Merge branch 'master' into bvl-group-trees

14 files changed, 640 insertions, 60 deletions

diff --git a/spec/controllers/admin/users_controller_spec.rb b/spec/controllers/admin/users_controller_spec.rb
index aadd3317875..25fe547ff37 100644
--- a/spec/controllers/admin/users_controller_spec.rb
+++ b/spec/controllers/admin/users_controller_spec.rb
@@ -2,7 +2,7 @@ require 'spec_helper'
 
 describe Admin::UsersController do
   let(:user) { create(:user) }
-  let(:admin) { create(:admin) }
+  set(:admin) { create(:admin) }
 
   before do
     sign_in(admin)
diff --git a/spec/controllers/dashboard/todos_controller_spec.rb b/spec/controllers/dashboard/todos_controller_spec.rb
index c8c6b9f41bf..9df4ebf2fa0 100644
--- a/spec/controllers/dashboard/todos_controller_spec.rb
+++ b/spec/controllers/dashboard/todos_controller_spec.rb
@@ -57,7 +57,7 @@ describe Dashboard::TodosController do
         expect(response).to redirect_to(dashboard_todos_path(page: last_page))
       end
 
-      it 'redirects to correspondent page' do
+      it 'goes to the correct page' do
         get :index, page: last_page
 
         expect(assigns(:todos).current_page).to eq(last_page)
@@ -70,6 +70,30 @@ describe Dashboard::TodosController do
 
         expect(response).to redirect_to(dashboard_todos_path(page: last_page))
       end
+
+      context 'when providing no filters' do
+        it 'does not perform a query to get the page count, but gets that from the user' do
+          allow(controller).to receive(:current_user).and_return(user)
+
+          expect(user).to receive(:todos_pending_count).and_call_original
+
+          get :index, page: (last_page + 1).to_param, sort: :created_asc
+
+          expect(response).to redirect_to(dashboard_todos_path(page: last_page, sort: :created_asc))
+        end
+      end
+
+      context 'when providing filters' do
+        it 'performs a query to get the correct page count' do
+          allow(controller).to receive(:current_user).and_return(user)
+
+          expect(user).not_to receive(:todos_pending_count)
+
+          get :index, page: (last_page + 1).to_param, project_id: project.id
+
+          expect(response).to redirect_to(dashboard_todos_path(page: last_page, project_id: project.id))
+        end
+      end
     end
   end
 
