Merge remote-tracking branch 'upstream/master' into qa-deploy-key-scenario

* upstream/master: (106 commits)
  Remove callback as we already update accordingly on services
  added missing imports
  correctly imports performance bar
  Added imports for dispatcher routes
  Make the exposing of the Application secret more explicit
  Add documentation about when the application API was added
  Add application create API
  Return a blank JSON response for a missing .js file to prevent Rails CSRF errors
  add CHANGELOG.md entry for !15804
  disable CopyAsGFM on iOS due to bug in webkit
  Update changelog
  GitalyClient::ConflictsService#conflicts? should return true for conflicts with missing side
  Return more consistent values for merge_status on MR API
  Fix a migration spec messing up the MergeRequestDiff DB schema
  Backport changes to Gitlab::Checks::ChangeAccess from EE
  remove webpack bundle tag for monitoring:environments:metrics
  Set timezone for karma to UTC
  Upgrade jasmine + raven to newer versions
  Ensure Gitaly Ruby gems are installed using the correct Gemfile and at the correct location
  Clarify that a feature that isn't in review by the 1st or 3rd doesn't necessarily miss the freeze
  ...

1 files changed, 42 insertions, 0 deletions

diff --git a/qa/qa/specs/features/api/users_spec.rb b/qa/qa/specs/features/api/users_spec.rb
new file mode 100644
index 00000000000..9d039590a0e
--- /dev/null
+++ b/qa/qa/specs/features/api/users_spec.rb
@@ -0,0 +1,42 @@
+module QA
+  feature 'API users', :core do
+    before(:context) do
+      @api_client = Runtime::API::Client.new(:gitlab)
+    end
+
+    context 'when authenticated' do
+      let(:request) { Runtime::API::Request.new(@api_client, '/users') }
+
+      scenario 'get list of users' do
+        get request.url
+
+        expect_status(200)
+      end
+
+      scenario 'submit request with a valid user name' do
+        get request.url, { params: { username: 'root' } }
+
+        expect_status(200)
+        expect(json_body).to be_an Array
+        expect(json_body.size).to eq(1)
+        expect(json_body.first[:username]).to eq Runtime::User.name
+      end
+
+      scenario 'submit request with an invalid user name' do
+        get request.url, { params: { username: 'invalid' } }
+
+        expect_status(200)
+        expect(json_body).to be_an Array
+        expect(json_body.size).to eq(0)
+      end
+    end
+
+    scenario 'submit request with an invalid token' do
+      request = Runtime::API::Request.new(@api_client, '/users', personal_access_token: 'invalid')
+
+      get request.url
+
+      expect_status(401)
+    end
+  end
+end