Merge remote-tracking branch 'upstream/master' into save-artifacts_sizes

* upstream/master: (175 commits)
  Document Repository#keep_around
  Don't garbage collect commits that have related DB records like comments
  Update CHANGELOG
  Update RedCloth to 4.3.2 for CVE-2012-6684
  Fix typo in Merge Requests API documentation
  Downgrade to Redis 3.2.2 due to massive memory leak with Sidekiq
  Enable Style/EmptyLines cop, remove redundant ones
  Update CHANGELOG
  Cache results from jQuery selectors to retrieve namespace name
  Fix import button when import fail due the namespace already been taken
  Fix snippets comments not displayed
  Fix emoji paths in relative root configurations
  Exclude requesters from Project#members, Group#members and User#members
  Upgrade Thin from 1.6.1 to 1.7.0.
  Many squashed commits
  Cache autocomplete results
  Upgrade Sidekiq from 4.1.2 to 4.1.4.
  Upgrade seed-fu from 2.3.5 to 2.3.6
  use has_many relationship with events
  Support creating a todo on issuables via API
  ...

14 files changed, 267 insertions, 40 deletions

diff --git a/spec/requests/api/api_helpers_spec.rb b/spec/requests/api/api_helpers_spec.rb
index f22db61e744..83025953889 100644
--- a/spec/requests/api/api_helpers_spec.rb
+++ b/spec/requests/api/api_helpers_spec.rb
@@ -1,7 +1,6 @@
 require 'spec_helper'
 
 describe API::Helpers, api: true do
-
   include API::Helpers
   include ApiHelpers
 
diff --git a/spec/requests/api/award_emoji_spec.rb b/spec/requests/api/award_emoji_spec.rb
index ed78d582bd0..72a6d45f47d 100644
--- a/spec/requests/api/award_emoji_spec.rb
+++ b/spec/requests/api/award_emoji_spec.rb
@@ -62,7 +62,6 @@ describe API::API, api: true  do
     end
   end
 
-
   describe "GET /projects/:id/awardable/:awardable_id/award_emoji/:award_id" do
     context 'on an issue' do
       it "returns the award emoji" do
diff --git a/spec/requests/api/builds_spec.rb b/spec/requests/api/builds_spec.rb
index 2ab9d640269..f5b39c3d698 100644
--- a/spec/requests/api/builds_spec.rb
+++ b/spec/requests/api/builds_spec.rb
@@ -63,23 +63,60 @@ describe API::API, api: true  do
   end
 
   describe 'GET /projects/:id/repository/commits/:sha/builds' do
-    before do
-      project.ensure_pipeline(pipeline.sha, 'master')
-      get api("/projects/#{project.id}/repository/commits/#{pipeline.sha}/builds", api_user)
-    end
+    context 'when commit does not exist in repository' do
+      before do
+        get api("/projects/#{project.id}/repository/commits/1a271fd1/builds", api_user)
+      end
 
-    context 'authorized user' do
-      it 'should return project builds for specific commit' do
-        expect(response).to have_http_status(200)
-        expect(json_response).to be_an Array
+      it 'responds with 404' do
+        expect(response).to have_http_status(404)
       end
     end
 
-    context 'unauthorized user' do
-      let(:api_user) { nil }
+    context 'when commit exists in repository' do
+      context 'when user is authorized' do
+        context 'when pipeline has builds' do
+          before do
+            create(:ci_pipeline, project: project, sha: project.commit.id)
+            create(:ci_build, pipeline: pipeline)
+            create(:ci_build)
+
+            get api("/projects/#{project.id}/repository/commits/#{project.commit.id}/builds", api_user)
+          end
+
+          it 'should return project builds for specific commit' do
+            expect(response).to have_http_status(200)
+            expect(json_response).to be_an Array
+            expect(json_response.size).to eq 2
+          end
+        end
 
