Merge branch '27148-limit-bulk-create-memberships' into 'master'

Limit non-administrators to adding 100 members at a time to groups and projects

Closes #27148

See merge request !11940

2 files changed, 12 insertions, 3 deletions

diff --git a/spec/controllers/admin/groups_controller_spec.rb b/spec/controllers/admin/groups_controller_spec.rb
index c29b2fe8946..ddf38967dd7 100644
--- a/spec/controllers/admin/groups_controller_spec.rb
+++ b/spec/controllers/admin/groups_controller_spec.rb
@@ -36,6 +36,15 @@ describe Admin::GroupsController do
       expect(group.users).to include group_user
     end
 
+    it 'can add unlimited members' do
+      put :members_update, id: group,
+                           user_ids: 1.upto(1000).to_a.join(','),
+                           access_level: Gitlab::Access::GUEST
+
+      expect(response).to set_flash.to 'Users were successfully added.'
+      expect(response).to redirect_to(admin_group_path(group))
+    end
+
     it 'adds no user to members' do
       put :members_update, id: group,
                            user_ids: '',
diff --git a/spec/controllers/projects/project_members_controller_spec.rb b/spec/controllers/projects/project_members_controller_spec.rb
index a4b4392d7cc..2294d5df581 100644
--- a/spec/controllers/projects/project_members_controller_spec.rb
+++ b/spec/controllers/projects/project_members_controller_spec.rb
@@ -36,7 +36,7 @@ describe Projects::ProjectMembersController do
       before { project.team << [user, :master] }
 
       it 'adds user to members' do
-        expect_any_instance_of(Members::CreateService).to receive(:execute).and_return(true)
+        expect_any_instance_of(Members::CreateService).to receive(:execute).and_return(status: :success)
 
         post :create, namespace_id: project.namespace,
                       project_id: project,
@@ -48,14 +48,14 @@ describe Projects::ProjectMembersController do
       end
 
       it 'adds no user to members' do
-        expect_any_instance_of(Members::CreateService).to receive(:execute).and_return(false)
+        expect_any_instance_of(Members::CreateService).to receive(:execute).and_return(status: :failure, message: 'Message')
 
         post :create, namespace_id: project.namespace,
                       project_id: project,
                       user_ids: '',
                       access_level: Gitlab::Access::GUEST
 
-        expect(response).to set_flash.to 'No users specified.'
+        expect(response).to set_flash.to 'Message'
         expect(response).to redirect_to(namespace_project_settings_members_path(project.namespace, project))
       end
     end