4c44c5ef9a
Public projects listed in the public section will be linked to the actual project's page. Public projects now give any user Guest permissions to the project, allowing them to download the code, read and create issues, and view anything else in the project's pages. Ample access tests have been added to the project_access_spec to verify correct permissions and behavior on public projects. - Visitors to the site who are not logged in still cannot view the project's pages. - Logged-in users visiting a public project where they are not a team member can create issues, but not snippets. They can view the projects code, issues, merge requests, etc, just as if they were a Guest member of the project. - Since this is a public project, the user is also granted :download_code permissions, a permission normally reserved for Reporters, since they can clone the repo anyways and browse commits and branches locally.
474 lines
15 KiB
Ruby
474 lines
15 KiB
Ruby
require 'spec_helper'
|
|
|
|
describe "Application access" do
|
|
describe "GET /" do
|
|
it { root_path.should be_allowed_for :admin }
|
|
it { root_path.should be_allowed_for :user }
|
|
it { root_path.should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /projects/new" do
|
|
it { new_project_path.should be_allowed_for :admin }
|
|
it { new_project_path.should be_allowed_for :user }
|
|
it { new_project_path.should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "Project" do
|
|
let(:project) { create(:project_with_code) }
|
|
|
|
let(:master) { create(:user) }
|
|
let(:guest) { create(:user) }
|
|
let(:reporter) { create(:user) }
|
|
|
|
before do
|
|
# full access
|
|
project.team << [master, :master]
|
|
|
|
# readonly
|
|
project.team << [reporter, :reporter]
|
|
end
|
|
|
|
describe "GET /project_code" do
|
|
subject { project_path(project) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_denied_for guest }
|
|
it { should be_denied_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/tree/master" do
|
|
subject { project_tree_path(project, project.repository.root_ref) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_denied_for guest }
|
|
it { should be_denied_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/commits/master" do
|
|
subject { project_commits_path(project, project.repository.root_ref, limit: 1) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_denied_for guest }
|
|
it { should be_denied_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/commit/:sha" do
|
|
subject { project_commit_path(project, project.repository.commit) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_denied_for guest }
|
|
it { should be_denied_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/compare" do
|
|
subject { project_compare_index_path(project) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_denied_for guest }
|
|
it { should be_denied_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/team" do
|
|
subject { project_team_index_path(project) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_denied_for guest }
|
|
it { should be_denied_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/wall" do
|
|
subject { project_wall_path(project) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_denied_for guest }
|
|
it { should be_denied_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/blob" do
|
|
before do
|
|
commit = project.repository.commit
|
|
path = commit.tree.contents.select { |i| i.is_a?(Grit::Blob)}.first.name
|
|
@blob_path = project_blob_path(project, File.join(commit.id, path))
|
|
end
|
|
|
|
it { @blob_path.should be_allowed_for master }
|
|
it { @blob_path.should be_allowed_for reporter }
|
|
it { @blob_path.should be_allowed_for :admin }
|
|
it { @blob_path.should be_denied_for guest }
|
|
it { @blob_path.should be_denied_for :user }
|
|
it { @blob_path.should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/edit" do
|
|
subject { edit_project_path(project) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_denied_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_denied_for guest }
|
|
it { should be_denied_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/deploy_keys" do
|
|
subject { project_deploy_keys_path(project) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_denied_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_denied_for guest }
|
|
it { should be_denied_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/issues" do
|
|
subject { project_issues_path(project) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_denied_for guest }
|
|
it { should be_denied_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/snippets" do
|
|
subject { project_snippets_path(project) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_denied_for guest }
|
|
it { should be_denied_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/merge_requests" do
|
|
subject { project_merge_requests_path(project) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_denied_for guest }
|
|
it { should be_denied_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/repository" do
|
|
subject { project_repository_path(project) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_denied_for guest }
|
|
it { should be_denied_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/repository/branches" do
|
|
subject { branches_project_repository_path(project) }
|
|
|
|
before do
|
|
# Speed increase
|
|
Project.any_instance.stub(:branches).and_return([])
|
|
end
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_denied_for guest }
|
|
it { should be_denied_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/repository/tags" do
|
|
subject { tags_project_repository_path(project) }
|
|
|
|
before do
|
|
# Speed increase
|
|
Project.any_instance.stub(:tags).and_return([])
|
|
end
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_denied_for guest }
|
|
it { should be_denied_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/hooks" do
|
|
subject { project_hooks_path(project) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_denied_for guest }
|
|
it { should be_denied_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
end
|
|
|
|
|
|
describe "PublicProject" do
|
|
let(:project) { create(:project) }
|
|
|
|
let(:master) { create(:user) }
|
|
let(:guest) { create(:user) }
|
|
let(:reporter) { create(:user) }
|
|
|
|
let(:admin) { create(:user) }
|
|
|
|
before do
|
|
# public project
|
|
project.public = true
|
|
project.save!
