3 files changed, 115 insertions, 6 deletions

diff --git a/spec/services/terraform/remote_state_handler_spec.rb b/spec/services/terraform/remote_state_handler_spec.rb
index ca392849d49..19c1d4109e9 100644
--- a/spec/services/terraform/remote_state_handler_spec.rb
+++ b/spec/services/terraform/remote_state_handler_spec.rb
@@ -33,6 +33,14 @@ RSpec.describe Terraform::RemoteStateHandler do
         it 'returns the state' do
           expect(subject.find_with_lock).to eq(state)
         end
+
+        context 'with a state scheduled for deletion' do
+          let!(:state) { create(:terraform_state, :deletion_in_progress, project: project, name: 'state') }
+
+          it 'raises an exception' do
+            expect { subject.find_with_lock }.to raise_error(described_class::StateDeletedError)
+          end
+        end
       end
     end
   end
@@ -84,6 +92,13 @@ RSpec.describe Terraform::RemoteStateHandler do
           .to raise_error(described_class::StateLockedError)
       end
 
+      it 'raises an exception if the state is scheduled for deletion' do
+        create(:terraform_state, :deletion_in_progress, project: project, name: 'new-state')
+
+        expect { handler.handle_with_lock }
+          .to raise_error(described_class::StateDeletedError)
+      end
+
       context 'user does not have permission to modify state' do
         let(:user) { developer }
 
@@ -127,24 +142,28 @@ RSpec.describe Terraform::RemoteStateHandler do
 
         expect { handler.lock! }.to raise_error(described_class::StateLockedError)
       end
+
+      it 'raises an exception when the state exists and is scheduled for deletion' do
+        create(:terraform_state, :deletion_in_progress, project: project, name: 'new-state')
+
+        expect { handler.lock! }.to raise_error(described_class::StateDeletedError)
+      end
     end
 
     describe '#unlock!' do
-      let(:lock_id) { 'abc-abc' }
+      let_it_be(:state) { create(:terraform_state, :locked, project: project, name: 'new-state', lock_xid: 'abc-abc') }
+
+      let(:lock_id) { state.lock_xid }
 
       subject(:handler) do
         described_class.new(
           project,
           user,
-          name: 'new-state',
+          name: state.name,
           lock_id: lock_id
         )
       end
 
-      before do
-        create(:terraform_state, :locked, project: project, name: 'new-state', lock_xid: 'abc-abc')
-      end
-
       it 'unlocks the state' do
         state = handler.unlock!
 
@@ -169,6 +188,15 @@ RSpec.describe Terraform::RemoteStateHandler do
             .to raise_error(described_class::StateLockedError)
         end
       end
+
+      context 'with a state scheduled for deletion' do
+        it 'raises an exception' do
+          state.update!(deleted_at: Time.current)
+
+          expect { handler.unlock! }
+            .to raise_error(described_class::StateDeletedError)
+        end
+      end
     end
   end
 end
diff --git a/spec/services/terraform/states/destroy_service_spec.rb b/spec/services/terraform/states/destroy_service_spec.rb
new file mode 100644
index 00000000000..5acf32cd73c
--- /dev/null
+++ b/spec/services/terraform/states/destroy_service_spec.rb
@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Terraform::States::DestroyService do
+  let_it_be(:state) { create(:terraform_state, :with_version, :deletion_in_progress) }
+
+  let(:file) { instance_double(Terraform::StateUploader, relative_path: 'path') }
+
+  before do
+    allow_next_found_instance_of(Terraform::StateVersion) do |version|
+      allow(version).to receive(:file).and_return(file)
+    end
+  end
+
+  describe '#execute' do
+    subject { described_class.new(state).execute }
+
+    it 'removes version files from object storage, followed by the state record' do
+      expect(file).to receive(:remove!).once
+      expect(state).to receive(:destroy!)
+
+      subject
+    end
+
+    context 'state is not marked for deletion' do
+      let(:state) { create(:terraform_state) }
+
+      it 'does not delete the state' do
+        expect(state).not_to receive(:destroy!)
+
+        subject
+      end
+    end
+  end
+end
diff --git a/spec/services/terraform/states/trigger_destroy_service_spec.rb b/spec/services/terraform/states/trigger_destroy_service_spec.rb
new file mode 100644
index 00000000000..2e96331779c
--- /dev/null
+++ b/spec/services/terraform/states/trigger_destroy_service_spec.rb
@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Terraform::States::TriggerDestroyService do
+  let_it_be(:project) { create(:project) }
+  let_it_be(:user) { create(:user, maintainer_projects: [project]) }
+
+  describe '#execute', :aggregate_failures do
+    let_it_be(:state) { create(:terraform_state, project: project) }
+
+    subject { described_class.new(state, current_user: user).execute }
+
+    it 'marks the state as deleted and schedules a cleanup worker' do
+      expect(Terraform::States::DestroyWorker).to receive(:perform_async).with(state.id).once
+
+      expect(subject).to be_success
+      expect(state.deleted_at).to be_like_time(Time.current)
+    end
+
+    shared_examples 'unable to delete state' do
+      it 'does not modify the state' do
+        expect(Terraform::States::DestroyWorker).not_to receive(:perform_async)
+
+        expect { subject }.not_to change(state, :deleted_at)
+        expect(subject).to be_error
+        expect(subject.message).to eq(message)
+      end
+    end
+
+    context 'user does not have permission' do
+      let(:user) { create(:user, developer_projects: [project]) }
+      let(:message) { 'You have insufficient permissions to delete this state' }
+
+      include_examples 'unable to delete state'
+    end
+
+    context 'state is locked' do
+      let(:state) { create(:terraform_state, :locked, project: project) }
+      let(:message) { 'Cannot remove a locked state' }
+
+      include_examples 'unable to delete state'
+    end
+  end
+end