2017-02-09 07:39:39 -05:00
|
|
|
require 'spec_helper'
|
|
|
|
|
2017-04-21 16:32:02 -04:00
|
|
|
describe API::V3::Members do
|
2017-04-04 02:48:49 -04:00
|
|
|
let(:master) { create(:user, username: 'master_user') }
|
2017-02-09 07:39:39 -05:00
|
|
|
let(:developer) { create(:user) }
|
|
|
|
let(:access_requester) { create(:user) }
|
|
|
|
let(:stranger) { create(:user) }
|
|
|
|
|
|
|
|
let(:project) do
|
2017-08-02 15:55:11 -04:00
|
|
|
create(:project, :public, :access_requestable, creator_id: master.id, namespace: master.namespace) do |project|
|
2017-12-22 03:18:28 -05:00
|
|
|
project.add_developer(developer)
|
|
|
|
project.add_master(master)
|
2017-02-09 07:39:39 -05:00
|
|
|
project.request_access(access_requester)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
let!(:group) do
|
|
|
|
create(:group, :public, :access_requestable) do |group|
|
|
|
|
group.add_developer(developer)
|
|
|
|
group.add_owner(master)
|
|
|
|
group.request_access(access_requester)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
shared_examples 'GET /:sources/:id/members' do |source_type|
|
|
|
|
context "with :sources == #{source_type.pluralize}" do
|
|
|
|
it_behaves_like 'a 404 response when source is private' do
|
|
|
|
let(:route) { get v3_api("/#{source_type.pluralize}/#{source.id}/members", stranger) }
|
|
|
|
end
|
|
|
|
|
|
|
|
%i[master developer access_requester stranger].each do |type|
|
|
|
|
context "when authenticated as a #{type}" do
|
|
|
|
it 'returns 200' do
|
|
|
|
user = public_send(type)
|
|
|
|
get v3_api("/#{source_type.pluralize}/#{source.id}/members", user)
|
|
|
|
|
2017-10-19 14:28:19 -04:00
|
|
|
expect(response).to have_gitlab_http_status(200)
|
2017-02-09 07:39:39 -05:00
|
|
|
expect(json_response.size).to eq(2)
|
|
|
|
expect(json_response.map { |u| u['id'] }).to match_array [master.id, developer.id]
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'does not return invitees' do
|
|
|
|
create(:"#{source_type}_member", invite_token: '123', invite_email: 'test@abc.com', source: source, user: nil)
|
|
|
|
|
|
|
|
get v3_api("/#{source_type.pluralize}/#{source.id}/members", developer)
|
|
|
|
|
2017-10-19 14:28:19 -04:00
|
|
|
expect(response).to have_gitlab_http_status(200)
|
2017-02-09 07:39:39 -05:00
|
|
|
expect(json_response.size).to eq(2)
|
|
|
|
expect(json_response.map { |u| u['id'] }).to match_array [master.id, developer.id]
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'finds members with query string' do
|
|
|
|
get v3_api("/#{source_type.pluralize}/#{source.id}/members", developer), query: master.username
|
|
|
|
|
2017-10-19 14:28:19 -04:00
|
|
|
expect(response).to have_gitlab_http_status(200)
|
2017-02-09 07:39:39 -05:00
|
|
|
expect(json_response.count).to eq(1)
|
|
|
|
expect(json_response.first['username']).to eq(master.username)
|
|
|
|
end
|
2018-01-04 11:35:44 -05:00
|
|
|
|
|
|
|
it 'finds all members with no query specified' do
|
|
|
|
get v3_api("/#{source_type.pluralize}/#{source.id}/members", developer), query: ''
|
|
|
|
|
|
|
|
expect(response).to have_gitlab_http_status(200)
|
|
|
|
expect(response).to include_pagination_headers
|
|
|
|
expect(json_response).to be_an Array
|
|
|
|
expect(json_response.count).to eq(2)
|
|
|
|
expect(json_response.map { |u| u['id'] }).to match_array [master.id, developer.id]
|
|
|
|
end
|
2017-02-09 07:39:39 -05:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
shared_examples 'GET /:sources/:id/members/:user_id' do |source_type|
|
|
|
|
context "with :sources == #{source_type.pluralize}" do
|
|
|
|
it_behaves_like 'a 404 response when source is private' do
|
|
|
|
let(:route) { get v3_api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", stranger) }
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when authenticated as a non-member' do
