0675c..b29f9ae913f 100644 --- a/spec/requests/api/graphql/project_query_spec.rb +++ b/spec/requests/api/graphql/project_query_spec.rb @@ -5,36 +5,34 @@ require 'spec_helper' RSpec.describe 'getting project information' do include GraphqlHelpers - let(:group) { create(:group) } - let(:project) { create(:project, :repository, group: group) } - let(:current_user) { create(:user) } + let_it_be(:group) { create(:group) } + let_it_be(:project) { create(:project, :repository, group: group) } + let_it_be(:current_user) { create(:user) } + let(:fields) { all_graphql_fields_for(Project, max_depth: 2, excluded: %w(jiraImports services)) } let(:query) do - graphql_query_for( - 'project', - { 'fullPath' => project.full_path }, - all_graphql_fields_for('project'.to_s.classify, excluded: %w(jiraImports services)) - ) + graphql_query_for(:project, { full_path: project.full_path }, fields) end context 'when the user has full access to the project' do let(:full_access_query) do - graphql_query_for('project', 'fullPath' => project.full_path) + graphql_query_for(:project, { full_path: project.full_path }, + all_graphql_fields_for('Project', max_depth: 2)) end before do project.add_maintainer(current_user) end - it 'includes the project' do - post_graphql(query, current_user: current_user) + it 'includes the project', :use_clean_rails_memory_store_caching, :request_store do + post_graphql(full_access_query, current_user: current_user) expect(graphql_data['project']).not_to be_nil end end - context 'when the user has access to the project' do - before do + context 'when the user has access to the project', :use_clean_rails_memory_store_caching, :request_store do + before_all do project.add_developer(current_user) end @@ -55,10 +53,12 @@ RSpec.describe 'getting project information' do create(:ci_pipeline, project: project) end + let(:fields) { query_nodes(:pipelines) } + it 'is included in the pipelines connection' do post_graphql(query, current_user: current_user) - expect(graphql_data['project']['pipelines']['edges'].size).to eq(1) + expect(graphql_data_at(:project, :pipelines, :nodes)).to contain_exactly(a_kind_of(Hash)) end end @@ -109,7 +109,7 @@ RSpec.describe 'getting project information' do end describe 'performance' do - before do + before_all do project.add_developer(current_user) mrs = create_list(:merge_request, 10, :closed, :with_head_pipeline, source_project: project, @@ -151,8 +151,9 @@ RSpec.describe 'getting project information' do ))) end - it 'can lookahead to eliminate N+1 queries', :use_clean_rails_memory_store_caching, :request_store do - expect { run_query(10) }.to issue_same_number_of_queries_as { run_query(1) }.or_fewer.ignoring_cached_queries + it 'can lookahead to eliminate N+1 queries' do + baseline = ActiveRecord::QueryRecorder.new { run_query(1) } + expect { run_query(10) }.not_to exceed_query_limit(baseline) end end diff --git a/spec/requests/api/graphql/user_query_spec.rb b/spec/requests/api/graphql/user_query_spec.rb index 8c45a67cb0f..60520906e87 100644 --- a/spec/requests/api/graphql/user_query_spec.rb +++ b/spec/requests/api/graphql/user_query_spec.rb @@ -58,9 +58,25 @@ RSpec.describe 'getting user information' do source_project: project_b, author: user) end + let_it_be(:reviewed_mr) do + create(:merge_request, :unique_branches, :unique_author, + source_project: project_a, reviewers: [user]) + end + + let_it_be(:reviewed_mr_b) do + create(:merge_request, :unique_branches, :unique_author, + source_project: project_b, reviewers: [user]) + end + + let_it_be(:reviewed_mr_c) do + create(:merge_request, :unique_branches, :unique_author, + source_project: project_b, reviewers: [user]) + end + let(:current_user) { authorised_user } let(:authored_mrs) { graphql_data_at(:user, :authored_merge_requests, :nodes) } let(:assigned_mrs) { graphql_data_at(:user, :assigned_merge_requests, :nodes) } + let(:reviewed_mrs) { graphql_data_at(:user, :review_requested_merge_requests, :nodes) } let(:user_params) { { username: user.username } } before do @@ -82,7 +98,8 @@ RSpec.describe 'getting user information' do 'username' => presenter.username, 'webUrl' => presenter.web_url, 'avatarUrl' => presenter.avatar_url, - 'email' => presenter.public_email + 'email' => presenter.public_email, + 'publicEmail' => presenter.public_email )) expect(graphql_data['user']['status']).to match( @@ -156,6 +173,23 @@ RSpec.describe 'getting user information' do ) end end + + context 'filtering by reviewer' do + let(:reviewer) { create(:user) } + let(:mr_args) { { reviewer_username: reviewer.username } } + + it 'finds the assigned mrs' do + assigned_mr_b.reviewers << reviewer + assigned_mr_c.reviewers << reviewer + + post_graphql(query, current_user: current_user) + + expect(assigned_mrs).to contain_exactly( + a_hash_including('id' => global_id_of(assigned_mr_b)), + a_hash_including('id' => global_id_of(assigned_mr_c)) + ) + end + end end context 'the current user does not have access' do @@ -167,6 +201,95 @@ RSpec.describe 'getting user information' do end end + describe 'reviewRequestedMergeRequests' do + let(:user_fields) do + query_graphql_field(:review_requested_merge_requests, mr_args, 'nodes { id }') + end + + let(:mr_args) { nil } + + it_behaves_like 'a working graphql query' + + it 'can be found' do + expect(reviewed_mrs).to contain_exactly( + a_hash_including('id' => global_id_of(reviewed_mr)), + a_hash_including('id' => global_id_of(reviewed_mr_b)), + a_hash_including('id' => global_id_of(reviewed_mr_c)) + ) + end + + context 'applying filters' do + context 'filtering by IID without specifying a project' do + let(:mr_args) do + { iids: [reviewed_mr_b.iid.to_s] } + end + + it 'return an argument error that mentions the missing fields' do + expect_graphql_errors_to_include(/projectPath/) + end + end + + context 'filtering by project path and IID' do + let(:mr_args) do + { project_path: project_b.full_path, iids: [reviewed_mr_b.iid.to_s] } + end + + it 'selects the correct MRs' do + expect(reviewed_mrs).to contain_exactly( + a_hash_including('id' => global_id_of(reviewed_mr_b)) + ) + end + end + + context 'filtering by project path' do + let(:mr_args) do + { project_path: project_b.full_path } + end + + it 'selects the correct MRs' do + expect(reviewed_mrs).to contain_exactly( + a_hash_including('id' => global_id_of(reviewed_mr_b)), + a_hash_including('id' => global_id_of(reviewed_mr_c)) + ) + end + end + + context 'filtering by author' do + let(:author) { reviewed_mr_b.author } + let(:mr_args) { { author_username: author.username } } + + it 'finds the authored mrs' do + expect(reviewed_mrs).to contain_exactly( + a_hash_including('id' => global_id_of(reviewed_mr_b)) + ) + end + end + + context 'filtering by assignee' do + let(:assignee) { create(:user) } + let(:mr_args) { { assignee_username: assignee.username } } + + it 'finds the authored mrs' do + reviewed_mr_c.assignees << assignee + + post_graphql(query, current_user: current_user) + + expect(reviewed_mrs).to contain_exactly( + a_hash_including('id' => global_id_of(reviewed_mr_c)) + ) + end + end + end + + context 'the current user does not have access' do + let(:current_user) { unauthorized_user } + + it 'cannot be found' do + expect(reviewed_mrs).to be_empty + end + end + end + describe 'authoredMergeRequests' do let(:user_fields) do query_graphql_field(:authored_merge_requests, mr_args, 'nodes { id }') @@ -212,6 +335,23 @@ RSpec.describe 'getting user information' do end end + context 'filtering by reviewer' do + let(:reviewer) { create(:user) } + let(:mr_args) { { reviewer_username: reviewer.username } } + + it 'finds the assigned mrs' do + authored_mr_b.reviewers << reviewer + authored_mr_c.reviewers << reviewer + + post_graphql(query, current_user: current_user) + + expect(authored_mrs).to contain_exactly( + a_hash_including('id' => global_id_of(authored_mr_b)), + a_hash_including('id' => global_id_of(authored_mr_c)) + ) + end + end + context 'filtering by project path and IID' do let(:mr_args) do { project_path: project_b.full_path, iids: [authored_mr_b.iid.to_s] } diff --git a/spec/requests/api/graphql/users_spec.rb b/spec/requests/api/graphql/users_spec.rb index 91ac206676b..72d86c10df1 100644 --- a/spec/requests/api/graphql/users_spec.rb +++ b/spec/requests/api/graphql/users_spec.rb @@ -59,20 +59,16 @@ RSpec.describe 'Users' do describe 'sorting and pagination' do let_it_be(:data_path) { [:users] } - def pagination_query(params, page_info) - graphql_query_for("users", params, "#{page_info} edges { node { id } }") - end - - def pagination_results_data(data) - data.map { |user| user.dig('node', 'id') } + def pagination_query(params) + graphql_query_for(:users, params, "#{page_info} nodes { id }") end context 'when sorting by created_at' do - let_it_be(:ascending_users) { [user3, user2, user1, current_user].map(&:to_global_id).map(&:to_s) } + let_it_be(:ascending_users) { [user3, user2, user1, current_user].map { |u| global_id_of(u) } } context 'when ascending' do it_behaves_like 'sorted paginated query' do - let(:sort_param) { 'created_asc' } + let(:sort_param) { :CREATED_ASC } let(:first_param) { 1 } let(:expected_results) { ascending_users } end @@ -80,7 +76,7 @@ RSpec.describe 'Users' do context 'when descending' do it_behaves_like 'sorted paginated query' do - let(:sort_param) { 'created_desc' } + let(:sort_param) { :CREATED_DESC } let(:first_param) { 1 } let(:expected_results) { ascending_users.reverse } end diff --git a/spec/requests/api/graphql_spec.rb b/spec/requests/api/graphql_spec.rb index 5dc8edb87e9..4eaf57a7d35 100644 --- a/spec/requests/api/graphql_spec.rb +++ b/spec/requests/api/graphql_spec.rb @@ -105,7 +105,7 @@ RSpec.describe 'GraphQL' do stub_authentication_activity_metrics(debug: false) end - it 'Authenticates users with a PAT' do + it 'authenticates users with a PAT' do expect(authentication_metrics) .to increment(:user_authenticated_counter) .and increment(:user_session_override_counter) diff --git a/spec/requests/api/group_clusters_spec.rb b/spec/requests/api/group_clusters_spec.rb index eb21ae9468c..f65f9384efa 100644 --- a/spec/requests/api/group_clusters_spec.rb +++ b/spec/requests/api/group_clusters_spec.rb @@ -89,6 +89,8 @@ RSpec.describe API::GroupClusters do expect(json_response['environment_scope']).to eq('*') expect(json_response['cluster_type']).to eq('group_type') expect(json_response['domain']).to eq('example.com') + expect(json_response['enabled']).to be_truthy + expect(json_response['managed']).to be_truthy end it 'returns group information' do @@ -172,6 +174,7 @@ RSpec.describe API::GroupClusters do name: 'test-cluster', domain: 'domain.example.com', managed: false, + enabled: false, namespace_per_environment: false, platform_kubernetes_attributes: platform_kubernetes_attributes, management_project_id: management_project_id @@ -206,6 +209,7 @@ RSpec.describe API::GroupClusters do expect(cluster_result.name).to eq('test-cluster') expect(cluster_result.domain).to eq('domain.example.com') expect(cluster_result.managed).to be_falsy + expect(cluster_result.enabled).to be_falsy expect(cluster_result.management_project_id).to eq management_project_id expect(cluster_result.namespace_per_environment).to eq(false) expect(platform_kubernetes.rbac?).to be_truthy @@ -342,7 +346,9 @@ RSpec.describe API::GroupClusters do { domain: domain, platform_kubernetes_attributes: platform_kubernetes_attributes, - management_project_id: management_project_id + management_project_id: management_project_id, + managed: false, + enabled: false } end @@ -381,6 +387,8 @@ RSpec.describe API::GroupClusters do it 'updates cluster attributes' do expect(cluster.domain).to eq('new-domain.com') expect(cluster.management_project).to eq(management_project) + expect(cluster.managed).to be_falsy + expect(cluster.enabled).to be_falsy end end @@ -394,6 +402,8 @@ RSpec.describe API::GroupClusters do it 'does not update cluster attributes' do expect(cluster.domain).to eq('old-domain.com') expect(cluster.management_project).to be_nil + expect(cluster.managed).to be_truthy + expect(cluster.enabled).to be_truthy end it 'returns validation errors' do diff --git a/spec/requests/api/group_import_spec.rb b/spec/requests/api/group_import_spec.rb index cb63206fcb8..d8e945baf6a 100644 --- a/spec/requests/api/group_import_spec.rb +++ b/spec/requests/api/group_import_spec.rb @@ -264,7 +264,7 @@ RSpec.describe API::GroupImport do subject expect(response).to have_gitlab_http_status(:ok) - expect(response.content_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE) + expect(response.media_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE) end it 'rejects requests that bypassed gitlab-workhorse' do @@ -285,7 +285,7 @@ RSpec.describe API::GroupImport do subject expect(response).to have_gitlab_http_status(:ok) - expect(response.content_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE) + expect(response.media_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE) expect(json_response).not_to have_key('TempPath') expect(json_response['RemoteObject']).to have_key('ID') expect(json_response['RemoteObject']).to have_key('GetURL') @@ -304,7 +304,7 @@ RSpec.describe API::GroupImport do subject expect(response).to have_gitlab_http_status(:ok) - expect(response.content_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE) + expect(response.media_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE) expect(json_response['TempPath']).to eq(ImportExportUploader.workhorse_local_upload_path) expect(json_response['RemoteObject']).to be_nil end diff --git a/spec/requests/api/import_github_spec.rb b/spec/requests/api/import_github_spec.rb index 5bbcb0c1950..d5fed330401 100644 --- a/spec/requests/api/import_github_spec.rb +++ b/spec/requests/api/import_github_spec.rb @@ -44,7 +44,7 @@ RSpec.describe API::ImportGithub do it 'returns 201 response when the project is imported successfully' do allow(Gitlab::LegacyGithubImport::ProjectCreator) - .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, access_params, type: provider) + .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, type: provider, **access_params) .and_return(double(execute: project)) post api("/import/github", user), params: { @@ -59,7 +59,7 @@ RSpec.describe API::ImportGithub do it 'returns 201 response when the project is imported successfully from GHE' do allow(Gitlab::LegacyGithubImport::ProjectCreator) - .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, access_params, type: provider) + .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, type: provider, **access_params) .and_return(double(execute: project)) post api("/import/github", user), params: { diff --git a/spec/requests/api/internal/base_spec.rb b/spec/requests/api/internal/base_spec.rb index 6fe77727702..e04f63befd0 100644 --- a/spec/requests/api/internal/base_spec.rb +++ b/spec/requests/api/internal/base_spec.rb @@ -220,6 +220,8 @@ RSpec.describe API::Internal::Base do end it 'returns a token without expiry when the expires_at parameter is missing' do + token_size = (PersonalAccessToken.token_prefix || '').size + 20 + post api('/internal/personal_access_token'), params: { secret_token: secret_token, @@ -229,12 +231,14 @@ RSpec.describe API::Internal::Base do } expect(json_response['success']).to be_truthy - expect(json_response['token']).to match(/\A\S{20}\z/) + expect(json_response['token']).to match(/\A\S{#{token_size}}\z/) expect(json_response['scopes']).to match_array(%w(read_api read_repository)) expect(json_response['expires_at']).to be_nil end it 'returns a token with expiry when it receives a valid expires_at parameter' do + token_size = (PersonalAccessToken.token_prefix || '').size + 20 + post api('/internal/personal_access_token'), params: { secret_token: secret_token, @@ -245,7 +249,7 @@ RSpec.describe API::Internal::Base do } expect(json_response['success']).to be_truthy - expect(json_response['token']).to match(/\A\S{20}\z/) + expect(json_response['token']).to match(/\A\S{#{token_size}}\z/) expect(json_response['scopes']).to match_array(%w(read_api read_repository)) expect(json_response['expires_at']).to eq('9001-11-17') end @@ -722,8 +726,7 @@ RSpec.describe API::Internal::Base do 'ssh', { authentication_abilities: [:read_project, :download_code, :push_code], - namespace_path: project.namespace.path, - repository_path: project.path, + repository_path: "#{project.full_path}.git", redirected_path: nil } ).and_return(access_checker) @@ -1337,9 +1340,13 @@ RSpec.describe API::Internal::Base do end context 'when the OTP is valid' do - it 'returns success' do + it 'registers a new OTP session and returns success' do allow_any_instance_of(Users::ValidateOtpService).to receive(:execute).with(otp).and_return(status: :success) + expect_next_instance_of(::Gitlab::Auth::Otp::SessionEnforcer) do |session_enforcer| + expect(session_enforcer).to receive(:update_session).once + end + subject expect(json_response['success']).to be_truthy diff --git a/spec/requests/api/internal/kubernetes_spec.rb b/spec/requests/api/internal/kubernetes_spec.rb index a532b8e59f2..afff3647b91 100644 --- a/spec/requests/api/internal/kubernetes_spec.rb +++ b/spec/requests/api/internal/kubernetes_spec.rb @@ -87,7 +87,7 @@ RSpec.describe API::Internal::Kubernetes do end end - describe "GET /internal/kubernetes/agent_info" do + describe 'GET /internal/kubernetes/agent_info' do def send_request(headers: {}, params: {}) get api('/internal/kubernetes/agent_info'), params: params, headers: headers.reverse_merge(jwt_auth_headers) end @@ -137,9 +137,7 @@ RSpec.describe API::Internal::Kubernetes do include_examples 'agent authentication' context 'an agent is found' do - let!(:agent_token) { create(:cluster_agent_token) } - - let(:agent) { agent_token.agent } + let_it_be(:agent_token) { create(:cluster_agent_token) } context 'project is public' do let(:project) { create(:project, :public) } @@ -186,6 +184,16 @@ RSpec.describe API::Internal::Kubernetes do expect(response).to have_gitlab_http_status(:not_found) end + + context 'and agent belongs to project' do + let(:agent_token) { create(:cluster_agent_token, agent: create(:cluster_agent, project: project)) } + + it 'returns 200' do + send_request(params: { id: project.id }, headers: { 'Authorization' => "Bearer #{agent_token.token}" }) + + expect(response).to have_gitlab_http_status(:success) + end + end end context 'project is internal' do diff --git a/spec/requests/api/internal/pages_spec.rb b/spec/requests/api/internal/pages_spec.rb index 9a63e2a8ed5..5b970ca605c 100644 --- a/spec/requests/api/internal/pages_spec.rb +++ b/spec/requests/api/internal/pages_spec.rb @@ -128,32 +128,38 @@ RSpec.describe API::Internal::Pages do ) end - it 'responds with proxy configuration' do + it 'responds with 204 because of feature deprecation' do query_host(serverless_domain.uri.host) - expect(response).to have_gitlab_http_status(:ok) - expect(response).to match_response_schema('internal/serverless/virtual_domain') - - expect(json_response['certificate']).to eq(pages_domain.certificate) - expect(json_response['key']).to eq(pages_domain.key) + expect(response).to have_gitlab_http_status(:no_content) + expect(response.body).to be_empty - expect(json_response['lookup_paths']).to eq( - [ - { - 'source' => { - 'type' => 'serverless', - 'service' => "test-function.#{project.name}-#{project.id}-#{environment.slug}.#{serverless_domain_cluster.knative.hostname}", - 'cluster' => { - 'hostname' => serverless_domain_cluster.knative.hostname, - 'address' => serverless_domain_cluster.knative.external_ip, - 'port' => 443, - 'cert' => serverless_domain_cluster.certificate, - 'key' => serverless_domain_cluster.key - } - } - } - ] - ) + ## + # Serverless serving and reverse proxy to Kubernetes / Knative has + # been deprecated and disabled, as per + # https://gitlab.com/gitlab-org/gitlab-pages/-/issues/467 + # + # expect(response).to match_response_schema('internal/serverless/virtual_domain') + # expect(json_response['certificate']).to eq(pages_domain.certificate) + # expect(json_response['key']).to eq(pages_domain.key) + # + # expect(json_response['lookup_paths']).to eq( + # [ + # { + # 'source' => { + # 'type' => 'serverless', + # 'service' => "test-function.#{project.name}-#{project.id}-#{environment.slug}.#{serverless_domain_cluster.knative.hostname}", + # 'cluster' => { + # 'hostname' => serverless_domain_cluster.knative.hostname, + # 'address' => serverless_domain_cluster.knative.external_ip, + # 'port' => 443, + # 'cert' => serverless_domain_cluster.certificate, + # 'key' => serverless_domain_cluster.key + # } + # } + # } + # ] + # ) end end end diff --git a/spec/requests/api/jobs_spec.rb b/spec/requests/api/jobs_spec.rb index c1498e03f76..f8521818845 100644 --- a/spec/requests/api/jobs_spec.rb +++ b/spec/requests/api/jobs_spec.rb @@ -3,6 +3,7 @@ require 'spec_helper' RSpec.describe API::Jobs do + using RSpec::Parameterized::TableSyntax include HttpIOHelpers let_it_be(:project, reload: true) do @@ -717,6 +718,58 @@ RSpec.describe API::Jobs do expect(response).to have_gitlab_http_status(:unauthorized) end end + + context 'when ci_debug_trace is set to true' do + before_all do + create(:ci_instance_variable, key: 'CI_DEBUG_TRACE', value: true) + end + + where(:public_builds, :user_project_role, :expected_status) do + true | 'developer' | :ok + true | 'guest' | :forbidden + false | 'developer' | :ok + false | 'guest' | :forbidden + end + + with_them do + before do + project.update!(public_builds: public_builds) + project.add_role(user, user_project_role) + + get api("/projects/#{project.id}/jobs/#{job.id}/trace", api_user) + end + + it 'renders trace to authorized users' do + expect(response).to have_gitlab_http_status(expected_status) + end + end + + context 'with restrict_access_to_build_debug_mode feature disabled' do + before do + stub_feature_flags(restrict_access_to_build_debug_mode: false) + end + + where(:public_builds, :user_project_role, :expected_status) do + true | 'developer' | :ok + true | 'guest' | :ok + false | 'developer' | :ok + false | 'guest' | :forbidden + end + + with_them do + before do + project.update!