Merge branch 'master' into fix-git-hooks-when-creating-file

* master: (1031 commits)
  Add changelog entry for renaming API param [ci skip]
  Add missing milestone parameter
  Refactor issues filter in API
  Fix project hooks params
  Gitlab::LDAP::Person uses LDAP attributes configuration
  Don't delete files from spec/fixtures
  Copy, don't move uploaded avatar files
  Minor improvements to changelog docs
  Rename logo, apply for Slack too
  Fix Gemfile.lock for the octokit update
  Fix cross-project references copy to include the project reference
  Add logo in public files
  Use stable icon for Mattermost integration
  rewrite the item.respond_to?(:x?) && item.x? to item.try(:x?)
  API: extern_uid is a string
  Increases pipeline graph drowdown width in order to prevent strange position on chrome on ubuntu
  Removed bottom padding from merge manually from CLI because of repositioning award emoji's
  Make haml_lint happy
  Improve spec
  Add feature tests for Cycle Analytics
  ...

16 files changed, 585 insertions, 238 deletions

diff --git a/spec/controllers/dashboard/todos_controller_spec.rb b/spec/controllers/dashboard/todos_controller_spec.rb
new file mode 100644
index 00000000000..288984cfba9
--- /dev/null
+++ b/spec/controllers/dashboard/todos_controller_spec.rb
@@ -0,0 +1,37 @@
+require 'spec_helper'
+
+describe Dashboard::TodosController do
+  let(:user) { create(:user) }
+  let(:project) { create(:project) }
+  let(:todo_service) { TodoService.new }
+
+  describe 'GET #index' do
+    before do
+      sign_in(user)
+      project.team << [user, :developer]
+    end
+
+    context 'when using pagination' do
+      let(:last_page) { user.todos.page().total_pages }
+      let!(:issues) { create_list(:issue, 2, project: project, assignee: user) }
+
+      before do
+        issues.each { |issue| todo_service.new_issue(issue, user) }
+        allow(Kaminari.config).to receive(:default_per_page).and_return(1)
+      end
+
+      it 'redirects to last_page if page number is larger than number of pages' do
+        get :index, page: (last_page + 1).to_param
+
+        expect(response).to redirect_to(dashboard_todos_path(page: last_page))
+      end
+
+      it 'redirects to correspondent page' do
+        get :index, page: last_page
+
+        expect(assigns(:todos).current_page).to eq(last_page)
+        expect(response).to have_http_status(200)
+      end
+    end
+  end
+end
diff --git a/spec/controllers/groups_controller_spec.rb b/spec/controllers/groups_controller_spec.rb
index a763e2c5ba8..98dfb3e5216 100644
--- a/spec/controllers/groups_controller_spec.rb
+++ b/spec/controllers/groups_controller_spec.rb
@@ -105,4 +105,25 @@ describe GroupsController do
       end
     end
   end
+
+  describe 'PUT update' do
+    before do
+      sign_in(user)
+    end
+
+    it 'updates the path succesfully' do
+      post :update, id: group.to_param, group: { path: 'new_path' }
+
+      expect(response).to have_http_status(302)
+      expect(controller).to set_flash[:notice]
+    end
+
+    it 'does not update the path on error' do
+      allow_any_instance_of(Group).to receive(:move_dir).and_raise(Gitlab::UpdatePathError)
+      post :update, id: group.to_param, group: { path: 'new_path' }
+
+      expect(assigns(:group).errors).not_to be_empty
+      expect(assigns(:group).path).not_to eq('new_path')
+    end
+  end
 end
diff --git a/spec/controllers/import/bitbucket_controller_spec.rb b/spec/controllers/import/bitbucket_controller_spec.rb
index 1d3c9fbbe2f..ce7c0b334ee 100644
--- a/spec/controllers/import/bitbucket_controller_spec.rb
+++ b/spec/controllers/import/bitbucket_controller_spec.rb
@@ -6,11 +6,11 @@ describe Import::BitbucketController do
   let(:user) { create(:user) }
   let(:token) { "asdasd12345" }
   let(:secret) { "sekrettt" }
-  let(:access_params) { { bitbucket_access_token: token, bitbucket_access_token_secret: secret } }
+  let(:refresh_token) { SecureRandom.hex(15) }
+  let(:access_params) { { token: token, expires_at: nil, expires_in: nil, refresh_token: nil } }
 
   def assign_session_tokens
-    session[:bitbucket_access_token] = token
-    session[:bitbucket_access_token_secret] = secret
+    session[:bitbucket_token] = token
   end
 
   before do
@@ -24,29 +24,36 @@ describe Import::BitbucketController do
     end
 
     it "updates access token" do
-      access_token = double(token: token, secret: secret)
-      allow_any_instance_of(Gitlab::BitbucketImport::Client).
+      expires_at = Time.now + 1.day
+      expires_in = 1.day
+      access_token = double(token: token,
+                            secret: secret,
+                            expires_at: expires_at,
+                            expires_in: expires_in,
+                            refresh_token: refresh_token)
+      allow_any_instance_of(OAuth2::Client).
         to receive(:get_token).and_return(access_token)
       stub_omniauth_provider('bitbucket')
 
