debian-mirror-gitlab/spec/requests/api/members_spec.rb

377 lines
13 KiB
Ruby
Raw Normal View History

2016-09-13 17:45:13 +05:30
require 'spec_helper'
2017-08-17 22:00:37 +05:30
describe API::Members do
let(:master) { create(:user, username: 'master_user') }
2016-09-13 17:45:13 +05:30
let(:developer) { create(:user) }
let(:access_requester) { create(:user) }
let(:stranger) { create(:user) }
let(:project) do
2017-09-10 17:25:29 +05:30
create(:project, :public, :access_requestable, creator_id: master.id, namespace: master.namespace) do |project|
2018-03-17 18:26:18 +05:30
project.add_developer(developer)
project.add_master(master)
2017-08-17 22:00:37 +05:30
project.request_access(access_requester)
end
2016-09-13 17:45:13 +05:30
end
let!(:group) do
2017-08-17 22:00:37 +05:30
create(:group, :public, :access_requestable) do |group|
group.add_developer(developer)
group.add_owner(master)
group.request_access(access_requester)
end
2016-09-13 17:45:13 +05:30
end
shared_examples 'GET /:sources/:id/members' do |source_type|
context "with :sources == #{source_type.pluralize}" do
it_behaves_like 'a 404 response when source is private' do
let(:route) { get api("/#{source_type.pluralize}/#{source.id}/members", stranger) }
end
2016-09-29 09:46:39 +05:30
%i[master developer access_requester stranger].each do |type|
context "when authenticated as a #{type}" do
it 'returns 200' do
user = public_send(type)
2017-08-17 22:00:37 +05:30
2016-09-29 09:46:39 +05:30
get api("/#{source_type.pluralize}/#{source.id}/members", user)
2018-03-17 18:26:18 +05:30
expect(response).to have_gitlab_http_status(200)
2017-08-17 22:00:37 +05:30
expect(response).to include_pagination_headers
expect(json_response).to be_an Array
2016-09-29 09:46:39 +05:30
expect(json_response.size).to eq(2)
expect(json_response.map { |u| u['id'] }).to match_array [master.id, developer.id]
2016-09-13 17:45:13 +05:30
end
end
end
2018-03-17 18:26:18 +05:30
it 'avoids N+1 queries' do
# Establish baseline
get api("/#{source_type.pluralize}/#{source.id}/members", master)
control = ActiveRecord::QueryRecorder.new do
get api("/#{source_type.pluralize}/#{source.id}/members", master)
end
project.add_developer(create(:user))
expect do
get api("/#{source_type.pluralize}/#{source.id}/members", master)
end.not_to exceed_query_limit(control)
end
2016-09-29 09:46:39 +05:30
it 'does not return invitees' do
create(:"#{source_type}_member", invite_token: '123', invite_email: 'test@abc.com', source: source, user: nil)
get api("/#{source_type.pluralize}/#{source.id}/members", developer)
2018-03-17 18:26:18 +05:30
expect(response).to have_gitlab_http_status(200)
2017-08-17 22:00:37 +05:30
expect(response).to include_pagination_headers
expect(json_response).to be_an Array
2016-09-29 09:46:39 +05:30
expect(json_response.size).to eq(2)
expect(json_response.map { |u| u['id'] }).to match_array [master.id, developer.id]
end
2016-09-13 17:45:13 +05:30
it 'finds members with query string' do
get api("/#{source_type.pluralize}/#{source.id}/members", developer), query: master.username
2018-03-17 18:26:18 +05:30
expect(response).to have_gitlab_http_status(200)
2017-08-17 22:00:37 +05:30
expect(response).to include_pagination_headers
expect(json_response).to be_an Array
2016-09-13 17:45:13 +05:30
expect(json_response.count).to eq(1)
expect(json_response.first['username']).to eq(master.username)
end
2018-03-17 18:26:18 +05:30
it 'finds all members with no query specified' do
get api("/#{source_type.pluralize}/#{source.id}/members", developer), query: ''
expect(response).to have_gitlab_http_status(200)
expect(response).to include_pagination_headers
expect(json_response).to be_an Array
expect(json_response.count).to eq(2)
expect(json_response.map { |u| u['id'] }).to match_array [master.id, developer.id]
end
2016-09-13 17:45:13 +05:30
end
end
shared_examples 'GET /:sources/:id/members/:user_id' do |source_type|
context "with :sources == #{source_type.pluralize}" do
it_behaves_like 'a 404 response when source is private' do
let(:route) { get api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", stranger) }
end
context 'when authenticated as a non-member' do
%i[access_requester stranger].each do |type|
context "as a #{type}" do
it 'returns 200' do
user = public_send(type)
get api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", user)
2018-03-17 18:26:18 +05:30
expect(response).to have_gitlab_http_status(200)
2016-09-13 17:45:13 +05:30
# User attributes
expect(json_response['id']).to eq(developer.id)
expect(json_response['name']).to eq(developer.name)