(public_builds: public_builds) + project.add_role(user, user_project_role) + + get api("/projects/#{project.id}/jobs/#{job.id}/trace", api_user) + end + + it 'renders trace to authorized users' do + expect(response).to have_gitlab_http_status(expected_status) + end + end + end + end end describe 'POST /projects/:id/jobs/:job_id/cancel' do diff --git a/spec/requests/api/merge_requests_spec.rb b/spec/requests/api/merge_requests_spec.rb index e7005bd3ec5..4339f1dd830 100644 --- a/spec/requests/api/merge_requests_spec.rb +++ b/spec/requests/api/merge_requests_spec.rb @@ -1888,6 +1888,54 @@ RSpec.describe API::MergeRequests do expect(response).to have_gitlab_http_status(:created) end end + + describe 'SSE counter' do + let(:headers) { {} } + let(:params) do + { + title: 'Test merge_request', + source_branch: 'feature_conflict', + target_branch: 'master', + author_id: user.id, + milestone_id: milestone.id, + squash: true + } + end + + subject { post api("/projects/#{project.id}/merge_requests", user), params: params, headers: headers } + + it 'does not increase the SSE counter by default' do + expect(Gitlab::UsageDataCounters::EditorUniqueCounter).not_to receive(:track_sse_edit_action) + + subject + + expect(response).to have_gitlab_http_status(:created) + end + + context 'when referer is not the SSE' do + let(:headers) { { 'HTTP_REFERER' => 'https://gitlab.com' } } + + it 'does not increase the SSE counter by default' do + expect(Gitlab::UsageDataCounters::EditorUniqueCounter).not_to receive(:track_sse_edit_action) + + subject + + expect(response).to have_gitlab_http_status(:created) + end + end + + context 'when referer is the SSE' do + let(:headers) { { 'HTTP_REFERER' => project_show_sse_url(project, 'master/README.md') } } + + it 'increases the SSE counter by default' do + expect(Gitlab::UsageDataCounters::EditorUniqueCounter).to receive(:track_sse_edit_action).with(author: user) + + subject + + expect(response).to have_gitlab_http_status(:created) + end + end + end end describe 'PUT /projects/:id/merge_reuests/:merge_request_iid' do diff --git a/spec/requests/api/nuget_packages_spec.rb b/spec/requests/api/nuget_packages_spec.rb deleted file mode 100644 index 62f244c433b..00000000000 --- a/spec/requests/api/nuget_packages_spec.rb +++ /dev/null @@ -1,533 +0,0 @@ -# frozen_string_literal: true -require 'spec_helper' - -RSpec.describe API::NugetPackages do - include WorkhorseHelpers - include PackagesManagerApiSpecHelpers - include HttpBasicAuthHelpers - - let_it_be(:user) { create(:user) } - let_it_be(:project, reload: true) { create(:project, :public) } - let_it_be(:personal_access_token) { create(:personal_access_token, user: user) } - let_it_be(:deploy_token) { create(:deploy_token, read_package_registry: true, write_package_registry: true) } - let_it_be(:project_deploy_token) { create(:project_deploy_token, deploy_token: deploy_token, project: project) } - - describe 'GET /api/v4/projects/:id/packages/nuget' do - let(:url) { "/projects/#{project.id}/packages/nuget/index.json" } - - subject { get api(url) } - - context 'without the need for a license' do - context 'with valid project' do - using RSpec::Parameterized::TableSyntax - - context 'personal token' do - where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do - 'PUBLIC' | :developer | true | true | 'process nuget service index request' | :success - 'PUBLIC' | :guest | true | true | 'process nuget service index request' | :success - 'PUBLIC' | :developer | true | false | 'process nuget service index request' | :success - 'PUBLIC' | :guest | true | false | 'process nuget service index request' | :success - 'PUBLIC' | :developer | false | true | 'process nuget service index request' | :success - 'PUBLIC' | :guest | false | true | 'process nuget service index request' | :success - 'PUBLIC' | :developer | false | false | 'process nuget service index request' | :success - 'PUBLIC' | :guest | false | false | 'process nuget service index request' | :success - 'PUBLIC' | :anonymous | false | true | 'process nuget service index request' | :success - 'PRIVATE' | :developer | true | true | 'process nuget service index request' | :success - 'PRIVATE' | :guest | true | true | 'rejects nuget packages access' | :forbidden - 'PRIVATE' | :developer | true | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :guest | true | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :developer | false | true | 'rejects nuget packages access' | :not_found - 'PRIVATE' | :guest | false | true | 'rejects nuget packages access' | :not_found - 'PRIVATE' | :developer | false | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :guest | false | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :anonymous | false | true | 'rejects nuget packages access' | :unauthorized - end - - with_them do - let(:token) { user_token ? personal_access_token.token : 'wrong' } - let(:headers) { user_role == :anonymous ? {} : basic_auth_header(user.username, token) } - - subject { get api(url), headers: headers } - - before do - project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false)) - end - - it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member] - end - end - - context 'with job token' do - where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do - 'PUBLIC' | :developer | true | true | 'process nuget service index request' | :success - 'PUBLIC' | :guest | true | true | 'process nuget service index request' | :success - 'PUBLIC' | :developer | true | false | 'rejects nuget packages access' | :unauthorized - 'PUBLIC' | :guest | true | false | 'rejects nuget packages access' | :unauthorized - 'PUBLIC' | :developer | false | true | 'process nuget service index request' | :success - 'PUBLIC' | :guest | false | true | 'process nuget service index request' | :success - 'PUBLIC' | :developer | false | false | 'rejects nuget packages access' | :unauthorized - 'PUBLIC' | :guest | false | false | 'rejects nuget packages access' | :unauthorized - 'PUBLIC' | :anonymous | false | true | 'process nuget service index request' | :success - 'PRIVATE' | :developer | true | true | 'process nuget service index request' | :success - 'PRIVATE' | :guest | true | true | 'rejects nuget packages access' | :forbidden - 'PRIVATE' | :developer | true | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :guest | true | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :developer | false | true | 'rejects nuget packages access' | :not_found - 'PRIVATE' | :guest | false | true | 'rejects nuget packages access' | :not_found - 'PRIVATE' | :developer | false | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :guest | false | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :anonymous | false | true | 'rejects nuget packages access' | :unauthorized - end - - with_them do - let(:job) { user_token ? create(:ci_build, project: project, user: user, status: :running) : double(token: 'wrong') } - let(:headers) { user_role == :anonymous ? {} : job_basic_auth_header(job) } - - subject { get api(url), headers: headers } - - before do - project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false)) - end - - it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member] - end - end - end - - it_behaves_like 'deploy token for package GET requests' - - it_behaves_like 'rejects nuget access with unknown project id' - - it_behaves_like 'rejects nuget access with invalid project id' - end - end - - describe 'PUT /api/v4/projects/:id/packages/nuget/authorize' do - let_it_be(:workhorse_token) { JWT.encode({ 'iss' => 'gitlab-workhorse' }, Gitlab::Workhorse.secret, 'HS256') } - let_it_be(:workhorse_header) { { 'GitLab-Workhorse' => '1.0', Gitlab::Workhorse::INTERNAL_API_REQUEST_HEADER => workhorse_token } } - let(:url) { "/projects/#{project.id}/packages/nuget/authorize" } - let(:headers) { {} } - - subject { put api(url), headers: headers } - - context 'without the need for a license' do - context 'with valid project' do - using RSpec::Parameterized::TableSyntax - - where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do - 'PUBLIC' | :developer | true | true | 'process nuget workhorse authorization' | :success - 'PUBLIC' | :guest | true | true | 'rejects nuget packages access' | :forbidden - 'PUBLIC' | :developer | true | false | 'rejects nuget packages access' | :unauthorized - 'PUBLIC' | :guest | true | false | 'rejects nuget packages access' | :unauthorized - 'PUBLIC' | :developer | false | true | 'rejects nuget packages access' | :forbidden - 'PUBLIC' | :guest | false | true | 'rejects nuget packages access' | :forbidden - 'PUBLIC' | :developer | false | false | 'rejects nuget packages access' | :unauthorized - 'PUBLIC' | :guest | false | false | 'rejects nuget packages access' | :unauthorized - 'PUBLIC' | :anonymous | false | true | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :developer | true | true | 'process nuget workhorse authorization' | :success - 'PRIVATE' | :guest | true | true | 'rejects nuget packages access' | :forbidden - 'PRIVATE' | :developer | true | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :guest | true | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :developer | false | true | 'rejects nuget packages access' | :not_found - 'PRIVATE' | :guest | false | true | 'rejects nuget packages access' | :not_found - 'PRIVATE' | :developer | false | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :guest | false | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :anonymous | false | true | 'rejects nuget packages access' | :unauthorized - end - - with_them do - let(:token) { user_token ? personal_access_token.token : 'wrong' } - let(:user_headers) { user_role == :anonymous ? {} : basic_auth_header(user.username, token) } - let(:headers) { user_headers.merge(workhorse_header) } - - before do - project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false)) - end - - it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member] - end - end - - it_behaves_like 'deploy token for package uploads' - - it_behaves_like 'rejects nuget access with unknown project id' - - it_behaves_like 'rejects nuget access with invalid project id' - end - end - - describe 'PUT /api/v4/projects/:id/packages/nuget' do - let(:workhorse_token) { JWT.encode({ 'iss' => 'gitlab-workhorse' }, Gitlab::Workhorse.secret, 'HS256') } - let(:workhorse_header) { { 'GitLab-Workhorse' => '1.0', Gitlab::Workhorse::INTERNAL_API_REQUEST_HEADER => workhorse_token } } - let_it_be(:file_name) { 'package.nupkg' } - let(:url) { "/projects/#{project.id}/packages/nuget" } - let(:headers) { {} } - let(:params) { { package: temp_file(file_name) } } - let(:file_key) { :package } - let(:send_rewritten_field) { true } - - subject do - workhorse_finalize( - api(url), - method: :put, - file_key: file_key, - params: params, - headers: headers, - send_rewritten_field: send_rewritten_field - ) - end - - context 'without the need for a license' do - context 'with valid project' do - using RSpec::Parameterized::TableSyntax - - where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do - 'PUBLIC' | :developer | true | true | 'process nuget upload' | :created - 'PUBLIC' | :guest | true | true | 'rejects nuget packages access' | :forbidden - 'PUBLIC' | :developer | true | false | 'rejects nuget packages access' | :unauthorized - 'PUBLIC' | :guest | true | false | 'rejects nuget packages access' | :unauthorized - 'PUBLIC' | :developer | false | true | 'rejects nuget packages access' | :forbidden - 'PUBLIC' | :guest | false | true | 'rejects nuget packages access' | :forbidden - 'PUBLIC' | :developer | false | false | 'rejects nuget packages access' | :unauthorized - 'PUBLIC' | :guest | false | false | 'rejects nuget packages access' | :unauthorized - 'PUBLIC' | :anonymous | false | true | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :developer | true | true | 'process nuget upload' | :created - 'PRIVATE' | :guest | true | true | 'rejects nuget packages access' | :forbidden - 'PRIVATE' | :developer | true | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :guest | true | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :developer | false | true | 'rejects nuget packages access' | :not_found - 'PRIVATE' | :guest | false | true | 'rejects nuget packages access' | :not_found - 'PRIVATE' | :developer | false | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :guest | false | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :anonymous | false | true | 'rejects nuget packages access' | :unauthorized - end - - with_them do - let(:token) { user_token ? personal_access_token.token : 'wrong' } - let(:user_headers) { user_role == :anonymous ? {} : basic_auth_header(user.username, token) } - let(:headers) { user_headers.merge(workhorse_header) } - - before do - project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false)) - end - - it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member] - end - end - - it_behaves_like 'deploy token for package uploads' - - it_behaves_like 'rejects nuget access with unknown project id' - - it_behaves_like 'rejects nuget access with invalid project id' - - context 'file size above maximum limit' do - let(:headers) { basic_auth_header(deploy_token.username, deploy_token.token).merge(workhorse_header) } - - before do - allow_next_instance_of(UploadedFile) do |uploaded_file| - allow(uploaded_file).to receive(:size).and_return(project.actual_limits.nuget_max_file_size + 1) - end - end - - it_behaves_like 'returning response status', :bad_request - end - end - end - - describe 'GET /api/v4/projects/:id/packages/nuget/metadata/*package_name/index' do - include_context 'with expected presenters dependency groups' - - let_it_be(:package_name) { 'Dummy.Package' } - let_it_be(:packages) { create_list(:nuget_package, 5, :with_metadatum, name: package_name, project: project) } - let_it_be(:tags) { packages.each { |pkg| create(:packages_tag, package: pkg, name: 'test') } } - let(:url) { "/projects/#{project.id}/packages/nuget/metadata/#{package_name}/index.json" } - - subject { get api(url) } - - before do - packages.each { |pkg| create_dependencies_for(pkg) } - end - - context 'without the need for license' do - context 'with valid project' do - using RSpec::Parameterized::TableSyntax - - where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do - 'PUBLIC' | :developer | true | true | 'process nuget metadata request at package name level' | :success - 'PUBLIC' | :guest | true | true | 'process nuget metadata request at package name level' | :success - 'PUBLIC' | :developer | true | false | 'process nuget metadata request at package name level' | :success - 'PUBLIC' | :guest | true | false | 'process nuget metadata request at package name level' | :success - 'PUBLIC' | :developer | false | true | 'process nuget metadata request at package name level' | :success - 'PUBLIC' | :guest | false | true | 'process nuget metadata request at package name level' | :success - 'PUBLIC' | :developer | false | false | 'process nuget metadata request at package name level' | :success - 'PUBLIC' | :guest | false | false | 'process nuget metadata request at package name level' | :success - 'PUBLIC' | :anonymous | false | true | 'process nuget metadata request at package name level' | :success - 'PRIVATE' | :developer | true | true | 'process nuget metadata request at package name level' | :success - 'PRIVATE' | :guest | true | true | 'rejects nuget packages access' | :forbidden - 'PRIVATE' | :developer | true | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :guest | true | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :developer | false | true | 'rejects nuget packages access' | :not_found - 'PRIVATE' | :guest | false | true | 'rejects nuget packages access' | :not_found - 'PRIVATE' | :developer | false | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :guest | false | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :anonymous | false | true | 'rejects nuget packages access' | :unauthorized - end - - with_them do - let(:token) { user_token ? personal_access_token.token : 'wrong' } - let(:headers) { user_role == :anonymous ? {} : basic_auth_header(user.username, token) } - - subject { get api(url), headers: headers } - - before do - project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false)) - end - - it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member] - end - - it_behaves_like 'deploy token for package GET requests' - - it_behaves_like 'rejects nuget access with unknown project id' - - it_behaves_like 'rejects nuget access with invalid project id' - end - end - end - - describe 'GET /api/v4/projects/:id/packages/nuget/metadata/*package_name/*package_version' do - include_context 'with expected presenters dependency groups' - - let_it_be(:package_name) { 'Dummy.Package' } - let_it_be(:package) { create(:nuget_package, :with_metadatum, name: 'Dummy.Package', project: project) } - let_it_be(:tag) { create(:packages_tag, package: package, name: 'test') } - let(:url) { "/projects/#{project.id}/packages/nuget/metadata/#{package_name}/#{package.version}.json" } - - subject { get api(url) } - - before do - create_dependencies_for(package) - end - - context 'without the need for a license' do - context 'with valid project' do - using RSpec::Parameterized::TableSyntax - - where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do - 'PUBLIC' | :developer | true | true | 'process nuget metadata request at package name and package version level' | :success - 'PUBLIC' | :guest | true | true | 'process nuget metadata request at package name and package version level' | :success - 'PUBLIC' | :developer | true | false | 'process nuget metadata request at package name and package version level' | :success - 'PUBLIC' | :guest | true | false | 'process nuget metadata request at package name and package version level' | :success - 'PUBLIC' | :developer | false | true | 'process nuget metadata request at package name and package version level' | :success - 'PUBLIC' | :guest | false | true | 'process nuget metadata request at package name and package version level' | :success - 'PUBLIC' | :developer | false | false | 'process nuget metadata request at package name and package version level' | :success - 'PUBLIC' | :guest | false | false | 'process nuget metadata request at package name and package version level' | :success - 'PUBLIC' | :anonymous | false | true | 'process nuget metadata request at package name and package version level' | :success - 'PRIVATE' | :developer | true | true | 'process nuget metadata request at package name and package version level' | :success - 'PRIVATE' | :guest | true | true | 'rejects nuget packages access' | :forbidden - 'PRIVATE' | :developer | true | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :guest | true | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :developer | false | true | 'rejects nuget packages access' | :not_found - 'PRIVATE' | :guest | false | true | 'rejects nuget packages access' | :not_found - 'PRIVATE' | :developer | false | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :guest | false | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :anonymous | false | true | 'rejects nuget packages access' | :unauthorized - end - - with_them do - let(:token) { user_token ? personal_access_token.token : 'wrong' } - let(:headers) { user_role == :anonymous ? {} : basic_auth_header(user.username, token) } - - subject { get api(url), headers: headers } - - before do - project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false)) - end - - it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member] - end - end - - it_behaves_like 'deploy token for package GET requests' - - context 'with invalid package name' do - let_it_be(:package_name) { 'Unkown' } - - it_behaves_like 'rejects nuget packages access', :developer, :not_found - end - end - end - - describe 'GET /api/v4/projects/:id/packages/nuget/download/*package_name/index' do - let_it_be(:package_name) { 'Dummy.Package' } - let_it_be(:packages) { create_list(:nuget_package, 5, name: package_name, project: project) } - let(:url) { "/projects/#{project.id}/packages/nuget/download/#{package_name}/index.json" } - - subject { get api(url) } - - context 'without the need for a license' do - context 'with valid project' do - using RSpec::Parameterized::TableSyntax - - where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do - 'PUBLIC' | :developer | true | true | 'process nuget download versions request' | :success - 'PUBLIC' | :guest | true | true | 'process nuget download versions request' | :success - 'PUBLIC' | :developer | true | false | 'process nuget download versions request' | :success - 'PUBLIC' | :guest | true | false | 'process nuget download versions request' | :success - 'PUBLIC' | :developer | false | true | 'process nuget download versions request' | :success - 'PUBLIC' | :guest | false | true | 'process nuget download versions request' | :success - 'PUBLIC' | :developer | false | false | 'process nuget download versions request' | :success - 'PUBLIC' | :guest | false | false | 'process nuget download versions request' | :success - 'PUBLIC' | :anonymous | false | true | 'process nuget download versions request' | :success - 'PRIVATE' | :developer | true | true | 'process nuget download versions request' | :success - 'PRIVATE' | :guest | true | true | 'rejects nuget packages access' | :forbidden - 'PRIVATE' | :developer | true | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :guest | true | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :developer | false | true | 'rejects nuget packages access' | :not_found - 'PRIVATE' | :guest | false | true | 'rejects nuget packages access' | :not_found - 'PRIVATE' | :developer | false | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :guest | false | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :anonymous | false | true | 'rejects nuget packages access' | :unauthorized - end - - with_them do - let(:token) { user_token ? personal_access_token.token : 'wrong' } - let(:headers) { user_role == :anonymous ? {} : basic_auth_header(user.username, token) } - - subject { get api(url), headers: headers } - - before do - project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false)) - end - - it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member] - end - end - - it_behaves_like 'deploy token for package GET requests' - - it_behaves_like 'rejects nuget access with unknown project id' - - it_behaves_like 'rejects nuget access with invalid project id' - end - end - - describe 'GET /api/v4/projects/:id/packages/nuget/download/*package_name/*package_version/*package_filename' do - let_it_be(:package_name) { 'Dummy.Package' } - let_it_be(:package) { create(:nuget_package, project: project, name: package_name) } - - let(:url) { "/projects/#{project.id}/packages/nuget/download/#{package.name}/#{package.version}/#{package.name}.