       get :callback
 
-      expect(session[:bitbucket_access_token]).to eq(token)
-      expect(session[:bitbucket_access_token_secret]).to eq(secret)
+      expect(session[:bitbucket_token]).to eq(token)
+      expect(session[:bitbucket_refresh_token]).to eq(refresh_token)
+      expect(session[:bitbucket_expires_at]).to eq(expires_at)
+      expect(session[:bitbucket_expires_in]).to eq(expires_in)
       expect(controller).to redirect_to(status_import_bitbucket_url)
     end
   end
 
   describe "GET status" do
     before do
-      @repo = OpenStruct.new(slug: 'vim', owner: 'asd')
+      @repo = double(slug: 'vim', owner: 'asd', full_name: 'asd/vim', "valid?" => true)
       assign_session_tokens
     end
 
     it "assigns variables" do
       @project = create(:project, import_type: 'bitbucket', creator_id: user.id)
-      client = stub_client(projects: [@repo])
-      allow(client).to receive(:incompatible_projects).and_return([])
+      allow_any_instance_of(Bitbucket::Client).to receive(:repos).and_return([@repo])
 
       get :status
 
@@ -57,7 +64,7 @@ describe Import::BitbucketController do
 
     it "does not show already added project" do
       @project = create(:project, import_type: 'bitbucket', creator_id: user.id, import_source: 'asd/vim')
-      stub_client(projects: [@repo])
+      allow_any_instance_of(Bitbucket::Client).to receive(:repos).and_return([@repo])
 
       get :status
 
@@ -70,19 +77,16 @@ describe Import::BitbucketController do
     let(:bitbucket_username) { user.username }
 
     let(:bitbucket_user) do
-      { user: { username: bitbucket_username } }.with_indifferent_access
+      double(username: bitbucket_username)
     end
 
     let(:bitbucket_repo) do
-      { slug: "vim", owner: bitbucket_username }.with_indifferent_access
+      double(slug: "vim", owner: bitbucket_username, name: 'vim')
     end
 
     before do
-      allow(Gitlab::BitbucketImport::KeyAdder).
-        to receive(:new).with(bitbucket_repo, user, access_params).
-        and_return(double(execute: true))
-
-      stub_client(user: bitbucket_user, project: bitbucket_repo)
+      allow_any_instance_of(Bitbucket::Client).to receive(:repo).and_return(bitbucket_repo)
+      allow_any_instance_of(Bitbucket::Client).to receive(:user).and_return(bitbucket_user)
       assign_session_tokens
     end
 
@@ -90,7 +94,7 @@ describe Import::BitbucketController do
       context "when the Bitbucket user and GitLab user's usernames match" do
         it "takes the current user's namespace" do
           expect(Gitlab::BitbucketImport::ProjectCreator).
-            to receive(:new).with(bitbucket_repo, user.namespace, user, access_params).
+            to receive(:new).with(bitbucket_repo, bitbucket_repo.name, user.namespace, user, access_params).
             and_return(double(execute: true))
 
           post :create, format: :js
@@ -102,7 +106,7 @@ describe Import::BitbucketController do
 
         it "takes the current user's namespace" do
           expect(Gitlab::BitbucketImport::ProjectCreator).
-            to receive(:new).with(bitbucket_repo, user.namespace, user, access_params).
+            to receive(:new).with(bitbucket_repo, bitbucket_repo.name, user.namespace, user, access_params).
             and_return(double(execute: true))
 
           post :create, format: :js
@@ -114,7 +118,7 @@ describe Import::BitbucketController do
       let(:other_username) { "someone_else" }
 
       before do
-        bitbucket_repo["owner"] = other_username
+        allow(bitbucket_repo).to receive(:owner).and_return(other_username)
       end
 
       context "when a namespace with the Bitbucket user's username already exists" do
@@ -123,7 +127,7 @@ describe Import::BitbucketController do
         context "when the namespace is owned by the GitLab user" do
           it "takes the existing namespace" do
             expect(Gitlab::BitbucketImport::ProjectCreator).
-              to receive(:new).with(bitbucket_repo, existing_namespace, user, access_params).
+              to receive(:new).with(bitbucket_repo, bitbucket_repo.name, existing_namespace, user, access_params).
               and_return(double(execute: true))
 
             post :create, format: :js
@@ -156,7 +160,7 @@ describe Import::BitbucketController do
 
           it "takes the new namespace" do
             expect(Gitlab::BitbucketImport::ProjectCreator).
-              to receive(:new).with(bitbucket_repo, an_instance_of(Group), user, access_params).
+              to receive(:new).with(bitbucket_repo, bitbucket_repo.name, an_instance_of(Group), user, access_params).
               and_return(double(execute: true))
 
