Add latest changes from gitlab-org/gitlab@master

2 files changed, 56 insertions, 5 deletions

diff --git a/spec/controllers/ldap/omniauth_callbacks_controller_spec.rb b/spec/controllers/ldap/omniauth_callbacks_controller_spec.rb
index ceab9754617..2e7d3746031 100644
--- a/spec/controllers/ldap/omniauth_callbacks_controller_spec.rb
+++ b/spec/controllers/ldap/omniauth_callbacks_controller_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe Ldap::OmniauthCallbacksController do
+describe Ldap::OmniauthCallbacksController, :do_not_mock_admin_mode do
   include_context 'Ldap::OmniauthCallbacksController'
 
   it 'allows sign in' do
@@ -65,4 +65,55 @@ describe Ldap::OmniauthCallbacksController do
       expect(request.env['warden']).to be_authenticated
     end
   end
+
+  describe 'enable admin mode' do
+    include_context 'custom session'
+
+    before do
+      sign_in user
+    end
+
+    context 'with a regular user' do
+      it 'cannot be enabled' do
+        reauthenticate_and_check_admin_mode(expected_admin_mode: false)
+
+        expect(response).to redirect_to(root_path)
+      end
+    end
+
+    context 'with an admin user' do
+      let(:user) { create(:omniauth_user, :admin, extern_uid: uid, provider: provider) }
+
+      context 'when requested first' do
+        before do
+          subject.current_user_mode.request_admin_mode!
+        end
+
+        it 'can be enabled' do
+          reauthenticate_and_check_admin_mode(expected_admin_mode: true)
+
+          expect(response).to redirect_to(admin_root_path)
+        end
+      end
+
+      context 'when not requested first' do
+        it 'cannot be enabled' do
+          reauthenticate_and_check_admin_mode(expected_admin_mode: false)
+
+          expect(response).to redirect_to(root_path)
+        end
+      end
+    end
+  end
+
+  def reauthenticate_and_check_admin_mode(expected_admin_mode:)
+    # Initially admin mode disabled
+    expect(subject.current_user_mode.admin_mode?).to be(false)
+
+    # Trigger OmniAuth admin mode flow and expect admin mode status
+    post provider
+
+    expect(request.env['warden']).to be_authenticated
+    expect(subject.current_user_mode.admin_mode?).to be(expected_admin_mode)
+  end
 end
diff --git a/spec/controllers/sessions_controller_spec.rb b/spec/controllers/sessions_controller_spec.rb
index af2e452c0ca..eb24532b35f 100644
--- a/spec/controllers/sessions_controller_spec.rb
+++ b/spec/controllers/sessions_controller_spec.rb
@@ -41,10 +41,10 @@ describe SessionsController do
         stub_ldap_setting(enabled: true)
       end
 
-      it 'assigns ldap_servers' do
+      it 'ldap_servers available in helper' do
         get(:new)
 
-        expect(assigns[:ldap_servers].first.to_h).to include('label' => 'ldap', 'provider_name' => 'ldapmain')
+        expect(subject.ldap_servers.first.to_h).to include('label' => 'ldap', 'provider_name' => 'ldapmain')
       end
 
       context 'with sign_in disabled' do
@@ -52,10 +52,10 @@ describe SessionsController do
           stub_ldap_setting(prevent_ldap_sign_in: true)
         end
 
-        it 'assigns no ldap_servers' do
+        it 'no ldap_servers available in helper' do
           get(:new)
 
-          expect(assigns[:ldap_servers]).to eq []
+          expect(subject.ldap_servers).to eq []
         end
       end
     end