diff --git a/spec/controllers/google_api/authorizations_controller_spec.rb b/spec/controllers/google_api/authorizations_controller_spec.rb
new file mode 100644
index 00000000000..80d553f0f34
--- /dev/null
+++ b/spec/controllers/google_api/authorizations_controller_spec.rb
@@ -0,0 +1,49 @@
+require 'spec_helper'
+
+describe GoogleApi::AuthorizationsController do
+  describe 'GET|POST #callback' do
+    let(:user) { create(:user) }
+    let(:token) { 'token' }
+    let(:expires_at) { 1.hour.since.strftime('%s') }
+
+    subject { get :callback, code: 'xxx', state: @state }
+
+    before do
+      sign_in(user)
+
+      allow_any_instance_of(GoogleApi::CloudPlatform::Client)
+        .to receive(:get_token).and_return([token, expires_at])
+    end
+
+    it 'sets token and expires_at in session' do
+      subject
+
+      expect(session[GoogleApi::CloudPlatform::Client.session_key_for_token])
+        .to eq(token)
+      expect(session[GoogleApi::CloudPlatform::Client.session_key_for_expires_at])
+        .to eq(expires_at)
+    end
+
+    context 'when redirect uri key is stored in state' do
+      set(:project) { create(:project) }
+      let(:redirect_uri) { project_clusters_url(project).to_s }
+
+      before do
+        @state = GoogleApi::CloudPlatform::Client
+          .new_session_key_for_redirect_uri do |key|
+          session[key] = redirect_uri
+        end
+      end
+
+      it 'redirects to the URL stored in state param' do
+        expect(subject).to redirect_to(redirect_uri)
+      end
+    end
+
+    context 'when redirection url is not stored in state' do
+      it 'redirects to root_path' do
+        expect(subject).to redirect_to(root_path)
+      end
+    end
+  end
+end
diff --git a/spec/controllers/profiles/emails_controller_spec.rb b/spec/controllers/profiles/emails_controller_spec.rb
new file mode 100644
index 00000000000..ecf14aad54f
--- /dev/null
+++ b/spec/controllers/profiles/emails_controller_spec.rb
@@ -0,0 +1,35 @@
+require 'spec_helper'
+
+describe Profiles::EmailsController do
+  let(:user) { create(:user) }
+
+  before do
+    sign_in(user)
+  end
+
+  describe '#create' do
+    let(:email_params) { { email: "add_email@example.com" } }
+
+    it 'sends an email confirmation' do
+      expect { post(:create, { email: email_params }) }.to change { ActionMailer::Base.deliveries.size }
+      expect(ActionMailer::Base.deliveries.last.to).to eq [email_params[:email]]
+      expect(ActionMailer::Base.deliveries.last.subject).to match "Confirmation instructions"
+    end
+  end
+
+  describe '#resend_confirmation_instructions' do
+    let(:email_params) { { email: "add_email@example.com" } }
+
+    it 'resends an email confirmation' do
+      email = user.emails.create(email: 'add_email@example.com')
+
+      expect { put(:resend_confirmation_instructions, { id: email }) }.to change { ActionMailer::Base.deliveries.size }
+      expect(ActionMailer::Base.deliveries.last.to).to eq [email_params[:email]]
+      expect(ActionMailer::Base.deliveries.last.subject).to match "Confirmation instructions"
+    end
+
+    it 'unable to resend an email confirmation' do
+      expect { put(:resend_confirmation_instructions, { id: 1 }) }.not_to change { ActionMailer::Base.deliveries.size }
+    end
+  end
+end
diff --git a/spec/controllers/profiles_controller_spec.rb b/spec/controllers/profiles_controller_spec.rb
index b52b63e05a4..ce5040ff02b 100644
--- a/spec/controllers/profiles_controller_spec.rb
+++ b/spec/controllers/profiles_controller_spec.rb
@@ -15,6 +15,20 @@ describe ProfilesController do
       expect(user.unconfirmed_email).to eq('john@gmail.com')
     end
 
+    it "allows an email update without confirmation if existing verified email" do
+      user = create(:user)
+      create(:email, :confirmed, user: user, email: 'john@gmail.com')
+      sign_in(user)
+
+      put :update,
+          user: { email: "john@gmail.com", name: "John" }
+
+      user.reload
+
+      expect(response.status).to eq(302)
+      expect(user.unconfirmed_email).to eq nil
+    end
+
     it "ignores an email update from a user with an external email address" do
       stub_omniauth_setting(sync_profile_from_provider: ['ldap'])
       stub_omniauth_setting(sync_profile_attributes: true)
diff --git a/spec/controllers/projects/artifacts_controller_spec.rb b/spec/controllers/projects/artifacts_controller_spec.rb
index caa63e7bd22..d0992719171 100644
--- a/spec/controllers/projects/artifacts_controller_spec.rb
+++ b/spec/controllers/projects/artifacts_controller_spec.rb
@@ -1,8 +1,8 @@
 require 'spec_helper'
 
 describe Projects::ArtifactsController do
-  let(:user) { create(:user) }
-  let(:project) { create(:project, :repository) }
+  set(:user) { create(:user) }
+  set(:project) { create(:project, :repository, :public) }
 
   let(:pipeline) do
     create(:ci_pipeline,
@@ -15,7 +15,7 @@ describe Projects::ArtifactsController do
   let(:job) { create(:ci_build, :success, :artifacts, pipeline: pipeline) }
 
   before do
-    project.team << [user, :developer]
+    project.add_developer(user)
 
     sign_in(user)
   end
@@ -47,19 +47,67 @@ describe Projects::ArtifactsController do
   end
 
   describe 'GET file' do
-    context 'when the file exists' do
-      it 'renders the file view' do
-        get :file, namespace_id: project.namespace, project_id: project, job_id: job, path: 'ci_artifacts.txt'
+    before do
+      allow(Gitlab.config.pages).to receive(:enabled).and_return(true)
+    end
 