             post :create, format: :js
@@ -177,7 +181,7 @@ describe Import::BitbucketController do
 
           it "takes the current user's namespace" do
             expect(Gitlab::BitbucketImport::ProjectCreator).
-              to receive(:new).with(bitbucket_repo, user.namespace, user, access_params).
+              to receive(:new).with(bitbucket_repo, bitbucket_repo.name, user.namespace, user, access_params).
               and_return(double(execute: true))
 
             post :create, format: :js
diff --git a/spec/controllers/import/gitea_controller_spec.rb b/spec/controllers/import/gitea_controller_spec.rb
new file mode 100644
index 00000000000..5ba64ab3eed
--- /dev/null
+++ b/spec/controllers/import/gitea_controller_spec.rb
@@ -0,0 +1,43 @@
+require 'spec_helper'
+
+describe Import::GiteaController do
+  include ImportSpecHelper
+
+  let(:provider) { :gitea }
+  let(:host_url) { 'https://try.gitea.io' }
+
+  include_context 'a GitHub-ish import controller'
+
+  def assign_host_url
+    session[:gitea_host_url] = host_url
+  end
+
+  describe "GET new" do
+    it_behaves_like 'a GitHub-ish import controller: GET new' do
+      before do
+        assign_host_url
+      end
+    end
+  end
+
+  describe "POST personal_access_token" do
+    it_behaves_like 'a GitHub-ish import controller: POST personal_access_token'
+  end
+
+  describe "GET status" do
+    it_behaves_like 'a GitHub-ish import controller: GET status' do
+      before do
+        assign_host_url
+      end
+      let(:extra_assign_expectations) { { gitea_host_url: host_url } }
+    end
+  end
+
+  describe 'POST create' do
+    it_behaves_like 'a GitHub-ish import controller: POST create' do
+      before do
+        assign_host_url
+      end
+    end
+  end
+end
diff --git a/spec/controllers/import/github_controller_spec.rb b/spec/controllers/import/github_controller_spec.rb
index 4f96567192d..95696e14b6c 100644
--- a/spec/controllers/import/github_controller_spec.rb
+++ b/spec/controllers/import/github_controller_spec.rb
@@ -3,34 +3,18 @@ require 'spec_helper'
 describe Import::GithubController do
   include ImportSpecHelper
 
-  let(:user) { create(:user) }
-  let(:token) { "asdasd12345" }
-  let(:access_params) { { github_access_token: token } }
+  let(:provider) { :github }
 
-  def assign_session_token
-    session[:github_access_token] = token
-  end
-
-  before do
-    sign_in(user)
-    allow(controller).to receive(:github_import_enabled?).and_return(true)
-  end
+  include_context 'a GitHub-ish import controller'
 
   describe "GET new" do
-    it "redirects to GitHub for an access token if logged in with GitHub" do
-      allow(controller).to receive(:logged_in_with_github?).and_return(true)
-      expect(controller).to receive(:go_to_github_for_permissions)
+    it_behaves_like 'a GitHub-ish import controller: GET new'
 
-      get :new
-    end
-
-    it "redirects to status if we already have a token" do
-      assign_session_token
-      allow(controller).to receive(:logged_in_with_github?).and_return(false)
+    it "redirects to GitHub for an access token if logged in with GitHub" do
+      allow(controller).to receive(:logged_in_with_provider?).and_return(true)
+      expect(controller).to receive(:go_to_provider_for_permissions)
 
       get :new
-
-      expect(controller).to redirect_to(status_import_github_url)
     end
   end
 
@@ -51,196 +35,14 @@ describe Import::GithubController do
   end
 
   describe "POST personal_access_token" do
-    it "updates access token" do
-      token = "asdfasdf9876"
-
-      allow_any_instance_of(Gitlab::GithubImport::Client).
-        to receive(:user).and_return(true)
-
-      post :personal_access_token, personal_access_token: token
-
-      expect(session[:github_access_token]).to eq(token)
-      expect(controller).to redirect_to(status_import_github_url)
-    end
+    it_behaves_like 'a GitHub-ish import controller: POST personal_access_token'
   end
 