-      it 'should not return project builds' do
-        expect(response).to have_http_status(401)
+        context 'when pipeline has no builds' do
+          before do
+            branch_head = project.commit('feature').id
+            get api("/projects/#{project.id}/repository/commits/#{branch_head}/builds", api_user)
+          end
+
+          it 'returns an empty array' do
+            expect(response).to have_http_status(200)
+            expect(json_response).to be_an Array
+            expect(json_response).to be_empty
+          end
+        end
+      end
+
+      context 'when user is not authorized' do
+        before do
+          create(:ci_pipeline, project: project, sha: project.commit.id)
+          create(:ci_build, pipeline: pipeline)
+
+          get api("/projects/#{project.id}/repository/commits/#{project.commit.id}/builds", nil)
+        end
+
+        it 'should not return project builds' do
+          expect(response).to have_http_status(401)
+          expect(json_response.except('message')).to be_empty
+        end
       end
     end
   end
diff --git a/spec/requests/api/commit_statuses_spec.rb b/spec/requests/api/commit_statuses_spec.rb
index 6668f3543f6..2da01da7fa1 100644
--- a/spec/requests/api/commit_statuses_spec.rb
+++ b/spec/requests/api/commit_statuses_spec.rb
@@ -11,7 +11,6 @@ describe API::CommitStatuses, api: true do
   let(:developer) { create_user(:developer) }
   let(:sha) { commit.id }
 
-
   describe "GET /projects/:id/repository/commits/:sha/statuses" do
     let(:get_url) { "/projects/#{project.id}/repository/commits/#{sha}/statuses" }
 
diff --git a/spec/requests/api/doorkeeper_access_spec.rb b/spec/requests/api/doorkeeper_access_spec.rb
index 881b818b5e9..5262a623761 100644
--- a/spec/requests/api/doorkeeper_access_spec.rb
+++ b/spec/requests/api/doorkeeper_access_spec.rb
@@ -7,7 +7,6 @@ describe API::API, api: true  do
   let!(:application) { Doorkeeper::Application.create!(name: "MyApp", redirect_uri: "https://app.com", owner: user) }
   let!(:token) { Doorkeeper::AccessToken.create! application_id: application.id, resource_owner_id: user.id }
 
-
   describe "when unauthenticated" do
     it "returns authentication success" do
       get api("/user"), access_token: token.token
diff --git a/spec/requests/api/internal_spec.rb b/spec/requests/api/internal_spec.rb
index 437c89c3577..fcea45f19ba 100644
--- a/spec/requests/api/internal_spec.rb
+++ b/spec/requests/api/internal_spec.rb
@@ -72,6 +72,7 @@ describe API::API, api: true  do
 
           expect(response).to have_http_status(200)
           expect(json_response["status"]).to be_truthy
+          expect(json_response["repository_path"]).to eq(project.repository.path_to_repo)
         end
       end
 
@@ -81,6 +82,7 @@ describe API::API, api: true  do
 
           expect(response).to have_http_status(200)
           expect(json_response["status"]).to be_truthy
+          expect(json_response["repository_path"]).to eq(project.repository.path_to_repo)
         end
       end
     end
diff --git a/spec/requests/api/labels_spec.rb b/spec/requests/api/labels_spec.rb
index 39736779986..0404cf31ff7 100644
--- a/spec/requests/api/labels_spec.rb
+++ b/spec/requests/api/labels_spec.rb
@@ -11,7 +11,6 @@ describe API::API, api: true  do
     project.team << [user, :master]
   end
 
-
   describe 'GET /projects/:id/labels' do
     it 'should return project labels' do
       get api("/projects/#{project.id}/labels", user)
diff --git a/spec/requests/api/notes_spec.rb b/spec/requests/api/notes_spec.rb
index bacd01f8e74..65c53211dd3 100644
--- a/spec/requests/api/notes_spec.rb
+++ b/spec/requests/api/notes_spec.rb
@@ -159,7 +159,6 @@ describe API::API, api: true  do
           end
         end
 
-
         context "and current user can view the note" do
           it "should return an issue note by id" do
             get api("/projects/#{ext_proj.id}/issues/#{ext_issue.id}/notes/#{cross_reference_note.id}", private_user)
@@ -221,7 +220,6 @@ describe API::API, api: true  do
           expect(Time.parse(json_response['created_at'])).to be_within(1.second).of(creation_time)
         end
       end
-
     end
 
     context "when noteable is a Snippet" do
@@ -396,5 +394,4 @@ describe API::API, api: true  do
       end
     end
   end
-
 end
diff --git a/spec/requests/api/projects_spec.rb b/spec/requests/api/projects_spec.rb
index 41b5ed9bc33..611dd2a2a88 100644
--- a/spec/requests/api/projects_spec.rb
+++ b/spec/requests/api/projects_spec.rb
@@ -217,7 +217,7 @@ describe API::API, api: true  do
 