-        expect(response).to render_template('projects/artifacts/file')
+    context 'when the file is served by GitLab Pages' do
+      before do
+        allow(Gitlab.config.pages).to receive(:artifacts_server).and_return(true)
+      end
+
+      context 'when the file exists' do
+        it 'renders the file view' do
+          get :file, namespace_id: project.namespace, project_id: project, job_id: job, path: 'ci_artifacts.txt'
+
+          expect(response).to have_http_status(302)
+        end
+      end
+
+      context 'when the file does not exist' do
+        it 'responds Not Found' do
+          get :file, namespace_id: project.namespace, project_id: project, job_id: job, path: 'unknown'
+
+          expect(response).to be_not_found
+        end
       end
     end
 
-    context 'when the file does not exist' do
-      it 'responds Not Found' do
-        get :file, namespace_id: project.namespace, project_id: project, job_id: job, path: 'unknown'
+    context 'when the file is served through Rails' do
+      context 'when the file exists' do
+        it 'renders the file view' do
+          get :file, namespace_id: project.namespace, project_id: project, job_id: job, path: 'ci_artifacts.txt'
 
-        expect(response).to be_not_found
+          expect(response).to have_http_status(:ok)
+          expect(response).to render_template('projects/artifacts/file')
+        end
+      end
+
+      context 'when the file does not exist' do
+        it 'responds Not Found' do
+          get :file, namespace_id: project.namespace, project_id: project, job_id: job, path: 'unknown'
+
+          expect(response).to be_not_found
+        end
+      end
+    end
+
+    context 'when the project is private' do
+      let(:private_project) { create(:project, :repository, :private) }
+      let(:pipeline) { create(:ci_pipeline, project: private_project) }
+      let(:job) { create(:ci_build, :success, :artifacts, pipeline: pipeline) }
+
+      before do
+        private_project.add_developer(user)
+
+        allow(Gitlab.config.pages).to receive(:artifacts_server).and_return(true)
+      end
+
+      it 'does not redirect the request' do
+        get :file, namespace_id: private_project.namespace, project_id: private_project, job_id: job, path: 'ci_artifacts.txt'
+
+        expect(response).to have_http_status(:ok)
+        expect(response).to render_template('projects/artifacts/file')
       end
     end
   end
diff --git a/spec/controllers/projects/blob_controller_spec.rb b/spec/controllers/projects/blob_controller_spec.rb
index 64b9af7b845..fb76b7fdf38 100644
--- a/spec/controllers/projects/blob_controller_spec.rb
+++ b/spec/controllers/projects/blob_controller_spec.rb
@@ -1,6 +1,8 @@
 require 'rails_helper'
 
 describe Projects::BlobController do
+  include ProjectForksHelper
+
   let(:project) { create(:project, :public, :repository) }
 
   describe "GET show" do
@@ -226,9 +228,8 @@ describe Projects::BlobController do
     end
 
     context 'when user has forked project' do
-      let(:forked_project_link) { create(:forked_project_link, forked_from_project: project) }
-      let!(:forked_project) { forked_project_link.forked_to_project }
-      let(:guest) { forked_project.owner }
+      let!(:forked_project) { fork_project(project, guest, namespace: guest.namespace, repository: true) }
+      let(:guest) { create(:user) }
 
       before do
         sign_in(guest)
diff --git a/spec/controllers/projects/branches_controller_spec.rb b/spec/controllers/projects/branches_controller_spec.rb
index 5e0b57e9b2e..3b3b63444c7 100644
--- a/spec/controllers/projects/branches_controller_spec.rb
+++ b/spec/controllers/projects/branches_controller_spec.rb
@@ -62,7 +62,7 @@ describe Projects::BranchesController do
         let(:branch) { "feature%2Ftest" }
         let(:ref) { "<script>alert('ref');</script>" }
         it { is_expected.to render_template('new') }
-        it { project.repository.branch_names.include?('feature/test') }
+        it { project.repository.branch_exists?('feature/test') }
       end
     end
 