   describe "GET status" do
-    before do
-      @repo = OpenStruct.new(login: 'vim', full_name: 'asd/vim')
-      @org = OpenStruct.new(login: 'company')
-      @org_repo = OpenStruct.new(login: 'company', full_name: 'company/repo')
-      assign_session_token
-    end
-
-    it "assigns variables" do
-      @project = create(:project, import_type: 'github', creator_id: user.id)
-      stub_client(repos: [@repo, @org_repo], orgs: [@org], org_repos: [@org_repo])
-
-      get :status
-
-      expect(assigns(:already_added_projects)).to eq([@project])
-      expect(assigns(:repos)).to eq([@repo, @org_repo])
-    end
-
-    it "does not show already added project" do
-      @project = create(:project, import_type: 'github', creator_id: user.id, import_source: 'asd/vim')
-      stub_client(repos: [@repo], orgs: [])
-
-      get :status
-
-      expect(assigns(:already_added_projects)).to eq([@project])
-      expect(assigns(:repos)).to eq([])
-    end
-
-    it "handles an invalid access token" do
-      allow_any_instance_of(Gitlab::GithubImport::Client).
-        to receive(:repos).and_raise(Octokit::Unauthorized)
-
-      get :status
-
-      expect(session[:github_access_token]).to eq(nil)
-      expect(controller).to redirect_to(new_import_github_url)
-      expect(flash[:alert]).to eq('Access denied to your GitHub account.')
-    end
+    it_behaves_like 'a GitHub-ish import controller: GET status'
   end
 
   describe "POST create" do
-    let(:github_username) { user.username }
-    let(:github_user) { OpenStruct.new(login: github_username) }
-    let(:github_repo) do
-      OpenStruct.new(
-        name: 'vim',
-        full_name: "#{github_username}/vim",
-        owner: OpenStruct.new(login: github_username)
-      )
-    end
-
-    before do
-      stub_client(user: github_user, repo: github_repo)
-      assign_session_token
-    end
-
-    context "when the repository owner is the GitHub user" do
-      context "when the GitHub user and GitLab user's usernames match" do
-        it "takes the current user's namespace" do
-          expect(Gitlab::GithubImport::ProjectCreator).
-            to receive(:new).with(github_repo, github_repo.name, user.namespace, user, access_params).
-              and_return(double(execute: true))
-
-          post :create, format: :js
-        end
-      end
-
-      context "when the GitHub user and GitLab user's usernames don't match" do
-        let(:github_username) { "someone_else" }
-
-        it "takes the current user's namespace" do
-          expect(Gitlab::GithubImport::ProjectCreator).
-            to receive(:new).with(github_repo, github_repo.name, user.namespace, user, access_params).
-              and_return(double(execute: true))
-
-          post :create, format: :js
-        end
-      end
-    end
-
-    context "when the repository owner is not the GitHub user" do
-      let(:other_username) { "someone_else" }
-
-      before do
-        github_repo.owner = OpenStruct.new(login: other_username)
-        assign_session_token
-      end
-
-      context "when a namespace with the GitHub user's username already exists" do
-        let!(:existing_namespace) { create(:namespace, name: other_username, owner: user) }
-
-        context "when the namespace is owned by the GitLab user" do
-          it "takes the existing namespace" do
-            expect(Gitlab::GithubImport::ProjectCreator).
-              to receive(:new).with(github_repo, github_repo.name, existing_namespace, user, access_params).
-                and_return(double(execute: true))
-
-            post :create, format: :js
-          end
-        end
-
-        context "when the namespace is not owned by the GitLab user" do
-          before do
-            existing_namespace.owner = create(:user)
-            existing_namespace.save
-          end
-
-          it "creates a project using user's namespace" do
-            expect(Gitlab::GithubImport::ProjectCreator).
-              to receive(:new).with(github_repo, github_repo.name, user.namespace, user, access_params).
-                and_return(double(execute: true))
-
-            post :create, format: :js
-          end
-        end
-      end
-
-      context "when a namespace with the GitHub user's username doesn't exist" do
-        context "when current user can create namespaces" do
-          it "creates the namespace" do
-            expect(Gitlab::GithubImport::ProjectCreator).
-              to receive(:new).and_return(double(execute: true))
-
-            expect { post :create, target_namespace: github_repo.name, format: :js }.to change(Namespace, :count).by(1)
-          end
-
-          it "takes the new namespace" do
-            expect(Gitlab::GithubImport::ProjectCreator).
-              to receive(:new).with(github_repo, github_repo.name, an_instance_of(Group), user, access_params).
-              and_return(double(execute: true))
-
-            post :create, target_namespace: github_repo.name, format: :js
-          end
-        end
-
-        context "when current user can't create namespaces" do
-          before do
-            user.update_attribute(:can_create_group, false)
-          end
-
-          it "doesn't create the namespace" do
-            expect(Gitlab::GithubImport::ProjectCreator).
-              to receive(:new).and_return(double(execute: true))
-
-            expect { post :create, format: :js }.not_to change(Namespace, :count)
-          end
-
-          it "takes the current user's namespace" do
-            expect(Gitlab::GithubImport::ProjectCreator).
-              to receive(:new).with(github_repo, github_repo.name, user.namespace, user, access_params).
-              and_return(double(execute: true))
-
-            post :create, format: :js
-          end
-        end
-      end
-
-      context 'user has chosen a namespace and name for the project' do
-        let(:test_namespace) { create(:namespace, name: 'test_namespace', owner: user) }
-        let(:test_name) { 'test_name' }
-
-        it 'takes the selected namespace and name' do
-          expect(Gitlab::GithubImport::ProjectCreator).
-            to receive(:new).with(github_repo, test_name, test_namespace, user, access_params).
-              and_return(double(execute: true))
-
-          post :create, { target_namespace: test_namespace.name, new_name: test_name, format: :js }
-        end
-
-        it 'takes the selected name and default namespace' do
-          expect(Gitlab::GithubImport::ProjectCreator).
-            to receive(:new).with(github_repo, test_name, user.namespace, user, access_params).
-              and_return(double(execute: true))
-
-          post :create, { new_name: test_name, format: :js }
-        end
-      end
-    end
+    it_behaves_like 'a GitHub-ish import controller: POST create'
   end
 end
diff --git a/spec/controllers/profiles/personal_access_tokens_spec.rb b/spec/controllers/profiles/personal_access_tokens_spec.rb
new file mode 100644
index 00000000000..45534a3a587
--- /dev/null
+++ b/spec/controllers/profiles/personal_access_tokens_spec.rb
@@ -0,0 +1,49 @@
+require 'spec_helper'
+
+describe Profiles::PersonalAccessTokensController do
+  let(:user) { create(:user) }
+
+  describe '#create' do
+    def created_token
+      PersonalAccessToken.order(:created_at).last
+    end
+
+    before { sign_in(user) }
+
+    it "allows creation of a token" do
+      name = FFaker::Product.brand
+
+      post :create, personal_access_token: { name: name }
+
+      expect(created_token).not_to be_nil
+      expect(created_token.name).to eq(name)
+      expect(created_token.expires_at).to be_nil
+      expect(PersonalAccessToken.active).to include(created_token)
+    end
+
+    it "allows creation of a token with an expiry date" do
+      expires_at = 5.days.from_now
+
+      post :create, personal_access_token: { name: FFaker::Product.brand, expires_at: expires_at }
+
+      expect(created_token).not_to be_nil
+      expect(created_token.expires_at.to_i).to eq(expires_at.to_i)
+    end
+
+    context "scopes" do
+      it "allows creation of a token with scopes" do
+        post :create, personal_access_token: { name: FFaker::Product.brand, scopes: ['api', 'read_user'] }
+
+        expect(created_token).not_to be_nil
+        expect(created_token.scopes).to eq(['api', 'read_user'])
+      end
+
+      it "allows creation of a token with no scopes" do
+        post :create, personal_access_token: { name: FFaker::Product.brand, scopes: [] }
+
+        expect(created_token).not_to be_nil
+        expect(created_token.scopes).to eq([])
+      end
+    end
+  end
+end
diff --git a/spec/controllers/projects/blame_controller_spec.rb b/spec/controllers/projects/blame_controller_spec.rb
index 25f06299a29..4402ca43c65 100644
--- a/spec/controllers/projects/blame_controller_spec.rb
+++ b/spec/controllers/projects/blame_controller_spec.rb
@@ -25,5 +25,10 @@ describe Projects::BlameController do
       let(:id) { 'master/files/ruby/popen.rb' }
       it { is_expected.to respond_with(:success) }
     end
+
+    context "invalid file" do
+      let(:id) { 'master/files/ruby/missing_file.rb'}
+      it { expect(response).to have_http_status(404) }
+    end
   end
 end
diff --git a/spec/controllers/projects/blob_controller_spec.rb b/spec/controllers/projects/blob_controller_spec.rb
index 3efef757ae2..f35c5d992d9 100644
--- a/spec/controllers/projects/blob_controller_spec.rb
+++ b/spec/controllers/projects/blob_controller_spec.rb
@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 describe Projects::BlobController do
-  let(:project) { create(:project) }
+  let(:project) { create(:project, :public) }
   let(:user)    { create(:user) }
 