       post api('/projects', user), project
 
-      project.each_pair do |k,v|
+      project.each_pair do |k, v|
         expect(json_response[k.to_s]).to eq(v)
       end
     end
@@ -325,7 +325,7 @@ describe API::API, api: true  do
 
       post api("/projects/user/#{user.id}", admin), project
 
-      project.each_pair do |k,v|
+      project.each_pair do |k, v|
         next if k == :path
         expect(json_response[k.to_s]).to eq(v)
       end
@@ -707,7 +707,6 @@ describe API::API, api: true  do
     end
 
     describe 'DELETE /projects/:id/fork' do
-
       it "shouldn't be visible to users outside group" do
         delete api("/projects/#{project_fork_target.id}/fork", user)
         expect(response).to have_http_status(404)
@@ -805,7 +804,7 @@ describe API::API, api: true  do
 
     context 'when authenticated' do
       it 'should return an array of projects' do
-        get api("/projects/search/#{query}",user)
+        get api("/projects/search/#{query}", user)
         expect(response).to have_http_status(200)
         expect(json_response).to be_an Array
         expect(json_response.size).to eq(6)
diff --git a/spec/requests/api/services_spec.rb b/spec/requests/api/services_spec.rb
index bf7eaaaaaed..a2446e12804 100644
--- a/spec/requests/api/services_spec.rb
+++ b/spec/requests/api/services_spec.rb
@@ -87,7 +87,6 @@ describe API::API, api: true  do
         
         expect(response).to have_http_status(403)
       end
-
     end
   end
 end
diff --git a/spec/requests/api/settings_spec.rb b/spec/requests/api/settings_spec.rb
index f756101c514..684c2cd8e24 100644
--- a/spec/requests/api/settings_spec.rb
+++ b/spec/requests/api/settings_spec.rb
@@ -6,7 +6,6 @@ describe API::API, 'Settings', api: true  do
   let(:user) { create(:user) }
   let(:admin) { create(:admin) }
 
-
   describe "GET /application/settings" do
     it "should return application settings" do
       get api("/application/settings", admin)
@@ -14,16 +13,23 @@ describe API::API, 'Settings', api: true  do
       expect(json_response).to be_an Hash
       expect(json_response['default_projects_limit']).to eq(42)
       expect(json_response['signin_enabled']).to be_truthy
+      expect(json_response['repository_storage']).to eq('default')
     end
   end
 
