2019-08-22 10:57:44 +00:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2016-07-18 08:16:56 +00:00
|
|
|
require 'spec_helper'
|
|
|
|
|
2020-06-24 18:09:03 +00:00
|
|
|
RSpec.describe Gitlab::UserAccess do
|
2018-02-27 13:18:32 +00:00
|
|
|
include ProjectForksHelper
|
|
|
|
|
2020-07-21 18:09:45 +00:00
|
|
|
let(:access) { described_class.new(user, container: project) }
|
2017-08-01 18:51:52 +00:00
|
|
|
let(:project) { create(:project, :repository) }
|
2016-07-18 08:16:56 +00:00
|
|
|
let(:user) { create(:user) }
|
|
|
|
|
2017-05-08 07:41:58 +00:00
|
|
|
describe '#can_push_to_branch?' do
|
2016-07-18 08:16:56 +00:00
|
|
|
describe 'push to none protected branch' do
|
2018-07-11 14:36:08 +00:00
|
|
|
it 'returns true if user is a maintainer' do
|
|
|
|
project.add_maintainer(user)
|
2016-08-01 15:48:15 +00:00
|
|
|
|
2016-07-18 08:16:56 +00:00
|
|
|
expect(access.can_push_to_branch?('random_branch')).to be_truthy
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns true if user is a developer' do
|
2017-12-22 08:18:28 +00:00
|
|
|
project.add_developer(user)
|
2016-08-01 15:48:15 +00:00
|
|
|
|
2016-07-18 08:16:56 +00:00
|
|
|
expect(access.can_push_to_branch?('random_branch')).to be_truthy
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns false if user is a reporter' do
|
2017-12-22 08:18:28 +00:00
|
|
|
project.add_reporter(user)
|
2016-08-01 15:48:15 +00:00
|
|
|
|
2016-07-18 08:16:56 +00:00
|
|
|
expect(access.can_push_to_branch?('random_branch')).to be_falsey
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2020-03-04 21:07:54 +00:00
|
|
|
describe 'push to branch in an internal project' do
|
|
|
|
it 'will not infinitely loop when a project is internal' do
|
|
|
|
project.visibility_level = Gitlab::VisibilityLevel::INTERNAL
|
|
|
|
project.save!
|
|
|
|
|
|
|
|
expect(project).not_to receive(:branch_allows_collaboration?)
|
|
|
|
|
|
|
|
access.can_push_to_branch?('master')
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2016-08-01 09:06:57 +00:00
|
|
|
describe 'push to empty project' do
|
|
|
|
let(:empty_project) { create(:project_empty_repo) }
|
2020-07-21 18:09:45 +00:00
|
|
|
let(:project_access) { described_class.new(user, container: empty_project) }
|
2016-08-01 09:06:57 +00:00
|
|
|
|
2020-12-17 18:10:14 +00:00
|
|
|
context 'when admin mode is enabled', :enable_admin_mode do
|
|
|
|
it 'returns true for admins' do
|
|
|
|
user.update!(admin: true)
|
2018-04-18 13:52:55 +00:00
|
|
|
|
2020-12-17 18:10:14 +00:00
|
|
|
expect(access.can_push_to_branch?('master')).to be_truthy
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when admin mode is disabled' do
|
|
|
|
it 'returns false for admins' do
|
|
|
|
user.update!(admin: true)
|
|
|
|
|
|
|
|
expect(access.can_push_to_branch?('master')).to be_falsey
|
|
|
|
end
|
2018-04-18 13:52:55 +00:00
|
|
|
end
|
|
|
|
|
2018-07-11 14:36:08 +00:00
|
|
|
it 'returns true if user is maintainer' do
|
|
|
|
empty_project.add_maintainer(user)
|
2016-08-01 09:06:57 +00:00
|
|
|
|
|
|
|
expect(project_access.can_push_to_branch?('master')).to be_truthy
|
|
|
|
end
|
|
|
|
|
2020-03-02 12:07:57 +00:00
|
|
|
context 'when the user is a developer' do
|
|
|
|
using RSpec::Parameterized::TableSyntax
|
|
|
|
|
|
|
|
before do
|
|
|
|
empty_project.add_developer(user)
|
|
|
|
end
|
|
|
|
|
|
|
|
where(:default_branch_protection_level, :result) do
|
|
|
|
