diff options
Diffstat (limited to 'spec/support_specs/ability_check_spec.rb')
-rw-r--r-- | spec/support_specs/ability_check_spec.rb | 148 |
1 files changed, 148 insertions, 0 deletions
diff --git a/spec/support_specs/ability_check_spec.rb b/spec/support_specs/ability_check_spec.rb new file mode 100644 index 00000000000..ce841112d86 --- /dev/null +++ b/spec/support_specs/ability_check_spec.rb @@ -0,0 +1,148 @@ +# frozen_string_literal: true + +require 'fast_spec_helper' + +require 'declarative_policy' +require 'request_store' +require 'tempfile' + +require 'gitlab/safe_request_store' + +require_relative '../../app/models/ability' +require_relative '../support/ability_check' + +RSpec.describe Support::AbilityCheck, feature_category: :system_access do # rubocop:disable RSpec/FilePath + let(:user) { :user } + let(:child) { Testing::Child.new } + let(:parent) { Testing::Parent.new(child) } + + before do + # Usually done in spec/spec_helper. + described_class.inject(Ability.singleton_class) + + stub_const('Testing::BasePolicy', Class.new(DeclarativePolicy::Base)) + + stub_const('Testing::Parent', Struct.new(:parent_of)) + stub_const('Testing::ParentPolicy', Class.new(Testing::BasePolicy) do + delegate { @subject.parent_of } + condition(:is_adult) { @subject.is_a?(Testing::Parent) } + rule { is_adult }.enable :drink_coffee + end) + + stub_const('Testing::Child', Class.new) + stub_const('Testing::ChildPolicy', Class.new(Testing::BasePolicy) do + condition(:always) { true } + rule { always }.enable :eat_ice + end) + end + + def expect_no_deprecation_warning(&block) + expect(&block).not_to output.to_stderr + end + + def expect_deprecation_warning(policy_class, ability, &block) + expect(&block) + .to output(/DEPRECATION WARNING: Ability :#{ability} in #{policy_class} not found./) + .to_stderr + end + + def expect_allowed(user, ability, subject) + expect(Ability.allowed?(user, ability, subject)) + end + + shared_examples 'ability found' do + it 'policy ability is found' do + expect_no_deprecation_warning do + expect_allowed(user, ability, subject).to eq(true) + end + end + end + + shared_examples 'ability not found' do |warning:| + description = 'policy ability is not found' + description += warning ? ' and emits a warning' : ' without warning' + + it description do + check = -> { expect_allowed(user, ability, subject).to eq(false) } + + if warning + expect_deprecation_warning(warning, ability, &check) + else + expect_no_deprecation_warning(&check) + end + end + end + + shared_context 'with custom TODO YAML' do + let(:yaml_file) { Tempfile.new } + + before do + yaml_file.write(yaml_content) + yaml_file.rewind + + stub_const("#{described_class}::Checker::TODO_YAML", yaml_file.path) + described_class::Checker.clear_memoization(:todo_list) + end + + after do + described_class::Checker.clear_memoization(:todo_list) + yaml_file.unlink + end + end + + describe 'checking ability' do + context 'with valid direct ability' do + let(:subject) { parent } + let(:ability) { :drink_coffee } + + include_examples 'ability found' + + context 'with empty TODO yaml' do + let(:yaml_content) { nil } + + include_context 'with custom TODO YAML' + include_examples 'ability found' + end + + context 'with non-Hash TODO yaml' do + let(:yaml_content) { '[]' } + + include_context 'with custom TODO YAML' + include_examples 'ability found' + end + end + + context 'with unreachable ability' do + let(:subject) { child } + let(:ability) { :drink_coffee } + + include_examples 'ability not found', warning: 'Testing::ChildPolicy' + + context 'when ignored in TODO YAML' do + let(:yaml_content) do + <<~YAML + Testing::ChildPolicy: + - #{ability} + YAML + end + + include_context 'with custom TODO YAML' + include_examples 'ability not found', warning: false + end + end + + context 'with unknown ability' do + let(:subject) { parent } + let(:ability) { :unknown } + + include_examples 'ability not found', warning: 'Testing::ParentPolicy' + end + + context 'with delegated ability' do + let(:subject) { parent } + let(:ability) { :eat_ice } + + include_examples 'ability found' + end + end +end |