   before do
@@ -84,5 +84,35 @@ describe Projects::BlobController do
         end
       end
     end
+
+    context 'when user has forked project' do
+      let(:guest) { create(:user) }
+      let!(:forked_project) { Projects::ForkService.new(project, guest).execute }
+      let!(:merge_request) { create(:merge_request, source_project: project, target_project: project, source_branch: "fork-test-1", target_branch: "master") }
+
+      before { sign_in(guest) }
+
+      it "redirects to forked project new merge request" do
+        default_params[:target_branch] = "fork-test-1"
+        default_params[:create_merge_request] = 1
+
+        allow_any_instance_of(Files::UpdateService).to receive(:commit).and_return(:success)
+
+        put :update, default_params
+
+        expect(response).to redirect_to(
+          new_namespace_project_merge_request_path(
+            forked_project.namespace,
+            forked_project,
+            merge_request: {
+              source_project_id: forked_project.id,
+              target_project_id: project.id,
+              source_branch: "fork-test-1",
+              target_branch: "master"
+            }
+          )
+        )
+      end
+    end
   end
 end
diff --git a/spec/controllers/projects/environments_controller_spec.rb b/spec/controllers/projects/environments_controller_spec.rb
index bc5e2711125..7ac1d62d1b1 100644
--- a/spec/controllers/projects/environments_controller_spec.rb
+++ b/spec/controllers/projects/environments_controller_spec.rb
@@ -71,6 +71,75 @@ describe Projects::EnvironmentsController do
     end
   end
 