diff --git a/spec/controllers/projects/clusters_controller_spec.rb b/spec/controllers/projects/clusters_controller_spec.rb
new file mode 100644
index 00000000000..7985028d73b
--- /dev/null
+++ b/spec/controllers/projects/clusters_controller_spec.rb
@@ -0,0 +1,308 @@
+require 'spec_helper'
+
+describe Projects::ClustersController do
+  set(:user) { create(:user) }
+  set(:project) { create(:project) }
+  let(:role) { :master }
+
+  before do
+    project.team << [user, role]
+
+    sign_in(user)
+  end
+
+  describe 'GET index' do
+    subject do
+      get :index, namespace_id: project.namespace,
+                  project_id: project
+    end
+
+    context 'when cluster is already created' do
+      let!(:cluster) { create(:gcp_cluster, :created_on_gke, project: project) }
+
+      it 'redirects to show a cluster' do
+        subject
+
+        expect(response).to redirect_to(project_cluster_path(project, cluster))
+      end
+    end
+
+    context 'when we do not have cluster' do
+      it 'redirects to create a cluster' do
+        subject
+
+        expect(response).to redirect_to(new_project_cluster_path(project))
+      end
+    end
+  end
+
+  describe 'GET login' do
+    render_views
+
+    subject do
+      get :login, namespace_id: project.namespace,
+                  project_id: project
+    end
+
+    context 'when we do have omniauth configured' do
+      it 'shows login button' do
+        subject
+
+        expect(response.body).to include('auth_buttons/signin_with_google')
+      end
+    end
+
+    context 'when we do not have omniauth configured' do
+      before do
+        stub_omniauth_setting(providers: [])
+      end
+
+      it 'shows notice message' do
+        subject
+
+        expect(response.body).to include('Ask your GitLab administrator if you want to use this service.')
+      end
+    end
+  end
+
+  shared_examples 'requires to login' do
+    it 'redirects to create a cluster' do
+      subject
+
+      expect(response).to redirect_to(login_project_clusters_path(project))
+    end
+  end
+
+  describe 'GET new' do
+    render_views
+
+    subject do
+      get :new, namespace_id: project.namespace,
+                project_id: project
+    end
+
+    context 'when logged' do
+      before do
+        make_logged_in
+      end
+
+      it 'shows a creation form' do
+        subject
+
+        expect(response.body).to include('Create cluster')
+      end
+    end
+
+    context 'when not logged' do
+      it_behaves_like 'requires to login'
+    end
+  end
+
+  describe 'POST create' do
+    subject do
+      post :create, params.merge(namespace_id: project.namespace,
+                                 project_id: project)
+    end
+
+    context 'when not logged' do
+      let(:params) { {} }
+
+      it_behaves_like 'requires to login'
+    end
+
+    context 'when logged in' do
+      before do
+        make_logged_in
+      end
+
+      context 'when all required parameters are set' do
+        let(:params) do
+          {
+            cluster: {
+              gcp_cluster_name: 'new-cluster',
+              gcp_project_id: '111'
+            }
+          }
+        end
+
+        before do
+          expect(ClusterProvisionWorker).to receive(:perform_async) { }
+        end
+
+        it 'creates a new cluster' do
+          expect { subject }.to change { Gcp::Cluster.count }
+
+          expect(response).to redirect_to(project_cluster_path(project, project.cluster))
+        end
+      end
+
+      context 'when not all required parameters are set' do
+        render_views
+
+        let(:params) do
+          {
+            cluster: {
+              project_namespace: 'some namespace'
+            }
+          }
+        end
+
+        it 'shows an error message' do
+          expect { subject }.not_to change { Gcp::Cluster.count }
+
+          expect(response).to render_template(:new)
+        end
+      end
+    end
+  end
+
+  describe 'GET status' do
+    let(:cluster) { create(:gcp_cluster, :created_on_gke, project: project) }
+
+    subject do
+      get :status, namespace_id: project.namespace,
