Add latest changes from gitlab-org/gitlab@13-10-stable-eev13.10.0-rc40

1 files changed, 276 insertions, 18 deletions

diff --git a/spec/requests/api/rubygem_packages_spec.rb b/spec/requests/api/rubygem_packages_spec.rb
index 5dd68bf9b10..d6ad8186063 100644
--- a/spec/requests/api/rubygem_packages_spec.rb
+++ b/spec/requests/api/rubygem_packages_spec.rb
@@ -3,9 +3,11 @@
 require 'spec_helper'
 
 RSpec.describe API::RubygemPackages do
+  include PackagesManagerApiSpecHelpers
+  include WorkhorseHelpers
   using RSpec::Parameterized::TableSyntax
 
-  let_it_be(:project) { create(:project) }
+  let_it_be_with_reload(:project) { create(:project) }
   let_it_be(:personal_access_token) { create(:personal_access_token) }
   let_it_be(:user) { personal_access_token.user }
   let_it_be(:job) { create(:ci_build, :running, user: user) }
@@ -13,6 +15,14 @@ RSpec.describe API::RubygemPackages do
   let_it_be(:project_deploy_token) { create(:project_deploy_token, deploy_token: deploy_token, project: project) }
   let_it_be(:headers) { {} }
 
+  let(:tokens) do
+    {
+      personal_access_token: personal_access_token.token,
+      deploy_token: deploy_token.token,
+      job_token: job.token
+    }
+  end
+
   shared_examples 'when feature flag is disabled' do
     let(:headers) do
       { 'HTTP_AUTHORIZATION' => personal_access_token.token }
@@ -34,7 +44,7 @@ RSpec.describe API::RubygemPackages do
   end
 
   shared_examples 'without authentication' do
-    it_behaves_like 'returning response status', :unauthorized
+    it_behaves_like 'returning response status', :not_found
   end
 
   shared_examples 'with authentication' do
@@ -42,14 +52,6 @@ RSpec.describe API::RubygemPackages do
       { 'HTTP_AUTHORIZATION' => token }
     end
 
-    let(:tokens) do
-      {
-        personal_access_token: personal_access_token.token,
-        deploy_token: deploy_token.token,
-        job_token: job.token
-      }
-    end
-
     where(:user_role, :token_type, :valid_token, :status) do
       :guest     | :personal_access_token   | true  | :not_found
       :guest     | :personal_access_token   | false | :unauthorized
@@ -106,34 +108,290 @@ RSpec.describe API::RubygemPackages do
   end
 
   describe 'GET /api/v4/projects/:project_id/packages/rubygems/gems/:file_name' do
-    let(:url) { api("/projects/#{project.id}/packages/rubygems/gems/my_gem-1.0.0.gem") }
+    let_it_be(:package_name) { 'package' }
+    let_it_be(:version) { '0.0.1' }
+    let_it_be(:package) { create(:rubygems_package, project: project, name: package_name, version: version) }
+    let_it_be(:file_name) { "#{package_name}-#{version}.gem" }
+
+    let(:url) { api("/projects/#{project.id}/packages/rubygems/gems/#{file_name}") }
 