+  describe 'GET #terminal' do
+    context 'with valid id' do
+      it 'responds with a status code 200' do
+        get :terminal, environment_params
+
+        expect(response).to have_http_status(200)
+      end
+
+      it 'loads the terminals for the enviroment' do
+        expect_any_instance_of(Environment).to receive(:terminals)
+
+        get :terminal, environment_params
+      end
+    end
+
+    context 'with invalid id' do
+      it 'responds with a status code 404' do
+        get :terminal, environment_params(id: 666)
+
+        expect(response).to have_http_status(404)
+      end
+    end
+  end
+
+  describe 'GET #terminal_websocket_authorize' do
+    context 'with valid workhorse signature' do
+      before do
+        allow(Gitlab::Workhorse).to receive(:verify_api_request!).and_return(nil)
+      end
+
+      context 'and valid id' do
+        it 'returns the first terminal for the environment' do
+          expect_any_instance_of(Environment).
+            to receive(:terminals).
+            and_return([:fake_terminal])
+
+          expect(Gitlab::Workhorse).
+            to receive(:terminal_websocket).
+            with(:fake_terminal).
+            and_return(workhorse: :response)
+
+          get :terminal_websocket_authorize, environment_params
+
+          expect(response).to have_http_status(200)
+          expect(response.headers["Content-Type"]).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE)
+          expect(response.body).to eq('{"workhorse":"response"}')
+        end
+      end
+
+      context 'and invalid id' do
+        it 'returns 404' do
+          get :terminal_websocket_authorize, environment_params(id: 666)
+
+          expect(response).to have_http_status(404)
+        end
+      end
+    end
+
+    context 'with invalid workhorse signature' do
+      it 'aborts with an exception' do
+        allow(Gitlab::Workhorse).to receive(:verify_api_request!).and_raise(JWT::DecodeError)
+
+        expect { get :terminal_websocket_authorize, environment_params }.to raise_error(JWT::DecodeError)
+        # controller tests don't set the response status correctly. It's enough
+        # to check that the action raised an exception
+      end
+    end
+  end
+
   def environment_params(opts = {})
     opts.reverse_merge(namespace_id: project.namespace,
                        project_id: project,
diff --git a/spec/controllers/projects/issues_controller_spec.rb b/spec/controllers/projects/issues_controller_spec.rb
index dbe5ddccbcf..e2321f2034b 100644
--- a/spec/controllers/projects/issues_controller_spec.rb
+++ b/spec/controllers/projects/issues_controller_spec.rb
@@ -52,6 +52,36 @@ describe Projects::IssuesController do
         expect(response).to have_http_status(404)
       end
     end
+
+    context 'with page param' do
+      let(:last_page) { project.issues.page().total_pages }
+      let!(:issue_list) { create_list(:issue, 2, project: project) }
+
+      before do
+        sign_in(user)
+        project.team << [user, :developer]
+        allow(Kaminari.config).to receive(:default_per_page).and_return(1)
+      end
+
+      it 'redirects to last_page if page number is larger than number of pages' do
+        get :index,
+          namespace_id: project.namespace.path.to_param,
+          project_id: project.path.to_param,
+          page: (last_page + 1).to_param
+
+        expect(response).to redirect_to(namespace_project_issues_path(page: last_page, state: controller.params[:state], scope: controller.params[:scope]))
+      end
+
+      it 'redirects to specified page' do
+        get :index,
+          namespace_id: project.namespace.path.to_param,
+          project_id: project.path.to_param,
+          page: last_page.to_param
+
+        expect(assigns(:issues).current_page).to eq(last_page)
+        expect(response).to have_http_status(200)
+      end
+    end
   end
 
