2016-08-12 22:27:42 +00:00
require 'spec_helper'
describe Gitlab :: Checks :: ChangeAccess , lib : true do
describe '#exec' do
let ( :user ) { create ( :user ) }
2017-01-24 23:42:12 +00:00
let ( :project ) { create ( :project , :repository ) }
2016-08-12 22:27:42 +00:00
let ( :user_access ) { Gitlab :: UserAccess . new ( user , project : project ) }
2017-04-03 23:05:51 +00:00
let ( :oldrev ) { 'be93687618e4b132087f430a4d8fc3a609c9b77c' }
let ( :newrev ) { '54fcc214b94e78d7a41a9a8fe6d87a5e59500e51' }
let ( :ref ) { 'refs/heads/master' }
let ( :changes ) { { oldrev : oldrev , newrev : newrev , ref : ref } }
2017-03-13 11:31:27 +00:00
let ( :protocol ) { 'ssh' }
2016-08-12 22:27:42 +00:00
2017-03-13 11:31:27 +00:00
subject do
described_class . new (
changes ,
project : project ,
user_access : user_access ,
protocol : protocol
) . exec
end
2016-08-12 22:27:42 +00:00
2017-03-31 16:57:29 +00:00
before { project . add_developer ( user ) }
2016-08-12 22:27:42 +00:00
context 'without failed checks' do
it " doesn't return any error " do
expect ( subject . status ) . to be ( true )
end
end
context 'when the user is not allowed to push code' do
it 'returns an error' do
expect ( user_access ) . to receive ( :can_do_action? ) . with ( :push_code ) . and_return ( false )
expect ( subject . status ) . to be ( false )
expect ( subject . message ) . to eq ( 'You are not allowed to push code to this project.' )
end
end
context 'tags check' do
2017-04-03 23:05:51 +00:00
let ( :ref ) { 'refs/tags/v1.0.0' }
2016-08-12 22:27:42 +00:00
it 'returns an error if the user is not allowed to update tags' do
2017-03-31 16:57:29 +00:00
allow ( user_access ) . to receive ( :can_do_action? ) . with ( :push_code ) . and_return ( true )
2016-08-12 22:27:42 +00:00
expect ( user_access ) . to receive ( :can_do_action? ) . with ( :admin_project ) . and_return ( false )
expect ( subject . status ) . to be ( false )
expect ( subject . message ) . to eq ( 'You are not allowed to change existing tags on this project.' )
end
2017-03-31 16:57:29 +00:00
context 'with protected tag' do
let! ( :protected_tag ) { create ( :protected_tag , project : project , name : 'v*' ) }
2017-04-03 23:05:51 +00:00
context 'as master' do
before { project . add_master ( user ) }
2017-03-31 16:57:29 +00:00
2017-04-03 23:05:51 +00:00
context 'deletion' do
let ( :oldrev ) { 'be93687618e4b132087f430a4d8fc3a609c9b77c' }
let ( :newrev ) { '0000000000000000000000000000000000000000' }
it 'is prevented' do
expect ( subject . status ) . to be ( false )
expect ( subject . message ) . to include ( 'cannot be deleted' )
end
2017-03-31 16:57:29 +00:00
end
2017-04-03 23:05:51 +00:00
context 'update' do
let ( :oldrev ) { 'be93687618e4b132087f430a4d8fc3a609c9b77c' }
let ( :newrev ) { '54fcc214b94e78d7a41a9a8fe6d87a5e59500e51' }
2017-03-31 16:57:29 +00:00
2017-04-03 23:05:51 +00:00
it 'is prevented' do
expect ( subject . status ) . to be ( false )
expect ( subject . message ) . to include ( 'cannot be updated' )
end
end
2017-03-31 16:57:29 +00:00
end
2017-04-03 23:05:51 +00:00
context 'creation' do
let ( :oldrev ) { '0000000000000000000000000000000000000000' }
let ( :newrev ) { '54fcc214b94e78d7a41a9a8fe6d87a5e59500e51' }
let ( :ref ) { 'refs/tags/v9.1.0' }
2017-03-31 16:57:29 +00:00
2017-04-03 23:05:51 +00:00
it 'prevents creation below access level' do
expect ( subject . status ) . to be ( false )
expect ( subject . message ) . to include ( 'allowed to create this tag as it is protected' )
end
context 'when user has access' do
2017-04-04 02:37:22 +00:00
