debian-mirror-gitlab/spec/services/spam/spam_action_service_spec.rb

# frozen_string_literal: true

require 'spec_helper'

RSpec.describe Spam::SpamActionService do
  include_context 'includes Spam constants'

  let(:fake_ip) { '1.2.3.4' }
  let(:fake_user_agent) { 'fake-user-agent' }
  let(:fake_referrer) { 'fake-http-referrer' }
  let(:env) do
    { 'action_dispatch.remote_ip' => fake_ip,
      'HTTP_USER_AGENT' => fake_user_agent,
      'HTTP_REFERRER' => fake_referrer }
  end

  let(:request) { double(:request, env: env) }

  let_it_be(:project) { create(:project, :public) }
  let_it_be(:user) { create(:user) }
  let(:issue) { create(:issue, project: project, author: user) }

  before do
    issue.spam = false
  end

  shared_examples 'only checks for spam if a request is provided' do
    context 'when request is missing' do
      let(:request) { nil }

      it "doesn't check as spam" do
        expect(fake_verdict_service).not_to receive(:execute)

        response = subject

        expect(response.message).to match(/request was not present/)
        expect(issue).not_to be_spam
      end
    end

    context 'when request exists' do
      it 'creates a spam log' do
        expect { subject }
          .to log_spam(title: issue.title, description: issue.description, noteable_type: 'Issue')
      end
    end
  end

  shared_examples 'creates a spam log' do
    it do
      expect { subject }.to change { SpamLog.count }.by(1)

      new_spam_log = SpamLog.last
      expect(new_spam_log.user_id).to eq(user.id)
      expect(new_spam_log.title).to eq(issue.title)
      expect(new_spam_log.description).to eq(issue.description)
      expect(new_spam_log.source_ip).to eq(fake_ip)
      expect(new_spam_log.user_agent).to eq(fake_user_agent)
      expect(new_spam_log.noteable_type).to eq('Issue')
      expect(new_spam_log.via_api).to eq(false)
    end
  end

  describe '#execute' do
    let(:request) { double(:request, env: env) }
    let(:fake_captcha_verification_service) { double(:captcha_verification_service) }
    let(:fake_verdict_service) { double(:spam_verdict_service) }
    let(:allowlisted) { false }
    let(:api) { nil }
    let(:captcha_response) { 'abc123' }
    let(:spam_log_id) { existing_spam_log.id }
    let(:spam_params) do
      Spam::SpamActionService.filter_spam_params!(
        api: api,
        captcha_response: captcha_response,
        spam_log_id: spam_log_id
      )
    end

    let(:verdict_service_opts) do
      {
        ip_address: fake_ip,
        user_agent: fake_user_agent,
        referrer: fake_referrer
      }
    end

    let(:verdict_service_args) do
      {
        target: issue,
        user: user,
        request: request,
        options: verdict_service_opts,
        context: {
          action: :create,
          target_type: 'Issue'
        }
      }
    end

    let_it_be(:existing_spam_log) { create(:spam_log, user: user, recaptcha_verified: false) }

    subject do
      described_service = described_class.new(spammable: issue, request: request, user: user, action: :create)
      allow(described_service).to receive(:allowlisted?).and_return(allowlisted)
      described_service.execute(spam_params: spam_params)
    end

    before do
      allow(Captcha::CaptchaVerificationService).to receive(:new) { fake_captcha_verification_service }
      allow(Spam::SpamVerdictService).to receive(:new).with(verdict_service_args).and_return(fake_verdict_service)
    end

    context 'when captcha response verification returns true' do
      before do
        expect(fake_captcha_verification_service)
          .to receive(:execute).with(captcha_response: captcha_response, request: request) { true }
      end

      it "doesn't check with the SpamVerdictService" do
        aggregate_failures do
          expect(SpamLog).to receive(:verify_recaptcha!).with(
            user_id: user.id,
            id: spam_log_id
          )
          expect(fake_verdict_service).not_to receive(:execute)
        end

        subject
      end

      it 'updates spam log' do
        expect { subject }.to change { existing_spam_log.reload.recaptcha_verified }.from(false).to(true)
      end
    end