expect(json_response['username']).to eq(developer.username)
expect(json_response['state']).to eq(developer.state)
expect(json_response['avatar_url']).to eq(developer.avatar_url)
expect(json_response['web_url']).to eq(Gitlab::Routing.url_helpers.user_url(developer))
# Member attributes
expect(json_response['access_level']).to eq(Member::DEVELOPER)
end
end
end
end
end
end
shared_examples 'POST /:sources/:id/members' do |source_type|
context "with :sources == #{source_type.pluralize}" do
it_behaves_like 'a 404 response when source is private' do
2016-11-03 12:29:30 +05:30
let(:route) do
post api("/#{source_type.pluralize}/#{source.id}/members", stranger),
user_id: access_requester.id, access_level: Member::MASTER
end
2016-09-13 17:45:13 +05:30
end
context 'when authenticated as a non-member or member with insufficient rights' do
%i[access_requester stranger developer].each do |type|
context "as a #{type}" do
it 'returns 403' do
user = public_send(type)
2016-11-03 12:29:30 +05:30
post api("/#{source_type.pluralize}/#{source.id}/members", user),
user_id: access_requester.id, access_level: Member::MASTER
2016-09-13 17:45:13 +05:30
2018-03-17 18:26:18 +05:30
expect(response).to have_gitlab_http_status(403)
2016-09-13 17:45:13 +05:30
end
end
end
end
context 'when authenticated as a master/owner' do
context 'and new member is already a requester' do
it 'transforms the requester into a proper member' do
expect do
post api("/#{source_type.pluralize}/#{source.id}/members", master),
user_id: access_requester.id, access_level: Member::MASTER
2018-03-17 18:26:18 +05:30
expect(response).to have_gitlab_http_status(201)
2016-09-13 17:45:13 +05:30
end.to change { source.members.count }.by(1)
expect(source.requesters.count).to eq(0)
expect(json_response['id']).to eq(access_requester.id)
expect(json_response['access_level']).to eq(Member::MASTER)
end
end
it 'creates a new member' do
expect do
post api("/#{source_type.pluralize}/#{source.id}/members", master),
user_id: stranger.id, access_level: Member::DEVELOPER, expires_at: '2016-08-05'
2018-03-17 18:26:18 +05:30
expect(response).to have_gitlab_http_status(201)
2016-09-13 17:45:13 +05:30
end.to change { source.members.count }.by(1)
expect(json_response['id']).to eq(stranger.id)
expect(json_response['access_level']).to eq(Member::DEVELOPER)
expect(json_response['expires_at']).to eq('2016-08-05')
end
end
2017-08-17 22:00:37 +05:30
it "returns 409 if member already exists" do
2016-09-13 17:45:13 +05:30
post api("/#{source_type.pluralize}/#{source.id}/members", master),
user_id: master.id, access_level: Member::MASTER
2018-03-17 18:26:18 +05:30
expect(response).to have_gitlab_http_status(409)
2016-09-13 17:45:13 +05:30
end
it 'returns 400 when user_id is not given' do
post api("/#{source_type.pluralize}/#{source.id}/members", master),
access_level: Member::MASTER
2018-03-17 18:26:18 +05:30
expect(response).to have_gitlab_http_status(400)
2016-09-13 17:45:13 +05:30
end
it 'returns 400 when access_level is not given' do
post api("/#{source_type.pluralize}/#{source.id}/members", master),
user_id: stranger.id
2018-03-17 18:26:18 +05:30
expect(response).to have_gitlab_http_status(400)
2016-09-13 17:45:13 +05:30
end
2017-08-17 22:00:37 +05:30
it 'returns 400 when access_level is not valid' do
2016-09-13 17:45:13 +05:30
post api("/#{source_type.pluralize}/#{source.id}/members", master),
user_id: stranger.id, access_level: 1234
2018-03-17 18:26:18 +05:30
expect(response).to have_gitlab_http_status(400)
2016-09-13 17:45:13 +05:30
end
end
end
shared_examples 'PUT /:sources/:id/members/:user_id' do |source_type|
context "with :sources == #{source_type.pluralize}" do
it_behaves_like 'a 404 response when source is private' do
2016-11-03 12:29:30 +05:30
let(:route) do
put api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", stranger),
access_level: Member::MASTER
end
2016-09-13 17:45:13 +05:30
end
context 'when authenticated as a non-member or member with insufficient rights' do
%i[access_requester stranger developer].each do |type|
context "as a #{type}" do
it 'returns 403' do
user = public_send(type)
2016-11-03 12:29:30 +05:30
put api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", user),
access_level: Member::MASTER
2016-09-13 17:45:13 +05:30
2018-03-17 18:26:18 +05:30
expect(response).to have_gitlab_http_status(403)
2016-09-13 17:45:13 +05:30
end
end
end
end
context 'when authenticated as a master/owner' do
it 'updates the member' do
put api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", master),
access_level: Member::MASTER, expires_at: '2016-08-05'