     subject { get(url, headers: headers) }
 
-    it_behaves_like 'an unimplemented route'
+    context 'with valid project' do
+      where(:visibility, :user_role, :member, :token_type, :valid_token, :shared_examples_name, :expected_status) do
+        :public  | :developer  | true  | :personal_access_token | true  | 'Rubygems gem download'            | :success
+        :public  | :guest      | true  | :personal_access_token | true  | 'Rubygems gem download'            | :success
+        :public  | :developer  | true  | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :guest      | true  | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :developer  | false | :personal_access_token | true  | 'Rubygems gem download'            | :success
+        :public  | :guest      | false | :personal_access_token | true  | 'Rubygems gem download'            | :success
+        :public  | :developer  | false | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :guest      | false | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :anonymous  | false | :personal_access_token | true  | 'Rubygems gem download'            | :success
+        :private | :developer  | true  | :personal_access_token | true  | 'Rubygems gem download'            | :success
+        :private | :guest      | true  | :personal_access_token | true  | 'rejects rubygems packages access' | :forbidden
+        :private | :developer  | true  | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :guest      | true  | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :developer  | false | :personal_access_token | true  | 'rejects rubygems packages access' | :not_found
+        :private | :guest      | false | :personal_access_token | true  | 'rejects rubygems packages access' | :not_found
+        :private | :developer  | false | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :guest      | false | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :anonymous  | false | :personal_access_token | true  | 'rejects rubygems packages access' | :not_found
+        :public  | :developer  | true  | :job_token             | true  | 'Rubygems gem download'            | :success
+        :public  | :guest      | true  | :job_token             | true  | 'Rubygems gem download'            | :success
+        :public  | :developer  | true  | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :guest      | true  | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :developer  | false | :job_token             | true  | 'Rubygems gem download'            | :success
+        :public  | :guest      | false | :job_token             | true  | 'Rubygems gem download'            | :success
+        :public  | :developer  | false | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :guest      | false | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :developer  | true  | :job_token             | true  | 'Rubygems gem download'            | :success
+        :private | :guest      | true  | :job_token             | true  | 'rejects rubygems packages access' | :forbidden
+        :private | :developer  | true  | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :guest      | true  | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :developer  | false | :job_token             | true  | 'rejects rubygems packages access' | :not_found
+        :private | :guest      | false | :job_token             | true  | 'rejects rubygems packages access' | :not_found
+        :private | :developer  | false | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :guest      | false | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :developer  | true  | :deploy_token          | true  | 'Rubygems gem download'            | :success
+        :public  | :developer  | true  | :deploy_token          | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :developer  | true  | :deploy_token          | true  | 'Rubygems gem download'            | :success
+        :private | :developer  | true  | :deploy_token          | false | 'rejects rubygems packages access' | :unauthorized
+      end
+
+      with_them do
+        let(:token) { valid_token ? tokens[token_type] : 'invalid-token123' }
+        let(:headers) { user_role == :anonymous ? {} : { 'HTTP_AUTHORIZATION' => token } }
+
+        before do
+          project.update_column(:visibility_level, Gitlab::VisibilityLevel.level_value(visibility.to_s))
+        end
+
+        it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
+      end
+    end
   end
 
   describe 'POST /api/v4/projects/:project_id/packages/rubygems/api/v1/gems/authorize' do
+    include_context 'workhorse headers'
+
     let(:url) { api("/projects/#{project.id}/packages/rubygems/api/v1/gems/authorize") }
+    let(:headers) { {} }
 