+                   project_id: project,
+                   id: cluster,
+                   format: :json
+    end
+
+    it "responds with matching schema" do
+      subject
+
+      expect(response).to have_http_status(:ok)
+      expect(response).to match_response_schema('cluster_status')
+    end
+  end
+
+  describe 'GET show' do
+    render_views
+
+    let(:cluster) { create(:gcp_cluster, :created_on_gke, project: project) }
+
+    subject do
+      get :show, namespace_id: project.namespace,
+                 project_id: project,
+                 id: cluster
+    end
+
+    context 'when logged as master' do
+      it "allows to update cluster" do
+        subject
+
+        expect(response).to have_http_status(:ok)
+        expect(response.body).to include("Save")
+      end
+
+      it "allows remove integration" do
+        subject
+
+        expect(response).to have_http_status(:ok)
+        expect(response.body).to include("Remove integration")
+      end
+    end
+
+    context 'when logged as developer' do
+      let(:role) { :developer }
+
+      it "does not allow to access page" do
+        subject
+
+        expect(response).to have_http_status(:not_found)
+      end
+    end
+  end
+
+  describe 'PUT update' do
+    render_views
+
+    let(:service) { project.build_kubernetes_service }
+    let(:cluster) { create(:gcp_cluster, :created_on_gke, project: project, service: service) }
+    let(:params) { {} }
+
+    subject do
+      put :update, params.merge(namespace_id: project.namespace,
+                                project_id: project,
+                                id: cluster)
+    end
+
+    context 'when logged as master' do
+      context 'when valid params are used' do
+        let(:params) do
+          {
+            cluster: { enabled: false }
+          }
+        end
+
+        it "redirects back to show page" do
+          subject
+
+          expect(response).to redirect_to(project_cluster_path(project, project.cluster))
+          expect(flash[:notice]).to eq('Cluster was successfully updated.')
+        end
+      end
+
+      context 'when invalid params are used' do
+        let(:params) do
+          {
+            cluster: { project_namespace: 'my Namespace 321321321 #' }
+          }
+        end
+
+        it "rejects changes" do
+          subject
+
+          expect(response).to have_http_status(:ok)
+          expect(response).to render_template(:show)
+        end
+      end
+    end
+
+    context 'when logged as developer' do
+      let(:role) { :developer }
+
+      it "does not allow to update cluster" do
+        subject
+
+        expect(response).to have_http_status(:not_found)
+      end
+    end
+  end
+
+  describe 'delete update' do
+    let(:cluster) { create(:gcp_cluster, :created_on_gke, project: project) }
+
+    subject do
+      delete :destroy, namespace_id: project.namespace,
+                       project_id: project,
+                       id: cluster
+    end
+
+    context 'when logged as master' do
+      it "redirects back to clusters list" do
+        subject
+
+        expect(response).to redirect_to(project_clusters_path(project))
+        expect(flash[:notice]).to eq('Cluster integration was successfully removed.')
+      end
+    end
+
+    context 'when logged as developer' do
+      let(:role) { :developer }
+
+      it "does not allow to destroy cluster" do
+        subject
+
+        expect(response).to have_http_status(:not_found)
+      end
+    end
+  end
+
+  def make_logged_in
+    session[GoogleApi::CloudPlatform::Client.session_key_for_token] = '1234'
+    session[GoogleApi::CloudPlatform::Client.session_key_for_expires_at] = in_hour.to_i.to_s
+  end
+
+  def in_hour
+    Time.now + 1.hour
+  end
+end
diff --git a/spec/controllers/projects/merge_requests/diffs_controller_spec.rb b/spec/controllers/projects/merge_requests/diffs_controller_spec.rb
index fad2c8f3ab7..7260350d5fb 100644
--- a/spec/controllers/projects/merge_requests/diffs_controller_spec.rb
+++ b/spec/controllers/projects/merge_requests/diffs_controller_spec.rb
@@ -1,6 +1,8 @@
 require 'spec_helper'
 