#{package.version}.nupkg" } - - subject { get api(url) } - - context 'without the need for a license' do - context 'with valid project' do - using RSpec::Parameterized::TableSyntax - - where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do - 'PUBLIC' | :developer | true | true | 'process nuget download content request' | :success - 'PUBLIC' | :guest | true | true | 'process nuget download content request' | :success - 'PUBLIC' | :developer | true | false | 'process nuget download content request' | :success - 'PUBLIC' | :guest | true | false | 'process nuget download content request' | :success - 'PUBLIC' | :developer | false | true | 'process nuget download content request' | :success - 'PUBLIC' | :guest | false | true | 'process nuget download content request' | :success - 'PUBLIC' | :developer | false | false | 'process nuget download content request' | :success - 'PUBLIC' | :guest | false | false | 'process nuget download content request' | :success - 'PUBLIC' | :anonymous | false | true | 'process nuget download content request' | :success - 'PRIVATE' | :developer | true | true | 'process nuget download content request' | :success - 'PRIVATE' | :guest | true | true | 'rejects nuget packages access' | :forbidden - 'PRIVATE' | :developer | true | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :guest | true | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :developer | false | true | 'rejects nuget packages access' | :not_found - 'PRIVATE' | :guest | false | true | 'rejects nuget packages access' | :not_found - 'PRIVATE' | :developer | false | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :guest | false | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :anonymous | false | true | 'rejects nuget packages access' | :unauthorized - end - - with_them do - let(:token) { user_token ? personal_access_token.token : 'wrong' } - let(:headers) { user_role == :anonymous ? {} : basic_auth_header(user.username, token) } - - subject { get api(url), headers: headers } - - before do - project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false)) - end - - it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member] - end - end - - it_behaves_like 'deploy token for package GET requests' - - it_behaves_like 'rejects nuget access with unknown project id' - - it_behaves_like 'rejects nuget access with invalid project id' - end - end - - describe 'GET /api/v4/projects/:id/packages/nuget/query' do - let_it_be(:package_a) { create(:nuget_package, :with_metadatum, name: 'Dummy.PackageA', project: project) } - let_it_be(:tag) { create(:packages_tag, package: package_a, name: 'test') } - let_it_be(:packages_b) { create_list(:nuget_package, 5, name: 'Dummy.PackageB', project: project) } - let_it_be(:packages_c) { create_list(:nuget_package, 5, name: 'Dummy.PackageC', project: project) } - let_it_be(:package_d) { create(:nuget_package, name: 'Dummy.PackageD', version: '5.0.5-alpha', project: project) } - let_it_be(:package_e) { create(:nuget_package, name: 'Foo.BarE', project: project) } - let(:search_term) { 'uMmy' } - let(:take) { 26 } - let(:skip) { 0 } - let(:include_prereleases) { true } - let(:query_parameters) { { q: search_term, take: take, skip: skip, prerelease: include_prereleases } } - let(:url) { "/projects/#{project.id}/packages/nuget/query?#{query_parameters.to_query}" } - - subject { get api(url) } - - context 'without the need for a license' do - context 'with valid project' do - using RSpec::Parameterized::TableSyntax - - where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do - 'PUBLIC' | :developer | true | true | 'process nuget search request' | :success - 'PUBLIC' | :guest | true | true | 'process nuget search request' | :success - 'PUBLIC' | :developer | true | false | 'process nuget search request' | :success - 'PUBLIC' | :guest | true | false | 'process nuget search request' | :success - 'PUBLIC' | :developer | false | true | 'process nuget search request' | :success - 'PUBLIC' | :guest | false | true | 'process nuget search request' | :success - 'PUBLIC' | :developer | false | false | 'process nuget search request' | :success - 'PUBLIC' | :guest | false | false | 'process nuget search request' | :success - 'PUBLIC' | :anonymous | false | true | 'process nuget search request' | :success - 'PRIVATE' | :developer | true | true | 'process nuget search request' | :success - 'PRIVATE' | :guest | true | true | 'rejects nuget packages access' | :forbidden - 'PRIVATE' | :developer | true | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :guest | true | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :developer | false | true | 'rejects nuget packages access' | :not_found - 'PRIVATE' | :guest | false | true | 'rejects nuget packages access' | :not_found - 'PRIVATE' | :developer | false | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :guest | false | false | 'rejects nuget packages access' | :unauthorized - 'PRIVATE' | :anonymous | false | true | 'rejects nuget packages access' | :unauthorized - end - - with_them do - let(:token) { user_token ? personal_access_token.token : 'wrong' } - let(:headers) { user_role == :anonymous ? {} : basic_auth_header(user.username, token) } - - subject { get api(url), headers: headers } - - before do - project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false)) - end - - it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member] - end - end - - it_behaves_like 'deploy token for package GET requests' - - it_behaves_like 'rejects nuget access with unknown project id' - - it_behaves_like 'rejects nuget access with invalid project id' - end - end -end diff --git a/spec/requests/api/nuget_project_packages_spec.rb b/spec/requests/api/nuget_project_packages_spec.rb new file mode 100644 index 00000000000..df1daf39144 --- /dev/null +++ b/spec/requests/api/nuget_project_packages_spec.rb @@ -0,0 +1,280 @@ +# frozen_string_literal: true +require 'spec_helper' + +RSpec.describe API::NugetProjectPackages do + include WorkhorseHelpers + include PackagesManagerApiSpecHelpers + include HttpBasicAuthHelpers + + let_it_be(:user) { create(:user) } + let_it_be(:project, reload: true) { create(:project, :public) } + let_it_be(:personal_access_token) { create(:personal_access_token, user: user) } + let_it_be(:deploy_token) { create(:deploy_token, read_package_registry: true, write_package_registry: true) } + let_it_be(:project_deploy_token) { create(:project_deploy_token, deploy_token: deploy_token, project: project) } + + describe 'GET /api/v4/projects/:id/packages/nuget' do + it_behaves_like 'handling nuget service requests' do + let(:url) { "/projects/#{project.id}/packages/nuget/index.json" } + end + end + + describe 'GET /api/v4/projects/:id/packages/nuget/metadata/*package_name/index' do + it_behaves_like 'handling nuget metadata requests with package name' do + let(:url) { "/projects/#{project.id}/packages/nuget/metadata/#{package_name}/index.json" } + end + end + + describe 'GET /api/v4/projects/:id/packages/nuget/metadata/*package_name/*package_version' do + it_behaves_like 'handling nuget metadata requests with package name and package version' do + let(:url) { "/projects/#{project.id}/packages/nuget/metadata/#{package_name}/#{package.version}.json" } + end + end + + describe 'GET /api/v4/projects/:id/packages/nuget/query' do + it_behaves_like 'handling nuget search requests' do + let(:url) { "/projects/#{project.id}/packages/nuget/query?#{query_parameters.to_query}" } + end + end + + describe 'PUT /api/v4/projects/:id/packages/nuget/authorize' do + let_it_be(:workhorse_token) { JWT.encode({ 'iss' => 'gitlab-workhorse' }, Gitlab::Workhorse.secret, 'HS256') } + let_it_be(:workhorse_header) { { 'GitLab-Workhorse' => '1.0', Gitlab::Workhorse::INTERNAL_API_REQUEST_HEADER => workhorse_token } } + let(:url) { "/projects/#{project.id}/packages/nuget/authorize" } + let(:headers) { {} } + + subject { put api(url), headers: headers } + + context 'without the need for a license' do + context 'with valid project' do + using RSpec::Parameterized::TableSyntax + + where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do + 'PUBLIC' | :developer | true | true | 'process nuget workhorse authorization' | :success + 'PUBLIC' | :guest | true | true | 'rejects nuget packages access' | :forbidden + 'PUBLIC' | :developer | true | false | 'rejects nuget packages access' | :unauthorized + 'PUBLIC' | :guest | true | false | 'rejects nuget packages access' | :unauthorized + 'PUBLIC' | :developer | false | true | 'rejects nuget packages access' | :forbidden + 'PUBLIC' | :guest | false | true | 'rejects nuget packages access' | :forbidden + 'PUBLIC' | :developer | false | false | 'rejects nuget packages access' | :unauthorized + 'PUBLIC' | :guest | false | false | 'rejects nuget packages access' | :unauthorized + 'PUBLIC' | :anonymous | false | true | 'rejects nuget packages access' | :unauthorized + 'PRIVATE' | :developer | true | true | 'process nuget workhorse authorization' | :success + 'PRIVATE' | :guest | true | true | 'rejects nuget packages access' | :forbidden + 'PRIVATE' | :developer | true | false | 'rejects nuget packages access' | :unauthorized + 'PRIVATE' | :guest | true | false | 'rejects nuget packages access' | :unauthorized + 'PRIVATE' | :developer | false | true | 'rejects nuget packages access' | :not_found + 'PRIVATE' | :guest | false | true | 'rejects nuget packages access' | :not_found + 'PRIVATE' | :developer | false | false | 'rejects nuget packages access' | :unauthorized + 'PRIVATE' | :guest | false | false | 'rejects nuget packages access' | :unauthorized + 'PRIVATE' | :anonymous | false | true | 'rejects nuget packages access' | :unauthorized + end + + with_them do + let(:token) { user_token ? personal_access_token.token : 'wrong' } + let(:user_headers) { user_role == :anonymous ? {} : basic_auth_header(user.username, token) } + let(:headers) { user_headers.merge(workhorse_header) } + + before do + project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false)) + end + + it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member] + end + end + + it_behaves_like 'deploy token for package uploads' + + it_behaves_like 'rejects nuget access with unknown project id' + + it_behaves_like 'rejects nuget access with invalid project id' + end + end + + describe 'PUT /api/v4/projects/:id/packages/nuget' do + let(:workhorse_token) { JWT.encode({ 'iss' => 'gitlab-workhorse' }, Gitlab::Workhorse.secret, 'HS256') } + let(:workhorse_header) { { 'GitLab-Workhorse' => '1.0', Gitlab::Workhorse::INTERNAL_API_REQUEST_HEADER => workhorse_token } } + let_it_be(:file_name) { 'package.nupkg' } + let(:url) { "/projects/#{project.id}/packages/nuget" } + let(:headers) { {} } + let(:params) { { package: temp_file(file_name) } } + let(:file_key) { :package } + let(:send_rewritten_field) { true } + + subject do + workhorse_finalize( + api(url), + method: :put, + file_key: file_key, + params: params, + headers: headers, + send_rewritten_field: send_rewritten_field + ) + end + + context 'without the need for a license' do + context 'with valid project' do + using RSpec::Parameterized::TableSyntax + + where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do + 'PUBLIC' | :developer | true | true | 'process nuget upload' | :created + 'PUBLIC' | :guest | true | true | 'rejects nuget packages access' | :forbidden + 'PUBLIC' | :developer | true | false | 'rejects nuget packages access' | :unauthorized + 'PUBLIC' | :guest | true | false | 'rejects nuget packages access' | :unauthorized + 'PUBLIC' | :developer | false | true | 'rejects nuget packages access' | :forbidden + 'PUBLIC' | :guest | false | true | 'rejects nuget packages access' | :forbidden + 'PUBLIC' | :developer | false | false | 'rejects nuget packages access' | :unauthorized + 'PUBLIC' | :guest | false | false | 'rejects nuget packages access' | :unauthorized + 'PUBLIC' | :anonymous | false | true | 'rejects nuget packages access' | :unauthorized + 'PRIVATE' | :developer | true | true | 'process nuget upload' | :created + 'PRIVATE' | :guest | true | true | 'rejects nuget packages access' | :forbidden + 'PRIVATE' | :developer | true | false | 'rejects nuget packages access' | :unauthorized + 'PRIVATE' | :guest | true | false | 'rejects nuget packages access' | :unauthorized + 'PRIVATE' | :developer | false | true | 'rejects nuget packages access' | :not_found + 'PRIVATE' | :guest | false | true | 'rejects nuget packages access' | :not_found + 'PRIVATE' | :developer | false | false | 'rejects nuget packages access' | :unauthorized + 'PRIVATE' | :guest | false | false | 'rejects nuget packages access' | :unauthorized + 'PRIVATE' | :anonymous | false | true | 'rejects nuget packages access' | :unauthorized + end + + with_them do + let(:token) { user_token ? personal_access_token.token : 'wrong' } + let(:user_headers) { user_role == :anonymous ? {} : basic_auth_header(user.username, token) } + let(:headers) { user_headers.merge(workhorse_header) } + + before do + project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false)) + end + + it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member] + end + end + + it_behaves_like 'deploy token for package uploads' + + it_behaves_like 'rejects nuget access with unknown project id' + + it_behaves_like 'rejects nuget access with invalid project id' + + context 'file size above maximum limit' do + let(:headers) { basic_auth_header(deploy_token.username, deploy_token.token).merge(workhorse_header) } + + before do + allow_next_instance_of(UploadedFile) do |uploaded_file| + allow(uploaded_file).to receive(:size).and_return(project.actual_limits.nuget_max_file_size + 1) + end + end + + it_behaves_like 'returning response status', :bad_request + end + end + end + + describe 'GET /api/v4/projects/:id/packages/nuget/download/*package_name/index' do + let_it_be(:package_name) { 'Dummy.Package' } + let_it_be(:packages) { create_list(:nuget_package, 5, name: package_name, project: project) } + let(:url) { "/projects/#{project.id}/packages/nuget/download/#{package_name}/index.json" } + + subject { get api(url) } + + context 'without the need for a license' do + context 'with valid project' do + using RSpec::Parameterized::TableSyntax + + where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do + 'PUBLIC' | :developer | true | true | 'process nuget download versions request' | :success + 'PUBLIC' | :guest | true | true | 'process nuget download versions request' | :success + 'PUBLIC' | :developer | true | false | 'process nuget download versions request' | :success + 'PUBLIC' | :guest | true | false | 'process nuget download versions request' | :success + 'PUBLIC' | :developer | false | true | 'process nuget download versions request' | :success + 'PUBLIC' | :guest | false | true | 'process nuget download versions request' | :success + 'PUBLIC' | :developer | false | false | 'process nuget download versions request' | :success + 'PUBLIC' | :guest | false | false | 'process nuget download versions request' | :success + 'PUBLIC' | :anonymous | false | true | 'process nuget download versions request' | :success + 'PRIVATE' | :developer | true | true | 'process nuget download versions request' | :success + 'PRIVATE' | :guest | true | true | 'rejects nuget packages access' | :forbidden + 'PRIVATE' | :developer | true | false | 'rejects nuget packages access' | :unauthorized + 'PRIVATE' | :guest | true | false | 'rejects nuget packages access' | :unauthorized + 'PRIVATE' | :developer | false | true | 'rejects nuget packages access' | :not_found + 'PRIVATE' | :guest | false | true | 'rejects nuget packages access' | :not_found + 'PRIVATE' | :developer | false | false | 'rejects nuget packages access' | :unauthorized + 'PRIVATE' | :guest | false | false | 'rejects nuget packages access' | :unauthorized + 'PRIVATE' | :anonymous | false | true | 'rejects nuget packages access' | :unauthorized + end + + with_them do + let(:token) { user_token ? personal_access_token.token : 'wrong' } + let(:headers) { user_role == :anonymous ? {} : basic_auth_header(user.username, token) } + + subject { get api(url), headers: headers } + + before do + project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false)) + end + + it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member] + end + end + + it_behaves_like 'deploy token for package GET requests' + + it_behaves_like 'rejects nuget access with unknown project id' + + it_behaves_like 'rejects nuget access with invalid project id' + end + end + + describe 'GET /api/v4/projects/:id/packages/nuget/download/*package_name/*package_version/*package_filename' do + let_it_be(:package_name) { 'Dummy.Package' } + let_it_be(:package) { create(:nuget_package, project: project, name: package_name) } + + let(:url) { "/projects/#{project.id}/packages/nuget/download/#{package.name}/#{package.version}/#{package.name}.#{package.version}.nupkg" } + + subject { get api(url) } + + context 'without the need for a license' do + context 'with valid project' do + using RSpec::Parameterized::TableSyntax + + where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do + 'PUBLIC' | :developer | true | true | 'process nuget download content request' | :success + 'PUBLIC' | :guest | true | true | 'process nuget download content request' | :success + 'PUBLIC' | :developer | true | false | 'process nuget download content request' | :success + 'PUBLIC' | :guest | true | false | 'process nuget download content request' | :success + 'PUBLIC' | :developer | false | true | 'process nuget download content request' | :success + 'PUBLIC' | :guest | false | true | 'process nuget download content request' | :success + 'PUBLIC' | :developer | false | false | 'process nuget download content request' | :success + 'PUBLIC' | :guest | false | false | 'process nuget download content request' | :success + 'PUBLIC' | :anonymous | false | true | 'process nuget download content request' | :success + 'PRIVATE' | :developer | true | true | 'process nuget download content request' | :success + 'PRIVATE' | :guest | true | true | 'rejects nuget packages access' | :forbidden + 'PRIVATE' | :developer | true | false | 'rejects nuget packages access' | :unauthorized + 'PRIVATE' | :guest | true | false | 'rejects nuget packages access' | :unauthorized + 'PRIVATE' | :developer | false | true | 'rejects nuget packages access' | :not_found + 'PRIVATE' | :guest | false | true | 'rejects nuget packages access' | :not_found + 'PRIVATE' | :developer | false | false | 'rejects nuget packages access' | :unauthorized + 'PRIVATE' | :guest | false | false | 'rejects nuget packages access' | :unauthorized + 'PRIVATE' | :anonymous | false | true | 'rejects nuget packages access' | :unauthorized + end + + with_them do + let(:token) { user_token ? personal_access_token.token : 'wrong' } + let(:headers) { user_role == :anonymous ? {} : basic_auth_header(user.username, token) } + + subject { get api(url), headers: headers } + + before do + project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false)) + end + + it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member] + end + end + + it_behaves_like 'deploy token for package GET requests' + + it_behaves_like 'rejects nuget access with unknown project id' + + it_behaves_like 'rejects nuget access with invalid project id' + end + end +end diff --git a/spec/requests/api/project_clusters_spec.rb b/spec/requests/api/project_clusters_spec.rb index 7b37862af74..f784f677c25 100644 --- a/spec/requests/api/project_clusters_spec.rb +++ b/spec/requests/api/project_clusters_spec.rb @@ -88,6 +88,8 @@ RSpec.describe API::ProjectClusters do expect(json_response['environment_scope']).to eq('*') expect(json_response['cluster_type']).to eq('project_type') expect(json_response['domain']).to eq('example.com') + expect(json_response['enabled']).to be_truthy + expect(json_response['managed']).to be_truthy end it 'returns project information' do @@ -171,6 +173,7 @@ RSpec.describe API::ProjectClusters do name: 'test-cluster', domain: 'domain.example.com', managed: false, + enabled: false, namespace_per_environment: false, platform_kubernetes_attributes: platform_kubernetes_attributes, management_project_id: management_project_id @@ -202,6 +205,7 @@ RSpec.describe API::ProjectClusters do expect(cluster_result.name).to eq('test-cluster') expect(cluster_result.domain).to eq('domain.example.com') expect(cluster_result.managed).to be_falsy + expect(cluster_result.enabled).to be_falsy expect(cluster_result.management_project_id).to eq management_project_id expect(cluster_result.namespace_per_environment).to eq(false) expect(platform_kubernetes.rbac?).to be_truthy @@ -337,7 +341,9 @@ RSpec.describe API::ProjectClusters do { domain: 'new-domain.com', platform_kubernetes_attributes: platform_kubernetes_attributes, - management_project_id: management_project_id + management_project_id: management_project_id, + managed: false, + enabled: false } end @@ -373,6 +379,8 @@ RSpec.describe API::ProjectClusters do it 'updates cluster attributes' do expect(response).to have_gitlab_http_status(:ok) expect(cluster.domain).to eq('new-domain.com') + expect(cluster.managed).to be_falsy + expect(cluster.enabled).to be_falsy expect(cluster.platform_kubernetes.namespace).to eq('new-namespace') expect(cluster.management_project).to eq(management_project) end @@ -384,6 +392,8 @@ RSpec.describe API::ProjectClusters do it 'does not update cluster attributes' do expect(response).to have_gitlab_http_status(:bad_request) expect(cluster.domain).not_to eq('new_domain.com') + expect(cluster.managed).to be_truthy + expect(cluster.enabled).to be_truthy expect(cluster.platform_kubernetes.namespace).not_to eq('invalid_namespace') expect(cluster.management_project).not_to eq(management_project) end diff --git a/spec/requests/api/project_import_spec.rb b/spec/requests/api/project_import_spec.rb index a6ae636996e..8e99d37c84f 100644 --- a/spec/requests/api/project_import_spec.rb +++ b/spec/requests/api/project_import_spec.rb @@ -303,7 +303,7 @@ RSpec.describe API::ProjectImport do subject expect(response).to have_gitlab_http_status(:ok) - expect(response.content_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE) + expect(response.media_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE) expect(json_response['TempPath']).to eq(ImportExportUploader.workhorse_local_upload_path) end @@ -325,7 +325,7 @@ RSpec.describe API::ProjectImport do subject expect(response).to have_gitlab_http_status(:ok) - expect(response.content_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE) + expect(response.media_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE) expect(json_response).not_to have_key('TempPath') expect(json_response['RemoteObject']).to have_key('ID') expect(json_response['RemoteObject']).to have_key('GetURL') @@ -344,7 +344,7 @@ RSpec.describe API::ProjectImport do subject expect(response).to have_gitlab_http_status(:ok) - expect(response.content_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE) + expect(response.media_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE) expect(json_response['TempPath']).to eq(ImportExportUploader.workhorse_local_upload_path) expect(json_response['RemoteObject']).to be_nil end diff --git a/spec/requests/api/project_repository_storage_moves_spec.rb b/spec/requests/api/project_repository_storage_moves_spec.rb index ecf4c75b52f..15e69c2aa16 100644 --- a/spec/requests/api/project_repository_storage_moves_spec.rb +++ b/spec/requests/api/project_repository_storage_moves_spec.rb @@ -6,8 +6,8 @@ RSpec.describe API::ProjectRepositoryStorageMoves do include AccessMatchersForRequest let_it_be(:user) { create(:admin) } - let_it_be(:project) { create(:project) } - let_it_be(:storage_move) { create(:project_repository_storage_move, :scheduled, project: project) } + let_it_be(:project) { create(:project, :repository).tap { |project| project.track_project_repository } } + let_it_be(:storage_move) { create(:project_repository_storage_move, :scheduled, container: project) } shared_examples 'get single project repository storage move' do let(:project_repository_storage_move_id) { storage_move.id } @@ -63,14 +63,14 @@ RSpec.describe API::ProjectRepositoryStorageMoves do control = ActiveRecord::QueryRecorder.new { get_project_repository_storage_moves } - create(:project_repository_storage_move, :scheduled, project: project) + create(:project_repository_storage_move, :scheduled, container: project) expect { get_project_repository_storage_moves }.not_to exceed_query_limit(control) end it 'returns the most recently created first' do - storage_move_oldest = create(:project_repository_storage_move, :scheduled, project: project, created_at: 2.days.ago) - storage_move_middle = create(:project_repository_storage_move, :scheduled, project: project, created_at: 1.day.ago) + storage_move_oldest = create(:project_repository_storage_move, :scheduled, container: project, created_at: 2.days.ago) + storage_move_middle = create(:project_repository_storage_move, :scheduled, container: project, created_at: 1.day.ago) get_project_repository_storage_moves @@ -159,4 +159,64 @@ RSpec.describe API::ProjectRepositoryStorageMoves do end end end + + describe 'POST /project_repository_storage_moves' do + let(:source_storage_name) { 'default' } + let(:destination_storage_name) { 'test_second_storage' } + + def create_project_repository_storage_moves + post api('/project_repository_storage_moves', user), params: { + source_storage_name: source_storage_name, + destination_storage_name: destination_storage_name + } + end + + before do + stub_storage_settings('test_second_storage' => { 'path' => 'tmp/tests/extra_storage' }) + end + + it 'schedules the worker' do + expect(ProjectScheduleBulkRepositoryShardMovesWorker).to receive(:perform_async).with(source_storage_name, destination_storage_name) + + create_project_repository_storage_moves + + expect(response).to have_gitlab_http_status(:accepted) + end + + context 'source_storage_name is invalid' do + let(:destination_storage_name) { 'not-a-real-storage' } + + it 'gives an error' do + create_project_repository_storage_moves + + expect(response).to have_gitlab_http_status(:bad_request) + end + end + + context 'destination_storage_name is missing' do + let(:destination_storage_name) { nil } + + it 'schedules the worker' do + expect(ProjectScheduleBulkRepositoryShardMovesWorker).to receive(:perform_async).with(source_storage_name, destination_storage_name) + + create_project_repository_storage_moves + + expect(response).to have_gitlab_http_status(:accepted) + end + end + + context 'destination_storage_name is invalid' do + let(:destination_storage_name) { 'not-a-real-storage' } + + it 'gives an error' do + create_project_repository_storage_moves + + expect(response).to have_gitlab_http_status(:bad_request) + end + end + + describe 'normal user' do + it { expect { create_project_repository_storage_moves }.to be_denied_for(:user) } + end + end end diff --git a/spec/requests/api/projects_spec.rb b/spec/requests/api/projects_spec.rb index 234ac1778fd..ad5468fb54c 100644 --- a/spec/requests/api/projects_spec.rb +++ b/spec/requests/api/projects_spec.rb @@ -254,7 +254,7 @@ RSpec.describe API::Projects do statistics = json_response.find { |p| p['id'] == project.id }['statistics'] expect(statistics).to be_present - expect(statistics).to include('commit_count', 'storage_size', 'repository_size', 'wiki_size', 'lfs_objects_size', 'job_artifacts_size', 'snippets_size') + expect(statistics).to include('commit_count', 'storage_size', 'repository_size', 'wiki_size', 'lfs_objects_size', 'job_artifacts_size', 'snippets_size', 'packages_size') end it "does not include license by default" do @@ -619,7 +619,7 @@ RSpec.describe API::Projects do end context 'sorting by project statistics' do - %w(repository_size storage_size wiki_size).each do |order_by| + %w(repository_size storage_size wiki_size packages_size).each do |order_by| context "sorting by #{order_by}" do before do ProjectStatistics.update_all(order_by => 100) @@ -873,6 +873,7 @@ RSpec.describe API::Projects do jobs_enabled: false, merge_requests_enabled: false, forking_access_level: 'disabled', + analytics_access_level: 'disabled', wiki_enabled: false, resolve_outdated_diff_discussions: false, remove_source_branch_after_merge: true, @@ -883,7 +884,9 @@ RSpec.describe API::Projects do only_allow_merge_if_all_discussions_are_resolved: false, ci_config_path: 'a/custom/path', merge_method: 'ff' - }) + }).tap do |attrs| + attrs[:operations_access_level] = 'disabled' + end post api('/projects', user), params: project @@ -900,6 +903,8 @@ RSpec.describe API::Projects do expect(project.project_feature.issues_access_level).to eq(ProjectFeature::DISABLED) expect(project.project_feature.merge_requests_access_level).to eq(ProjectFeature::DISABLED) expect(project.project_feature.wiki_access_level).to eq(ProjectFeature::DISABLED) + expect(project.operations_access_level).to eq(ProjectFeature::DISABLED) + expect(project.project_feature.analytics_access_level).to eq(ProjectFeature::DISABLED) end it 'creates a project using a template' do @@ -1579,6 +1584,7 @@ RSpec.describe API::Projects do expect(json_response['only_allow_merge_if_pipeline_succeeds']).to eq(project.only_allow_merge_if_pipeline_succeeds) expect(json_response['allow_merge_on_skipped_pipeline']).to eq(project.allow_merge_on_skipped_pipeline) expect(json_response['only_allow_merge_if_all_discussions_are_resolved']).to eq(project.only_allow_merge_if_all_discussions_are_resolved) + expect(json_response['operations_access_level']).to be_present end end @@ -1619,8 +1625,10 @@ RSpec.describe API::Projects do expect(json_response['issues_access_level']).to be_present expect(json_response['merge_requests_access_level']).to be_present expect(json_response['forking_access_level']).to be_present + expect(json_response['analytics_access_level']).to be_present expect(json_response['wiki_access_level']).to be_present expect(json_response['builds_access_level']).to be_present + expect(json_response['operations_access_level']).to be_present expect(json_response).to have_key('emails_disabled') expect(json_response['resolve_outdated_diff_discussions']).to eq(project.resolve_outdated_diff_discussions) expect(json_response['remove_source_branch_after_merge']).to be_truthy diff --git a/spec/requests/api/services_spec.rb b/spec/requests/api/services_spec.rb index 63ed57c5045..2157e69e7bf 100644 --- a/spec/requests/api/services_spec.rb +++ b/spec/requests/api/services_spec.rb @@ -76,7 +76,9 @@ RSpec.describe API::Services do required_attributes = service_attrs_list.select do |attr| service_klass.validators_on(attr).any? do |v| - v.class == ActiveRecord::Validations::PresenceValidator + v.class == ActiveRecord::Validations::PresenceValidator && + # exclude presence validators with conditional since those are not really required + ![:if, :unless].any? { |cond| v.options.include?(cond) } end end diff --git a/spec/requests/api/settings_spec.rb b/spec/requests/api/settings_spec.rb index 03320549e44..8fb0f8fc51a 100644 --- a/spec/requests/api/settings_spec.rb +++ b/spec/requests/api/settings_spec.rb @@ -43,6 +43,7 @@ RSpec.describe API::Settings, 'Settings' do expect(json_response['spam_check_endpoint_url']).to be_nil expect(json_response['wiki_page_max_content_bytes']).to be_a(Integer) expect(json_response['require_admin_approval_after_user_signup']).to eq(true) + expect(json_response['personal_access_token_prefix']).to be_nil end end @@ -122,7 +123,8 @@ RSpec.describe API::Settings, 'Settings' do spam_check_endpoint_url: 'https://example.com/spam_check', disabled_oauth_sign_in_sources: 'unknown', import_sources: 'github,bitbucket', - wiki_page_max_content_bytes: 12345 + wiki_page_max_content_bytes: 12345, + personal_access_token_prefix: "GL-" } expect(response).to have_gitlab_http_status(:ok) @@ -166,6 +168,7 @@ RSpec.describe API::Settings, 'Settings' do expect(json_response['disabled_oauth_sign_in_sources']).to eq([]) expect(json_response['import_sources']).to match_array(%w(github bitbucket)) expect(json_response['wiki_page_max_content_bytes']).to eq(12345) + expect(json_response['personal_access_token_prefix']).to eq("GL-") end end @@ -451,5 +454,25 @@ RSpec.describe API::Settings, 'Settings' do expect(json_response['error']).to eq('spam_check_endpoint_url is missing') end end + + context "personal access token prefix settings" do + context "handles validation errors" do + it "fails to update the settings with too long prefix" do + put api("/application/settings", admin), params: { personal_access_token_prefix: "prefix" * 10 } + + expect(response).to have_gitlab_http_status(:bad_request) + message = json_response["message"] + expect(message["personal_access_token_prefix"]).to include(a_string_matching("is too long")) + end + + it "fails to update the settings with invalid characters in the prefix" do + put api("/application/settings", admin), params: { personal_access_token_prefix: "éñ" } + + expect(response).to have_gitlab_http_status(:bad_request) + message = json_response["message"] + expect(message["personal_access_token_prefix"]).to include(a_string_matching("can contain only letters of the Base64 alphabet")) + end + end + end end end diff --git a/spec/requests/api/usage_data_spec.rb b/spec/requests/api/usage_data_spec.rb index 4f4f386e9db..d44f179eed8 100644 --- a/spec/requests/api/usage_data_spec.rb +++ b/spec/requests/api/usage_data_spec.rb @@ -5,6 +5,87 @@ require 'spec_helper' RSpec.describe API::UsageData do let_it_be(:user) { create(:user) } + describe 'POST /usage_data/increment_counter' do + let(:endpoint) { '/usage_data/increment_counter' } + let(:known_event) { "#{known_event_prefix}_#{known_event_postfix}" } + let(:known_event_prefix) { "static_site_editor" } + let(:known_event_postfix) { 'commits' } + let(:unknown_event) { 'unknown' } + + context 'without CSRF token' do + it 'returns forbidden' do + stub_feature_flags(usage_data_api: true) + allow(Gitlab::RequestForgeryProtection).to receive(:verified?).and_return(false) + + post api(endpoint, user), params: { event: known_event } + + expect(response).to have_gitlab_http_status(:forbidden) + end + end + + context 'usage_data_api feature not enabled' do + it 'returns not_found' do + stub_feature_flags(usage_data_api: false) + + post api(endpoint, user), params: { event: known_event } + + expect(response).to have_gitlab_http_status(:not_found) + end + end + + context 'without authentication' do + it 'returns 401 response' do + post api(endpoint), params: { event: known_event } + + expect(response).to have_gitlab_http_status(:unauthorized) + end + end + + context 'with authentication' do + before do + stub_feature_flags(usage_data_api: true) + stub_feature_flags("usage_data_#{known_event}" => true) + stub_application_setting(usage_ping_enabled: true) + allow(Gitlab::RequestForgeryProtection).to receive(:verified?).and_return(true) + end + + context 'when event is missing from params' do + it 'returns bad request' do + post api(endpoint, user), params: {} + + expect(response).to have_gitlab_http_status(:bad_request) + end + end + + %w[merge_requests commits].each do |postfix| + context 'with correct params' do + let(:known_event_postfix) { postfix } + + it 'returns status ok' do + expect(Gitlab::UsageDataCounters::BaseCounter).to receive(:count).with(known_event_postfix) + post api(endpoint, user), params: { event: known_event } + + expect(response).to have_gitlab_http_status(:ok) + end + end + end + + context 'with unknown event' do + before do + skip_feature_flags_yaml_validation + end + + it 'returns status ok' do + expect(Gitlab::UsageDataCounters::BaseCounter).not_to receive(:count) + + post api(endpoint, user), params: { event: unknown_event } + + expect(response).to have_gitlab_http_status(:ok) + end + end + end + end + describe 'POST /usage_data/increment_unique_users' do let(:endpoint) { '/usage_data/increment_unique_users' } let(:known_event) { 'g_compliance_dashboard' } diff --git a/spec/requests/api/users_spec.rb b/spec/requests/api/users_spec.rb index 98840d6238a..2cd1483f486 100644 --- a/spec/requests/api/users_spec.rb +++ b/spec/requests/api/users_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' -RSpec.describe API::Users, :do_not_mock_admin_mode do +RSpec.describe API::Users do let_it_be(:admin) { create(:admin) } let_it_be(:user, reload: true) { create(:user, username: 'user.with.dot') } let_it_be(:key) { create(:key, user: user) } @@ -2510,6 +2510,98 @@ RSpec.describe API::Users, :do_not_mock_admin_mode do end end + context 'approve pending user' do + shared_examples '404' do + it 'returns 404' do + expect(response).to have_gitlab_http_status(:not_found) + expect(json_response['message']).to eq('404 User Not Found') + end + end + + describe 'POST /users/:id/approve' do + subject(:approve) { post api("/users/#{user_id}/approve", api_user) } + + let_it_be(:pending_user) { create(:user, :blocked_pending_approval) } + let_it_be(:deactivated_user) { create(:user, :deactivated) } + let_it_be(:blocked_user) { create(:user, :blocked) } + + context 'performed by a non-admin user' do + let(:api_user) { user } + let(:user_id) { pending_user.id } + + it 'is not authorized to perform the action' do + expect { approve }.not_to change { pending_user.reload.state } + expect(response).to have_gitlab_http_status(:forbidden) + expect(json_response['message']).to eq('You are not allowed to approve a user') + end + end + + context 'performed by an admin user' do + let(:api_user) { admin } + + context 'for a deactivated user' do + let(:user_id) { deactivated_user.id } + + it 'does not approve a deactivated user' do + expect { approve }.not_to change { deactivated_user.reload.state } + expect(response).to have_gitlab_http_status(:conflict) + expect(json_response['message']).to eq('The user you are trying to approve is not pending an approval') + end + end + + context 'for an pending approval user' do + let(:user_id) { pending_user.id } + + it 'returns 201' do + expect { approve }.to change { pending_user.reload.state }.to('active') + expect(response).to have_gitlab_http_status(:created) + expect(json_response['message']).to eq('Success') + end + end + + context 'for an active user' do + let(:user_id) { user.id } + + it 'returns 201' do + expect { approve }.not_to change { user.reload.state } + expect(response).to have_gitlab_http_status(:conflict) + expect(json_response['message']).to eq('The user you are trying to approve is not pending an approval') + end + end + + context 'for a blocked user' do + let(:user_id) { blocked_user.id } + + it 'returns 403' do + expect { approve }.not_to change { blocked_user.reload.state } + expect(response).to have_gitlab_http_status(:conflict) + expect(json_response['message']).to eq('The user you are trying to approve is not pending an approval') + end + end + + context 'for a ldap blocked user' do + let(:user_id) { ldap_blocked_user.id } + + it 'returns 403' do + expect { approve }.not_to change { ldap_blocked_user.reload.state } + expect(response).to have_gitlab_http_status(:conflict) + expect(json_response['message']).to eq('The user you are trying to approve is not pending an approval') + end + end + + context 'for a user that does not exist' do + let(:user_id) { non_existing_record_id } + + before do + approve + end + + it_behaves_like '404' + end + end + end + end + describe 'POST /users/:id/block' do let(:blocked_user) { create(:user, state: 'blocked') } diff --git a/spec/requests/api/v3/github_spec.rb b/spec/requests/api/v3/github_spec.rb index 86ddf4a78d8..e7d9ba99743 100644 --- a/spec/requests/api/v3/github_spec.rb +++ b/spec/requests/api/v3/github_spec.rb @@ -383,7 +383,7 @@ RSpec.describe API::V3::Github do it 'counts Jira Cloud integration as enabled' do user_agent = 'Jira DVCS Connector Vertigo/4.42.0' - Timecop.freeze do + freeze_time do jira_get v3_api("/repos/#{project.namespace.path}/#{project.path}/branches", user), user_agent expect(project.reload.jira_dvcs_cloud_last_sync_at).to be_like_time(Time.now) @@ -393,7 +393,7 @@ RSpec.describe API::V3::Github do it 'counts Jira Server integration as enabled' do user_agent = 'Jira DVCS Connector/3.2.4' - Timecop.freeze do + freeze_time do jira_get v3_api("/repos/#{project.namespace.path}/#{project.path}/branches", user), user_agent expect(project.reload.jira_dvcs_server_last_sync_at).to be_like_time(Time.now) diff --git a/spec/requests/git_http_spec.rb b/spec/requests/git_http_spec.rb index 32aeeed43b6..bc89dc2fa77 100644 --- a/spec/requests/git_http_spec.rb +++ b/spec/requests/git_http_spec.rb @@ -809,12 +809,24 @@ RSpec.describe 'Git HTTP requests' do context 'administrator' do let(:user) { create(:admin) } - it_behaves_like 'can download code only' + context 'when admin mode is enabled', :enable_admin_mode do + it_behaves_like 'can download code only' - it 'downloads from other project get status 403' do - clone_get "#{other_project.full_path}.git", user: 'gitlab-ci-token', password: build.token + it 'downloads from other project get status 403' do + clone_get "#{other_project.full_path}.git", user: 'gitlab-ci-token', password: build.token - expect(response).to have_gitlab_http_status(:forbidden) + expect(response).to have_gitlab_http_status(:forbidden) + end + end + + context 'when admin mode is disabled' do + it_behaves_like 'can download code only' + + it 'downloads from other project get status 404' do + clone_get "#{other_project.full_path}.git", user: 'gitlab-ci-token', password: build.token + + expect(response).to have_gitlab_http_status(:not_found) + end end end diff --git a/spec/requests/ide_controller_spec.rb b/spec/requests/ide_controller_spec.rb new file mode 100644 index 00000000000..805c1f1d82b --- /dev/null +++ b/spec/requests/ide_controller_spec.rb @@ -0,0 +1,17 @@ +# frozen_string_literal: true + +require 'spec_helper' + +RSpec.describe IdeController do + let(:user) { create(:user) } + + before do + sign_in(user) + end + + it 'increases the views counter' do + expect(Gitlab::UsageDataCounters::WebIdeCounter).to receive(:increment_views_count) + + get ide_url + end +end diff --git a/spec/requests/import/gitlab_groups_controller_spec.rb b/spec/requests/import/gitlab_groups_controller_spec.rb index 4125c5c7c7a..51f1363cf1c 100644 --- a/spec/requests/import/gitlab_groups_controller_spec.rb +++ b/spec/requests/import/gitlab_groups_controller_spec.rb @@ -5,6 +5,7 @@ require 'spec_helper' RSpec.describe Import::GitlabGroupsController do include WorkhorseHelpers + let_it_be(:user) { create(:user) } let(:import_path) { "#{Dir.tmpdir}/gitlab_groups_controller_spec" } let(:workhorse_token) { JWT.encode({ 'iss' => 'gitlab-workhorse' }, Gitlab::Workhorse.secret, 'HS256') } let(:workhorse_headers) do @@ -28,8 +29,6 @@ RSpec.describe Import::GitlabGroupsController do describe 'POST create' do subject(:import_request) { upload_archive(file_upload, workhorse_headers, request_params) } - let_it_be(:user) { create(:user) } - let(:file) { File.join('spec', %w[fixtures group_export.tar.gz]) } let(:file_upload) { fixture_file_upload(file) } @@ -194,67 +193,11 @@ RSpec.describe Import::GitlabGroupsController do end describe 'POST authorize' do - let_it_be(:user) { create(:user) } - - before do - login_as(user) - end - - context 'when using a workhorse header' do - subject(:authorize_request) { post authorize_import_gitlab_group_path, headers: workhorse_headers } - - it 'authorizes the request' do - authorize_request - - expect(response).to have_gitlab_http_status :ok - expect(response.media_type).to eq Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE - expect(json_response['TempPath']).to eq ImportExportUploader.workhorse_local_upload_path - end - end - - context 'when the request bypasses gitlab-workhorse' do - subject(:authorize_request) { post authorize_import_gitlab_group_path } - - it 'rejects the request' do - expect { authorize_request }.to raise_error(JWT::DecodeError) - end - end - - context 'when direct upload is enabled' do - subject(:authorize_request) { post authorize_import_gitlab_group_path, headers: workhorse_headers } + it_behaves_like 'handle uploads authorize request' do + let(:uploader_class) { ImportExportUploader } + let(:maximum_size) { Gitlab::CurrentSettings.max_import_size.megabytes } - before do - stub_uploads_object_storage(ImportExportUploader, enabled: true, direct_upload: true) - end - - it 'accepts the request and stores the files' do - authorize_request - - expect(response).to have_gitlab_http_status :ok - expect(response.media_type).to eq Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE - expect(json_response).not_to have_key 'TempPath' - - expect(json_response['RemoteObject'].keys) - .to include('ID', 'GetURL', 'StoreURL', 'DeleteURL', 'MultipartUpload') - end - end - - context 'when direct upload is disabled' do - subject(:authorize_request) { post authorize_import_gitlab_group_path, headers: workhorse_headers } - - before do - stub_uploads_object_storage(ImportExportUploader, enabled: true, direct_upload: false) - end - - it 'handles the local file' do - authorize_request - - expect(response).to have_gitlab_http_status :ok - expect(response.media_type).to eq Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE - - expect(json_response['TempPath']).to eq ImportExportUploader.workhorse_local_upload_path - expect(json_response['RemoteObject']).to be_nil - end + subject { post authorize_import_gitlab_group_path, headers: workhorse_headers } end end end diff --git a/spec/requests/import/gitlab_projects_controller_spec.rb b/spec/requests/import/gitlab_projects_controller_spec.rb index c1ac5a9f2c8..d7d4de21a33 100644 --- a/spec/requests/import/gitlab_projects_controller_spec.rb +++ b/spec/requests/import/gitlab_projects_controller_spec.rb @@ -84,56 +84,11 @@ RSpec.describe Import::GitlabProjectsController do end describe 'POST authorize' do - subject { post authorize_import_gitlab_project_path, headers: workhorse_headers } + it_behaves_like 'handle uploads authorize request' do + let(:uploader_class) { ImportExportUploader } + let(:maximum_size) { Gitlab::CurrentSettings.max_import_size.megabytes } - it 'authorizes importing project with workhorse header' do - subject - - expect(response).to have_gitlab_http_status(:ok) - expect(response.content_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE) - expect(json_response['TempPath']).to eq(ImportExportUploader.workhorse_local_upload_path) - end - - it 'rejects requests that bypassed gitlab-workhorse' do - workhorse_headers.delete(Gitlab::Workhorse::INTERNAL_API_REQUEST_HEADER) - - expect { subject }.to raise_error(JWT::DecodeError) - end - - context 'when using remote storage' do - context 'when direct upload is enabled' do - before do - stub_uploads_object_storage(ImportExportUploader, enabled: true, direct_upload: true) - end - - it 'responds with status 200, location of file remote store and object details' do - subject - - expect(response).to have_gitlab_http_status(:ok) - expect(response.content_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE) - expect(json_response).not_to have_key('TempPath') - expect(json_response['RemoteObject']).to have_key('ID') - expect(json_response['RemoteObject']).to have_key('GetURL') - expect(json_response['RemoteObject']).to have_key('StoreURL') - expect(json_response['RemoteObject']).to have_key('DeleteURL') - expect(json_response['RemoteObject']).to