|
|
|
|
%i[access_requester stranger].each do |type|
|
|
|
|
context "as a #{type}" do
|
|
|
|
it 'returns 200' do
|
|
|
|
user = public_send(type)
|
|
|
|
get v3_api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", user)
|
|
|
|
|
2017-10-19 14:28:19 -04:00
|
|
|
expect(response).to have_gitlab_http_status(200)
|
2017-02-09 07:39:39 -05:00
|
|
|
# User attributes
|
|
|
|
expect(json_response['id']).to eq(developer.id)
|
|
|
|
expect(json_response['name']).to eq(developer.name)
|
|
|
|
expect(json_response['username']).to eq(developer.username)
|
|
|
|
expect(json_response['state']).to eq(developer.state)
|
|
|
|
expect(json_response['avatar_url']).to eq(developer.avatar_url)
|
|
|
|
expect(json_response['web_url']).to eq(Gitlab::Routing.url_helpers.user_url(developer))
|
|
|
|
|
|
|
|
# Member attributes
|
|
|
|
expect(json_response['access_level']).to eq(Member::DEVELOPER)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
shared_examples 'POST /:sources/:id/members' do |source_type|
|
|
|
|
context "with :sources == #{source_type.pluralize}" do
|
|
|
|
it_behaves_like 'a 404 response when source is private' do
|
|
|
|
let(:route) do
|
|
|
|
post v3_api("/#{source_type.pluralize}/#{source.id}/members", stranger),
|
|
|
|
user_id: access_requester.id, access_level: Member::MASTER
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when authenticated as a non-member or member with insufficient rights' do
|
|
|
|
%i[access_requester stranger developer].each do |type|
|
|
|
|
context "as a #{type}" do
|
|
|
|
it 'returns 403' do
|
|
|
|
user = public_send(type)
|
|
|
|
post v3_api("/#{source_type.pluralize}/#{source.id}/members", user),
|
|
|
|
user_id: access_requester.id, access_level: Member::MASTER
|
|
|
|
|
2017-10-19 14:28:19 -04:00
|
|
|
expect(response).to have_gitlab_http_status(403)
|
2017-02-09 07:39:39 -05:00
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when authenticated as a master/owner' do
|
|
|
|
context 'and new member is already a requester' do
|
|
|
|
it 'transforms the requester into a proper member' do
|
|
|
|
expect do
|
|
|
|
post v3_api("/#{source_type.pluralize}/#{source.id}/members", master),
|
|
|
|
user_id: access_requester.id, access_level: Member::MASTER
|
|
|
|
|
2017-10-19 14:28:19 -04:00
|
|
|
expect(response).to have_gitlab_http_status(201)
|
2017-02-09 07:39:39 -05:00
|
|
|
end.to change { source.members.count }.by(1)
|
|
|
|
expect(source.requesters.count).to eq(0)
|
|
|
|
expect(json_response['id']).to eq(access_requester.id)
|
|
|
|
expect(json_response['access_level']).to eq(Member::MASTER)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'creates a new member' do
|
|
|
|
expect do
|
|
|
|
post v3_api("/#{source_type.pluralize}/#{source.id}/members", master),
|
|
|
|
user_id: stranger.id, access_level: Member::DEVELOPER, expires_at: '2016-08-05'
|
|
|
|
|
2017-10-19 14:28:19 -04:00
|
|
|
expect(response).to have_gitlab_http_status(201)
|
2017-02-09 07:39:39 -05:00
|
|
|
end.to change { source.members.count }.by(1)
|
|
|
|
expect(json_response['id']).to eq(stranger.id)
|
|
|
|
expect(json_response['access_level']).to eq(Member::DEVELOPER)
|
|
|
|
expect(json_response['expires_at']).to eq('2016-08-05')
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
it "returns #{source_type == 'project' ? 201 : 409} if member already exists" do
|
|
|
|
post v3_api("/#{source_type.pluralize}/#{source.id}/members", master),
|
|
|
|
user_id: master.id, access_level: Member::MASTER
|
|
|
|
|
2017-10-19 14:28:19 -04:00
|
|
|
expect(response).to have_gitlab_http_status(source_type == 'project' ? 201 : 409)
|
2017-02-09 07:39:39 -05:00
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns 400 when user_id is not given' do
|
|
|
|
post v3_api("/#{source_type.pluralize}/#{source.id}/members", master),