     subject { post(url, headers: headers) }
 
-    it_behaves_like 'an unimplemented route'
+    context 'with valid project' do
+      where(:visibility, :user_role, :member, :token_type, :valid_token, :shared_examples_name, :expected_status) do
+        :public  | :developer  | true  | :personal_access_token | true  | 'process rubygems workhorse authorization' | :success
+        :public  | :guest      | true  | :personal_access_token | true  | 'rejects rubygems packages access'         | :forbidden
+        :public  | :developer  | true  | :personal_access_token | false | 'rejects rubygems packages access'         | :unauthorized
+        :public  | :guest      | true  | :personal_access_token | false | 'rejects rubygems packages access'         | :unauthorized
+        :public  | :developer  | false | :personal_access_token | true  | 'rejects rubygems packages access'         | :forbidden
+        :public  | :guest      | false | :personal_access_token | true  | 'rejects rubygems packages access'         | :forbidden
+        :public  | :developer  | false | :personal_access_token | false | 'rejects rubygems packages access'         | :unauthorized
+        :public  | :guest      | false | :personal_access_token | false | 'rejects rubygems packages access'         | :unauthorized
+        :public  | :anonymous  | false | :personal_access_token | true  | 'rejects rubygems packages access'         | :unauthorized
+        :private | :developer  | true  | :personal_access_token | true  | 'process rubygems workhorse authorization' | :success
+        :private | :guest      | true  | :personal_access_token | true  | 'rejects rubygems packages access'         | :forbidden
+        :private | :developer  | true  | :personal_access_token | false | 'rejects rubygems packages access'         | :unauthorized
+        :private | :guest      | true  | :personal_access_token | false | 'rejects rubygems packages access'         | :unauthorized
+        :private | :developer  | false | :personal_access_token | true  | 'rejects rubygems packages access'         | :not_found
+        :private | :guest      | false | :personal_access_token | true  | 'rejects rubygems packages access'         | :not_found
+        :private | :developer  | false | :personal_access_token | false | 'rejects rubygems packages access'         | :unauthorized
+        :private | :guest      | false | :personal_access_token | false | 'rejects rubygems packages access'         | :unauthorized
+        :private | :anonymous  | false | :personal_access_token | true  | 'rejects rubygems packages access'         | :unauthorized
+        :public  | :developer  | true  | :job_token             | true  | 'process rubygems workhorse authorization' | :success
+        :public  | :guest      | true  | :job_token             | true  | 'rejects rubygems packages access'         | :forbidden
+        :public  | :developer  | true  | :job_token             | false | 'rejects rubygems packages access'         | :unauthorized
+        :public  | :guest      | true  | :job_token             | false | 'rejects rubygems packages access'         | :unauthorized
+        :public  | :developer  | false | :job_token             | true  | 'rejects rubygems packages access'         | :forbidden
+        :public  | :guest      | false | :job_token             | true  | 'rejects rubygems packages access'         | :forbidden
+        :public  | :developer  | false | :job_token             | false | 'rejects rubygems packages access'         | :unauthorized
+        :public  | :guest      | false | :job_token             | false | 'rejects rubygems packages access'         | :unauthorized
+        :private | :developer  | true  | :job_token             | true  | 'process rubygems workhorse authorization' | :success
+        :private | :guest      | true  | :job_token             | true  | 'rejects rubygems packages access'         | :forbidden
+        :private | :developer  | true  | :job_token             | false | 'rejects rubygems packages access'         | :unauthorized
+        :private | :guest      | true  | :job_token             | false | 'rejects rubygems packages access'         | :unauthorized
+        :private | :developer  | false | :job_token             | true  | 'rejects rubygems packages access'         | :not_found
+        :private | :guest      | false | :job_token             | true  | 'rejects rubygems packages access'         | :not_found
+        :private | :developer  | false | :job_token             | false | 'rejects rubygems packages access'         | :unauthorized
+        :private | :guest      | false | :job_token             | false | 'rejects rubygems packages access'         | :unauthorized
+        :public  | :developer  | true  | :deploy_token          | true  | 'process rubygems workhorse authorization' | :success
+        :public  | :developer  | true  | :deploy_token          | false | 'rejects rubygems packages access'         | :unauthorized
+        :private | :developer  | true  | :deploy_token          | true  | 'process rubygems workhorse authorization' | :success
+        :private | :developer  | true  | :deploy_token          | false | 'rejects rubygems packages access'         | :unauthorized
+      end
+
+      with_them do
+        let(:token) { valid_token ? tokens[token_type] : 'invalid-token123' }
+        let(:user_headers) { user_role == :anonymous ? {} : { 'HTTP_AUTHORIZATION' => token } }
+        let(:headers) { user_headers.merge(workhorse_headers) }
+
+        before do
+          project.update_column(:visibility_level, Gitlab::VisibilityLevel.level_value(visibility.to_s))
+        end
+
+        it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
+      end
+    end
   end
 
   describe 'POST /api/v4/projects/:project_id/packages/rubygems/api/v1/gems' do
-    let(:url) { api("/projects/#{project.id}/packages/rubygems/api/v1/gems") }
+    include_context 'workhorse headers'
+
+    let(:url) { "/projects/#{project.id}/packages/rubygems/api/v1/gems" }
+
+    let_it_be(:file_name) { 'package.gem' }
+    let(:headers) { {} }
+    let(:params) { { file: temp_file(file_name) } }
+    let(:file_key) { :file }
+    let(:send_rewritten_field) { true }
+
+    subject do
+      workhorse_finalize(
+        api(url),
+        method: :post,
+        file_key: file_key,
+        params: params,
+        headers: headers,
+        send_rewritten_field: send_rewritten_field
+      )
+    end
 