have_key('MultipartUpload') - end - end - - context 'when direct upload is disabled' do - before do - stub_uploads_object_storage(ImportExportUploader, enabled: true, direct_upload: false) - end - - it 'handles as a local file' do - subject - - expect(response).to have_gitlab_http_status(:ok) - expect(response.content_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE) - expect(json_response['TempPath']).to eq(ImportExportUploader.workhorse_local_upload_path) - expect(json_response['RemoteObject']).to be_nil - end - end + subject { post authorize_import_gitlab_project_path, headers: workhorse_headers } end end end diff --git a/spec/requests/jwt_controller_spec.rb b/spec/requests/jwt_controller_spec.rb index fe6c0f0a556..e154e691d5f 100644 --- a/spec/requests/jwt_controller_spec.rb +++ b/spec/requests/jwt_controller_spec.rb @@ -5,13 +5,13 @@ require 'spec_helper' RSpec.describe JwtController do include_context 'parsed logs' - let(:service) { double(execute: {}) } - let(:service_class) { double(new: service) } - let(:service_name) { 'test' } + let(:service) { double(execute: {} ) } + let(:service_class) { Auth::ContainerRegistryAuthenticationService } + let(:service_name) { 'container_registry' } let(:parameters) { { service: service_name } } before do - stub_const('JwtController::SERVICES', service_name => service_class) + allow(service_class).to receive(:new).and_return(service) end shared_examples 'user logging' do @@ -22,194 +22,266 @@ RSpec.describe JwtController do end end - context 'existing service' do - subject! { get '/jwt/auth', params: parameters } + context 'authenticating against container registry' do + context 'existing service' do + subject! { get '/jwt/auth', params: parameters } - it { expect(response).to have_gitlab_http_status(:ok) } + it { expect(response).to have_gitlab_http_status(:ok) } - context 'returning custom http code' do - let(:service) { double(execute: { http_status: 505 }) } + context 'returning custom http code' do + let(:service) { double(execute: { http_status: 505 }) } - it { expect(response).to have_gitlab_http_status(:http_version_not_supported) } + it { expect(response).to have_gitlab_http_status(:http_version_not_supported) } + end end - end - context 'when using authenticated request' do - shared_examples 'rejecting a blocked user' do - context 'with blocked user' do - let(:user) { create(:user, :blocked) } + context 'when using authenticated request' do + shared_examples 'rejecting a blocked user' do + context 'with blocked user' do + let(:user) { create(:user, :blocked) } - it 'rejects the request as unauthorized' do - expect(response).to have_gitlab_http_status(:unauthorized) - expect(response.body).to include('HTTP Basic: Access denied') + it 'rejects the request as unauthorized' do + expect(response).to have_gitlab_http_status(:unauthorized) + expect(response.body).to include('HTTP Basic: Access denied') + end end end - end - context 'using CI token' do - let(:user) { create(:user) } - let(:build) { create(:ci_build, :running, user: user) } - let(:project) { build.project } - let(:headers) { { authorization: credentials('gitlab-ci-token', build.token) } } + context 'using CI token' do + let(:user) { create(:user) } + let(:build) { create(:ci_build, :running, user: user) } + let(:project) { build.project } + let(:headers) { { authorization: credentials('gitlab-ci-token', build.token) } } - context 'project with enabled CI' do - subject! { get '/jwt/auth', params: parameters, headers: headers } - - it { expect(service_class).to have_received(:new).with(project, user, ActionController::Parameters.new(parameters).permit!) } + context 'project with enabled CI' do + subject! { get '/jwt/auth', params: parameters, headers: headers } - it_behaves_like 'user logging' - end + it { expect(service_class).to have_received(:new).with(project, user, ActionController::Parameters.new(parameters).permit!) } - context 'project with disabled CI' do - before do - project.project_feature.update_attribute(:builds_access_level, ProjectFeature::DISABLED) + it_behaves_like 'user logging' end - subject! { get '/jwt/auth', params: parameters, headers: headers } + context 'project with disabled CI' do + before do + project.project_feature.update_attribute(:builds_access_level, ProjectFeature::DISABLED) + end - it { expect(response).to have_gitlab_http_status(:unauthorized) } - end + subject! { get '/jwt/auth', params: parameters, headers: headers } - context 'using deploy tokens' do - let(:deploy_token) { create(:deploy_token, read_registry: true, projects: [project]) } - let(:headers) { { authorization: credentials(deploy_token.username, deploy_token.token) } } + it { expect(response).to have_gitlab_http_status(:unauthorized) } + end - subject! { get '/jwt/auth', params: parameters, headers: headers } + context 'using deploy tokens' do + let(:deploy_token) { create(:deploy_token, read_registry: true, projects: [project]) } + let(:headers) { { authorization: credentials(deploy_token.username, deploy_token.token) } } - it 'authenticates correctly' do - expect(response).to have_gitlab_http_status(:ok) - expect(service_class).to have_received(:new).with(nil, deploy_token, ActionController::Parameters.new(parameters).permit!) - end + subject! { get '/jwt/auth', params: parameters, headers: headers } - it 'does not log a user' do - expect(log_data.keys).not_to include(%w(username user_id)) + it 'authenticates correctly' do + expect(response).to have_gitlab_http_status(:ok) + expect(service_class).to have_received(:new).with(nil, deploy_token, ActionController::Parameters.new(parameters).permit!) + end + + it 'does not log a user' do + expect(log_data.keys).not_to include(%w(username user_id)) + end end - end - context 'using personal access tokens' do - let(:pat) { create(:personal_access_token, user: user, scopes: ['read_registry']) } - let(:headers) { { authorization: credentials('personal_access_token', pat.token) } } + context 'using personal access tokens' do + let(:pat) { create(:personal_access_token, user: user, scopes: ['read_registry']) } + let(:headers) { { authorization: credentials('personal_access_token', pat.token) } } - before do - stub_container_registry_config(enabled: true) + before do + stub_container_registry_config(enabled: true) + end + + subject! { get '/jwt/auth', params: parameters, headers: headers } + + it 'authenticates correctly' do + expect(response).to have_gitlab_http_status(:ok) + expect(service_class).to have_received(:new).with(nil, user, ActionController::Parameters.new(parameters).permit!) + end + + it_behaves_like 'rejecting a blocked user' + it_behaves_like 'user logging' end + end + + context 'using User login' do + let(:user) { create(:user) } + let(:headers) { { authorization: credentials(user.username, user.password) } } subject! { get '/jwt/auth', params: parameters, headers: headers } - it 'authenticates correctly' do - expect(response).to have_gitlab_http_status(:ok) - expect(service_class).to have_received(:new).with(nil, user, ActionController::Parameters.new(parameters).permit!) - end + it { expect(service_class).to have_received(:new).with(nil, user, ActionController::Parameters.new(parameters).permit!) } it_behaves_like 'rejecting a blocked user' - it_behaves_like 'user logging' - end - end - - context 'using User login' do - let(:user) { create(:user) } - let(:headers) { { authorization: credentials(user.username, user.password) } } - subject! { get '/jwt/auth', params: parameters, headers: headers } + context 'when passing a flat array of scopes' do + # We use this trick to make rails to generate a query_string: + # scope=scope1&scope=scope2 + # It works because :scope and 'scope' are the same as string, but different objects + let(:parameters) do + { + :service => service_name, + :scope => 'scope1', + 'scope' => 'scope2' + } + end - it { expect(service_class).to have_received(:new).with(nil, user, ActionController::Parameters.new(parameters).permit!) } + let(:service_parameters) do + ActionController::Parameters.new({ service: service_name, scopes: %w(scope1 scope2) }).permit! + end - it_behaves_like 'rejecting a blocked user' + it { expect(service_class).to have_received(:new).with(nil, user, service_parameters) } - context 'when passing a flat array of scopes' do - # We use this trick to make rails to generate a query_string: - # scope=scope1&scope=scope2 - # It works because :scope and 'scope' are the same as string, but different objects - let(:parameters) do - { - :service => service_name, - :scope => 'scope1', - 'scope' => 'scope2' - } + it_behaves_like 'user logging' end - let(:service_parameters) do - ActionController::Parameters.new({ service: service_name, scopes: %w(scope1 scope2) }).permit! + context 'when user has 2FA enabled' do + let(:user) { create(:user, :two_factor) } + + context 'without personal token' do + it 'rejects the authorization attempt' do + expect(response).to have_gitlab_http_status(:unauthorized) + expect(response.body).to include('You must use a personal access token with \'api\' scope for Git over HTTP') + end + end + + context 'with personal token' do + let(:access_token) { create(:personal_access_token, user: user) } + let(:headers) { { authorization: credentials(user.username, access_token.token) } } + + it 'accepts the authorization attempt' do + expect(response).to have_gitlab_http_status(:ok) + end + end end - it { expect(service_class).to have_received(:new).with(nil, user, service_parameters) } + it 'does not cause session based checks to be activated' do + expect(Gitlab::Session).not_to receive(:with_session) + + get '/jwt/auth', params: parameters, headers: headers - it_behaves_like 'user logging' + expect(response).to have_gitlab_http_status(:ok) + end end - context 'when user has 2FA enabled' do - let(:user) { create(:user, :two_factor) } + context 'using invalid login' do + let(:headers) { { authorization: credentials('invalid', 'password') } } - context 'without personal token' do + context 'when internal auth is enabled' do it 'rejects the authorization attempt' do + get '/jwt/auth', params: parameters, headers: headers + expect(response).to have_gitlab_http_status(:unauthorized) - expect(response.body).to include('You must use a personal access token with \'api\' scope for Git over HTTP') + expect(response.body).not_to include('You must use a personal access token with \'api\' scope for Git over HTTP') end end - context 'with personal token' do - let(:access_token) { create(:personal_access_token, user: user) } - let(:headers) { { authorization: credentials(user.username, access_token.token) } } + context 'when internal auth is disabled' do + it 'rejects the authorization attempt with personal access token message' do + allow_next_instance_of(ApplicationSetting) do |instance| + allow(instance).to receive(:password_authentication_enabled_for_git?) { false } + end + get '/jwt/auth', params: parameters, headers: headers - it 'accepts the authorization attempt' do - expect(response).to have_gitlab_http_status(:ok) + expect(response).to have_gitlab_http_status(:unauthorized) + expect(response.body).to include('You must use a personal access token with \'api\' scope for Git over HTTP') end end end + end - it 'does not cause session based checks to be activated' do - expect(Gitlab::Session).not_to receive(:with_session) - - get '/jwt/auth', params: parameters, headers: headers + context 'when using unauthenticated request' do + it 'accepts the authorization attempt' do + get '/jwt/auth', params: parameters expect(response).to have_gitlab_http_status(:ok) end + + it 'allows read access' do + expect(service).to receive(:execute).with(authentication_abilities: Gitlab::Auth.read_only_authentication_abilities) + + get '/jwt/auth', params: parameters + end end - context 'using invalid login' do - let(:headers) { { authorization: credentials('invalid', 'password') } } + context 'unknown service' do + subject! { get '/jwt/auth', params: { service: 'unknown' } } - context 'when internal auth is enabled' do - it 'rejects the authorization attempt' do - get '/jwt/auth', params: parameters, headers: headers + it { expect(response).to have_gitlab_http_status(:not_found) } + end - expect(response).to have_gitlab_http_status(:unauthorized) - expect(response.body).not_to include('You must use a personal access token with \'api\' scope for Git over HTTP') - end - end + def credentials(login, password) + ActionController::HttpAuthentication::Basic.encode_credentials(login, password) + end + end - context 'when internal auth is disabled' do - it 'rejects the authorization attempt with personal access token message' do - allow_next_instance_of(ApplicationSetting) do |instance| - allow(instance).to receive(:password_authentication_enabled_for_git?) { false } - end - get '/jwt/auth', params: parameters, headers: headers + context 'authenticating against dependency proxy' do + let_it_be(:user) { create(:user) } + let_it_be(:personal_access_token) { create(:personal_access_token, user: user) } + let_it_be(:group) { create(:group) } + let_it_be(:project) { create(:project, :private, group: group) } + let_it_be(:group_deploy_token) { create(:deploy_token, :group, groups: [group]) } + let_it_be(:project_deploy_token) { create(:deploy_token, :project, projects: [project]) } + let_it_be(:service_name) { 'dependency_proxy' } + let(:headers) { { authorization: credentials(credential_user, credential_password) } } + let(:params) { { account: credential_user, client_id: 'docker', offline_token: true, service: service_name } } + + before do + stub_config(dependency_proxy: { enabled: true }) + end - expect(response).to have_gitlab_http_status(:unauthorized) - expect(response.body).to include('You must use a personal access token with \'api\' scope for Git over HTTP') - end + subject { get '/jwt/auth', params: params, headers: headers } + + shared_examples 'with valid credentials' do + it 'returns token successfully' do + subject + + expect(response).to have_gitlab_http_status(:success) + expect(json_response['token']).to be_present end end - end - context 'when using unauthenticated request' do - it 'accepts the authorization attempt' do - get '/jwt/auth', params: parameters + context 'with personal access token' do + let(:credential_user) { nil } + let(:credential_password) { personal_access_token.token } - expect(response).to have_gitlab_http_status(:ok) + it_behaves_like 'with valid credentials' end - it 'allows read access' do - expect(service).to receive(:execute).with(authentication_abilities: Gitlab::Auth.read_only_authentication_abilities) + context 'with user credentials token' do + let(:credential_user) { user.username } + let(:credential_password) { user.password } - get '/jwt/auth', params: parameters + it_behaves_like 'with valid credentials' end - end - context 'unknown service' do - subject! { get '/jwt/auth', params: { service: 'unknown' } } + context 'with group deploy token' do + let(:credential_user) { group_deploy_token.username } + let(:credential_password) { group_deploy_token.token } - it { expect(response).to have_gitlab_http_status(:not_found) } + it_behaves_like 'with valid credentials' + end + + context 'with project deploy token' do + let(:credential_user) { project_deploy_token.username } + let(:credential_password) { project_deploy_token.token } + + it_behaves_like 'with valid credentials' + end + + context 'with invalid credentials' do + let(:credential_user) { 'foo' } + let(:credential_password) { 'bar' } + + it 'returns unauthorized' do + subject + + expect(response).to have_gitlab_http_status(:unauthorized) + end + end end def credentials(login, password) diff --git a/spec/requests/lfs_http_spec.rb b/spec/requests/lfs_http_spec.rb index 48d125a37c3..535d511a459 100644 --- a/spec/requests/lfs_http_spec.rb +++ b/spec/requests/lfs_http_spec.rb @@ -6,1179 +6,1145 @@ RSpec.describe 'Git LFS API and storage' do include ProjectForksHelper include WorkhorseHelpers - let_it_be(:project, reload: true) { create(:project, :repository) } - let_it_be(:other_project) { create(:project, :repository) } + let_it_be(:project, reload: true) { create(:project, :empty_repo) } let_it_be(:user) { create(:user) } - let(:lfs_object) { create(:lfs_object, :with_file) } - let(:headers) do - { - 'Authorization' => authorization, - 'X-Sendfile-Type' => 'X-Sendfile' - }.compact - end - - let(:include_workhorse_jwt_header) { true } - let(:authorization) { } - let(:pipeline) { create(:ci_empty_pipeline, project: project) } + context 'with projects' do + it_behaves_like 'LFS http requests' do + let_it_be(:other_project, reload: true) { create(:project, :empty_repo) } - let(:sample_oid) { lfs_object.oid } - let(:sample_size) { lfs_object.size } - let(:sample_object) { { 'oid' => sample_oid, 'size' => sample_size } } - let(:non_existing_object_oid) { '91eff75a492a3ed0dfcb544d7f31326bc4014c8551849c192fd1e48d4dd2c897' } - let(:non_existing_object_size) { 1575078 } - let(:non_existing_object) { { 'oid' => non_existing_object_oid, 'size' => non_existing_object_size } } - let(:multiple_objects) { [sample_object, non_existing_object] } + let(:container) { project } + let(:authorize_guest) { project.add_guest(user) } + let(:authorize_download) { project.add_reporter(user) } + let(:authorize_upload) { project.add_developer(user) } - let(:lfs_enabled) { true } + context 'project specific LFS settings' do + let(:body) { upload_body(sample_object) } - before do - stub_lfs_setting(enabled: lfs_enabled) - end + before do + authorize_upload + project.update_attribute(:lfs_enabled, project_lfs_enabled) - context 'project specific LFS settings' do - let(:body) { upload_body(sample_object) } - let(:authorization) { authorize_user } + subject + end - before do - project.add_maintainer(user) - project.update_attribute(:lfs_enabled, project_lfs_enabled) + describe 'LFS disabled in project' do + let(:project_lfs_enabled) { false } - subject - end + context 'when uploading' do + subject(:request) { post_lfs_json(batch_url(project), body, headers) } - describe 'LFS disabled in project' do - let(:project_lfs_enabled) { false } + it_behaves_like 'LFS http 404 response' + end - context 'when uploading' do - subject { post_lfs_json(batch_url(project), body, headers) } + context 'when downloading' do + subject(:request) { get(objects_url(project, sample_oid), params: {}, headers: headers) } - it_behaves_like 'LFS http 404 response' - end + it_behaves_like 'LFS http 404 response' + end + end - context 'when downloading' do - subject { get(objects_url(project, sample_oid), params: {}, headers: headers) } + describe 'LFS enabled in project' do + let(:project_lfs_enabled) { true } - it_behaves_like 'LFS http 404 response' - end - end + context 'when uploading' do + subject(:request) { post_lfs_json(batch_url(project), body, headers) } - describe 'LFS enabled in project' do - let(:project_lfs_enabled) { true } + it_behaves_like 'LFS http 200 response' + end - context 'when uploading' do - subject { post_lfs_json(batch_url(project), body, headers) } + context 'when downloading' do + subject(:request) { get(objects_url(project, sample_oid), params: {}, headers: headers) } - it_behaves_like 'LFS http 200 response' + it_behaves_like 'LFS http 200 blob response' + end + end end - context 'when downloading' do - subject { get(objects_url(project, sample_oid), params: {}, headers: headers) } + describe 'when fetching LFS object' do + subject(:request) { get objects_url(project, sample_oid), params: {}, headers: headers } - it_behaves_like 'LFS http 200 blob response' - end - end - end + let(:response) { request && super() } - describe 'when fetching LFS object' do - let(:update_permissions) { } - let(:before_get) { } + before do + project.lfs_objects << lfs_object + end - before do - project.lfs_objects << lfs_object - update_permissions - before_get + context 'when LFS uses object storage' do + before do + authorize_download + end - get objects_url(project, sample_oid), params: {}, headers: headers - end + context 'when proxy download is enabled' do + before do + stub_lfs_object_storage(proxy_download: true) + lfs_object.file.migrate!(LfsObjectUploader::Store::REMOTE) + end - context 'when LFS uses object storage' do - let(:authorization) { authorize_user } + it 'responds with the workhorse send-url' do + expect(response).to have_gitlab_http_status(:ok) + expect(response.headers[Gitlab::Workhorse::SEND_DATA_HEADER]).to start_with("send-url:") + end + end - let(:update_permissions) do - project.add_maintainer(user) - end + context 'when proxy download is disabled' do + before do + stub_lfs_object_storage(proxy_download: false) + lfs_object.file.migrate!(LfsObjectUploader::Store::REMOTE) + end - context 'when proxy download is enabled' do - let(:before_get) do - stub_lfs_object_storage(proxy_download: true) - lfs_object.file.migrate!(LfsObjectUploader::Store::REMOTE) - end + it 'responds with redirect' do + expect(response).to have_gitlab_http_status(:found) + end - it 'responds with the workhorse send-url' do - expect(response).to have_gitlab_http_status(:ok) - expect(response.headers[Gitlab::Workhorse::SEND_DATA_HEADER]).to start_with("send-url:") + it 'responds with the file location' do + expect(response.location).to include(lfs_object.reload.file.path) + end + end end - end - context 'when proxy download is disabled' do - let(:before_get) do - stub_lfs_object_storage(proxy_download: false) - lfs_object.file.migrate!