1 files changed, 89 insertions, 4 deletions
diff --git a/spec/support/shared_examples/services/container_registry_auth_service_shared_examples.rb b/spec/support/shared_examples/services/container_registry_auth_service_shared_examples.rb
index 87bf134eeb8..c808b9a5318 100644
--- a/spec/support/shared_examples/services/container_registry_auth_service_shared_examples.rb
+++ b/spec/support/shared_examples/services/container_registry_auth_service_shared_examples.rb
@@ -71,7 +71,6 @@ end
 RSpec.shared_examples 'an accessible' do
   before do
     stub_feature_flags(container_registry_migration_phase1: false)
-    stub_feature_flags(container_registry_cdn_redirect: false)
   end
 
   let(:access) do
@@ -164,10 +163,9 @@ RSpec.shared_examples 'a container registry auth service' do
 
   before do
     stub_feature_flags(container_registry_migration_phase1: false)
-    stub_feature_flags(container_registry_cdn_redirect: false)
   end
 
-  describe '#full_access_token' do
+  describe '.full_access_token' do
     let_it_be(:project) { create(:project) }
 
     let(:token) { described_class.full_access_token(project.full_path) }
@@ -181,7 +179,26 @@ RSpec.shared_examples 'a container registry auth service' do
     it_behaves_like 'not a container repository factory'
   end
 
-  describe '#pull_access_token' do
+  describe '.import_access_token' do
+    let(:access) do
+      [{ 'type' => 'registry',
+        'name' => 'import',
+        'actions' => ['*'] }]
+    end
+
+    let(:token) { described_class.import_access_token }
+
+    subject { { token: token } }
+
+    it_behaves_like 'a valid token'
+    it_behaves_like 'not a container repository factory'
+
+    it 'has the correct scope' do
+      expect(payload).to include('access' => access)
+    end
+  end
+
+  describe '.pull_access_token' do
     let_it_be(:project) { create(:project) }
 
     let(:token) { described_class.pull_access_token(project.full_path) }
@@ -1126,4 +1143,72 @@ RSpec.shared_examples 'a container registry auth service' do
       end
     end
   end
+
+  context 'when importing' do
+    let_it_be(:container_repository) { create(:container_repository, :root, :importing) }
+    let_it_be(:current_project) { container_repository.project }
+    let_it_be(:current_user) { create(:user) }
+
+    before do
+      current_project.add_developer(current_user)
+    end
+
+    shared_examples 'containing the import error' do
+      it 'includes a helpful error message' do
+        expect(subject[:errors].first).to include(message: /Your repository is currently being migrated/)
+      end
+    end
+
+    context 'push request' do
+      let(:current_params) do
+        { scopes: ["repository:#{container_repository.path}:push"] }
+      end
+
+      it_behaves_like 'a forbidden' do
+        it_behaves_like 'containing the import error'
+      end
+    end
+
+    context 'delete request' do
+      let(:current_params) do
+        { scopes: ["repository:#{container_repository.path}:delete"] }
+      end
+
+      it_behaves_like 'a forbidden' do
+        it_behaves_like 'containing the import error'
+      end
+    end
+
+    context '* request' do
+      let(:current_params) do
+        { scopes: ["repository:#{container_repository.path}:*"] }
+      end
+
+      it_behaves_like 'a forbidden' do
+        it_behaves_like 'containing the import error'
+      end
+    end
+
+    context 'pull request' do
+      let(:current_params) do
+        { scopes: ["repository:#{container_repository.path}:pull"] }
+      end
+
+      let(:project) { current_project }
+
+      it_behaves_like 'a pullable'
+    end
+
+    context 'mixed request' do
+      let(:current_params) do
+        { scopes: ["repository:#{container_repository.path}:pull,push"] }
+      end
+
+      let(:project) { current_project }
+
+      it_behaves_like 'a forbidden' do
+        it_behaves_like 'containing the import error'
+      end
+    end
+  end
 end