|
|
|
|
access_level: Member::MASTER
|
|
|
|
|
2017-10-19 14:28:19 -04:00
|
|
|
expect(response).to have_gitlab_http_status(400)
|
2017-02-09 07:39:39 -05:00
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns 400 when access_level is not given' do
|
|
|
|
post v3_api("/#{source_type.pluralize}/#{source.id}/members", master),
|
|
|
|
user_id: stranger.id
|
|
|
|
|
2017-10-19 14:28:19 -04:00
|
|
|
expect(response).to have_gitlab_http_status(400)
|
2017-02-09 07:39:39 -05:00
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns 422 when access_level is not valid' do
|
|
|
|
post v3_api("/#{source_type.pluralize}/#{source.id}/members", master),
|
|
|
|
user_id: stranger.id, access_level: 1234
|
|
|
|
|
2017-10-19 14:28:19 -04:00
|
|
|
expect(response).to have_gitlab_http_status(422)
|
2017-02-09 07:39:39 -05:00
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
shared_examples 'PUT /:sources/:id/members/:user_id' do |source_type|
|
|
|
|
context "with :sources == #{source_type.pluralize}" do
|
|
|
|
it_behaves_like 'a 404 response when source is private' do
|
|
|
|
let(:route) do
|
|
|
|
put v3_api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", stranger),
|
|
|
|
access_level: Member::MASTER
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when authenticated as a non-member or member with insufficient rights' do
|
|
|
|
%i[access_requester stranger developer].each do |type|
|
|
|
|
context "as a #{type}" do
|
|
|
|
it 'returns 403' do
|
|
|
|
user = public_send(type)
|
|
|
|
put v3_api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", user),
|
|
|
|
access_level: Member::MASTER
|
|
|
|
|
2017-10-19 14:28:19 -04:00
|
|
|
expect(response).to have_gitlab_http_status(403)
|
2017-02-09 07:39:39 -05:00
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when authenticated as a master/owner' do
|
|
|
|
it 'updates the member' do
|
|
|
|
put v3_api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", master),
|
|
|
|
access_level: Member::MASTER, expires_at: '2016-08-05'
|
|
|
|
|
2017-10-19 14:28:19 -04:00
|
|
|
expect(response).to have_gitlab_http_status(200)
|
2017-02-09 07:39:39 -05:00
|
|
|
expect(json_response['id']).to eq(developer.id)
|
|
|
|
expect(json_response['access_level']).to eq(Member::MASTER)
|
|
|
|
expect(json_response['expires_at']).to eq('2016-08-05')
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns 409 if member does not exist' do
|
|
|
|
put v3_api("/#{source_type.pluralize}/#{source.id}/members/123", master),
|
|
|
|
access_level: Member::MASTER
|
|
|
|
|
2017-10-19 14:28:19 -04:00
|
|
|
expect(response).to have_gitlab_http_status(404)
|
2017-02-09 07:39:39 -05:00
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns 400 when access_level is not given' do
|
|
|
|
put v3_api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", master)
|
|
|
|
|
2017-10-19 14:28:19 -04:00
|
|
|
expect(response).to have_gitlab_http_status(400)
|
2017-02-09 07:39:39 -05:00
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns 422 when access level is not valid' do
|
|
|
|
put v3_api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", master),
|
|
|
|
access_level: 1234
|
|
|
|
|
2017-10-19 14:28:19 -04:00
|
|
|
expect(response).to have_gitlab_http_status(422)
|
2017-02-09 07:39:39 -05:00
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
shared_examples 'DELETE /:sources/:id/members/:user_id' do |source_type|
|
|
|
|
context "with :sources == #{source_type.pluralize}" do
|
|
|
|
it_behaves_like 'a 404 response when source is private' do
|
|
|
|
let(:route) { delete v3_api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", stranger) }
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when authenticated as a non-member or member with insufficient rights' do
|
|
|
|