(LfsObjectUploader::Store::REMOTE) - end + context 'when deploy key is authorized' do + let_it_be(:key) { create(:deploy_key) } + let(:authorization) { authorize_deploy_key } - it 'responds with redirect' do - expect(response).to have_gitlab_http_status(:found) - end + before do + project.deploy_keys << key + end - it 'responds with the file location' do - expect(response.location).to include(lfs_object.reload.file.path) + it_behaves_like 'LFS http 200 blob response' end - end - end - context 'when deploy key is authorized' do - let(:key) { create(:deploy_key) } - let(:authorization) { authorize_deploy_key } + context 'when using a user key (LFSToken)' do + let(:authorization) { authorize_user_key } - let(:update_permissions) do - project.deploy_keys << key - end + context 'when user allowed' do + before do + authorize_download + end - it_behaves_like 'LFS http 200 blob response' - end + it_behaves_like 'LFS http 200 blob response' - context 'when using a user key (LFSToken)' do - let(:authorization) { authorize_user_key } + context 'when user password is expired' do + let_it_be(:user) { create(:user, password_expires_at: 1.minute.ago)} - context 'when user allowed' do - let(:update_permissions) do - project.add_maintainer(user) - end + it_behaves_like 'LFS http 401 response' + end - it_behaves_like 'LFS http 200 blob response' + context 'when user is blocked' do + let_it_be(:user) { create(:user, :blocked)} - context 'when user password is expired' do - let(:user) { create(:user, password_expires_at: 1.minute.ago)} + it_behaves_like 'LFS http 401 response' + end + end - it_behaves_like 'LFS http 401 response' + context 'when user not allowed' do + it_behaves_like 'LFS http 404 response' + end end - context 'when user is blocked' do - let(:user) { create(:user, :blocked)} + context 'when build is authorized as' do + let(:authorization) { authorize_ci_project } + let(:pipeline) { create(:ci_empty_pipeline, project: project) } + let(:build) { create(:ci_build, :running, pipeline: pipeline, user: user) } - it_behaves_like 'LFS http 401 response' - end - end + shared_examples 'can download LFS only from own projects' do + context 'for owned project' do + let_it_be(:project) { create(:project, namespace: user.namespace) } - context 'when user not allowed' do - it_behaves_like 'LFS http 404 response' - end - end + it_behaves_like 'LFS http 200 blob response' + end - context 'when build is authorized as' do - let(:authorization) { authorize_ci_project } + context 'for member of project' do + before do + authorize_download + end - shared_examples 'can download LFS only from own projects' do - context 'for owned project' do - let(:project) { create(:project, namespace: user.namespace) } + it_behaves_like 'LFS http 200 blob response' + end - it_behaves_like 'LFS http 200 blob response' - end + context 'for other project' do + let(:pipeline) { create(:ci_empty_pipeline, project: other_project) } - context 'for member of project' do - let(:pipeline) { create(:ci_empty_pipeline, project: project) } + it 'rejects downloading code' do + expect(response).to have_gitlab_http_status(:not_found) + end + end + end + + context 'administrator', :enable_admin_mode do + let_it_be(:user) { create(:admin) } - let(:update_permissions) do - project.add_reporter(user) + it_behaves_like 'can download LFS only from own projects' end - it_behaves_like 'LFS http 200 blob response' - end + context 'regular user' do + it_behaves_like 'can download LFS only from own projects' + end - context 'for other project' do - let(:pipeline) { create(:ci_empty_pipeline, project: other_project) } + context 'does not have user' do + let(:build) { create(:ci_build, :running, pipeline: pipeline) } - it 'rejects downloading code' do - expect(response).to have_gitlab_http_status(:not_found) + it_behaves_like 'can download LFS only from own projects' end end end - context 'administrator' do - let(:user) { create(:admin) } - let(:build) { create(:ci_build, :running, pipeline: pipeline, user: user) } - - it_behaves_like 'can download LFS only from own projects' - end + describe 'when handling LFS batch request' do + subject(:request) { post_lfs_json batch_url(project), body, headers } - context 'regular user' do - let(:build) { create(:ci_build, :running, pipeline: pipeline, user: user) } + let(:response) { request && super() } + let(:lfs_chunked_encoding) { true } - it_behaves_like 'can download LFS only from own projects' - end + before do + stub_feature_flags(lfs_chunked_encoding: lfs_chunked_encoding) + project.lfs_objects << lfs_object + end - context 'does not have user' do - let(:build) { create(:ci_build, :running, pipeline: pipeline) } + shared_examples 'process authorization header' do |renew_authorization:| + let(:response_authorization) do + authorization_in_action(lfs_actions.first) + end - it_behaves_like 'can download LFS only from own projects' - end - end - end + if renew_authorization + context 'when the authorization comes from a user' do + it 'returns a new valid LFS token authorization' do + expect(response_authorization).not_to eq(authorization) + end - describe 'when handling LFS batch request' do - let(:update_lfs_permissions) { } - let(:update_user_permissions) { } + it 'returns a valid token' do + username, token = ::Base64.decode64(response_authorization.split(' ', 2).last).split(':', 2) - before do - update_lfs_permissions - update_user_permissions - post_lfs_json batch_url(project), body, headers - end + expect(username).to eq(user.username) + expect(Gitlab::LfsToken.new(user).token_valid?(token)).to be_truthy + end - shared_examples 'process authorization header' do |renew_authorization:| - let(:response_authorization) do - authorization_in_action(lfs_actions.first) - end + it 'generates only one new token per each request' do + authorizations = lfs_actions.map do |action| + authorization_in_action(action) + end.compact - if renew_authorization - context 'when the authorization comes from a user' do - it 'returns a new valid LFS token authorization' do - expect(response_authorization).not_to eq(authorization) + expect(authorizations.uniq.count).to eq 1 + end + end + else + context 'when the authorization comes from a token' do + it 'returns the same authorization header' do + expect(response_authorization).to eq(authorization) + end + end end - it 'returns a a valid token' do - username, token = ::Base64.decode64(response_authorization.split(' ', 2).last).split(':', 2) - - expect(username).to eq(user.username) - expect(Gitlab::LfsToken.new(user).token_valid?(token)).to be_truthy + def lfs_actions + json_response['objects'].map { |a| a['actions'] }.compact end - it 'generates only one new token per each request' do - authorizations = lfs_actions.map do |action| - authorization_in_action(action) - end.compact - - expect(authorizations.uniq.count).to eq 1 + def authorization_in_action(action) + (action['upload'] || action['download']).dig('header', 'Authorization') end end - else - context 'when the authorization comes from a token' do - it 'returns the same authorization header' do - expect(response_authorization).to eq(authorization) - end - end - end - - def lfs_actions - json_response['objects'].map { |a| a['actions'] }.compact - end - def authorization_in_action(action) - (action['upload'] || action['download']).dig('header', 'Authorization') - end - end + describe 'download' do + let(:body) { download_body(sample_object) } - describe 'download' do - let(:body) { download_body(sample_object) } + shared_examples 'an authorized request' do |renew_authorization:| + context 'when downloading an LFS object that is assigned to our project' do + it_behaves_like 'LFS http 200 response' - shared_examples 'an authorized request' do |renew_authorization:| - context 'when downloading an LFS object that is assigned to our project' do - let(:update_lfs_permissions) do - project.lfs_objects << lfs_object - end + it 'with href to download' do + expect(json_response['objects'].first).to include(sample_object) + expect(json_response['objects'].first['actions']['download']['href']).to eq(objects_url(project, sample_oid)) + end - it_behaves_like 'LFS http 200 response' + it_behaves_like 'process authorization header', renew_authorization: renew_authorization + end - it 'with href to download' do - expect(json_response['objects'].first).to include(sample_object) - expect(json_response['objects'].first['actions']['download']['href']).to eq(objects_url(project, sample_oid)) - end + context 'when downloading an LFS object that is assigned to other project' do + before do + lfs_object.update!(projects: [other_project]) + end - it_behaves_like 'process authorization header', renew_authorization: renew_authorization - end + it_behaves_like 'LFS http 200 response' - context 'when downloading an LFS object that is assigned to other project' do - let(:update_lfs_permissions) do - other_project.lfs_objects << lfs_object - end + it 'with an 404 for specific object' do + expect(json_response['objects'].first).to include(sample_object) + expect(json_response['objects'].first['error']).to include('code' => 404, 'message' => "Object does not exist on the server or you don't have permissions to access it") + end + end - it_behaves_like 'LFS http 200 response' + context 'when downloading a LFS object that does not exist' do + let(:body) { download_body(non_existing_object) } - it 'with an 404 for specific object' do - expect(json_response['objects'].first).to include(sample_object) - expect(json_response['objects'].first['error']).to include('code' => 404, 'message' => "Object does not exist on the server or you don't have permissions to access it") - end - end + it_behaves_like 'LFS http 200 response' - context 'when downloading a LFS object that does not exist' do - let(:body) { download_body(non_existing_object) } + it 'with an 404 for specific object' do + expect(json_response['objects'].first).to include(non_existing_object) + expect(json_response['objects'].first['error']).to include('code' => 404, 'message' => "Object does not exist on the server or you don't have permissions to access it") + end + end - it_behaves_like 'LFS http 200 response' + context 'when downloading one existing and one missing LFS object' do + let(:body) { download_body(multiple_objects) } - it 'with an 404 for specific object' do - expect(json_response['objects'].first).to include(non_existing_object) - expect(json_response['objects'].first['error']).to include('code' => 404, 'message' => "Object does not exist on the server or you don't have permissions to access it") - end - end + it_behaves_like 'LFS http 200 response' - context 'when downloading one new and one existing LFS object' do - let(:body) { download_body(multiple_objects) } - let(:update_lfs_permissions) do - project.lfs_objects << lfs_object - end + it 'responds with download hypermedia link for the existing object' do + expect(json_response['objects'].first).to include(sample_object) + expect(json_response['objects'].first['actions']['download']).to include('href' => objects_url(project, sample_oid)) + expect(json_response['objects'].last).to eq({ + 'oid' => non_existing_object_oid, + 'size' => non_existing_object_size, + 'error' => { + 'code' => 404, + 'message' => "Object does not exist on the server or you don't have permissions to access it" + } + }) + end - it_behaves_like 'LFS http 200 response' + it_behaves_like 'process authorization header', renew_authorization: renew_authorization + end - it 'responds with download hypermedia link for the new object' do - expect(json_response['objects'].first).to include(sample_object) - expect(json_response['objects'].first['actions']['download']).to include('href' => objects_url(project, sample_oid)) - expect(json_response['objects'].last).to eq({ - 'oid' => non_existing_object_oid, - 'size' => non_existing_object_size, - 'error' => { - 'code' => 404, - 'message' => "Object does not exist on the server or you don't have permissions to access it" - } - }) - end + context 'when downloading two existing LFS objects' do + let(:body) { download_body(multiple_objects) } + let(:other_object) { create(:lfs_object, :with_file, oid: non_existing_object_oid, size: non_existing_object_size) } - it_behaves_like 'process authorization header', renew_authorization: renew_authorization - end + before do + project.lfs_objects << other_object + end - context 'when downloading two existing LFS objects' do - let(:body) { download_body(multiple_objects) } - let(:other_object) { create(:lfs_object, :with_file, oid: non_existing_object_oid, size: non_existing_object_size) } - let(:update_lfs_permissions) do - project.lfs_objects << [lfs_object, other_object] - end + it 'responds with the download hypermedia link for each object' do + expect(json_response['objects'].first).to include(sample_object) + expect(json_response['objects'].first['actions']['download']).to include('href' => objects_url(project, sample_oid)) - it 'responds with the download hypermedia link for each object' do - expect(json_response['objects'].first).to include(sample_object) - expect(json_response['objects'].first['actions']['download']).to include('href' => objects_url(project, sample_oid)) + expect(json_response['objects'].last).to include(non_existing_object) + expect(json_response['objects'].last['actions']['download']).to include('href' => objects_url(project, non_existing_object_oid)) + end - expect(json_response['objects'].last).to include(non_existing_object) - expect(json_response['objects'].last['actions']['download']).to include('href' => objects_url(project, non_existing_object_oid)) + it_behaves_like 'process authorization header', renew_authorization: renew_authorization + end end - it_behaves_like 'process authorization header', renew_authorization: renew_authorization - end - end + context 'when user is authenticated' do + before do + project.add_role(user, role) if role + end - context 'when user is authenticated' do - let(:authorization) { authorize_user } + it_behaves_like 'an authorized request', renew_authorization: true do + let(:role) { :reporter } + end - let(:update_user_permissions) do - project.add_role(user, role) - end + context 'when user is not a member of the project' do + let(:role) { nil } - it_behaves_like 'an authorized request', renew_authorization: true do - let(:role) { :reporter } - end + it_behaves_like 'LFS http 404 response' + end - context 'when user is not a member of the project' do - let(:update_user_permissions) { nil } + context 'when user does not have download access' do + let(:role) { :guest } - it_behaves_like 'LFS http 404 response' - end + it_behaves_like 'LFS http 404 response' + end - context 'when user does not have download access' do - let(:role) { :guest } + context 'when user password is expired' do + let_it_be(:user) { create(:user, password_expires_at: 1.minute.ago)} + let(:role) { :reporter} - it_behaves_like 'LFS http 404 response' - end + # TODO: This should return a 404 response + # https://gitlab.com/gitlab-org/gitlab/-/issues/292006 + it_behaves_like 'LFS http 200 response' + end - context 'when user password is expired' do - let(:role) { :reporter} - let(:user) { create(:user, password_expires_at: 1.minute.ago)} + context 'when user is blocked' do + let_it_be(:user) { create(:user, :blocked)} + let(:role) { :reporter} - it 'with an 404 for specific object' do - expect(json_response['objects'].first).to include(sample_object) - expect(json_response['objects'].first['error']).to include('code' => 404, 'message' => "Object does not exist on the server or you don't have permissions to access it") + it_behaves_like 'LFS http 401 response' + end end - end - context 'when user is blocked' do - let(:role) { :reporter} - let(:user) { create(:user, :blocked)} + context 'when using Deploy Tokens' do + let(:authorization) { authorize_deploy_token } - it_behaves_like 'LFS http 401 response' - end - end + context 'when Deploy Token is not valid' do + let(:deploy_token) { create(:deploy_token, projects: [project], read_repository: false) } - context 'when using Deploy Tokens' do - let(:authorization) { authorize_deploy_token } - let(:update_user_permissions) { nil } - let(:role) { nil } - let(:update_lfs_permissions) do - project.lfs_objects << lfs_object - end + it_behaves_like 'LFS http 401 response' + end - context 'when Deploy Token is not valid' do - let(:deploy_token) { create(:deploy_token, projects: [project], read_repository: false) } + context 'when Deploy Token is not related to the project' do + let(:deploy_token) { create(:deploy_token, projects: [other_project]) } - it_behaves_like 'LFS http 401 response' - end + it_behaves_like 'LFS http 401 response' + end - context 'when Deploy Token is not related to the project' do - let(:deploy_token) { create(:deploy_token, projects: [other_project]) } + # TODO: We should fix this test case that causes flakyness by alternating the result of the above test cases. + context 'when Deploy Token is valid' do + let(:deploy_token) { create(:deploy_token, projects: [project]) } - it_behaves_like 'LFS http 401 response' - end + it_behaves_like 'an authorized request', renew_authorization: false + end + end - # TODO: We should fix this test case that causes flakyness by alternating the result of the above test cases. - context 'when Deploy Token is valid' do - let(:deploy_token) { create(:deploy_token, projects: [project]) } + context 'when build is authorized as' do + let(:authorization) { authorize_ci_project } - it_behaves_like 'an authorized request', renew_authorization: false - end - end + shared_examples 'can download LFS only from own projects' do |renew_authorization:| + context 'for own project' do + let(:pipeline) { create(:ci_empty_pipeline, project: project) } - context 'when build is authorized as' do - let(:authorization) { authorize_ci_project } + before do + authorize_download + end - let(:update_lfs_permissions) do - project.lfs_objects << lfs_object - end + it_behaves_like 'an authorized request', renew_authorization: renew_authorization + end - shared_examples 'can download LFS only from own projects' do |renew_authorization:| - context 'for own project' do - let(:pipeline) { create(:ci_empty_pipeline, project: project) } + context 'for other project' do + let(:pipeline) { create(:ci_empty_pipeline, project: other_project) } - let(:update_user_permissions) do - project.add_reporter(user) + it 'rejects downloading code' do + expect(response).to have_gitlab_http_status(:not_found) + end + end end - it_behaves_like 'an authorized request', renew_authorization: renew_authorization - end - - context 'for other project' do - let(:pipeline) { create(:ci_empty_pipeline, project: other_project) } + context 'administrator', :enable_admin_mode do + let_it_be(:user) { create(:admin) } + let(:build) { create(:ci_build, :running, pipeline: pipeline, user: user) } - it 'rejects downloading code' do - expect(response).to have_gitlab_http_status(:not_found) + it_behaves_like 'can download LFS only from own projects', renew_authorization: true end - end - end - context 'administrator' do - let(:user) { create(:admin) } - let(:build) { create(:ci_build, :running, pipeline: pipeline, user: user) } - - it_behaves_like 'can download LFS only from own projects', renew_authorization: true - end + context 'regular user' do + let(:build) { create(:ci_build, :running, pipeline: pipeline, user: user) } - context 'regular user' do - let(:build) { create(:ci_build, :running, pipeline: pipeline, user: user) } - - it_behaves_like 'can download LFS only from own projects', renew_authorization: true - end + it_behaves_like 'can download LFS only from own projects', renew_authorization: true + end - context 'does not have user' do - let(:build) { create(:ci_build, :running, pipeline: pipeline) } + context 'does not have user' do + let(:build) { create(:ci_build, :running, pipeline: pipeline) } - it_behaves_like 'can download LFS only from own projects', renew_authorization: false - end - end + it_behaves_like 'can download LFS only from own projects', renew_authorization: false + end + end - context 'when user is not authenticated' do - describe 'is accessing public project' do - let(:project) { create(:project, :public) } + context 'when user is not authenticated' do + let(:authorization) { nil } - let(:update_lfs_permissions) do - project.lfs_objects << lfs_object - end + describe 'is accessing public project' do + let_it_be(:project) { create(:project, :public) } - it_behaves_like 'LFS http 200 response' + it_behaves_like 'LFS http 200 response' - it 'returns href to download' do - expect(json_response).to eq({ - 'objects' => [ - { - 'oid' => sample_oid, - 'size' => sample_size, - 'authenticated' => true, - 'actions' => { - 'download' => { - 'href' => objects_url(project, sample_oid), - 'header' => {} + it 'returns href to download' do + expect(json_response).to eq({ + 'objects' => [ + { + 'oid' => sample_oid, + 'size' => sample_size, + 'authenticated' => true, + 'actions' => { + 'download' => { + 'href' => objects_url(project, sample_oid), + 'header' => {} + } + } } - } - } - ] - }) - end - end + ] + }) + end + end - describe 'is accessing non-public project' do - let(:update_lfs_permissions) do - project.lfs_objects << lfs_object + describe 'is accessing non-public project' do + it_behaves_like 'LFS http 401 response' + end end - - it_behaves_like 'LFS http 401 response' end - end - end - - describe 'upload' do - let(:project) { create(:project, :public) } - let(:body) { upload_body(sample_object) } - shared_examples 'pushes new LFS objects' do |renew_authorization:| - let(:sample_size) { 150.megabytes } - let(:sample_oid) { non_existing_object_oid } + describe 'upload' do + let_it_be(:project) { create(:project, :public) } + let(:body) { upload_body(sample_object) } - it_behaves_like 'LFS http 200 response' + shared_examples 'pushes new LFS objects' do |renew_authorization:| + let(:sample_size) { 150.megabytes } + let(:sample_oid) { non_existing_object_oid } - it 'responds with upload hypermedia link' do - expect(json_response['objects']).to be_kind_of(Array) - expect(json_response['objects'].first).to include(sample_object) - expect(json_response['objects'].first['actions']['upload']['href']).to eq(objects_url(project, sample_oid, sample_size)) - expect(json_response['objects'].first['actions']['upload']['header']).to include('Content-Type' => 'application/octet-stream') - end - - it_behaves_like 'process authorization header', renew_authorization: renew_authorization - end + it_behaves_like 'LFS http 200 response' - describe 'when request is authenticated' do - describe 'when user has project push access' do - let(:authorization) { authorize_user } + it 'responds with upload hypermedia link' do + expect(json_response['objects']).to be_kind_of(Array) + expect(json_response['objects'].first).to include(sample_object) + expect(json_response['objects'].first['actions']['upload']['href']).to eq(objects_url(project, sample_oid, sample_size)) - let(:update_user_permissions) do - project.add_developer(user) - end + headers = json_response['objects'].first['actions']['upload']['header'] + expect(headers['Content-Type']).to eq('application/octet-stream') + expect(headers['Transfer-Encoding']).to eq('chunked') + end - context 'when pushing an LFS object that already exists' do - shared_examples_for 'batch upload with existing LFS object' do - it_behaves_like 'LFS http 200 response' + context 'when lfs_chunked_encoding feature is disabled' do + let(:lfs_chunked_encoding) { false } - it 'responds with links the object to the project' do + it 'responds with upload hypermedia link' do expect(json_response['objects']).to be_kind_of(Array) expect(json_response['objects'].first).to include(sample_object) - expect(lfs_object.projects.pluck(:id)).not_to include(project.id) - expect(lfs_object.projects.pluck(:id)).to include(other_project.id) expect(json_response['objects'].first['actions']['upload']['href']).to eq(objects_url(project, sample_oid, sample_size)) - expect(json_response['objects'].first['actions']['upload']['header']).to include('Content-Type' => 'application/octet-stream') - end - it_behaves_like 'process authorization header', renew_authorization: true + headers = json_response['objects'].first['actions']['upload']['header'] + expect(headers['Content-Type']).to eq('application/octet-stream') + expect(headers['Transfer-Encoding']).to be_nil + end end - let(:update_lfs_permissions) do - other_project.lfs_objects << lfs_object - end + it_behaves_like 'process authorization header', renew_authorization: renew_authorization + end - context 'in another project' do - it_behaves_like 'batch upload with existing LFS object' - end + describe 'when request is authenticated' do + describe 'when user has project push access' do + before do + authorize_upload + end - context 'in source of fork project' do - let(:project) { fork_project(other_project) } + context 'when pushing an LFS object that already exists' do + shared_examples_for 'batch upload with existing LFS object' do + it_behaves_like 'LFS http 200 response' - it_behaves_like 'batch upload with existing LFS object' - end - end + it 'responds with links to the object in the project' do + expect(json_response['objects']).to be_kind_of(Array) + expect(json_response['objects'].first).to include(sample_object) + expect(lfs_object.projects.pluck(:id)).not_to include(project.id) + expect(lfs_object.projects.pluck(:id)).to include(other_project.id) + expect(json_response['objects'].first['actions']['upload']['href']).to eq(objects_url(project, sample_oid, sample_size)) - context 'when pushing a LFS object that does not exist' do - it_behaves_like 'pushes new LFS objects', renew_authorization: true - end + headers = json_response['objects'].first['actions']['upload']['header'] + expect(headers['Content-Type']).to eq('application/octet-stream') + expect(headers['Transfer-Encoding']).to eq('chunked') + end - context 'when pushing one new and one existing LFS object' do - let(:body) { upload_body(multiple_objects) } - let(:update_lfs_permissions) do - project.lfs_objects << lfs_object - end + it_behaves_like 'process authorization header', renew_authorization: true + end - it_behaves_like 'LFS http 200 response' + context 'in another project' do + before do + lfs_object.update!