summaryrefslogtreecommitdiff
path: root/spec/policies
diff options
context:
space:
mode:
authorGrzegorz Bizon <grzesiek.bizon@gmail.com>2017-01-23 14:49:13 +0100
committerGrzegorz Bizon <grzesiek.bizon@gmail.com>2017-01-23 14:49:13 +0100
commit5e3f8db7073743a4e4da39fa4203bdeab5caea5b (patch)
tree8a88895ea8a7e478c08e1a0780fe0115ef85e485 /spec/policies
parent3a54128d1f1ac1fa0779fe7309bd043ffa947ab5 (diff)
downloadgitlab-ce-5e3f8db7073743a4e4da39fa4203bdeab5caea5b.tar.gz
Fix build access policies when pipelines are public
Diffstat (limited to 'spec/policies')
-rw-r--r--spec/policies/ci/build_policy_spec.rb93
1 files changed, 93 insertions, 0 deletions
diff --git a/spec/policies/ci/build_policy_spec.rb b/spec/policies/ci/build_policy_spec.rb
new file mode 100644
index 00000000000..0f280f32eac
--- /dev/null
+++ b/spec/policies/ci/build_policy_spec.rb
@@ -0,0 +1,93 @@
+require 'spec_helper'
+
+describe Ci::BuildPolicy, :models do
+ let(:user) { create(:user) }
+ let(:build) { create(:ci_build, pipeline: pipeline) }
+ let(:pipeline) { create(:ci_empty_pipeline, project: project) }
+
+ let(:policies) do
+ described_class.abilities(user, build).to_set
+ end
+
+ shared_context 'public pipelines disabled' do
+ before { project.update_attribute(:public_builds, false) }
+ end
+
+ describe '#rules' do
+ context 'when user does not have access to the project' do
+ let(:project) { create(:empty_project, :private) }
+
+ context 'when public builds are enabled' do
+ it 'does not include ability to read build' do
+ expect(policies).not_to include :read_build
+ end
+ end
+
+ context 'when public builds are disabled' do
+ include_context 'public pipelines disabled'
+
+ it 'does not include ability to read build' do
+ expect(policies).not_to include :read_build
+ end
+ end
+ end
+
+ context 'when anonymous user has access to the project' do
+ let(:project) { create(:empty_project, :public) }
+
+ context 'when public builds are enabled' do
+ it 'includes ability to read build' do
+ expect(policies).to include :read_build
+ end
+ end
+
+ context 'when public builds are disabled' do
+ include_context 'public pipelines disabled'
+
+ it 'does not include ability to read build' do
+ expect(policies).not_to include :read_build
+ end
+ end
+ end
+
+ context 'when team member has access to the project' do
+ let(:project) { create(:empty_project, :public) }
+
+ context 'team member is a guest' do
+ before { project.team << [user, :guest] }
+
+ context 'when public builds are enabled' do
+ it 'includes ability to read build' do
+ expect(policies).to include :read_build
+ end
+ end
+
+ context 'when public builds are disabled' do
+ include_context 'public pipelines disabled'
+
+ it 'does not include ability to read build' do
+ expect(policies).not_to include :read_build
+ end
+ end
+ end
+
+ context 'team member is a reporter' do
+ before { project.team << [user, :reporter] }
+
+ context 'when public builds are enabled' do
+ it 'includes ability to read build' do
+ expect(policies).to include :read_build
+ end
+ end
+
+ context 'when public builds are disabled' do
+ include_context 'public pipelines disabled'
+
+ it 'does not include ability to read build' do
+ expect(policies).to include :read_build
+ end
+ end
+ end
+ end
+ end
+end