%i[access_requester stranger].each do |type|
|
|
|
|
context "as a #{type}" do
|
|
|
|
it 'returns 403' do
|
|
|
|
user = public_send(type)
|
|
|
|
delete v3_api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", user)
|
|
|
|
|
2017-10-19 14:28:19 -04:00
|
|
|
expect(response).to have_gitlab_http_status(403)
|
2017-02-09 07:39:39 -05:00
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when authenticated as a member and deleting themself' do
|
|
|
|
it 'deletes the member' do
|
|
|
|
expect do
|
|
|
|
delete v3_api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", developer)
|
|
|
|
|
2017-10-19 14:28:19 -04:00
|
|
|
expect(response).to have_gitlab_http_status(200)
|
2017-02-09 07:39:39 -05:00
|
|
|
end.to change { source.members.count }.by(-1)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when authenticated as a master/owner' do
|
|
|
|
context 'and member is a requester' do
|
|
|
|
it "returns #{source_type == 'project' ? 200 : 404}" do
|
|
|
|
expect do
|
|
|
|
delete v3_api("/#{source_type.pluralize}/#{source.id}/members/#{access_requester.id}", master)
|
|
|
|
|
2017-10-19 14:28:19 -04:00
|
|
|
expect(response).to have_gitlab_http_status(source_type == 'project' ? 200 : 404)
|
2017-02-09 07:39:39 -05:00
|
|
|
end.not_to change { source.requesters.count }
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'deletes the member' do
|
|
|
|
expect do
|
|
|
|
delete v3_api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", master)
|
|
|
|
|
2017-10-19 14:28:19 -04:00
|
|
|
expect(response).to have_gitlab_http_status(200)
|
2017-02-09 07:39:39 -05:00
|
|
|
end.to change { source.members.count }.by(-1)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
it "returns #{source_type == 'project' ? 200 : 404} if member does not exist" do
|
|
|
|
delete v3_api("/#{source_type.pluralize}/#{source.id}/members/123", master)
|
|
|
|
|
2017-10-19 14:28:19 -04:00
|
|
|
expect(response).to have_gitlab_http_status(source_type == 'project' ? 200 : 404)
|
2017-02-09 07:39:39 -05:00
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'GET /:sources/:id/members', 'project' do
|
|
|
|
let(:source) { project }
|
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'GET /:sources/:id/members', 'group' do
|
|
|
|
let(:source) { group }
|
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'GET /:sources/:id/members/:user_id', 'project' do
|
|
|
|
let(:source) { project }
|
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'GET /:sources/:id/members/:user_id', 'group' do
|
|
|
|
let(:source) { group }
|
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'POST /:sources/:id/members', 'project' do
|
|
|
|
let(:source) { project }
|
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'POST /:sources/:id/members', 'group' do
|
|
|
|
let(:source) { group }
|
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'PUT /:sources/:id/members/:user_id', 'project' do
|
|
|
|
let(:source) { project }
|
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'PUT /:sources/:id/members/:user_id', 'group' do
|
|
|
|
let(:source) { group }
|
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'DELETE /:sources/:id/members/:user_id', 'project' do
|
|
|
|
let(:source) { project }
|
|
|
|
end
|
|
|
|
|
|
|
|
it_behaves_like 'DELETE /:sources/:id/members/:user_id', 'group' do
|
|
|
|
let(:source) { group }
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'Adding owner to project' do
|
|
|
|
it 'returns 403' do
|
|
|
|
expect do
|
|
|
|
post v3_api("/projects/#{project.id}/members", master),
|
|
|
|
user_id: stranger.id, access_level: Member::OWNER
|
|
|
|
|
2017-10-19 14:28:19 -04:00
|
|
|
expect(response).to have_gitlab_http_status(422)
|
2017-02-09 07:39:39 -05:00
|
|
|
end.to change { project.members.count }.by(0)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|