Gitlab::Access::PROTECTION_NONE | true
|
|
|
|
Gitlab::Access::PROTECTION_DEV_CAN_PUSH | true
|
|
|
|
Gitlab::Access::PROTECTION_DEV_CAN_MERGE | false
|
|
|
|
Gitlab::Access::PROTECTION_FULL | false
|
|
|
|
end
|
|
|
|
|
|
|
|
with_them do
|
|
|
|
it do
|
|
|
|
expect(empty_project.namespace).to receive(:default_branch_protection).and_return(default_branch_protection_level).at_least(:once)
|
|
|
|
|
|
|
|
expect(project_access.can_push_to_branch?('master')).to eq(result)
|
|
|
|
end
|
|
|
|
end
|
2016-08-01 09:06:57 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2016-07-18 08:16:56 +00:00
|
|
|
describe 'push to protected branch' do
|
2017-01-05 11:40:54 +00:00
|
|
|
let(:branch) { create :protected_branch, project: project, name: "test" }
|
|
|
|
let(:not_existing_branch) { create :protected_branch, :developers_can_merge, project: project }
|
2016-07-18 08:16:56 +00:00
|
|
|
|
2020-12-17 18:10:14 +00:00
|
|
|
context 'when admin mode is enabled', :enable_admin_mode do
|
|
|
|
it 'returns true for admins' do
|
|
|
|
user.update!(admin: true)
|
2018-04-18 13:52:55 +00:00
|
|
|
|
2020-12-17 18:10:14 +00:00
|
|
|
expect(access.can_push_to_branch?(branch.name)).to be_truthy
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when admin mode is disabled' do
|
|
|
|
it 'returns false for admins' do
|
|
|
|
user.update!(admin: true)
|
|
|
|
|
|
|
|
expect(access.can_push_to_branch?(branch.name)).to be_falsey
|
|
|
|
end
|
2018-04-18 13:52:55 +00:00
|
|
|
end
|
|
|
|
|
2018-07-11 14:36:08 +00:00
|
|
|
it 'returns true if user is a maintainer' do
|
|
|
|
project.add_maintainer(user)
|
2016-08-01 15:48:15 +00:00
|
|
|
|
2016-07-18 08:16:56 +00:00
|
|
|
expect(access.can_push_to_branch?(branch.name)).to be_truthy
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns false if user is a developer' do
|
2017-12-22 08:18:28 +00:00
|
|
|
project.add_developer(user)
|
2016-08-01 15:48:15 +00:00
|
|
|
|
2016-07-18 08:16:56 +00:00
|
|
|
expect(access.can_push_to_branch?(branch.name)).to be_falsey
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns false if user is a reporter' do
|
2017-12-22 08:18:28 +00:00
|
|
|
project.add_reporter(user)
|
2016-08-01 15:48:15 +00:00
|
|
|
|
2016-07-18 08:16:56 +00:00
|
|
|
expect(access.can_push_to_branch?(branch.name)).to be_falsey
|
|
|
|
end
|
2017-01-05 11:40:54 +00:00
|
|
|
|
2017-04-28 14:05:00 +00:00
|
|
|
it 'returns false if branch does not exist' do
|
2017-12-22 08:18:28 +00:00
|
|
|
project.add_developer(user)
|
2017-01-05 11:40:54 +00:00
|
|
|
|
2017-04-28 14:05:00 +00:00
|
|
|
expect(access.can_push_to_branch?(not_existing_branch.name)).to be_falsey
|
2017-01-05 11:40:54 +00:00
|
|
|
end
|
2016-07-18 08:16:56 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
describe 'push to protected branch if allowed for developers' do
|
|
|
|
before do
|
2016-07-08 06:15:02 +00:00
|
|
|
@branch = create :protected_branch, :developers_can_push, project: project
|
2016-07-18 08:16:56 +00:00
|
|
|
end
|
|
|
|
|
2018-07-11 14:36:08 +00:00
|
|
|
it 'returns true if user is a maintainer' do
|
|
|
|
project.add_maintainer(user)
|
2016-08-01 15:48:15 +00:00
|
|
|
|
2016-07-18 08:16:56 +00:00
|
|
|
expect(access.can_push_to_branch?(@branch.name)).to be_truthy
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns true if user is a developer' do
|
2017-12-22 08:18:28 +00:00
|
|
|
project.add_developer(user)
