Merge branch 'create-live-trace-only-if-job-is-complete' into 'master'

Append trace chunk only if job is running

Closes #46383

See merge request gitlab-org/gitlab-ce!18969

3 files changed, 22 insertions, 0 deletions

diff --git a/changelogs/unreleased/create-live-trace-only-if-job-is-complete.yml b/changelogs/unreleased/create-live-trace-only-if-job-is-complete.yml
new file mode 100644
index 00000000000..f32c70cf884
--- /dev/null
+++ b/changelogs/unreleased/create-live-trace-only-if-job-is-complete.yml
@@ -0,0 +1,5 @@
+---
+title: Forbid to patch traces for finished jobs
+merge_request: 18969
+author:
+type: fixed
diff --git a/lib/api/runner.rb b/lib/api/runner.rb
index 649feba1036..a7f1cb1131f 100644
--- a/lib/api/runner.rb
+++ b/lib/api/runner.rb
@@ -149,6 +149,7 @@ module API
       end
       patch '/:id/trace' do
         job = authenticate_job!
+        forbidden!('Job is not running') unless job.running?
 
         error!('400 Missing header Content-Range', 400) unless request.headers.key?('Content-Range')
         content_range = request.headers['Content-Range']
diff --git a/spec/requests/api/runner_spec.rb b/spec/requests/api/runner_spec.rb
index da392c5ab81..efb9bddde44 100644
--- a/spec/requests/api/runner_spec.rb
+++ b/spec/requests/api/runner_spec.rb
@@ -918,6 +918,22 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
             expect(job.reload.trace.raw).to eq 'BUILD TRACE appended appended'
           end
 
+          context 'when job is cancelled' do
+            before do
+              job.cancel
+            end
+
+            context 'when trace is patched' do
+              before do
+                patch_the_trace
+              end
+
+              it 'returns Forbidden ' do
+                expect(response.status).to eq(403)
+              end
+            end
+          end
+
           context 'when redis data are flushed' do
             before do
               redis_shared_state_cleanup!