diff --git a/lib/api/projects.rb b/lib/api/projects.rb index d35ec73c8c1..5284d1d2305 100644 --- a/lib/api/projects.rb +++ b/lib/api/projects.rb @@ -199,18 +199,21 @@ module API post 'fork/:id' do attrs = {} namespace_id = params[:namespace] + if namespace_id.present? namespace = Namespace.find_by(id: namespace_id) || Namespace.find_by_path_or_name(namespace_id) - if namespace.nil? - not_found!('Target Namespace') - end + + not_found!('Target Namespace') unless namespace authorize! :create_projects, namespace + attrs[:namespace] = namespace end + @forked_project = ::Projects::ForkService.new(user_project, current_user, attrs).execute + if @forked_project.errors.any? conflict!(@forked_project.errors.messages) else diff --git a/spec/requests/api/fork_spec.rb b/spec/requests/api/fork_spec.rb index 97f17efc053..91b69384aad 100644 --- a/spec/requests/api/fork_spec.rb +++ b/spec/requests/api/fork_spec.rb @@ -28,6 +28,7 @@ describe API::API, api: true do context 'when authenticated' do it 'forks if user has sufficient access to project' do post api("/projects/fork/#{project.id}", user2) + expect(response).to have_http_status(201) expect(json_response['name']).to eq(project.name) expect(json_response['path']).to eq(project.path) @@ -38,6 +39,7 @@ describe API::API, api: true do it 'forks if user is admin' do post api("/projects/fork/#{project.id}", admin) + expect(response).to have_http_status(201) expect(json_response['name']).to eq(project.name) expect(json_response['path']).to eq(project.path) @@ -48,12 +50,14 @@ describe API::API, api: true do it 'fails on missing project access for the project to fork' do post api("/projects/fork/#{project.id}", user3) + expect(response).to have_http_status(404) expect(json_response['message']).to eq('404 Project Not Found') end it 'fails if forked project exists in the user namespace' do post api("/projects/fork/#{project.id}", user) + expect(response).to have_http_status(409) expect(json_response['message']['name']).to eq(['has already been taken']) expect(json_response['message']['path']).to eq(['has already been taken']) @@ -61,52 +65,61 @@ describe API::API, api: true do it 'fails if project to fork from does not exist' do post api('/projects/fork/424242', user) + expect(response).to have_http_status(404) expect(json_response['message']).to eq('404 Project Not Found') end it 'forks with explicit own user namespace id' do - post api("/projects/fork/#{project.id}?namespace=#{user2.namespace.id}", user2) + post api("/projects/fork/#{project.id}", user2), namespace: user2.namespace.id + expect(response).to have_http_status(201) expect(json_response['owner']['id']).to eq(user2.id) end it 'forks with explicit own user name as namespace' do - post api("/projects/fork/#{project.id}?namespace=#{user2.username}", user2) + post api("/projects/fork/#{project.id}", user2), namespace: user2.username + expect(response).to have_http_status(201) expect(json_response['owner']['id']).to eq(user2.id) end it 'forks to another user when admin' do - post api("/projects/fork/#{project.id}?namespace=#{user2.username}", admin) + post api("/projects/fork/#{project.id}", admin), namespace: user2.username + expect(response).to have_http_status(201) expect(json_response['owner']['id']).to eq(user2.id) end it 'fails if trying to fork to another user when not admin' do - post api("/projects/fork/#{project.id}?namespace=#{admin.namespace.id}", user2) + post api("/projects/fork/#{project.id}", user2), namespace: admin.namespace.id + expect(response).to have_http_status(403) end it 'fails if trying to fork to non-existent namespace' do - post api("/projects/fork/#{project.id}?namespace=42424242", user2) + post api("/projects/fork/#{project.id}", user2), namespace: 42424242 + expect(response).to have_http_status(404) expect(json_response['message']).to eq('404 Target Namespace Not Found') end it 'forks to owned group' do - post api("/projects/fork/#{project.id}?namespace=#{group2.name}", user2) + post api("/projects/fork/#{project.id}", user2), namespace: group2.name + expect(response).to have_http_status(201) expect(json_response['namespace']['name']).to eq(group2.name) end it 'fails to fork to not owned group' do - post api("/projects/fork/#{project.id}?namespace=#{group.name}", user2) + post api("/projects/fork/#{project.id}", user2), namespace: group.name + expect(response).to have_http_status(403) end it 'forks to not owned group when admin' do - post api("/projects/fork/#{project.id}?namespace=#{group.name}", admin) + post api("/projects/fork/#{project.id}", admin), namespace: group.name + expect(response).to have_http_status(201) expect(json_response['namespace']['name']).to eq(group.name) end @@ -115,6 +128,7 @@ describe API::API, api: true do context 'when unauthenticated' do it 'returns authentication error' do post api("/projects/fork/#{project.id}") + expect(response).to have_http_status(401) expect(json_response['message']).to eq('401 Unauthorized') end