    context 'when captcha response verification returns false' do
      before do
        expect(fake_captcha_verification_service)
          .to receive(:execute).with(captcha_response: captcha_response, request: request) { false }
      end

      context 'when spammable attributes have not changed' do
        before do
          issue.closed_at = Time.zone.now
        end

        it 'does not create a spam log' do
          expect { subject }
            .not_to change { SpamLog.count }
        end
      end

      context 'when spammable attributes have changed' do
        let(:expected_service_check_response_message) do
          /check Issue spammable model for any errors or captcha requirement/
        end

        before do
          issue.description = 'SPAM!'
        end

        context 'if allowlisted' do
          let(:allowlisted) { true }

          it 'does not perform spam check' do
            expect(Spam::SpamVerdictService).not_to receive(:new)

            response = subject

            expect(response.message).to match(/user was allowlisted/)
          end
        end

        context 'when disallowed by the spam verdict service' do
          before do
            allow(fake_verdict_service).to receive(:execute).and_return(DISALLOW)
          end

          context 'when allow_possible_spam feature flag is false' do
            before do
              stub_feature_flags(allow_possible_spam: false)
            end

            it_behaves_like 'only checks for spam if a request is provided'

            it 'marks as spam' do
              response = subject

              expect(response.message).to match(expected_service_check_response_message)
              expect(issue).to be_spam
            end
          end

          context 'when allow_possible_spam feature flag is true' do
            it_behaves_like 'only checks for spam if a request is provided'

            it 'does not mark as spam' do
              response = subject

              expect(response.message).to match(expected_service_check_response_message)
              expect(issue).not_to be_spam
            end
          end
        end

        context 'when spam verdict service conditionally allows' do
          before do
            allow(fake_verdict_service).to receive(:execute).and_return(CONDITIONAL_ALLOW)
          end

          context 'when allow_possible_spam feature flag is false' do
            before do
              stub_feature_flags(allow_possible_spam: false)
            end

            it_behaves_like 'only checks for spam if a request is provided'

            it_behaves_like 'creates a spam log'

            it 'does not mark as spam' do
              response = subject

              expect(response.message).to match(expected_service_check_response_message)
              expect(issue).not_to be_spam
            end

            it 'marks as needing reCAPTCHA' do
              response = subject

              expect(response.message).to match(expected_service_check_response_message)
              expect(issue.needs_recaptcha?).to be_truthy
            end
          end

          context 'when allow_possible_spam feature flag is true' do
            it_behaves_like 'only checks for spam if a request is provided'

            it_behaves_like 'creates a spam log'

            it 'does not mark as needing reCAPTCHA' do
              response = subject

              expect(response.message).to match(expected_service_check_response_message)
              expect(issue.needs_recaptcha).to be_falsey
            end
          end
        end

        context 'when spam verdict service allows creation' do
          before do
            allow(fake_verdict_service).to receive(:execute).and_return(ALLOW)
          end

          it 'does not create a spam log' do
            expect { subject }
              .not_to change { SpamLog.count }
          end

          it 'clears spam flags' do
            expect(issue).to receive(:clear_spam_flags!)

            subject
          end
        end

        context 'spam verdict service options' do
          before do
            allow(fake_verdict_service).to receive(:execute) { ALLOW }
          end

          context 'when the request is nil' do
            let(:request) { nil }
            let(:issue_ip_address) { '1.2.3.4' }
            let(:issue_user_agent) { 'lynx' }
            let(:verdict_service_opts) do
              {
                ip_address: issue_ip_address,
                user_agent: issue_user_agent
              }
            end

            before do
              allow(issue).to receive(:ip_address) { issue_ip_address }
              allow(issue).to receive(:user_agent) { issue_user_agent }
            end

            it 'assembles the options with information from the spammable' do
              # TODO: This code untestable, because we do not perform a verification if there is not a
              #   request. See corresponding comment in code
              # expect(Spam::SpamVerdictService).to receive(:new).with(verdict_service_args)

              subject
            end
          end

          context 'when the request is present' do
            it 'assembles the options with information from the request' do
              expect(Spam::SpamVerdictService).to receive(:new).with(verdict_service_args)

              subject
            end
          end
        end
      end
    end
  end
end