   describe "PUT /application/settings" do
+    before do
+      storages = { 'custom' => 'tmp/tests/custom_repositories' }
+      allow(Gitlab.config.repositories).to receive(:storages).and_return(storages)
+    end
+
     it "should update application settings" do
       put api("/application/settings", admin),
-        default_projects_limit: 3, signin_enabled: false
+        default_projects_limit: 3, signin_enabled: false, repository_storage: 'custom'
       expect(response).to have_http_status(200)
       expect(json_response['default_projects_limit']).to eq(3)
       expect(json_response['signin_enabled']).to be_falsey
+      expect(json_response['repository_storage']).to eq('custom')
     end
   end
 end
diff --git a/spec/requests/api/todos_spec.rb b/spec/requests/api/todos_spec.rb
new file mode 100644
index 00000000000..92a4fa216cd
--- /dev/null
+++ b/spec/requests/api/todos_spec.rb
@@ -0,0 +1,190 @@
+require 'spec_helper'
+
+describe API::Todos, api: true do
+  include ApiHelpers
+
+  let(:project_1) { create(:project) }
+  let(:project_2) { create(:project) }
+  let(:author_1) { create(:user) }
+  let(:author_2) { create(:user) }
+  let(:john_doe) { create(:user, username: 'john_doe') }
+  let(:merge_request) { create(:merge_request, source_project: project_1) }
+  let!(:pending_1) { create(:todo, :mentioned, project: project_1, author: author_1, user: john_doe) }
+  let!(:pending_2) { create(:todo, project: project_2, author: author_2, user: john_doe) }
+  let!(:pending_3) { create(:todo, project: project_1, author: author_2, user: john_doe) }
+  let!(:done) { create(:todo, :done, project: project_1, author: author_1, user: john_doe) }
+
+  before do
+    project_1.team << [john_doe, :developer]
+    project_2.team << [john_doe, :developer]
+  end
+
+  describe 'GET /todos' do
+    context 'when unauthenticated' do
+      it 'returns authentication error' do
+        get api('/todos')
+
+        expect(response.status).to eq(401)
+      end
+    end
+
+    context 'when authenticated' do
+      it 'returns an array of pending todos for current user' do
+        get api('/todos', john_doe)
+
+        expect(response.status).to eq(200)
+        expect(json_response).to be_an Array
+        expect(json_response.length).to eq(3)
+        expect(json_response[0]['id']).to eq(pending_3.id)
+        expect(json_response[0]['project']).to be_a Hash
+        expect(json_response[0]['author']).to be_a Hash
+        expect(json_response[0]['target_type']).to be_present
+        expect(json_response[0]['target']).to be_a Hash
+        expect(json_response[0]['target_url']).to be_present
+        expect(json_response[0]['body']).to be_present
+        expect(json_response[0]['state']).to eq('pending')
+        expect(json_response[0]['action_name']).to eq('assigned')
+        expect(json_response[0]['created_at']).to be_present
+      end
+
+      context 'and using the author filter' do
+        it 'filters based on author_id param' do
+          get api('/todos', john_doe), { author_id: author_2.id }
+
+          expect(response.status).to eq(200)
+          expect(json_response).to be_an Array
+          expect(json_response.length).to eq(2)
+        end
+      end
+
+      context 'and using the type filter' do
+        it 'filters based on type param' do
+          create(:todo, project: project_1, author: author_2, user: john_doe, target: merge_request)
+
+          get api('/todos', john_doe), { type: 'MergeRequest' }
+
+          expect(response.status).to eq(200)
+          expect(json_response).to be_an Array
+          expect(json_response.length).to eq(1)
+        end
+      end
+
+      context 'and using the state filter' do
+        it 'filters based on state param' do
+          get api('/todos', john_doe), { state: 'done' }
+
+          expect(response.status).to eq(200)
+          expect(json_response).to be_an Array
+          expect(json_response.length).to eq(1)
+        end
+      end
+
+      context 'and using the project filter' do
+        it 'filters based on project_id param' do
+          get api('/todos', john_doe), { project_id: project_2.id }
+
+          expect(response.status).to eq(200)
+          expect(json_response).to be_an Array
+          expect(json_response.length).to eq(1)
+        end
+      end
+
+      context 'and using the action filter' do
+        it 'filters based on action param' do
+          get api('/todos', john_doe), { action: 'mentioned' }
+
+          expect(response.status).to eq(200)
+          expect(json_response).to be_an Array
+          expect(json_response.length).to eq(1)
+        end
+      end
+    end
+  end
+
+  describe 'DELETE /todos/:id' do
+    context 'when unauthenticated' do
+      it 'returns authentication error' do
+        delete api("/todos/#{pending_1.id}")
+
+        expect(response.status).to eq(401)
+      end
+    end
+
+    context 'when authenticated' do
+      it 'marks a todo as done' do
+        delete api("/todos/#{pending_1.id}", john_doe)
+
+        expect(response.status).to eq(200)
+        expect(pending_1.reload).to be_done
+      end
+    end
+  end
+
+  describe 'DELETE /todos' do
+    context 'when unauthenticated' do
+      it 'returns authentication error' do
+        delete api('/todos')
+
+        expect(response.status).to eq(401)
+      end
+    end
+
+    context 'when authenticated' do
+      it 'marks all todos as done' do
+        delete api('/todos', john_doe)
+
+        expect(response.status).to eq(200)
+        expect(json_response).to be_an Array
+        expect(json_response.length).to eq(3)
+        expect(pending_1.reload).to be_done
+        expect(pending_2.reload).to be_done
+        expect(pending_3.reload).to be_done
+      end
+    end
+  end
+
+  shared_examples 'an issuable' do |issuable_type|
+    it 'creates a todo on an issuable' do
+      post api("/projects/#{project_1.id}/#{issuable_type}/#{issuable.id}/todo", john_doe)
+
+      expect(response.status).to eq(201)
+      expect(json_response['project']).to be_a Hash
+      expect(json_response['author']).to be_a Hash
+      expect(json_response['target_type']).to eq(issuable.class.name)
+      expect(json_response['target']).to be_a Hash
+      expect(json_response['target_url']).to be_present
+      expect(json_response['body']).to be_present
+      expect(json_response['state']).to eq('pending')
+      expect(json_response['action_name']).to eq('marked')
+      expect(json_response['created_at']).to be_present
+    end
+
+    it 'returns 304 there already exist a todo on that issuable' do
+      create(:todo, project: project_1, author: author_1, user: john_doe, target: issuable)
+
+      post api("/projects/#{project_1.id}/#{issuable_type}/#{issuable.id}/todo", john_doe)
+
+      expect(response.status).to eq(304)
+    end
+
+    it 'returns 404 if the issuable is not found' do
+      post api("/projects/#{project_1.id}/#{issuable_type}/123/todo", john_doe)
+
+      expect(response.status).to eq(404)
+    end
+  end
+
+  describe 'POST :id/issuable_type/:issueable_id/todo' do
+    context 'for an issue' do
+      it_behaves_like 'an issuable', 'issues' do
+        let(:issuable) { create(:issue, author: author_1, project: project_1) }
+      end
+    end
+
+    context 'for a merge request' do
+      it_behaves_like 'an issuable', 'merge_requests' do
+        let(:issuable) { merge_request }
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/users_spec.rb b/spec/requests/api/users_spec.rb
index 056256a29f5..e43e3e269bf 100644
--- a/spec/requests/api/users_spec.rb
+++ b/spec/requests/api/users_spec.rb
@@ -246,7 +246,6 @@ describe API::API, api: true  do
   end
 
