gitlab-org--gitlab-foss/spec/lib/gitlab/deploy_key_access_spec.rb

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

68 lines
2.4 KiB
Ruby
Raw Normal View History

# frozen_string_literal: true
require 'spec_helper'
RSpec.describe Gitlab::DeployKeyAccess do
let_it_be(:user) { create(:user) }
let_it_be(:deploy_key) { create(:deploy_key, user: user) }
let(:project) { create(:project, :repository) }
let(:protected_branch) { create(:protected_branch, :no_one_can_push, project: project) }
subject(:access) { described_class.new(deploy_key, container: project) }
before do
project.add_guest(user)
create(:deploy_keys_project, :write_access, project: project, deploy_key: deploy_key)
end
describe '#can_create_tag?' do
context 'push tag that matches a protected tag pattern via a deploy key' do
it 'still pushes that tag' do
create(:protected_tag, project: project, name: 'v*')
expect(access.can_create_tag?('v0.1.2')).to be_truthy
end
end
end
describe '#can_push_for_ref?' do
context 'push to a protected branch of this project via a deploy key' do
before do
create(:protected_branch_push_access_level, protected_branch: protected_branch, deploy_key: deploy_key)
end
context 'when the project has active deploy key owned by this user' do
it 'returns true' do
expect(access.can_push_for_ref?(protected_branch.name)).to be_truthy
end
end
context 'when the project has active deploy keys, but not by this user' do
let(:deploy_key) { create(:deploy_key, user: create(:user)) }
it 'returns false' do
expect(access.can_push_for_ref?(protected_branch.name)).to be_falsey
end
end
context 'when there is another branch no one can push to' do
let(:another_branch) { create(:protected_branch, :no_one_can_push, name: 'another_branch', project: project) }
it 'returns false when trying to push to that other branch' do
expect(access.can_push_for_ref?(another_branch.name)).to be_falsey
end
context 'and the deploy key added for the first protected branch is also added for this other branch' do
it 'returns true for both protected branches' do
create(:protected_branch_push_access_level, protected_branch: another_branch, deploy_key: deploy_key)
expect(access.can_push_for_ref?(protected_branch.name)).to be_truthy
expect(access.can_push_for_ref?(another_branch.name)).to be_truthy
end
end
end
end
end
end