|
2016-08-01 15:48:15 +00:00
|
|
|
|
2016-07-18 08:16:56 +00:00
|
|
|
expect(access.can_push_to_branch?(@branch.name)).to be_truthy
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns false if user is a reporter' do
|
2017-12-22 08:18:28 +00:00
|
|
|
project.add_reporter(user)
|
2016-08-01 15:48:15 +00:00
|
|
|
|
2016-07-18 08:16:56 +00:00
|
|
|
expect(access.can_push_to_branch?(@branch.name)).to be_falsey
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2018-02-27 13:18:32 +00:00
|
|
|
describe 'allowing pushes to maintainers of forked projects' do
|
|
|
|
let(:canonical_project) { create(:project, :public, :repository) }
|
|
|
|
let(:project) { fork_project(canonical_project, create(:user), repository: true) }
|
|
|
|
|
|
|
|
before do
|
|
|
|
create(
|
|
|
|
:merge_request,
|
|
|
|
target_project: canonical_project,
|
|
|
|
source_project: project,
|
|
|
|
source_branch: 'awesome-feature',
|
2018-05-23 01:54:57 +00:00
|
|
|
allow_collaboration: true
|
2018-02-27 13:18:32 +00:00
|
|
|
)
|
|
|
|
end
|
|
|
|
|
2019-10-23 09:06:03 +00:00
|
|
|
it 'allows users that have push access to the canonical project to push to the MR branch', :sidekiq_might_not_need_inline do
|
2018-02-27 13:18:32 +00:00
|
|
|
canonical_project.add_developer(user)
|
|
|
|
|
|
|
|
expect(access.can_push_to_branch?('awesome-feature')).to be_truthy
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'does not allow the user to push to other branches' do
|
|
|
|
canonical_project.add_developer(user)
|
|
|
|
|
|
|
|
expect(access.can_push_to_branch?('master')).to be_falsey
|
|
|
|
end
|
|
|
|
|
2020-02-07 15:09:52 +00:00
|
|
|
it 'does not allow the user to push if they do not have push access to the canonical project' do
|
2018-02-27 13:18:32 +00:00
|
|
|
canonical_project.add_guest(user)
|
|
|
|
|
|
|
|
expect(access.can_push_to_branch?('awesome-feature')).to be_falsey
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2016-07-18 08:16:56 +00:00
|
|
|
describe 'merge to protected branch if allowed for developers' do
|
|
|
|
before do
|
2016-07-08 06:15:02 +00:00
|
|
|
@branch = create :protected_branch, :developers_can_merge, project: project
|
2016-07-18 08:16:56 +00:00
|
|
|
end
|
|
|
|
|
2018-07-11 14:36:08 +00:00
|
|
|
it 'returns true if user is a maintainer' do
|
|
|
|
project.add_maintainer(user)
|
2016-08-01 15:48:15 +00:00
|
|
|
|
2016-07-18 08:16:56 +00:00
|
|
|
expect(access.can_merge_to_branch?(@branch.name)).to be_truthy
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns true if user is a developer' do
|
2017-12-22 08:18:28 +00:00
|
|
|
project.add_developer(user)
|
2016-08-01 15:48:15 +00:00
|
|
|
|
2016-07-18 08:16:56 +00:00
|
|
|
expect(access.can_merge_to_branch?(@branch.name)).to be_truthy
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns false if user is a reporter' do
|
2017-12-22 08:18:28 +00:00
|
|
|
project.add_reporter(user)
|
2016-08-01 15:48:15 +00:00
|
|
|
|
2016-07-18 08:16:56 +00:00
|
|
|
expect(access.can_merge_to_branch?(@branch.name)).to be_falsey
|
|
|
|
end
|
|
|
|
end
|
2021-03-31 18:09:19 +00:00
|
|
|
|
|
|
|
context 'when skip_collaboration_check is true' do
|
|
|
|
let(:access) { described_class.new(user, container: project, skip_collaboration_check: true) }
|
|
|
|
|
|
|
|
it 'does not call Project#branch_allows_collaboration?' do
|
|
|
|
expect(project).not_to receive(:branch_allows_collaboration?)