-    subject { post(url, headers: headers) }
+    context 'with valid project' do
+      where(:visibility, :user_role, :member, :token_type, :valid_token, :shared_examples_name, :expected_status) do
+        :public  | :developer  | true  | :personal_access_token | true  | 'process rubygems upload'          | :created
+        :public  | :guest      | true  | :personal_access_token | true  | 'rejects rubygems packages access' | :forbidden
+        :public  | :developer  | true  | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :guest      | true  | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :developer  | false | :personal_access_token | true  | 'rejects rubygems packages access' | :forbidden
+        :public  | :guest      | false | :personal_access_token | true  | 'rejects rubygems packages access' | :forbidden
+        :public  | :developer  | false | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :guest      | false | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :anonymous  | false | :personal_access_token | true  | 'rejects rubygems packages access' | :unauthorized
+        :private | :developer  | true  | :personal_access_token | true  | 'process rubygems upload'          | :created
+        :private | :guest      | true  | :personal_access_token | true  | 'rejects rubygems packages access' | :forbidden
+        :private | :developer  | true  | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :guest      | true  | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :developer  | false | :personal_access_token | true  | 'rejects rubygems packages access' | :not_found
+        :private | :guest      | false | :personal_access_token | true  | 'rejects rubygems packages access' | :not_found
+        :private | :developer  | false | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :guest      | false | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :anonymous  | false | :personal_access_token | true  | 'rejects rubygems packages access' | :unauthorized
+        :public  | :developer  | true  | :job_token             | true  | 'process rubygems upload'          | :created
+        :public  | :guest      | true  | :job_token             | true  | 'rejects rubygems packages access' | :forbidden
+        :public  | :developer  | true  | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :guest      | true  | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :developer  | false | :job_token             | true  | 'rejects rubygems packages access' | :forbidden
+        :public  | :guest      | false | :job_token             | true  | 'rejects rubygems packages access' | :forbidden
+        :public  | :developer  | false | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :guest      | false | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :developer  | true  | :job_token             | true  | 'process rubygems upload'          | :created
+        :private | :guest      | true  | :job_token             | true  | 'rejects rubygems packages access' | :forbidden
+        :private | :developer  | true  | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :guest      | true  | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :developer  | false | :job_token             | true  | 'rejects rubygems packages access' | :not_found
+        :private | :guest      | false | :job_token             | true  | 'rejects rubygems packages access' | :not_found
+        :private | :developer  | false | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :guest      | false | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :developer  | true  | :deploy_token          | true  | 'process rubygems upload'          | :created
+        :public  | :developer  | true  | :deploy_token          | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :developer  | true  | :deploy_token          | true  | 'process rubygems upload'          | :created
+        :private | :developer  | true  | :deploy_token          | false | 'rejects rubygems packages access' | :unauthorized
+      end
 
-    it_behaves_like 'an unimplemented route'
+      with_them do
+        let(:token) { valid_token ? tokens[token_type] : 'invalid-token123' }
+        let(:user_headers) { user_role == :anonymous ? {} : { 'HTTP_AUTHORIZATION' => token } }
+        let(:headers) { user_headers.merge(workhorse_headers) }
+
+        before do
+          project.update_column(:visibility_level, Gitlab::VisibilityLevel.level_value(visibility.to_s))
+        end
+
+        it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
+      end
+
+      context 'failed package file save' do
+        let(:user_headers) { { 'HTTP_AUTHORIZATION' => personal_access_token.token } }
+        let(:headers) { user_headers.merge(workhorse_headers) }
+
+        before do
+          project.add_developer(user)
+        end
+
+        it 'does not create package record', :aggregate_failures do
+          allow(Packages::CreatePackageFileService).to receive(:new).and_raise(StandardError)
+
+          expect { subject }
+              .to change { project.packages.count }.by(0)
+              .and change { Packages::PackageFile.count }.by(0)
+          expect(response).to have_gitlab_http_status(:error)
+        end
+      end
+    end
   end
 
   describe 'GET /api/v4/projects/:project_id/packages/rubygems/api/v1/dependencies' do
+    let_it_be(:package) { create(:rubygems_package, project: project) }
+
     let(:url) { api("/projects/#{project.id}/packages/rubygems/api/v1/dependencies") }
 