 describe Projects::MergeRequests::DiffsController do
+  include ProjectForksHelper
+
   let(:project) { create(:project, :repository) }
   let(:user)    { project.owner }
   let(:merge_request) { create(:merge_request_with_diffs, target_project: project, source_project: project) }
@@ -37,12 +39,12 @@ describe Projects::MergeRequests::DiffsController do
         render_views
 
         let(:project) { create(:project, :repository) }
-        let(:fork_project) { create(:forked_project_with_submodules) }
-        let(:merge_request) { create(:merge_request_with_diffs, source_project: fork_project, source_branch: 'add-submodule-version-bump', target_branch: 'master', target_project: project) }
+        let(:forked_project) { fork_project_with_submodules(project) }
+        let(:merge_request) { create(:merge_request_with_diffs, source_project: forked_project, source_branch: 'add-submodule-version-bump', target_branch: 'master', target_project: project) }
 
         before do
-          fork_project.build_forked_project_link(forked_to_project_id: fork_project.id, forked_from_project_id: project.id)
-          fork_project.save
+          project.add_developer(user)
+
           merge_request.reload
           go
         end
diff --git a/spec/controllers/projects/merge_requests_controller_spec.rb b/spec/controllers/projects/merge_requests_controller_spec.rb
index e46d1995498..707e7c32283 100644
--- a/spec/controllers/projects/merge_requests_controller_spec.rb
+++ b/spec/controllers/projects/merge_requests_controller_spec.rb
@@ -1,6 +1,8 @@
 require 'spec_helper'
 
 describe Projects::MergeRequestsController do
+  include ProjectForksHelper
+
   let(:project) { create(:project, :repository) }
   let(:user)    { project.owner }
   let(:merge_request) { create(:merge_request_with_diffs, target_project: project, source_project: project) }
@@ -204,14 +206,11 @@ describe Projects::MergeRequestsController do
 
     context 'there is no source project' do
       let(:project)       { create(:project, :repository) }
-      let(:fork_project)  { create(:forked_project_with_submodules) }
-      let(:merge_request) { create(:merge_request, source_project: fork_project, source_branch: 'add-submodule-version-bump', target_branch: 'master', target_project: project) }
+      let(:forked_project)  { fork_project_with_submodules(project) }
+      let!(:merge_request) { create(:merge_request, source_project: forked_project, source_branch: 'add-submodule-version-bump', target_branch: 'master', target_project: project) }
 
       before do
-        fork_project.build_forked_project_link(forked_to_project_id: fork_project.id, forked_from_project_id: project.id)
-        fork_project.save
-        merge_request.reload
-        fork_project.destroy
+        forked_project.destroy
       end
 
       it 'closes MR without errors' do
@@ -599,21 +598,16 @@ describe Projects::MergeRequestsController do
 
   describe 'GET ci_environments_status' do
     context 'the environment is from a forked project' do
-      let!(:forked)       { create(:project, :repository) }
+      let!(:forked)       { fork_project(project, user, repository: true) }
       let!(:environment)  { create(:environment, project: forked) }
       let!(:deployment)   { create(:deployment, environment: environment, sha: forked.commit.id, ref: 'master') }
       let(:admin)         { create(:admin) }
 
       let(:merge_request) do
-        create(:forked_project_link, forked_to_project: forked,
-                                     forked_from_project: project)
-
         create(:merge_request, source_project: forked, target_project: project)
       end
 
       before do
-        forked.team << [user, :master]
-
         get :ci_environments_status,
           namespace_id: merge_request.project.namespace.to_param,
           project_id: merge_request.project,
diff --git a/spec/controllers/projects/notes_controller_spec.rb b/spec/controllers/projects/notes_controller_spec.rb
index c0337f96fc6..135fd6449ff 100644
--- a/spec/controllers/projects/notes_controller_spec.rb
+++ b/spec/controllers/projects/notes_controller_spec.rb
@@ -1,6 +1,8 @@
 require 'spec_helper'
 
 describe Projects::NotesController do
+  include ProjectForksHelper
+
   let(:user)    { create(:user) }
   let(:project) { create(:project) }
   let(:issue)   { create(:issue, project: project) }
@@ -210,18 +212,16 @@ describe Projects::NotesController do
     context 'when creating a commit comment from an MR fork' do
       let(:project) { create(:project, :repository) }
 