2018-03-17 18:26:18 +05:30
expect(response).to have_gitlab_http_status(200)
2016-09-13 17:45:13 +05:30
expect(json_response['id']).to eq(developer.id)
expect(json_response['access_level']).to eq(Member::MASTER)
expect(json_response['expires_at']).to eq('2016-08-05')
end
end
it 'returns 409 if member does not exist' do
put api("/#{source_type.pluralize}/#{source.id}/members/123", master),
access_level: Member::MASTER
2018-03-17 18:26:18 +05:30
expect(response).to have_gitlab_http_status(404)
2016-09-13 17:45:13 +05:30
end
it 'returns 400 when access_level is not given' do
put api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", master)
2018-03-17 18:26:18 +05:30
expect(response).to have_gitlab_http_status(400)
2016-09-13 17:45:13 +05:30
end
2017-08-17 22:00:37 +05:30
it 'returns 400 when access level is not valid' do
2016-09-13 17:45:13 +05:30
put api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", master),
access_level: 1234
2018-03-17 18:26:18 +05:30
expect(response).to have_gitlab_http_status(400)
2016-09-13 17:45:13 +05:30
end
end
end
shared_examples 'DELETE /:sources/:id/members/:user_id' do |source_type|
context "with :sources == #{source_type.pluralize}" do
it_behaves_like 'a 404 response when source is private' do
let(:route) { delete api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", stranger) }
end
context 'when authenticated as a non-member or member with insufficient rights' do
%i[access_requester stranger].each do |type|
context "as a #{type}" do
it 'returns 403' do
user = public_send(type)
delete api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", user)
2018-03-17 18:26:18 +05:30
expect(response).to have_gitlab_http_status(403)
2016-09-13 17:45:13 +05:30
end
end
end
end
context 'when authenticated as a member and deleting themself' do
it 'deletes the member' do
expect do
delete api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", developer)
2018-03-17 18:26:18 +05:30
expect(response).to have_gitlab_http_status(204)
2016-09-13 17:45:13 +05:30
end.to change { source.members.count }.by(-1)
end
end
context 'when authenticated as a master/owner' do
context 'and member is a requester' do
2017-08-17 22:00:37 +05:30
it 'returns 404' do
2016-09-13 17:45:13 +05:30
expect do
delete api("/#{source_type.pluralize}/#{source.id}/members/#{access_requester.id}", master)
2018-03-17 18:26:18 +05:30
expect(response).to have_gitlab_http_status(404)
2016-09-13 17:45:13 +05:30
end.not_to change { source.requesters.count }
end
end
it 'deletes the member' do
expect do
delete api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", master)
2018-03-17 18:26:18 +05:30
expect(response).to have_gitlab_http_status(204)
2016-09-13 17:45:13 +05:30
end.to change { source.members.count }.by(-1)
end
2018-03-17 18:26:18 +05:30
it_behaves_like '412 response' do
let(:request) { api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", master) }
end
2016-09-13 17:45:13 +05:30
end
2017-08-17 22:00:37 +05:30
it 'returns 404 if member does not exist' do
2016-09-13 17:45:13 +05:30
delete api("/#{source_type.pluralize}/#{source.id}/members/123", master)
2018-03-17 18:26:18 +05:30
expect(response).to have_gitlab_http_status(404)
2016-09-13 17:45:13 +05:30
end
end
end
it_behaves_like 'GET /:sources/:id/members', 'project' do
let(:source) { project }
end
it_behaves_like 'GET /:sources/:id/members', 'group' do
let(:source) { group }
end
it_behaves_like 'GET /:sources/:id/members/:user_id', 'project' do
let(:source) { project }
end
it_behaves_like 'GET /:sources/:id/members/:user_id', 'group' do
let(:source) { group }
end
it_behaves_like 'POST /:sources/:id/members', 'project' do
let(:source) { project }
end
it_behaves_like 'POST /:sources/:id/members', 'group' do
let(:source) { group }
end
it_behaves_like 'PUT /:sources/:id/members/:user_id', 'project' do
let(:source) { project }
end
it_behaves_like 'PUT /:sources/:id/members/:user_id', 'group' do
let(:source) { group }
end
it_behaves_like 'DELETE /:sources/:id/members/:user_id', 'project' do
let(:source) { project }
end
it_behaves_like 'DELETE /:sources/:id/members/:user_id', 'group' do
let(:source) { group }
end
2016-11-03 12:29:30 +05:30
context 'Adding owner to project' do
it 'returns 403' do
expect do
post api("/projects/#{project.id}/members", master),
user_id: stranger.id, access_level: Member::OWNER
2018-03-17 18:26:18 +05:30
expect(response).to have_gitlab_http_status(400)
2016-11-03 12:29:30 +05:30
end.to change { project.members.count }.by(0)
end
end
2016-09-13 17:45:13 +05:30
end