-    subject { get(url, headers: headers) }
+    subject { get(url, headers: headers, params: params) }
+
+    context 'with valid project' do
+      where(:visibility, :user_role, :member, :token_type, :valid_token, :shared_examples_name, :expected_status) do
+        :public  | :developer  | true  | :personal_access_token | true  | 'dependency endpoint success'      | :success
+        :public  | :guest      | true  | :personal_access_token | true  | 'dependency endpoint success'      | :success
+        :public  | :developer  | true  | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :guest      | true  | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :developer  | false | :personal_access_token | true  | 'dependency endpoint success'      | :success
+        :public  | :guest      | false | :personal_access_token | true  | 'dependency endpoint success'      | :success
+        :public  | :developer  | false | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :guest      | false | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :anonymous  | false | :personal_access_token | true  | 'dependency endpoint success'      | :success
+        :private | :developer  | true  | :personal_access_token | true  | 'dependency endpoint success'      | :success
+        :private | :guest      | true  | :personal_access_token | true  | 'rejects rubygems packages access' | :forbidden
+        :private | :developer  | true  | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :guest      | true  | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :developer  | false | :personal_access_token | true  | 'rejects rubygems packages access' | :not_found
+        :private | :guest      | false | :personal_access_token | true  | 'rejects rubygems packages access' | :not_found
+        :private | :developer  | false | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :guest      | false | :personal_access_token | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :anonymous  | false | :personal_access_token | true  | 'rejects rubygems packages access' | :not_found
+        :public  | :developer  | true  | :job_token             | true  | 'dependency endpoint success'      | :success
+        :public  | :guest      | true  | :job_token             | true  | 'dependency endpoint success'      | :success
+        :public  | :developer  | true  | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :guest      | true  | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :developer  | false | :job_token             | true  | 'dependency endpoint success'      | :success
+        :public  | :guest      | false | :job_token             | true  | 'dependency endpoint success'      | :success
+        :public  | :developer  | false | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :guest      | false | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :developer  | true  | :job_token             | true  | 'dependency endpoint success'      | :success
+        :private | :guest      | true  | :job_token             | true  | 'rejects rubygems packages access' | :forbidden
+        :private | :developer  | true  | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :guest      | true  | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :developer  | false | :job_token             | true  | 'rejects rubygems packages access' | :not_found
+        :private | :guest      | false | :job_token             | true  | 'rejects rubygems packages access' | :not_found
+        :private | :developer  | false | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :guest      | false | :job_token             | false | 'rejects rubygems packages access' | :unauthorized
+        :public  | :developer  | true  | :deploy_token          | true  | 'dependency endpoint success'      | :success
+        :public  | :developer  | true  | :deploy_token          | false | 'rejects rubygems packages access' | :unauthorized
+        :private | :developer  | true  | :deploy_token          | true  | 'dependency endpoint success'      | :success
+        :private | :developer  | true  | :deploy_token          | false | 'rejects rubygems packages access' | :unauthorized
+      end
 
-    it_behaves_like 'an unimplemented route'
+      with_them do
+        let(:token) { valid_token ? tokens[token_type] : 'invalid-token123' }
+        let(:headers) { user_role == :anonymous ? {} : { 'HTTP_AUTHORIZATION' => token } }
+        let(:params) { {} }
+
+        before do
+          project.update!(visibility: visibility.to_s)
+        end
+
+        it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
+      end
+    end
   end
 end