-      let(:fork_project) do
-        create(:project, :repository).tap do |fork|
-          create(:forked_project_link, forked_to_project: fork, forked_from_project: project)
-        end
+      let(:forked_project) do
+        fork_project(project, nil, repository: true)
       end
 
       let(:merge_request) do
-        create(:merge_request, source_project: fork_project, target_project: project, source_branch: 'feature', target_branch: 'master')
+        create(:merge_request, source_project: forked_project, target_project: project, source_branch: 'feature', target_branch: 'master')
       end
 
       let(:existing_comment) do
-        create(:note_on_commit, note: 'a note', project: fork_project, commit_id: merge_request.commit_shas.first)
+        create(:note_on_commit, note: 'a note', project: forked_project, commit_id: merge_request.commit_shas.first)
       end
 
       def post_create(extra_params = {})
@@ -231,7 +231,7 @@ describe Projects::NotesController do
                project_id: project,
                target_type: 'merge_request',
                target_id: merge_request.id,
-               note_project_id: fork_project.id,
+               note_project_id: forked_project.id,
                in_reply_to_discussion_id: existing_comment.discussion_id
              }.merge(extra_params)
       end
@@ -253,16 +253,66 @@ describe Projects::NotesController do
       end
 
       context 'when the user has access to the fork' do
-        let(:discussion) { fork_project.notes.find_discussion(existing_comment.discussion_id) }
+        let(:discussion) { forked_project.notes.find_discussion(existing_comment.discussion_id) }
 
         before do
-          fork_project.add_developer(user)
+          forked_project.add_developer(user)
 
           existing_comment
         end
 
         it 'creates the note' do
-          expect { post_create }.to change { fork_project.notes.count }.by(1)
+          expect { post_create }.to change { forked_project.notes.count }.by(1)
+        end
+      end
+    end
+
+    context 'when the merge request discussion is locked' do
+      before do
+        project.update_attribute(:visibility_level, Gitlab::VisibilityLevel::PUBLIC)
+        merge_request.update_attribute(:discussion_locked, true)
+      end
+
+      context 'when a noteable is not found' do
+        it 'returns 404 status' do
+          request_params[:note][:noteable_id] = 9999
+          post :create, request_params.merge(format: :json)
+
+          expect(response).to have_http_status(404)
+        end
+      end
+
+      context 'when a user is a team member' do
+        it 'returns 302 status for html' do
+          post :create, request_params
+
+          expect(response).to have_http_status(302)
+        end
+
+        it 'returns 200 status for json' do
+          post :create, request_params.merge(format: :json)
+
+          expect(response).to have_http_status(200)
+        end
+
+        it 'creates a new note' do
+          expect { post :create, request_params }.to change { Note.count }.by(1)
+        end
+      end
+
+      context 'when a user is not a team member' do
+        before do
+          project.project_member(user).destroy
+        end
+
+        it 'returns 404 status' do
+          post :create, request_params
+
+          expect(response).to have_http_status(404)
+        end
+
+        it 'does not create a new note' do
+          expect { post :create, request_params }.not_to change { Note.count }
         end
       end
     end
diff --git a/spec/controllers/projects_controller_spec.rb b/spec/controllers/projects_controller_spec.rb
index 2a91a6613e6..0544afe31ed 100644
--- a/spec/controllers/projects_controller_spec.rb
+++ b/spec/controllers/projects_controller_spec.rb
@@ -1,6 +1,8 @@
 require('spec_helper')
 
 describe ProjectsController do
+  include ProjectForksHelper
+
   let(:project) { create(:project) }
   let(:public_project) { create(:project, :public) }
   let(:user) { create(:user) }
@@ -139,8 +141,9 @@ describe ProjectsController do
       end
     end
 