   describe 'GET #new' do
diff --git a/spec/controllers/projects/mattermosts_controller_spec.rb b/spec/controllers/projects/mattermosts_controller_spec.rb
new file mode 100644
index 00000000000..2ae635a1244
--- /dev/null
+++ b/spec/controllers/projects/mattermosts_controller_spec.rb
@@ -0,0 +1,58 @@
+require 'spec_helper'
+
+describe Projects::MattermostsController do
+  let!(:project) { create(:empty_project) }
+  let!(:user) { create(:user) }
+
+  before do
+    project.team << [user, :master]
+    sign_in(user)
+  end
+
+  describe 'GET #new' do
+    before do
+      allow_any_instance_of(MattermostSlashCommandsService).
+        to receive(:list_teams).and_return([])
+
+      get(:new,
+          namespace_id: project.namespace.to_param,
+          project_id: project.to_param)
+    end
+
+    it 'accepts the request' do
+      expect(response).to have_http_status(200)
+    end
+  end
+
+  describe 'POST #create' do
+    let(:mattermost_params) { { trigger: 'http://localhost:3000/trigger', team_id: 'abc' } }
+
+    subject do
+      post(:create,
+           namespace_id: project.namespace.to_param,
+           project_id: project.to_param,
+           mattermost: mattermost_params)
+    end
+
+    context 'no request can be made to mattermost' do
+      it 'shows the error' do
+        allow_any_instance_of(MattermostSlashCommandsService).to receive(:configure).and_return([false, "error message"])
+
+        expect(subject).to redirect_to(new_namespace_project_mattermost_url(project.namespace, project))
+      end
+    end
+
+    context 'the request is succesull' do
+      before do
+        allow_any_instance_of(Mattermost::Command).to receive(:create).and_return('token')
+      end
+
+      it 'redirects to the new page' do
+        subject
+        service = project.services.last
+
+        expect(subject).to redirect_to(edit_namespace_project_service_url(project.namespace, project, service))
+      end
+    end
+  end
+end
diff --git a/spec/controllers/projects/merge_requests_controller_spec.rb b/spec/controllers/projects/merge_requests_controller_spec.rb
index 9e0b80205d8..2a411d78395 100644
--- a/spec/controllers/projects/merge_requests_controller_spec.rb
+++ b/spec/controllers/projects/merge_requests_controller_spec.rb
@@ -127,11 +127,29 @@ describe Projects::MergeRequestsController do
   end
 
   describe 'GET index' do
-    def get_merge_requests
+    def get_merge_requests(page = nil)
       get :index,
           namespace_id: project.namespace.to_param,
           project_id: project.to_param,
-          state: 'opened'
+          state: 'opened', page: page.to_param
+    end
+
+    context 'when page param' do
+      let(:last_page) { project.merge_requests.page().total_pages }
+      let!(:merge_request) { create(:merge_request_with_diffs, target_project: project, source_project: project) }
+
+      it 'redirects to last_page if page number is larger than number of pages' do
+        get_merge_requests(last_page + 1)
+
+        expect(response).to redirect_to(namespace_project_merge_requests_path(page: last_page, state: controller.params[:state], scope: controller.params[:scope]))
+      end
+
+      it 'redirects to specified page' do
+        get_merge_requests(last_page)
+
+        expect(assigns(:merge_requests).current_page).to eq(last_page)
+        expect(response).to have_http_status(200)
+      end
     end
 
     context 'when filtering by opened state' do
@@ -649,10 +667,6 @@ describe Projects::MergeRequestsController do
     end
   end
 
-  describe 'GET builds' do
-    it_behaves_like "loads labels", :builds
-  end
-
   describe 'GET pipelines' do
     it_behaves_like "loads labels", :pipelines
   end
diff --git a/spec/controllers/projects/pipelines_controller_spec.rb b/spec/controllers/projects/pipelines_controller_spec.rb
new file mode 100644
index 00000000000..5fe7e6407cc
--- /dev/null
+++ b/spec/controllers/projects/pipelines_controller_spec.rb
@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe Projects::PipelinesController do
+  include ApiHelpers
+
+  let(:user) { create(:user) }
+  let(:project) { create(:empty_project, :public) }
+  let(:pipeline) { create(:ci_pipeline, project: project) }
+
+  before do
+    sign_in(user)
+  end
+
+  describe 'GET stages.json' do
+    context 'when accessing existing stage' do
+      before do
+        create(:ci_build, pipeline: pipeline, stage: 'build')
+
+        get_stage('build')
+      end
+
+      it 'returns html source for stage dropdown' do
+        expect(response).to have_http_status(:ok)
+        expect(response).to render_template('projects/pipelines/_stage')
+        expect(json_response).to include('html')
+      end
+    end
+
+    context 'when accessing unknown stage' do
+      before do
+        get_stage('test')
+      end
+
+      it 'responds with not found' do
+        expect(response).to have_http_status(:not_found)
+      end
+    end
+
+    def get_stage(name)
+      get :stage, namespace_id: project.namespace.path,
+                  project_id: project.path,
+                  id: pipeline.id,
+                  stage: name,
+                  format: :json
+    end
+  end
+end
diff --git a/spec/controllers/projects/releases_controller_spec.rb b/spec/controllers/projects/releases_controller_spec.rb
new file mode 100644
index 00000000000..9fd5c3b85f6
--- /dev/null
+++ b/spec/controllers/projects/releases_controller_spec.rb
@@ -0,0 +1,55 @@
+require 'spec_helper'
+
+describe Projects::ReleasesController do
+  let!(:project) { create(:project) }
+  let!(:user)    { create(:user) }
+  let!(:release) { create(:release, project: project) }
+  let!(:tag)     { release.tag }
+
+  before do
+    project.team << [user, :developer]
+    sign_in(user)
+  end
+
+  describe 'GET #edit' do
+    it 'initializes a new release' do
+      tag_id = release.tag
+      project.releases.destroy_all
+
+      get :edit, namespace_id: project.namespace.path, project_id: project.path, tag_id: tag_id
+
+      release = assigns(:release)
+      expect(release).not_to be_nil
+      expect(release).not_to be_persisted
+    end
+
+    it 'retrieves an existing release' do
+      get :edit, namespace_id: project.namespace.path, project_id: project.path, tag_id: release.tag
+
+      release = assigns(:release)
+      expect(release).not_to be_nil
+      expect(release).to be_persisted
+    end
+  end
+
+  describe 'PUT #update' do
+    it 'updates release note description' do
+      update_release('description updated')
+
+      release = project.releases.find_by_tag(tag)
+      expect(release.description).to eq("description updated")
+    end
+
+    it 'deletes release note when description is null' do
+      expect { update_release('') }.to change(project.releases, :count).by(-1)
+    end
+  end
+
+  def update_release(description)
+    put :update,
+      namespace_id: project.namespace.to_param,
+      project_id: project.to_param,
+      tag_id: release.tag,
+      release: { description: description }
+  end
+end
diff --git a/spec/controllers/projects/snippets_controller_spec.rb b/spec/controllers/projects/snippets_controller_spec.rb
index 72a3ebf2ebd..32b0e42c3cd 100644
--- a/spec/controllers/projects/snippets_controller_spec.rb
+++ b/spec/controllers/projects/snippets_controller_spec.rb
@@ -11,6 +11,28 @@ describe Projects::SnippetsController do
   end
 