   describe "GET /users/sign_up" do
-
     it "should redirect to sign in page" do
       get "/users/sign_up"
       expect(response).to have_http_status(302)
diff --git a/spec/requests/git_http_spec.rb b/spec/requests/git_http_spec.rb
index bae56334be4..82ab582beac 100644
--- a/spec/requests/git_http_spec.rb
+++ b/spec/requests/git_http_spec.rb
@@ -350,23 +350,23 @@ describe 'Git HTTP requests', lib: true do
   end
 
   def clone_get(project, options={})
-    get "/#{project}/info/refs", { service: 'git-upload-pack' }, auth_env(*options.values_at(:user, :password))
+    get "/#{project}/info/refs", { service: 'git-upload-pack' }, auth_env(*options.values_at(:user, :password, :spnego_request_token))
   end
 
   def clone_post(project, options={})
-    post "/#{project}/git-upload-pack", {}, auth_env(*options.values_at(:user, :password))
+    post "/#{project}/git-upload-pack", {}, auth_env(*options.values_at(:user, :password, :spnego_request_token))
   end
 
   def push_get(project, options={})
-    get "/#{project}/info/refs", { service: 'git-receive-pack' }, auth_env(*options.values_at(:user, :password))
+    get "/#{project}/info/refs", { service: 'git-receive-pack' }, auth_env(*options.values_at(:user, :password, :spnego_request_token))
   end
 
   def push_post(project, options={})
-    post "/#{project}/git-receive-pack", {}, auth_env(*options.values_at(:user, :password))
+    post "/#{project}/git-receive-pack", {}, auth_env(*options.values_at(:user, :password, :spnego_request_token))
   end
 
-  def download(project, user: nil, password: nil)
-    args = [project, { user: user, password: password }]
+  def download(project, user: nil, password: nil, spnego_request_token: nil)
+    args = [project, { user: user, password: password, spnego_request_token: spnego_request_token }]
 
     clone_get(*args)
     yield response
@@ -375,8 +375,8 @@ describe 'Git HTTP requests', lib: true do
     yield response
   end
 
-  def upload(project, user: nil, password: nil)
-    args = [project, { user: user, password: password }]
+  def upload(project, user: nil, password: nil, spnego_request_token: nil)
+    args = [project, { user: user, password: password, spnego_request_token: spnego_request_token }]
 
     push_get(*args)
     yield response
@@ -385,11 +385,14 @@ describe 'Git HTTP requests', lib: true do
     yield response
   end
 
-  def auth_env(user, password)
+  def auth_env(user, password, spnego_request_token)
+    env = {}
     if user && password
-      { 'HTTP_AUTHORIZATION' => ActionController::HttpAuthentication::Basic.encode_credentials(user, password) }
-    else
-      {}
+      env['HTTP_AUTHORIZATION'] = ActionController::HttpAuthentication::Basic.encode_credentials(user, password)
+    elsif spnego_request_token
+      env['HTTP_AUTHORIZATION'] = "Negotiate #{::Base64.strict_encode64('opaque_request_token')}"
     end
+
+    env
   end
 end