# frozen_string_literal: true require 'spec_helper' RSpec.describe API::Clusters::AgentTokens do let_it_be(:agent) { create(:cluster_agent) } let_it_be(:agent_token_one) { create(:cluster_agent_token, agent: agent) } let_it_be(:revoked_agent_token) { create(:cluster_agent_token, :revoked, agent: agent) } let_it_be(:project) { agent.project } let_it_be(:user) { agent.created_by_user } let_it_be(:unauthorized_user) { create(:user) } before_all do project.add_maintainer(user) project.add_guest(unauthorized_user) end describe 'GET /projects/:id/cluster_agents/:agent_id/tokens' do context 'with authorized user' do it 'returns tokens regardless of status' do get api("/projects/#{project.id}/cluster_agents/#{agent.id}/tokens", user) aggregate_failures "testing response" do expect(response).to have_gitlab_http_status(:ok) expect(response).to include_pagination_headers expect(response).to match_response_schema('public_api/v4/agent_tokens') expect(json_response.count).to eq(2) expect(json_response.first['name']).to eq(agent_token_one.name) expect(json_response.first['agent_id']).to eq(agent.id) expect(json_response.second['name']).to eq(revoked_agent_token.name) expect(json_response.second['agent_id']).to eq(agent.id) end end it 'returns a not_found error if agent_id does not exist' do get api("/projects/#{project.id}/cluster_agents/#{non_existing_record_id}/tokens", user) expect(response).to have_gitlab_http_status(:not_found) end end context 'with unauthorized user' do it 'cannot access agent tokens' do get api("/projects/#{project.id}/cluster_agents/#{agent.id}/tokens", unauthorized_user) expect(response).to have_gitlab_http_status(:not_found) end end it 'avoids N+1 queries', :request_store do # Establish baseline get api("/projects/#{project.id}/cluster_agents/#{agent.id}/tokens", user) control = ActiveRecord::QueryRecorder.new do get api("/projects/#{project.id}/cluster_agents/#{agent.id}/tokens", user) expect(response).to have_gitlab_http_status(:ok) end # Now create a second record and ensure that the API does not execute # any more queries than before create(:cluster_agent_token, agent: agent) expect do get api("/projects/#{project.id}/cluster_agents/#{agent.id}/tokens", user) end.not_to exceed_query_limit(control) end end describe 'GET /projects/:id/cluster_agents/:agent_id/tokens/:token_id' do context 'with authorized user' do it 'returns an agent token' do get api("/projects/#{project.id}/cluster_agents/#{agent.id}/tokens/#{agent_token_one.id}", user) aggregate_failures "testing response" do expect(response).to have_gitlab_http_status(:ok) expect(response).to match_response_schema('public_api/v4/agent_token') expect(json_response['id']).to eq(agent_token_one.id) expect(json_response['name']).to eq(agent_token_one.name) expect(json_response['agent_id']).to eq(agent.id) end end it 'returns a 404 error if agent token id is not available' do get api("/projects/#{project.id}/cluster_agents/#{agent.id}/tokens/#{non_existing_record_id}", user) expect(response).to have_gitlab_http_status(:not_found) end end context 'with unauthorized user' do it 'cannot access single agent token' do get api("/projects/#{project.id}/cluster_agents/#{agent.id}/tokens/#{agent_token_one.id}", unauthorized_user) expect(response).to have_gitlab_http_status(:not_found) end it 'cannot access token from agent of another project' do another_project = create(:project, namespace: unauthorized_user.namespace) another_agent = create(:cluster_agent, project: another_project, created_by_user: unauthorized_user) get api("/projects/#{another_project.id}/cluster_agents/#{another_agent.id}/tokens/#{agent_token_one.id}", unauthorized_user) expect(response).to have_gitlab_http_status(:not_found) end end end describe 'POST /projects/:id/cluster_agents/:agent_id/tokens' do it 'creates a new agent token' do params = { name: 'test-token', description: 'Test description' } post(api("/projects/#{project.id}/cluster_agents/#{agent.id}/tokens", user), params: params) aggregate_failures "testing response" do expect(response).to have_gitlab_http_status(:created) expect(response).to match_response_schema('public_api/v4/agent_token_with_token') expect(json_response['name']).to eq(params[:name]) expect(json_response['description']).to eq(params[:description]) expect(json_response['agent_id']).to eq(agent.id) end end it 'returns a 400 error if name not given' do post api("/projects/#{project.id}/cluster_agents/#{agent.id}/tokens", user) expect(response).to have_gitlab_http_status(:bad_request) end it 'returns 404 error if project does not exist' do post api("/projects/#{non_existing_record_id}/cluster_agents/tokens", user) expect(response).to have_gitlab_http_status(:not_found) end it 'returns 404 error if agent does not exist' do post api("/projects/#{project.id}/cluster_agents/#{non_existing_record_id}/tokens", user), params: { name: "some" } expect(response).to have_gitlab_http_status(:not_found) end context 'with unauthorized user' do it 'prevents to create agent token' do post api("/projects/#{project.id}/cluster_agents/#{agent.id}/tokens", unauthorized_user), params: { name: "some" } expect(response).to have_gitlab_http_status(:forbidden) end end end describe 'DELETE /projects/:id/cluster_agents/:agent_id/tokens/:token_id' do it 'revokes agent token' do delete api("/projects/#{project.id}/cluster_agents/#{agent.id}/tokens/#{agent_token_one.id}", user) expect(response).to have_gitlab_http_status(:no_content) expect(agent_token_one.reload).to be_revoked end it 'returns a 404 error when revoking non existent agent token' do delete api("/projects/#{project.id}/cluster_agents/#{agent.id}/tokens/#{non_existing_record_id}", user) expect(response).to have_gitlab_http_status(:not_found) end it 'returns a 404 if the user is unauthorized to revoke' do delete api("/projects/#{project.id}/cluster_agents/#{agent.id}/tokens/#{agent_token_one.id}", unauthorized_user) expect(response).to have_gitlab_http_status(:forbidden) end it 'cannot revoke token from agent of another project' do another_project = create(:project, namespace: unauthorized_user.namespace) another_agent = create(:cluster_agent, project: another_project, created_by_user: unauthorized_user) delete api("/projects/#{another_project.id}/cluster_agents/#{another_agent.id}/tokens/#{agent_token_one.id}", unauthorized_user) expect(response).to have_gitlab_http_status(:not_found) end end end