(projects: [other_project]) + end - it 'responds with upload hypermedia link for the new object' do - expect(json_response['objects']).to be_kind_of(Array) + it_behaves_like 'batch upload with existing LFS object' + end - expect(json_response['objects'].first).to include(sample_object) - expect(json_response['objects'].first).not_to have_key('actions') + context 'in source of fork project' do + let(:project) { fork_project(other_project) } - expect(json_response['objects'].last).to include(non_existing_object) - expect(json_response['objects'].last['actions']['upload']['href']).to eq(objects_url(project, non_existing_object_oid, non_existing_object_size)) - expect(json_response['objects'].last['actions']['upload']['header']).to include('Content-Type' => 'application/octet-stream') - end + before do + lfs_object.update!(projects: [other_project]) + end - it_behaves_like 'process authorization header', renew_authorization: true - end - end + it_behaves_like 'batch upload with existing LFS object' + end + end - context 'when user does not have push access' do - let(:authorization) { authorize_user } + context 'when pushing a LFS object that does not exist' do + it_behaves_like 'pushes new LFS objects', renew_authorization: true + end - it_behaves_like 'LFS http 403 response' - end + context 'when pushing one new and one existing LFS object' do + let(:body) { upload_body(multiple_objects) } - context 'when build is authorized' do - let(:authorization) { authorize_ci_project } + it_behaves_like 'LFS http 200 response' - context 'build has an user' do - let(:build) { create(:ci_build, :running, pipeline: pipeline, user: user) } + it 'responds with upload hypermedia link for the new object' do + expect(json_response['objects']).to be_kind_of(Array) - context 'tries to push to own project' do - it_behaves_like 'LFS http 403 response' - end + expect(json_response['objects'].first).to include(sample_object) + expect(json_response['objects'].first).not_to have_key('actions') - context 'tries to push to other project' do - let(:pipeline) { create(:ci_empty_pipeline, project: other_project) } + expect(json_response['objects'].last).to include(non_existing_object) + expect(json_response['objects'].last['actions']['upload']['href']).to eq(objects_url(project, non_existing_object_oid, non_existing_object_size)) + + headers = json_response['objects'].last['actions']['upload']['header'] + expect(headers['Content-Type']).to eq('application/octet-stream') + expect(headers['Transfer-Encoding']).to eq('chunked') + end + + it_behaves_like 'process authorization header', renew_authorization: true + end + end - # I'm not sure what this tests that is different from the previous test + context 'when user does not have push access' do it_behaves_like 'LFS http 403 response' end - end - context 'does not have user' do - let(:build) { create(:ci_build, :running, pipeline: pipeline) } + context 'when build is authorized' do + let(:authorization) { authorize_ci_project } + let(:pipeline) { create(:ci_empty_pipeline, project: project) } - it_behaves_like 'LFS http 403 response' - end - end + context 'build has an user' do + let(:build) { create(:ci_build, :running, pipeline: pipeline, user: user) } - context 'when deploy key has project push access' do - let(:key) { create(:deploy_key) } - let(:authorization) { authorize_deploy_key } + context 'tries to push to own project' do + it_behaves_like 'LFS http 403 response' + end - let(:update_user_permissions) do - project.deploy_keys_projects.create!(deploy_key: key, can_push: true) - end + context 'tries to push to other project' do + let(:pipeline) { create(:ci_empty_pipeline, project: other_project) } - it_behaves_like 'pushes new LFS objects', renew_authorization: false - end - end + # I'm not sure what this tests that is different from the previous test + it_behaves_like 'LFS http 403 response' + end + end - context 'when user is not authenticated' do - context 'when user has push access' do - let(:update_user_permissions) do - project.add_maintainer(user) - end + context 'does not have user' do + let(:build) { create(:ci_build, :running, pipeline: pipeline) } - it_behaves_like 'LFS http 401 response' - end + it_behaves_like 'LFS http 403 response' + end + end - context 'when user does not have push access' do - it_behaves_like 'LFS http 401 response' - end - end - end + context 'when deploy key has project push access' do + let(:key) { create(:deploy_key) } + let(:authorization) { authorize_deploy_key } - describe 'unsupported' do - let(:authorization) { authorize_user } - let(:body) { request_body('other', sample_object) } + before do + project.deploy_keys_projects.create!(deploy_key: key, can_push: true) + end - it_behaves_like 'LFS http 404 response' - end - end + it_behaves_like 'pushes new LFS objects', renew_authorization: false + end + end - describe 'when handling LFS batch request on a read-only GitLab instance' do - let(:authorization) { authorize_user } + context 'when user is not authenticated' do + let(:authorization) { nil } - subject { post_lfs_json(batch_url(project), body, headers) } + context 'when user has push access' do + before do + authorize_upload + end - before do - allow(Gitlab::Database).to receive(:read_only?) { true } + it_behaves_like 'LFS http 401 response' + end - project.add_maintainer(user) + context 'when user does not have push access' do + it_behaves_like 'LFS http 401 response' + end + end + end - subject - end + describe 'unsupported' do + let(:body) { request_body('other', sample_object) } - context 'when downloading' do - let(:body) { download_body(sample_object) } + it_behaves_like 'LFS http 404 response' + end + end - it_behaves_like 'LFS http 200 response' - end + describe 'when handling LFS batch request on a read-only GitLab instance' do + subject { post_lfs_json(batch_url(project), body, headers) } - context 'when uploading' do - let(:body) { upload_body(sample_object) } + before do + allow(Gitlab::Database).to receive(:read_only?) { true } - it_behaves_like 'LFS http expected response code and message' do - let(:response_code) { 403 } - let(:message) { 'You cannot write to this read-only GitLab instance.' } - end - end - end + project.add_maintainer(user) - describe 'when pushing a LFS object' do - shared_examples 'unauthorized' do - context 'and request is sent by gitlab-workhorse to authorize the request' do - before do - put_authorize + subject end - it_behaves_like 'LFS http 401 response' - end + context 'when downloading' do + let(:body) { download_body(sample_object) } - context 'and request is sent by gitlab-workhorse to finalize the upload' do - before do - put_finalize + it_behaves_like 'LFS http 200 response' end - it_behaves_like 'LFS http 401 response' - end + context 'when uploading' do + let(:body) { upload_body(sample_object) } - context 'and request is sent with a malformed headers' do - before do - put_finalize('/etc/passwd') + it_behaves_like 'LFS http expected response code and message' do + let(:response_code) { 403 } + let(:message) { 'You cannot write to this read-only GitLab instance.' } + end end - - it_behaves_like 'LFS http 401 response' end - end - shared_examples 'forbidden' do - context 'and request is sent by gitlab-workhorse to authorize the request' do - before do - put_authorize - end + describe 'when pushing a LFS object' do + let(:include_workhorse_jwt_header) { true } - it_behaves_like 'LFS http 403 response' - end + shared_examples 'unauthorized' do + context 'and request is sent by gitlab-workhorse to authorize the request' do + before do + put_authorize + end - context 'and request is sent by gitlab-workhorse to finalize the upload' do - before do - put_finalize - end + it_behaves_like 'LFS http 401 response' + end - it_behaves_like 'LFS http 403 response' - end + context 'and request is sent by gitlab-workhorse to finalize the upload' do + before do + put_finalize + end - context 'and request is sent with a malformed headers' do - before do - put_finalize('/etc/passwd') + it_behaves_like 'LFS http 401 response' + end + + context 'and request is sent with a malformed headers' do + before do + put_finalize('/etc/passwd') + end + + it_behaves_like 'LFS http 401 response' + end end - it_behaves_like 'LFS http 403 response' - end - end + shared_examples 'forbidden' do + context 'and request is sent by gitlab-workhorse to authorize the request' do + before do + put_authorize + end - describe 'to one project' do - describe 'when user is authenticated' do - let(:authorization) { authorize_user } + it_behaves_like 'LFS http 403 response' + end - describe 'when user has push access to the project' do - before do - project.add_developer(user) + context 'and request is sent by gitlab-workhorse to finalize the upload' do + before do + put_finalize + end + + it_behaves_like 'LFS http 403 response' end - context 'and the request bypassed workhorse' do - it 'raises an exception' do - expect { put_authorize(verified: false) }.to raise_error JWT::DecodeError + context 'and request is sent with a malformed headers' do + before do + put_finalize('/etc/passwd') end + + it_behaves_like 'LFS http 403 response' end + end - context 'and request is sent by gitlab-workhorse to authorize the request' do - shared_examples 'a valid response' do + describe 'to one project' do + describe 'when user is authenticated' do + describe 'when user has push access to the project' do before do - put_authorize + project.add_developer(user) end - it_behaves_like 'LFS http 200 workhorse response' - end - - shared_examples 'a local file' do - it_behaves_like 'a valid response' do - it 'responds with status 200, location of LFS store and object details' do - expect(json_response['TempPath']).to eq(LfsObjectUploader.workhorse_local_upload_path) - expect(json_response['RemoteObject']).to be_nil - expect(json_response['LfsOid']).to eq(sample_oid) - expect(json_response['LfsSize']).to eq(sample_size) + context 'and the request bypassed workhorse' do + it 'raises an exception' do + expect { put_authorize(verified: false) }.to raise_error JWT::DecodeError end end - end - context 'when using local storage' do - it_behaves_like 'a local file' - end + context 'and request is sent by gitlab-workhorse to authorize the request' do + shared_examples 'a valid response' do + before do + put_authorize + end - context 'when using remote storage' do - context 'when direct upload is enabled' do - before do - stub_lfs_object_storage(enabled: true, direct_upload: true) + it_behaves_like 'LFS http 200 workhorse response' end - it_behaves_like 'a valid response' do - it 'responds with status 200, location of LFS remote store and object details' do - expect(json_response).not_to have_key('TempPath') - expect(json_response['RemoteObject']).to have_key('ID') - expect(json_response['RemoteObject']).to have_key('GetURL') - expect(json_response['RemoteObject']).to have_key('StoreURL') - expect(json_response['RemoteObject']).to have_key('DeleteURL') - expect(json_response['RemoteObject']).not_to have_key('MultipartUpload') - expect(json_response['LfsOid']).to eq(sample_oid) - expect(json_response['LfsSize']).to eq(sample_size) + shared_examples 'a local file' do + it_behaves_like 'a valid response' do + it 'responds with status 200, location of LFS store and object details' do + expect(json_response['TempPath']).to eq(LfsObjectUploader.workhorse_local_upload_path) + expect(json_response['RemoteObject']).to be_nil + expect(json_response['LfsOid']).to eq(sample_oid) + expect(json_response['LfsSize']).to eq(sample_size) + end end end - end - context 'when direct upload is disabled' do - before do - stub_lfs_object_storage(enabled: true, direct_upload: false) + context 'when using local storage' do + it_behaves_like 'a local file' end - it_behaves_like 'a local file' - end - end - end + context 'when using remote storage' do + context 'when direct upload is enabled' do + before do + stub_lfs_object_storage(enabled: true, direct_upload: true) + end - context 'and request is sent by gitlab-workhorse to finalize the upload' do - before do - put_finalize - end + it_behaves_like 'a valid response' do + it 'responds with status 200, location of LFS remote store and object details' do + expect(json_response).not_to have_key('TempPath') + expect(json_response['RemoteObject']).to have_key('ID') + expect(json_response['RemoteObject']).to have_key('GetURL') + expect(json_response['RemoteObject']).to have_key('StoreURL') + expect(json_response['RemoteObject']).to have_key('DeleteURL') + expect(json_response['RemoteObject']).not_to have_key('MultipartUpload') + expect(json_response['LfsOid']).to eq(sample_oid) + expect(json_response['LfsSize']).to eq(sample_size) + end + end + end - it_behaves_like 'LFS http 200 response' + context 'when direct upload is disabled' do + before do + stub_lfs_object_storage(enabled: true, direct_upload: false) + end - it 'LFS object is linked to the project' do - expect(lfs_object.projects.pluck(:id)).to include(project.id) - end - end + it_behaves_like 'a local file' + end + end + end - context 'and request to finalize the upload is not sent by gitlab-workhorse' do - it 'fails with a JWT decode error' do - expect { put_finalize(lfs_tmp_file, verified: false) }.to raise_error(JWT::DecodeError) - end - end + context 'and request is sent by gitlab-workhorse to finalize the upload' do + before do + put_finalize + end - context 'and workhorse requests upload finalize for a new LFS object' do - before do - lfs_object.destroy! - end + it_behaves_like 'LFS http 200 response' - context 'with object storage disabled' do - it "doesn't attempt to migrate file to object storage" do - expect(ObjectStorage::BackgroundMoveWorker).not_to receive(:perform_async) + it 'LFS object is linked to the project' do + expect(lfs_object.projects.pluck(:id)).to include(project.id) + end + end - put_finalize(with_tempfile: true) + context 'and request to finalize the upload is not sent by gitlab-workhorse' do + it 'fails with a JWT decode error' do + expect { put_finalize(lfs_tmp_file, verified: false) }.to raise_error(JWT::DecodeError) + end end - end - context 'with object storage enabled' do - context 'and direct upload enabled' do - let!(:fog_connection) do - stub_lfs_object_storage(direct_upload: true) + context 'and workhorse requests upload finalize for a new LFS object' do + before do + lfs_object.destroy! end - let(:tmp_object) do - fog_connection.directories.new(key: 'lfs-objects').files.create( # rubocop: disable Rails/SaveBang - key: 'tmp/uploads/12312300', - body: 'content' - ) + context 'with object storage disabled' do + it "doesn't attempt to migrate file to object storage" do + expect(ObjectStorage::BackgroundMoveWorker).not_to receive(:perform_async) + + put_finalize(with_tempfile: true) + end end - ['123123', '../../123123'].each do |remote_id| - context "with invalid remote_id: #{remote_id}" do - subject do - put_finalize(remote_object: tmp_object, args: { - 'file.remote_id' => remote_id - }) + context 'with object storage enabled' do + context 'and direct upload enabled' do + let!(:fog_connection) do + stub_lfs_object_storage(direct_upload: true) end - it 'responds with status 403' do - subject + let(:tmp_object) do + fog_connection.directories.new(key: 'lfs-objects').files.create( # rubocop: disable Rails/SaveBang + key: 'tmp/uploads/12312300', + body: 'content' + ) + end + + ['123123', '../../123123'].each do |remote_id| + context "with invalid remote_id: #{remote_id}" do + subject do + put_finalize(remote_object: tmp_object, args: { + 'file.remote_id' => remote_id + }) + end + + it 'responds with status 403' do + subject - expect(response).to have_gitlab_http_status(:forbidden) + expect(response).to have_gitlab_http_status(:forbidden) + end + end end - end - end - context 'with valid remote_id' do - subject do - put_finalize(remote_object: tmp_object, args: { - 'file.remote_id' => '12312300', - 'file.name' => 'name' - }) - end + context 'with valid remote_id' do + subject do + put_finalize(remote_object: tmp_object, args: { + 'file.remote_id' => '12312300', + 'file.name' => 'name' + }) + end - it 'responds with status 200' do - subject + it 'responds with status 200' do + subject - expect(response).to have_gitlab_http_status(:ok) + expect(response).to have_gitlab_http_status(:ok) - object = LfsObject.find_by_oid(sample_oid) - expect(object).to be_present - expect(object.file.read).to eq(tmp_object.body) - end + object = LfsObject.find_by_oid(sample_oid) + expect(object).to be_present + expect(object.file.read).to eq(tmp_object.body) + end + + it 'schedules migration of file to object storage' do + subject + + expect(LfsObject.last.projects).to include(project) + end - it 'schedules migration of file to object storage' do - subject + it 'have valid file' do + subject - expect(LfsObject.last.projects).to include(project) + expect(LfsObject.last.file_store).to eq(ObjectStorage::Store::REMOTE) + expect(LfsObject.last.file).to be_exists + end + end end - it 'have valid file' do - subject + context 'and background upload enabled' do + before do + stub_lfs_object_storage(background_upload: true) + end + + it 'schedules migration of file to object storage' do + expect(ObjectStorage::BackgroundMoveWorker).to receive(:perform_async).with('LfsObjectUploader', 'LfsObject', :file, kind_of(Numeric)) - expect(LfsObject.last.file_store).to eq(ObjectStorage::Store::REMOTE) - expect(LfsObject.last.file).to be_exists + put_finalize(with_tempfile: true) + end end end end - context 'and background upload enabled' do + context 'without the lfs object' do before do - stub_lfs_object_storage(background_upload: true) + lfs_object.destroy! end - it 'schedules migration of file to object storage' do - expect(ObjectStorage::BackgroundMoveWorker).to receive(:perform_async).with('LfsObjectUploader', 'LfsObject', :file, kind_of(Numeric)) + it 'rejects slashes in the tempfile name (path traversal)' do + put_finalize('../bar', with_tempfile: true) + expect(response).to have_gitlab_http_status(:bad_request) + end + + context 'not sending the workhorse jwt header' do + let(:include_workhorse_jwt_header) { false } - put_finalize(with_tempfile: true) + it 'rejects the request' do + put_finalize(with_tempfile: true) + + expect(response).to have_gitlab_http_status(:unprocessable_entity) + end end end end - end - context 'without the lfs object' do - before do - lfs_object.destroy! - end + describe 'and user does not have push access' do + before do + project.add_reporter(user) + end - it 'rejects slashes in the tempfile name (path traversal)' do - put_finalize('../bar', with_tempfile: true) - expect(response).to have_gitlab_http_status(:bad_request) + it_behaves_like 'forbidden' end + end - context 'not sending the workhorse jwt header' do - let(:include_workhorse_jwt_header) { false } - - it 'rejects the request' do - put_finalize(with_tempfile: true) + context 'when build is authorized' do + let(:authorization) { authorize_ci_project } + let(:pipeline) { create(:ci_empty_pipeline, project: project) } - expect(response).to have_gitlab_http_status(:unprocessable_entity) - end - end - end - end + context 'build has an user' do + let(:build) { create(:ci_build, :running, pipeline: pipeline, user: user) } - describe 'and user does not have push access' do - before do - project.add_reporter(user) - end + context 'tries to push to own project' do + before do + project.add_developer(user) + put_authorize + end - it_behaves_like 'forbidden' - end - end + it_behaves_like 'LFS http 403 response' + end - context 'when build is authorized' do - let(:authorization) { authorize_ci_project } + context 'tries to push to other project' do + let(:pipeline) { create(:ci_empty_pipeline, project: other_project) } - context 'build has an user' do - let(:build) { create(:ci_build, :running, pipeline: pipeline, user: user) } + before do + put_authorize + end - context 'tries to push to own project' do - before do - project.add_developer(user) - put_authorize + it_behaves_like 'LFS http 404 response' + end end - it_behaves_like 'LFS http 403 response' - end + context 'does not have user' do + let(:build) { create(:ci_build, :running, pipeline: pipeline) } - context 'tries to push to other project' do - let(:pipeline) { create(:ci_empty_pipeline, project: other_project) } + before do + put_authorize + end - before do - put_authorize + it_behaves_like 'LFS http 403 response' end - - it_behaves_like 'LFS http 404 response' end - end - context 'does not have user' do - let(:build) { create(:ci_build, :running, pipeline: pipeline) } + describe 'when using a user key (LFSToken)' do + let(:authorization) { authorize_user_key } - before do - put_authorize - end + context 'when user allowed' do + before do + project.add_developer(user) + put_authorize + end - it_behaves_like 'LFS http 403 response' - end - end + it_behaves_like 'LFS http 200 workhorse response' - describe 'when using a user key (LFSToken)' do - let(:authorization) { authorize_user_key } + context 'when user password is expired' do + let_it_be(:user) { create(:user, password_expires_at: 1.minute.ago)} - context 'when user allowed' do - before do - project.add_developer(user) - put_authorize - end + it_behaves_like 'LFS http 401 response' + end - it_behaves_like 'LFS http 200 workhorse response' + context 'when user is blocked' do + let_it_be(:user) { create(:user, :blocked)} - context 'when user password is expired' do - let(:user) { create(:user, password_expires_at: 