|
|
|
|
# full access
|
|
project.team << [master, :master]
|
|
|
|
# readonly
|
|
project.team << [reporter, :reporter]
|
|
|
|
end
|
|
|
|
describe "Project should be public" do
|
|
subject { project }
|
|
|
|
its(:public?) { should be_true }
|
|
end
|
|
|
|
describe "GET /project_code" do
|
|
subject { project_path(project) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for admin }
|
|
it { should be_allowed_for guest }
|
|
it { should be_allowed_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/tree/master" do
|
|
subject { project_tree_path(project, project.repository.root_ref) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_allowed_for guest }
|
|
it { should be_allowed_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/commits/master" do
|
|
subject { project_commits_path(project, project.repository.root_ref, limit: 1) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_allowed_for guest }
|
|
it { should be_allowed_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/commit/:sha" do
|
|
subject { project_commit_path(project, project.repository.commit) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_allowed_for guest }
|
|
it { should be_allowed_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/compare" do
|
|
subject { project_compare_index_path(project) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_allowed_for guest }
|
|
it { should be_allowed_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/team" do
|
|
subject { project_team_index_path(project) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_allowed_for guest }
|
|
it { should be_allowed_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/wall" do
|
|
subject { project_wall_path(project) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_allowed_for guest }
|
|
it { should be_allowed_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/blob" do
|
|
before do
|
|
commit = project.repository.commit
|
|
path = commit.tree.contents.select { |i| i.is_a?(Grit::Blob)}.first.name
|
|
@blob_path = project_blob_path(project, File.join(commit.id, path))
|
|
end
|
|
|
|
it { @blob_path.should be_allowed_for master }
|
|
it { @blob_path.should be_allowed_for reporter }
|
|
it { @blob_path.should be_allowed_for :admin }
|
|
it { @blob_path.should be_allowed_for guest }
|
|
it { @blob_path.should be_allowed_for :user }
|
|
it { @blob_path.should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/edit" do
|
|
subject { edit_project_path(project) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_denied_for reporter }
|
|
it { should be_denied_for :admin }
|
|
it { should be_denied_for guest }
|
|
it { should be_denied_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/deploy_keys" do
|
|
subject { project_deploy_keys_path(project) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_denied_for reporter }
|
|
it { should be_denied_for :admin }
|
|
it { should be_denied_for guest }
|
|
it { should be_denied_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/issues" do
|
|
subject { project_issues_path(project) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_allowed_for guest }
|
|
it { should be_allowed_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/snippets" do
|
|
subject { project_snippets_path(project) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_allowed_for guest }
|
|
it { should be_allowed_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/snippets/new" do
|
|
subject { new_project_snippet_path(project) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_denied_for :admin }
|
|
it { should be_denied_for guest }
|
|
it { should be_denied_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/merge_requests" do
|
|
subject { project_merge_requests_path(project) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_allowed_for guest }
|
|
it { should be_allowed_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/repository" do
|
|
subject { project_repository_path(project) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_allowed_for guest }
|
|
it { should be_allowed_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/repository/branches" do
|
|
subject { branches_project_repository_path(project) }
|
|
|
|
before do
|
|
# Speed increase
|
|
Project.any_instance.stub(:branches).and_return([])
|
|
end
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_allowed_for guest }
|
|
it { should be_allowed_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/repository/tags" do
|
|
subject { tags_project_repository_path(project) }
|
|
|
|
before do
|
|
# Speed increase
|
|
Project.any_instance.stub(:tags).and_return([])
|
|
end
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_allowed_for guest }
|
|
it { should be_allowed_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
|
|
describe "GET /project_code/hooks" do
|
|
subject { project_hooks_path(project) }
|
|
|
|
it { should be_allowed_for master }
|
|
it { should be_allowed_for reporter }
|
|
it { should be_allowed_for :admin }
|
|
it { should be_allowed_for guest }
|
|
it { should be_allowed_for :user }
|
|
it { should be_denied_for :visitor }
|
|
end
|
|
end
|
|
end
|