diff options
author | Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com> | 2012-12-05 17:06:15 +0200 |
---|---|---|
committer | Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com> | 2012-12-05 17:06:15 +0200 |
commit | a350b52c9b621a5f37b27f8ca6cfc424ff573425 (patch) | |
tree | b3ba8e99d94354ad36a80c6a8ff504ecfc18e8a1 /spec/models/project_security_spec.rb | |
parent | 674efd38d83d6f805d2ed9637028d195470b309b (diff) | |
download | gitlab-ce-a350b52c9b621a5f37b27f8ca6cfc424ff573425.tar.gz |
Rewrite project security model tests
Diffstat (limited to 'spec/models/project_security_spec.rb')
-rw-r--r-- | spec/models/project_security_spec.rb | 93 |
1 files changed, 82 insertions, 11 deletions
diff --git a/spec/models/project_security_spec.rb b/spec/models/project_security_spec.rb index 60f8d45c9c8..92c6bce08f6 100644 --- a/spec/models/project_security_spec.rb +++ b/spec/models/project_security_spec.rb @@ -4,38 +4,109 @@ describe Project do describe :authorization do before do @p1 = create(:project) + @u1 = create(:user) @u2 = create(:user) + @u3 = create(:user) + @u4 = @p1.chief + @abilities = Six.new @abilities << Ability end - describe "read access" do + let(:guest_actions) { Ability.project_guest_rules } + let(:report_actions) { Ability.project_report_rules } + let(:dev_actions) { Ability.project_dev_rules } + let(:master_actions) { Ability.project_master_rules } + let(:admin_actions) { Ability.project_admin_rules } + + describe "Non member rules" do + it "should deny for non-project users any actions" do + admin_actions.each do |action| + @abilities.allowed?(@u1, action, @p1).should be_false + end + end + end + + describe "Guest Rules" do + before do + @p1.users_projects.create(project: @p1, user: @u2, project_access: UsersProject::GUEST) + end + + it "should allow for project user any guest actions" do + guest_actions.each do |action| + @abilities.allowed?(@u2, action, @p1).should be_true + end + end + end + + describe "Report Rules" do before do @p1.users_projects.create(project: @p1, user: @u2, project_access: UsersProject::REPORTER) end - it { @abilities.allowed?(@u1, :read_project, @p1).should be_false } - it { @abilities.allowed?(@u2, :read_project, @p1).should be_true } + it "should allow for project user any report actions" do + report_actions.each do |action| + @abilities.allowed?(@u2, action, @p1).should be_true + end + end end - describe "write access" do + describe "Developer Rules" do + before do + @p1.users_projects.create(project: @p1, user: @u2, project_access: UsersProject::REPORTER) + @p1.users_projects.create(project: @p1, user: @u3, project_access: UsersProject::DEVELOPER) + end + + it "should deny for developer master-specific actions" do + [dev_actions - report_actions].each do |action| + @abilities.allowed?(@u2, action, @p1).should be_false + end + end + + it "should allow for project user any dev actions" do + dev_actions.each do |action| + @abilities.allowed?(@u3, action, @p1).should be_true + end + end + end + + describe "Master Rules" do before do @p1.users_projects.create(project: @p1, user: @u2, project_access: UsersProject::DEVELOPER) + @p1.users_projects.create(project: @p1, user: @u3, project_access: UsersProject::MASTER) end - it { @abilities.allowed?(@u1, :write_project, @p1).should be_false } - it { @abilities.allowed?(@u2, :write_project, @p1).should be_true } + it "should deny for developer master-specific actions" do + [master_actions - dev_actions].each do |action| + @abilities.allowed?(@u2, action, @p1).should be_false + end + end + + it "should allow for project user any master actions" do + master_actions.each do |action| + @abilities.allowed?(@u3, action, @p1).should be_true + end + end end - describe "admin access" do + describe "Admin Rules" do before do - @p1.users_projects.create(project: @p1, user: @u1, project_access: UsersProject::DEVELOPER) - @p1.users_projects.create(project: @p1, user: @u2, project_access: UsersProject::MASTER) + @p1.users_projects.create(project: @p1, user: @u2, project_access: UsersProject::DEVELOPER) + @p1.users_projects.create(project: @p1, user: @u3, project_access: UsersProject::MASTER) end - it { @abilities.allowed?(@u1, :admin_project, @p1).should be_false } - it { @abilities.allowed?(@u2, :admin_project, @p1).should be_true } + it "should deny for masters admin-specific actions" do + [admin_actions - master_actions].each do |action| + @abilities.allowed?(@u2, action, @p1).should be_false + end + end + + it "should allow for project owner any admin actions" do + admin_actions.each do |action| + @abilities.allowed?(@u4, action, @p1).should be_true + end + end end end end |