1.minute.ago)} + it_behaves_like 'LFS http 401 response' + end + end - it_behaves_like 'LFS http 401 response' + context 'when user not allowed' do + before do + put_authorize + end + + it_behaves_like 'LFS http 404 response' + end end - context 'when user is blocked' do - let(:user) { create(:user, :blocked)} + context 'for unauthenticated' do + let(:authorization) { nil } - it_behaves_like 'LFS http 401 response' + it_behaves_like 'unauthorized' end end - context 'when user not allowed' do - before do - put_authorize - end + describe 'to a forked project' do + let_it_be(:upstream_project) { create(:project, :public) } + let_it_be(:project_owner) { create(:user) } + let(:project) { fork_project(upstream_project, project_owner) } - it_behaves_like 'LFS http 404 response' - end - end + describe 'when user is authenticated' do + describe 'when user has push access to the project' do + before do + project.add_developer(user) + end - context 'for unauthenticated' do - it_behaves_like 'unauthorized' - end - end + context 'and request is sent by gitlab-workhorse to authorize the request' do + before do + put_authorize + end - describe 'to a forked project' do - let(:upstream_project) { create(:project, :public) } - let(:project_owner) { create(:user) } - let(:project) { fork_project(upstream_project, project_owner) } + it_behaves_like 'LFS http 200 workhorse response' - describe 'when user is authenticated' do - let(:authorization) { authorize_user } + it 'with location of LFS store and object details' do + expect(json_response['TempPath']).to eq(LfsObjectUploader.workhorse_local_upload_path) + expect(json_response['LfsOid']).to eq(sample_oid) + expect(json_response['LfsSize']).to eq(sample_size) + end + end - describe 'when user has push access to the project' do - before do - project.add_developer(user) - end + context 'and request is sent by gitlab-workhorse to finalize the upload' do + before do + put_finalize + end - context 'and request is sent by gitlab-workhorse to authorize the request' do - before do - put_authorize - end + it_behaves_like 'LFS http 200 response' - it_behaves_like 'LFS http 200 workhorse response' + it 'LFS object is linked to the forked project' do + expect(lfs_object.projects.pluck(:id)).to include(project.id) + end + end + end - it 'with location of LFS store and object details' do - expect(json_response['TempPath']).to eq(LfsObjectUploader.workhorse_local_upload_path) - expect(json_response['LfsOid']).to eq(sample_oid) - expect(json_response['LfsSize']).to eq(sample_size) + describe 'and user does not have push access' do + it_behaves_like 'forbidden' end end - context 'and request is sent by gitlab-workhorse to finalize the upload' do + context 'when build is authorized' do + let(:authorization) { authorize_ci_project } + let(:pipeline) { create(:ci_empty_pipeline, project: project) } + before do - put_finalize + put_authorize end - it_behaves_like 'LFS http 200 response' + context 'build has an user' do + let(:build) { create(:ci_build, :running, pipeline: pipeline, user: user) } - it 'LFS object is linked to the forked project' do - expect(lfs_object.projects.pluck(:id)).to include(project.id) - end - end - end - - describe 'and user does not have push access' do - it_behaves_like 'forbidden' - end - end + context 'tries to push to own project' do + it_behaves_like 'LFS http 403 response' + end - context 'when build is authorized' do - let(:authorization) { authorize_ci_project } + context 'tries to push to other project' do + let(:pipeline) { create(:ci_empty_pipeline, project: other_project) } - before do - put_authorize - end + # I'm not sure what this tests that is different from the previous test + it_behaves_like 'LFS http 403 response' + end + end - context 'build has an user' do - let(:build) { create(:ci_build, :running, pipeline: pipeline, user: user) } + context 'does not have user' do + let(:build) { create(:ci_build, :running, pipeline: pipeline) } - context 'tries to push to own project' do - it_behaves_like 'LFS http 403 response' + it_behaves_like 'LFS http 403 response' + end end - context 'tries to push to other project' do - let(:pipeline) { create(:ci_empty_pipeline, project: other_project) } + context 'for unauthenticated' do + let(:authorization) { nil } - # I'm not sure what this tests that is different from the previous test - it_behaves_like 'LFS http 403 response' + it_behaves_like 'unauthorized' end - end - context 'does not have user' do - let(:build) { create(:ci_build, :running, pipeline: pipeline) } + describe 'and second project not related to fork or a source project' do + let_it_be(:second_project) { create(:project) } - it_behaves_like 'LFS http 403 response' - end - end - - context 'for unauthenticated' do - it_behaves_like 'unauthorized' - end + before do + second_project.add_maintainer(user) + upstream_project.lfs_objects << lfs_object + end - describe 'and second project not related to fork or a source project' do - let(:second_project) { create(:project) } - let(:authorization) { authorize_user } + context 'when pushing the same LFS object to the second project' do + before do + finalize_headers = headers + .merge('X-Gitlab-Lfs-Tmp' => lfs_tmp_file) + .merge(workhorse_internal_api_request_header) - before do - second_project.add_maintainer(user) - upstream_project.lfs_objects << lfs_object - end + put objects_url(second_project, sample_oid, sample_size), + params: {}, + headers: finalize_headers + end - context 'when pushing the same LFS object to the second project' do - before do - finalize_headers = headers - .merge('X-Gitlab-Lfs-Tmp' => lfs_tmp_file) - .merge(workhorse_internal_api_request_header) + it_behaves_like 'LFS http 200 response' - put objects_url(second_project, sample_oid, sample_size), - params: {}, - headers: finalize_headers + it 'links the LFS object to the project' do + expect(lfs_object.projects.pluck(:id)).to include(second_project.id, upstream_project.id) + end + end end + end - it_behaves_like 'LFS http 200 response' + def put_authorize(verified: true) + authorize_headers = headers + authorize_headers.merge!(workhorse_internal_api_request_header) if verified - it 'links the LFS object to the project' do - expect(lfs_object.projects.pluck(:id)).to include(second_project.id, upstream_project.id) - end + put authorize_url(project, sample_oid, sample_size), params: {}, headers: authorize_headers end - end - end - def put_authorize(verified: true) - authorize_headers = headers - authorize_headers.merge!(workhorse_internal_api_request_header) if verified + def put_finalize(lfs_tmp = lfs_tmp_file, with_tempfile: false, verified: true, remote_object: nil, args: {}) + uploaded_file = nil - put authorize_url(project, sample_oid, sample_size), params: {}, headers: authorize_headers - end + if with_tempfile + upload_path = LfsObjectUploader.workhorse_local_upload_path + file_path = upload_path + '/' + lfs_tmp if lfs_tmp - def put_finalize(lfs_tmp = lfs_tmp_file, with_tempfile: false, verified: true, remote_object: nil, args: {}) - uploaded_file = nil + FileUtils.mkdir_p(upload_path) + FileUtils.touch(file_path) - if with_tempfile - upload_path = LfsObjectUploader.workhorse_local_upload_path - file_path = upload_path + '/' + lfs_tmp if lfs_tmp + uploaded_file = UploadedFile.new(file_path, filename: File.basename(file_path)) + elsif remote_object + uploaded_file = fog_to_uploaded_file(remote_object) + end - FileUtils.mkdir_p(upload_path) - FileUtils.touch(file_path) + finalize_headers = headers + finalize_headers.merge!(workhorse_internal_api_request_header) if verified + + workhorse_finalize( + objects_url(project, sample_oid, sample_size), + method: :put, + file_key: :file, + params: args.merge(file: uploaded_file), + headers: finalize_headers, + send_rewritten_field: include_workhorse_jwt_header + ) + end - uploaded_file = UploadedFile.new(file_path, filename: File.basename(file_path)) - elsif remote_object - uploaded_file = fog_to_uploaded_file(remote_object) + def lfs_tmp_file + "#{sample_oid}012345678" + end end - - finalize_headers = headers - finalize_headers.merge!(workhorse_internal_api_request_header) if verified - - workhorse_finalize( - objects_url(project, sample_oid, sample_size), - method: :put, - file_key: :file, - params: args.merge(file: uploaded_file), - headers: finalize_headers, - send_rewritten_field: include_workhorse_jwt_header - ) - end - - def lfs_tmp_file - "#{sample_oid}012345678" - end - end - - context 'with projects' do - it_behaves_like 'LFS http requests' do - let(:container) { project } - let(:authorize_guest) { project.add_guest(user) } - let(:authorize_download) { project.add_reporter(user) } - let(:authorize_upload) { project.add_developer(user) } end end diff --git a/spec/requests/projects/cycle_analytics_events_spec.rb b/spec/requests/projects/cycle_analytics_events_spec.rb index 3f57b8ba67b..f8fa9459467 100644 --- a/spec/requests/projects/cycle_analytics_events_spec.rb +++ b/spec/requests/projects/cycle_analytics_events_spec.rb @@ -7,108 +7,115 @@ RSpec.describe 'value stream analytics events' do let(:project) { create(:project, :repository, public_builds: false) } let(:issue) { create(:issue, project: project, created_at: 2.days.ago) } - describe 'GET /:namespace/:project/value_stream_analytics/events/issues' do - before do - project.add_developer(user) + shared_examples 'value stream analytics events examples' do + describe 'GET /:namespace/:project/value_stream_analytics/events/issues' do + before do + project.add_developer(user) - 3.times do |count| - travel_to(Time.now + count.days) do - create_cycle + 3.times do |count| + travel_to(Time.now + count.days) do + create_cycle + end end - end - - deploy_master(user, project) - - login_as(user) - end - - it 'lists the issue events' do - get project_cycle_analytics_issue_path(project, format: :json) - first_issue_iid = project.issues.sort_by_attribute(:created_desc).pluck(:iid).first.to_s + deploy_master(user, project) - expect(json_response['events']).not_to be_empty - expect(json_response['events'].first['iid']).to eq(first_issue_iid) - end + login_as(user) + end - it 'lists the plan events' do - get project_cycle_analytics_plan_path(project, format: :json) + it 'lists the issue events' do + get project_cycle_analytics_issue_path(project, format: :json) - first_issue_iid = project.issues.sort_by_attribute(:created_desc).pluck(:iid).first.to_s + first_issue_iid = project.issues.sort_by_attribute(:created_desc).pluck(:iid).first.to_s - expect(json_response['events']).not_to be_empty - expect(json_response['events'].first['iid']).to eq(first_issue_iid) - end + expect(json_response['events']).not_to be_empty + expect(json_response['events'].first['iid']).to eq(first_issue_iid) + end - it 'lists the code events' do - get project_cycle_analytics_code_path(project, format: :json) + it 'lists the plan events' do + get project_cycle_analytics_plan_path(project, format: :json) - expect(json_response['events']).not_to be_empty + first_issue_iid = project.issues.sort_by_attribute(:created_desc).pluck(:iid).first.to_s - first_mr_iid = project.merge_requests.sort_by_attribute(:created_desc).pluck(:iid).first.to_s + expect(json_response['events']).not_to be_empty + expect(json_response['events'].first['iid']).to eq(first_issue_iid) + end - expect(json_response['events'].first['iid']).to eq(first_mr_iid) - end + it 'lists the code events' do + get project_cycle_analytics_code_path(project, format: :json) - it 'lists the test events', :sidekiq_might_not_need_inline do - get project_cycle_analytics_test_path(project, format: :json) + expect(json_response['events']).not_to be_empty - expect(json_response['events']).not_to be_empty - expect(json_response['events'].first['date']).not_to be_empty - end + first_mr_iid = project.merge_requests.sort_by_attribute(:created_desc).pluck(:iid).first.to_s - it 'lists the review events' do - get project_cycle_analytics_review_path(project, format: :json) + expect(json_response['events'].first['iid']).to eq(first_mr_iid) + end - first_mr_iid = project.merge_requests.sort_by_attribute(:created_desc).pluck(:iid).first.to_s + it 'lists the test events', :sidekiq_inline do + get project_cycle_analytics_test_path(project, format: :json) - expect(json_response['events']).not_to be_empty - expect(json_response['events'].first['iid']).to eq(first_mr_iid) - end + expect(json_response['events']).not_to be_empty + expect(json_response['events'].first['date']).not_to be_empty + end - it 'lists the staging events', :sidekiq_might_not_need_inline do - get project_cycle_analytics_staging_path(project, format: :json) + it 'lists the review events' do + get project_cycle_analytics_review_path(project, format: :json) - expect(json_response['events']).not_to be_empty - expect(json_response['events'].first['date']).not_to be_empty - end + first_mr_iid = project.merge_requests.sort_by_attribute(:created_desc).pluck(:iid).first.to_s - context 'specific branch' do - it 'lists the test events', :sidekiq_might_not_need_inline do - branch = project.merge_requests.first.source_branch + expect(json_response['events']).not_to be_empty + expect(json_response['events'].first['iid']).to eq(first_mr_iid) + end - get project_cycle_analytics_test_path(project, format: :json, branch: branch) + it 'lists the staging events', :sidekiq_inline do + get project_cycle_analytics_staging_path(project, format: :json) expect(json_response['events']).not_to be_empty expect(json_response['events'].first['date']).not_to be_empty end - end - context 'with private project and builds' do - before do - project.members.last.update(access_level: Gitlab::Access::GUEST) - end + context 'with private project and builds' do + before do + project.members.last.update(access_level: Gitlab::Access::GUEST) + end - it 'does not list the test events' do - get project_cycle_analytics_test_path(project, format: :json) + it 'does not list the test events' do + get project_cycle_analytics_test_path(project, format: :json) - expect(response).to have_gitlab_http_status(:not_found) - end + expect(response).to have_gitlab_http_status(:not_found) + end - it 'does not list the staging events' do - get project_cycle_analytics_staging_path(project, format: :json) + it 'does not list the staging events' do + get project_cycle_analytics_staging_path(project, format: :json) - expect(response).to have_gitlab_http_status(:not_found) - end + expect(response).to have_gitlab_http_status(:not_found) + end - it 'lists the issue events' do - get project_cycle_analytics_issue_path(project, format: :json) + it 'lists the issue events' do + get project_cycle_analytics_issue_path(project, format: :json) - expect(response).to have_gitlab_http_status(:ok) + expect(response).to have_gitlab_http_status(:ok) + end end end end + describe 'when new_project_level_vsa_backend feature flag is off' do + before do + stub_feature_flags(new_project_level_vsa_backend: false, thing: project) + end + + it_behaves_like 'value stream analytics events examples' + end + + describe 'when new_project_level_vsa_backend feature flag is on' do + before do + stub_feature_flags(new_project_level_vsa_backend: true, thing: project) + end + + it_behaves_like 'value stream analytics events examples' + end + def create_cycle milestone = create(:milestone, project: project) issue.update(milestone: milestone) @@ -123,5 +130,7 @@ RSpec.describe 'value stream analytics events' do merge_merge_requests_closing_issue(user, project, issue) ProcessCommitWorker.new.perform(project.id, user.id, mr.commits.last.to_hash) + + mr.metrics.update!(latest_build_started_at: 1.hour.ago, latest_build_finished_at: Time.now) end end diff --git a/spec/requests/projects/metrics_dashboard_spec.rb b/spec/requests/projects/metrics_dashboard_spec.rb index 0a4100f2bf5..c248463faa3 100644 --- a/spec/requests/projects/metrics_dashboard_spec.rb +++ b/spec/requests/projects/metrics_dashboard_spec.rb @@ -70,7 +70,7 @@ RSpec.describe 'Projects::MetricsDashboardController' do context 'when query param environment does not exist' do it 'responds with 404' do - send_request(environment: 99) + send_request(environment: non_existing_record_id) expect(response).to have_gitlab_http_status(:not_found) end end @@ -105,7 +105,7 @@ RSpec.describe 'Projects::MetricsDashboardController' do context 'when query param environment does not exist' do it 'responds with 404' do - send_request(dashboard_path: dashboard_path, environment: 99) + send_request(dashboard_path: dashboard_path, environment: non_existing_record_id) expect(response).to have_gitlab_http_status(:not_found) end end diff --git a/spec/requests/rack_attack_global_spec.rb b/spec/requests/rack_attack_global_spec.rb index 805ac5a9118..c2e68df2c40 100644 --- a/spec/requests/rack_attack_global_spec.rb +++ b/spec/requests/rack_attack_global_spec.rb @@ -106,7 +106,7 @@ RSpec.describe 'Rack Attack global throttles' do let(:request_jobs_url) { '/api/v4/jobs/request' } let(:runner) { create(:ci_runner) } - it 'does not cont as unauthenticated' do + it 'does not count as unauthenticated' do (1 + requests_per_period).times do post request_jobs_url, params: { token: runner.token } expect(response).to have_gitlab_http_status(:no_content) @@ -114,6 +114,17 @@ RSpec.describe 'Rack Attack global throttles' do end end + context 'when the request is to a health endpoint' do + let(:health_endpoint) { '/-/metrics' } + + it 'does not throttle the requests' do + (1 + requests_per_period).times do + get health_endpoint + expect(response).to have_gitlab_http_status(:ok) + end + end + end + it 'logs RackAttack info into structured logs' do requests_per_period.times do get url_that_does_not_require_authentication @@ -133,6 +144,14 @@ RSpec.describe 'Rack Attack global throttles' do get url_that_does_not_require_authentication end + + it_behaves_like 'tracking when dry-run mode is set' do + let(:throttle_name) { 'throttle_unauthenticated' } + + def do_request + get url_that_does_not_require_authentication + end + end end context 'when the throttle is disabled' do @@ -231,6 +250,10 @@ RSpec.describe 'Rack Attack global throttles' do let(:post_params) { { user: { login: 'username', password: 'password' } } } + def do_request + post protected_path_that_does_not_require_authentication, params: post_params + end + before do settings_to_set[:throttle_protected_paths_requests_per_period] = requests_per_period # 1 settings_to_set[:throttle_protected_paths_period_in_seconds] = period_in_seconds # 10_000 @@ -244,7 +267,7 @@ RSpec.describe 'Rack Attack global throttles' do it 'allows requests over the rate limit' do (1 + requests_per_period).times do - post protected_path_that_does_not_require_authentication, params: post_params + do_request expect(response).to have_gitlab_http_status(:ok) end end @@ -258,12 +281,16 @@ RSpec.describe 'Rack Attack global throttles' do it 'rejects requests over the rate limit' do requests_per_period.times do - post protected_path_that_does_not_require_authentication, params: post_params + do_request expect(response).to have_gitlab_http_status(:ok) end expect_rejection { post protected_path_that_does_not_require_authentication, params: post_params } end + + it_behaves_like 'tracking when dry-run mode is set' do + let(:throttle_name) { 'throttle_unauthenticated_protected_paths' } + end end end diff --git a/spec/requests/self_monitoring_project_spec.rb b/spec/requests/self_monitoring_project_spec.rb index 5844a27da17..f7227f71b05 100644 --- a/spec/requests/self_monitoring_project_spec.rb +++ b/spec/requests/self_monitoring_project_spec.rb @@ -12,7 +12,7 @@ RSpec.describe 'Self-Monitoring project requests' do it_behaves_like 'not accessible to non-admin users' - context 'with admin user' do + context 'with admin user', :enable_admin_mode do before do login_as(admin) end @@ -36,7 +36,7 @@ RSpec.describe 'Self-Monitoring project requests' do it_behaves_like 'not accessible to non-admin users' - context 'with admin user' do + context 'with admin user', :enable_admin_mode do before do login_as(admin) end @@ -116,7 +116,7 @@ RSpec.describe 'Self-Monitoring project requests' do it_behaves_like 'not accessible to non-admin users' - context 'with admin user' do + context 'with admin user', :enable_admin_mode do before do login_as(admin) end @@ -140,7 +140,7 @@ RSpec.describe 'Self-Monitoring project requests' do it_behaves_like 'not accessible to non-admin users' - context 'with admin user' do + context 'with admin user', :enable_admin_mode do before do login_as(admin) end diff --git a/spec/requests/whats_new_controller_spec.rb b/spec/requests/whats_new_controller_spec.rb index c04a6b00a93..8005d38dbb0 100644 --- a/spec/requests/whats_new_controller_spec.rb +++ b/spec/requests/whats_new_controller_spec.rb @@ -4,29 +4,31 @@ require 'spec_helper' RSpec.describe WhatsNewController do describe 'whats_new_path' do - context 'with whats_new_drawer feature enabled' do - let(:fixture_dir_glob) { Dir.glob(File.join('spec', 'fixtures', 'whats_new', '*.yml')) } + let(:item) { double(:item) } + let(:highlights) { double(:highlight, items: [item], map: [item].map, next_page: 2) } + context 'with whats_new_drawer feature enabled' do before do stub_feature_flags(whats_new_drawer: true) - allow(Dir).to receive(:glob).with(Rails.root.join('data', 'whats_new', '*.yml')).and_return(fixture_dir_glob) end context 'with no page param' do it 'responds with paginated data and headers' do + allow(ReleaseHighlight).to receive(:paginated).with(page: 1).and_return(highlights) + allow(Gitlab::WhatsNew::ItemPresenter).to receive(:present).with(item).and_return(item) + get whats_new_path, xhr: true - expect(response.body).to eq([{ title: "bright and sunshinin' day", release: "01.05" }].to_json) + expect(response.body).to eq(highlights.items.to_json) expect(response.headers['X-Next-Page']).to eq(2) end end context 'with page param' do - it 'responds with paginated data and headers' do - get whats_new_path(page: 2), xhr: true + it 'passes the page parameter' do + expect(ReleaseHighlight).to receive(:paginated).with(page: 2).and_call_original - expect(response.body).to eq([{ title: 'bright' }].to_json) - expect(response.headers['X-Next-Page']).to eq(3) + get whats_new_path(page: 2), xhr: true end it 'returns a 404 if page param is negative' do @@ -34,13 +36,17 @@ RSpec.describe WhatsNewController do expect(response).to have_gitlab_http_status(:not_found) end + end + + context 'with version param' do + it 'returns items without pagination headers' do + allow(ReleaseHighlight).to receive(:for_version).with(version: '42').and_return(highlights) + allow(Gitlab::WhatsNew::ItemPresenter).to receive(:present).with(item).and_return(item) + + get whats_new_path(version: 42), xhr: true - context 'when there are no more paginated results' do - it 'responds with nil X-Next-Page header' do - get whats_new_path(page: 3), xhr: true - expect(response.body).to eq([{ title: "It's gonna be a bright" }].to_json) - expect(response.headers['X-Next-Page']).to be nil - end + expect(response.body).to eq(highlights.items.to_json) + expect(response.headers['X-Next-Page']).to be_nil end end end |