|
|
|
|
expect(access.can_push_to_branch?('master')).to be_falsey
|
|
|
|
end
|
|
|
|
end
|
2016-07-18 08:16:56 +00:00
|
|
|
end
|
2017-04-04 01:05:42 +00:00
|
|
|
|
2017-05-08 07:41:58 +00:00
|
|
|
describe '#can_create_tag?' do
|
2017-04-04 01:05:42 +00:00
|
|
|
describe 'push to none protected tag' do
|
2018-07-11 14:36:08 +00:00
|
|
|
it 'returns true if user is a maintainer' do
|
|
|
|
project.add_user(user, :maintainer)
|
2017-04-04 01:05:42 +00:00
|
|
|
|
|
|
|
expect(access.can_create_tag?('random_tag')).to be_truthy
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns true if user is a developer' do
|
|
|
|
project.add_user(user, :developer)
|
|
|
|
|
|
|
|
expect(access.can_create_tag?('random_tag')).to be_truthy
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns false if user is a reporter' do
|
|
|
|
project.add_user(user, :reporter)
|
|
|
|
|
|
|
|
expect(access.can_create_tag?('random_tag')).to be_falsey
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
describe 'push to protected tag' do
|
|
|
|
let(:tag) { create(:protected_tag, project: project, name: "test") }
|
|
|
|
let(:not_existing_tag) { create :protected_tag, project: project }
|
|
|
|
|
2018-07-11 14:36:08 +00:00
|
|
|
it 'returns true if user is a maintainer' do
|
|
|
|
project.add_user(user, :maintainer)
|
2017-04-04 01:05:42 +00:00
|
|
|
|
|
|
|
expect(access.can_create_tag?(tag.name)).to be_truthy
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns false if user is a developer' do
|
|
|
|
project.add_user(user, :developer)
|
|
|
|
|
|
|
|
expect(access.can_create_tag?(tag.name)).to be_falsey
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns false if user is a reporter' do
|
|
|
|
project.add_user(user, :reporter)
|
|
|
|
|
|
|
|
expect(access.can_create_tag?(tag.name)).to be_falsey
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
describe 'push to protected tag if allowed for developers' do
|
|
|
|
before do
|
2017-04-04 02:37:22 +00:00
|
|
|
@tag = create(:protected_tag, :developers_can_create, project: project)
|
2017-04-04 01:05:42 +00:00
|
|
|
end
|
|
|
|
|
2018-07-11 14:36:08 +00:00
|
|
|
it 'returns true if user is a maintainer' do
|
|
|
|
project.add_user(user, :maintainer)
|
2017-04-04 01:05:42 +00:00
|
|
|
|
|
|
|
expect(access.can_create_tag?(@tag.name)).to be_truthy
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns true if user is a developer' do
|
|
|
|
project.add_user(user, :developer)
|
|
|
|
|
|
|
|
expect(access.can_create_tag?(@tag.name)).to be_truthy
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns false if user is a reporter' do
|
|
|
|
project.add_user(user, :reporter)
|
|
|
|
|
|
|
|
expect(access.can_create_tag?(@tag.name)).to be_falsey
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
2017-05-08 07:41:58 +00:00
|
|
|
|
|
|
|
describe '#can_delete_branch?' do
|
|
|
|
describe 'delete unprotected branch' do
|
2018-07-11 14:36:08 +00:00
|
|
|
it 'returns true if user is a maintainer' do
|
|
|
|
project.add_user(user, :maintainer)
|
2017-05-08 07:41:58 +00:00
|
|
|
|
|
|
|
expect(access.can_delete_branch?('random_branch')).to be_truthy
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns true if user is a developer' do
|
|
|
|
project.add_user(user, :developer)
|
|
|
|
|
|
|
|
expect(access.can_delete_branch?('random_branch')).to be_truthy
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns false if user is a reporter' do
|
|
|
|
project.add_user(user, :reporter)
|
|
|
|
|
|
|
|
expect(access.can_delete_branch?('random_branch')).to be_falsey
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
describe 'delete protected branch' do
|
|
|
|
let(:branch) { create(:protected_branch, project: project, name: "test") }
|
|
|
|
|
2018-07-11 14:36:08 +00:00
|
|
|
it 'returns true if user is a maintainer' do
|
|
|
|
project.add_user(user, :maintainer)
|
2017-05-08 07:41:58 +00:00
|
|
|
|
|
|
|
expect(access.can_delete_branch?(branch.name)).to be_truthy
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns false if user is a developer' do
|
|
|
|
project.add_user(user, :developer)
|
|
|
|
|
|
|
|
expect(access.can_delete_branch?(branch.name)).to be_falsey
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns false if user is a reporter' do
|
|
|
|
project.add_user(user, :reporter)
|
|
|
|
|
|
|
|
expect(access.can_delete_branch?(branch.name)).to be_falsey
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
2020-12-15 03:10:12 +00:00
|
|
|
|
|
|
|
describe '#can_push_for_ref?' do
|
|
|
|
let(:ref) { 'test_ref' }
|
|
|
|
|
|
|
|
context 'when user cannot push_code to a project repository (eg. as a guest)' do
|
|
|
|
it 'is false' do
|
|
|
|
project.add_user(user, :guest)
|
|
|
|
|
|
|
|
expect(access.can_push_for_ref?(ref)).to be_falsey
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when user can push_code to a project repository (eg. as a developer)' do
|
|
|
|
it 'is true' do
|
|
|
|
project.add_user(user, :developer)
|
|
|
|
|
|
|
|
expect(access.can_push_for_ref?(ref)).to be_truthy
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
2016-07-18 08:16:56 +00:00
|
|
|
end
|