-    context 'when the storage is not available', broken_storage: true do
-      let(:project) { create(:project, :broken_storage) }
+    context 'when the storage is not available', :broken_storage do
+      set(:project) { create(:project, :broken_storage) }
+
       before do
         project.add_developer(user)
         sign_in(user)
@@ -376,10 +379,10 @@ describe ProjectsController do
 
     context "when the project is forked" do
       let(:project)      { create(:project, :repository) }
-      let(:fork_project) { create(:project, :repository, forked_from_project: project) }
+      let(:forked_project) { fork_project(project, nil, repository: true) }
       let(:merge_request) do
         create(:merge_request,
-          source_project: fork_project,
+          source_project: forked_project,
           target_project: project)
       end
 
@@ -387,7 +390,7 @@ describe ProjectsController do
         project.merge_requests << merge_request
         sign_in(admin)
 
-        delete :destroy, namespace_id: fork_project.namespace, id: fork_project
+        delete :destroy, namespace_id: forked_project.namespace, id: forked_project
 
         expect(merge_request.reload.state).to eq('closed')
       end
@@ -454,18 +457,14 @@ describe ProjectsController do
       end
 
       context 'with forked project' do
-        let(:project_fork) { create(:project, :repository, namespace: user.namespace) }
-
-        before do
-          create(:forked_project_link, forked_to_project: project_fork)
-        end
+        let(:forked_project) { fork_project(create(:project, :public), user) }
 
         it 'removes fork from project' do
           delete(:remove_fork,
-              namespace_id: project_fork.namespace.to_param,
-              id: project_fork.to_param, format: :js)
+              namespace_id: forked_project.namespace.to_param,
+              id: forked_project.to_param, format: :js)
 
-          expect(project_fork.forked?).to be_falsey
+          expect(forked_project.reload.forked?).to be_falsey
           expect(flash[:notice]).to eq('The fork relationship has been removed.')
           expect(response).to render_template(:remove_fork)
         end
diff --git a/spec/controllers/registrations_controller_spec.rb b/spec/controllers/registrations_controller_spec.rb
index 5a4ab39ab86..1d3ddfbd220 100644
--- a/spec/controllers/registrations_controller_spec.rb
+++ b/spec/controllers/registrations_controller_spec.rb
@@ -76,12 +76,68 @@ describe RegistrationsController do
       sign_in(user)
     end
 
-    it 'schedules the user for destruction' do
-      expect(DeleteUserWorker).to receive(:perform_async).with(user.id, user.id, {})
+    def expect_failure(message)
+      expect(flash[:alert]).to eq(message)
+      expect(response.status).to eq(303)
+      expect(response).to redirect_to profile_account_path
+    end
+
+    def expect_password_failure
+      expect_failure('Invalid password')
+    end
+
+    def expect_username_failure
+      expect_failure('Invalid username')
+    end
+
+    def expect_success
+      expect(flash[:notice]).to eq 'Account scheduled for removal.'
+      expect(response.status).to eq(303)
+      expect(response).to redirect_to new_user_session_path
+    end
 
-      post(:destroy)
+    context 'user requires password confirmation' do
+      it 'fails if password confirmation is not provided' do
+        post :destroy
 
-      expect(response.status).to eq(302)
+        expect_password_failure
+      end
+
+      it 'fails if password confirmation is wrong' do
+        post :destroy, password: 'wrong password'
+
+        expect_password_failure
+      end
+
+      it 'succeeds if password is confirmed' do
+        post :destroy, password: '12345678'
+
+        expect_success
+      end
+    end
+
+    context 'user does not require password confirmation' do
+      before do
+        stub_application_setting(password_authentication_enabled: false)
+      end
+
+      it 'fails if username confirmation is not provided' do
+        post :destroy
+
+        expect_username_failure
+      end
+
+      it 'fails if username confirmation is wrong' do
+        post :destroy, username: 'wrong username'
+
+        expect_username_failure
+      end
+
+      it 'succeeds if username is confirmed' do
+        post :destroy, username: user.username
+
+        expect_success
+      end
     end
   end
 end