let! ( :protected_tag ) { create ( :protected_tag , :developers_can_create , project : project , name : 'v*' ) }
2017-03-31 16:57:29 +00:00
2017-04-03 23:05:51 +00:00
it 'allows tag creation' do
expect ( subject . status ) . to be ( true )
end
2017-03-31 16:57:29 +00:00
end
end
end
2016-08-12 22:27:42 +00:00
end
2017-05-08 07:41:58 +00:00
context 'branches check' do
context 'trying to delete the default branch' do
let ( :newrev ) { '0000000000000000000000000000000000000000' }
let ( :ref ) { 'refs/heads/master' }
2016-08-12 22:27:42 +00:00
2017-05-08 07:41:58 +00:00
it 'returns an error' do
expect ( subject . status ) . to be ( false )
expect ( subject . message ) . to eq ( 'The default branch of a project cannot be deleted.' )
end
2016-08-12 22:27:42 +00:00
end
2017-05-08 07:41:58 +00:00
context 'protected branches check' do
before do
allow ( ProtectedBranch ) . to receive ( :protected? ) . with ( project , 'master' ) . and_return ( true )
allow ( ProtectedBranch ) . to receive ( :protected? ) . with ( project , 'feature' ) . and_return ( true )
end
2016-08-12 22:27:42 +00:00
2017-05-08 07:41:58 +00:00
it 'returns an error if the user is not allowed to do forced pushes to protected branches' do
expect ( Gitlab :: Checks :: ForcePush ) . to receive ( :force_push? ) . and_return ( true )
2016-08-12 22:27:42 +00:00
2017-05-08 07:41:58 +00:00
expect ( subject . status ) . to be ( false )
expect ( subject . message ) . to eq ( 'You are not allowed to force push code to a protected branch on this project.' )
end
2016-08-12 22:27:42 +00:00
2017-05-08 07:41:58 +00:00
it 'returns an error if the user is not allowed to merge to protected branches' do
expect_any_instance_of ( Gitlab :: Checks :: MatchingMergeRequest ) . to receive ( :match? ) . and_return ( true )
expect ( user_access ) . to receive ( :can_merge_to_branch? ) . and_return ( false )
expect ( user_access ) . to receive ( :can_push_to_branch? ) . and_return ( false )
2016-08-12 22:27:42 +00:00
2017-05-08 07:41:58 +00:00
expect ( subject . status ) . to be ( false )
expect ( subject . message ) . to eq ( 'You are not allowed to merge code into protected branches on this project.' )
end
it 'returns an error if the user is not allowed to push to protected branches' do
expect ( user_access ) . to receive ( :can_push_to_branch? ) . and_return ( false )
2016-08-12 22:27:42 +00:00
expect ( subject . status ) . to be ( false )
2017-05-08 07:41:58 +00:00
expect ( subject . message ) . to eq ( 'You are not allowed to push code to protected branches on this project.' )
end
context 'branch deletion' do
let ( :newrev ) { '0000000000000000000000000000000000000000' }
let ( :ref ) { 'refs/heads/feature' }
context 'if the user is not allowed to delete protected branches' do
it 'returns an error' do
expect ( subject . status ) . to be ( false )
expect ( subject . message ) . to eq ( 'You are not allowed to delete protected branches from this project. Only a project master or owner can delete a protected branch.' )
end
end
context 'if the user is allowed to delete protected branches' do
before do
project . add_master ( user )
end
context 'through the web interface' do
let ( :protocol ) { 'web' }
it 'allows branch deletion' do
expect ( subject . status ) . to be ( true )
end
end
context 'over SSH or HTTP' do
it 'returns an error' do
expect ( subject . status ) . to be ( false )
expect ( subject . message ) . to eq ( 'You can only delete protected branches using the web interface.' )
end
end
end
2016-08-12 22:27:42 +00:00
end
end
end
end
end