diff options
author | Douwe Maan <douwe@selenight.nl> | 2017-10-12 14:38:39 +0200 |
---|---|---|
committer | Douwe Maan <douwe@selenight.nl> | 2017-11-02 11:39:03 +0100 |
commit | 3f24f9ed182f5226210349b8e67e484e132ce971 (patch) | |
tree | 6f6a9148f3d89ea2d19cefe90470a8dca4dabc64 /spec/requests | |
parent | a1781a49416790f727b3dd3453bf704723e72b90 (diff) | |
download | gitlab-ce-3f24f9ed182f5226210349b8e67e484e132ce971.tar.gz |
Add sudo API scope
Diffstat (limited to 'spec/requests')
-rw-r--r-- | spec/requests/api/doorkeeper_access_spec.rb | 8 | ||||
-rw-r--r-- | spec/requests/api/helpers_spec.rb | 8 | ||||
-rw-r--r-- | spec/requests/api/users_spec.rb | 4 |
3 files changed, 10 insertions, 10 deletions
diff --git a/spec/requests/api/doorkeeper_access_spec.rb b/spec/requests/api/doorkeeper_access_spec.rb index 174593593f8..308134eba72 100644 --- a/spec/requests/api/doorkeeper_access_spec.rb +++ b/spec/requests/api/doorkeeper_access_spec.rb @@ -39,20 +39,20 @@ describe 'doorkeeper access' do end describe "when user is blocked" do - it "returns authentication error" do + it "returns authorization error" do user.block get api("/user"), access_token: token.token - expect(response).to have_gitlab_http_status(401) + expect(response).to have_gitlab_http_status(403) end end describe "when user is ldap_blocked" do - it "returns authentication error" do + it "returns authorization error" do user.ldap_block get api("/user"), access_token: token.token - expect(response).to have_gitlab_http_status(401) + expect(response).to have_gitlab_http_status(403) end end end diff --git a/spec/requests/api/helpers_spec.rb b/spec/requests/api/helpers_spec.rb index 0ab9f94376c..9631324607f 100644 --- a/spec/requests/api/helpers_spec.rb +++ b/spec/requests/api/helpers_spec.rb @@ -173,18 +173,18 @@ describe API::Helpers do expect { current_user }.to raise_error /401/ end - it "returns a 401 response for a user without access" do + it "returns a 403 response for a user without access" do env[API::APIGuard::PRIVATE_TOKEN_HEADER] = personal_access_token.token allow_any_instance_of(Gitlab::UserAccess).to receive(:allowed?).and_return(false) - expect { current_user }.to raise_error /401/ + expect { current_user }.to raise_error /403/ end - it 'returns a 401 response for a user who is blocked' do + it 'returns a 403 response for a user who is blocked' do user.block! env[API::APIGuard::PRIVATE_TOKEN_HEADER] = personal_access_token.token - expect { current_user }.to raise_error /401/ + expect { current_user }.to raise_error /403/ end it "leaves user as is when sudo not specified" do diff --git a/spec/requests/api/users_spec.rb b/spec/requests/api/users_spec.rb index fc1d055afe2..634c8dae0ba 100644 --- a/spec/requests/api/users_spec.rb +++ b/spec/requests/api/users_spec.rb @@ -127,8 +127,8 @@ describe API::Users do context "when admin" do context 'when sudo is defined' do it 'does not return 500' do - admin_personal_access_token = create(:personal_access_token, user: admin).token - get api("/users?private_token=#{admin_personal_access_token}&sudo=#{user.id}", admin) + admin_personal_access_token = create(:personal_access_token, user: admin, scopes: [:sudo]) + get api("/users?sudo=#{user.id}", admin, personal_access_token: admin_personal_access_token) expect(response).to have_gitlab_http_status(:success) end |