summaryrefslogtreecommitdiff
path: root/spec/requests
diff options
context:
space:
mode:
authorhaseeb <haseebeqx@gmail.com>2017-09-18 17:29:17 +0000
committerRémy Coutable <remy@rymai.me>2017-09-18 17:29:17 +0000
commitff4e81e0aec38c26e75d960c3d2af9329576ca32 (patch)
tree6903ef4fa30d5d467af3a9386423fcb7aeabb731 /spec/requests
parent8d568fe324dbf753e99e8f63df8f4cb1b484270d (diff)
downloadgitlab-ce-ff4e81e0aec38c26e75d960c3d2af9329576ca32.tar.gz
fix #35290 Make read-only API for public merge requests available without authentication
Diffstat (limited to 'spec/requests')
-rw-r--r--spec/requests/api/merge_requests_spec.rb37
1 files changed, 32 insertions, 5 deletions
diff --git a/spec/requests/api/merge_requests_spec.rb b/spec/requests/api/merge_requests_spec.rb
index 21d2c9644fb..c4f6e97b915 100644
--- a/spec/requests/api/merge_requests_spec.rb
+++ b/spec/requests/api/merge_requests_spec.rb
@@ -28,10 +28,29 @@ describe API::MergeRequests do
describe 'GET /merge_requests' do
context 'when unauthenticated' do
- it 'returns authentication error' do
- get api('/merge_requests')
+ it 'returns an array of all merge requests' do
+ get api('/merge_requests', user), scope: 'all'
+
+ expect(response).to have_http_status(200)
+ expect(json_response).to be_an Array
+ end
+
+ it "returns authentication error without any scope" do
+ get api("/merge_requests")
+
+ expect(response).to have_http_status(401)
+ end
+
+ it "returns authentication error when scope is assigned-to-me" do
+ get api("/merge_requests"), scope: 'assigned-to-me'
- expect(response).to have_gitlab_http_status(401)
+ expect(response).to have_http_status(401)
+ end
+
+ it "returns authentication error when scope is created-by-me" do
+ get api("/merge_requests"), scope: 'created-by-me'
+
+ expect(response).to have_http_status(401)
end
end
@@ -134,10 +153,18 @@ describe API::MergeRequests do
describe "GET /projects/:id/merge_requests" do
context "when unauthenticated" do
- it "returns authentication error" do
+ it 'returns merge requests for public projects' do
+ get api("/projects/#{project.id}/merge_requests")
+
+ expect(response).to have_http_status(200)
+ expect(json_response).to be_an Array
+ end
+
+ it "returns 404 for non public projects" do
+ project = create(:project, :private)
get api("/projects/#{project.id}/merge_requests")
- expect(response).to have_gitlab_http_status(401)
+ expect(response).to have_http_status(404)
end
end