   describe 'GET #index' do
+    context 'when page param' do
+      let(:last_page) { project.snippets.page().total_pages }
+      let!(:project_snippet) { create(:project_snippet, :public, project: project, author: user) }
+
+      it 'redirects to last_page if page number is larger than number of pages' do
+        get :index,
+          namespace_id: project.namespace.path,
+          project_id: project.path, page: (last_page + 1).to_param
+
+        expect(response).to redirect_to(namespace_project_snippets_path(page: last_page))
+      end
+
+      it 'redirects to specified page' do
+        get :index,
+          namespace_id: project.namespace.path,
+          project_id: project.path, page: last_page.to_param
+
+        expect(assigns(:snippets).current_page).to eq(last_page)
+        expect(response).to have_http_status(200)
+      end
+    end
+
     context 'when the project snippet is private' do
       let!(:project_snippet) { create(:project_snippet, :private, project: project, author: user) }
 
diff --git a/spec/controllers/search_controller_spec.rb b/spec/controllers/search_controller_spec.rb
new file mode 100644
index 00000000000..b7bb9290712
--- /dev/null
+++ b/spec/controllers/search_controller_spec.rb
@@ -0,0 +1,61 @@
+require 'spec_helper'
+
+describe SearchController do
+  let(:user)    { create(:user) }
+  let(:project) { create(:empty_project, :public) }
+
+  before do
+    sign_in(user)
+  end
+
+  it 'finds issue comments' do
+    project = create(:empty_project, :public)
+    note = create(:note_on_issue, project: project)
+
+    get :show, project_id: project.id, scope: 'notes', search: note.note
+
+    expect(assigns[:search_objects].first).to eq note
+  end
+
+  context 'on restricted projects' do
+    context 'when signed out' do
+      before { sign_out(user) }
+
+      it "doesn't expose comments on issues" do
+        project = create(:empty_project, :public, issues_access_level: ProjectFeature::PRIVATE)
+        note = create(:note_on_issue, project: project)
+
+        get :show, project_id: project.id, scope: 'notes', search: note.note
+
+        expect(assigns[:search_objects].count).to eq(0)
+      end
+    end
+
+    it "doesn't expose comments on issues" do
+      project = create(:empty_project, :public, issues_access_level: ProjectFeature::PRIVATE)
+      note = create(:note_on_issue, project: project)
+
+      get :show, project_id: project.id, scope: 'notes', search: note.note
+
+      expect(assigns[:search_objects].count).to eq(0)
+    end
+
+    it "doesn't expose comments on merge_requests" do
+      project = create(:empty_project, :public, merge_requests_access_level: ProjectFeature::PRIVATE)
+      note = create(:note_on_merge_request, project: project)
+
+      get :show, project_id: project.id, scope: 'notes', search: note.note
+
+      expect(assigns[:search_objects].count).to eq(0)
+    end
+
+    it "doesn't expose comments on snippets" do
+      project = create(:empty_project, :public, snippets_access_level: ProjectFeature::PRIVATE)
+      note = create(:note_on_project_snippet, project: project)
+
+      get :show, project_id: project.id, scope: 'notes', search: note.note
+
+      expect(assigns[:search_objects].count).to eq(0)
+    end
+  end
+end