summaryrefslogtreecommitdiff
path: root/spec
diff options
context:
space:
mode:
authorGitLab Bot <gitlab-bot@gitlab.com>2021-04-27 08:58:45 +0000
committerGitLab Bot <gitlab-bot@gitlab.com>2021-04-27 08:58:57 +0000
commit01e158d0eb6d238c7bddc657c0a588c5d9cc95a8 (patch)
treea630bcf87eec8fc7dd9cd9ea51f35bb80a105ee4 /spec
parentce8500b9939b185913ca299f5a227492680b9d68 (diff)
downloadgitlab-ce-01e158d0eb6d238c7bddc657c0a588c5d9cc95a8.tar.gz
Add latest changes from gitlab-org/security/gitlab@13-11-stable-ee
Diffstat (limited to 'spec')
-rw-r--r--spec/requests/api/issues/issues_spec.rb28
-rw-r--r--spec/requests/api/issues/post_projects_issues_spec.rb14
2 files changed, 41 insertions, 1 deletions
diff --git a/spec/requests/api/issues/issues_spec.rb b/spec/requests/api/issues/issues_spec.rb
index 0fe68be027c..8f10de59526 100644
--- a/spec/requests/api/issues/issues_spec.rb
+++ b/spec/requests/api/issues/issues_spec.rb
@@ -943,6 +943,34 @@ RSpec.describe API::Issues do
it_behaves_like 'issuable update endpoint' do
let(:entity) { issue }
end
+
+ describe 'updated_at param' do
+ let(:fixed_time) { Time.new(2001, 1, 1) }
+ let(:updated_at) { Time.new(2000, 1, 1) }
+
+ before do
+ travel_to fixed_time
+ end
+
+ it 'allows admins to set the timestamp' do
+ put api("/projects/#{project.id}/issues/#{issue.iid}", admin), params: { labels: 'label1', updated_at: updated_at }
+
+ expect(response).to have_gitlab_http_status(:ok)
+ expect(Time.parse(json_response['updated_at'])).to be_like_time(updated_at)
+ expect(ResourceLabelEvent.last.created_at).to be_like_time(updated_at)
+ end
+
+ it 'does not allow other users to set the timestamp' do
+ reporter = create(:user)
+ project.add_developer(reporter)
+
+ put api("/projects/#{project.id}/issues/#{issue.iid}", reporter), params: { labels: 'label1', updated_at: updated_at }
+
+ expect(response).to have_gitlab_http_status(:ok)
+ expect(Time.parse(json_response['updated_at'])).to be_like_time(fixed_time)
+ expect(ResourceLabelEvent.last.created_at).to be_like_time(fixed_time)
+ end
+ end
end
describe 'DELETE /projects/:id/issues/:issue_iid' do
diff --git a/spec/requests/api/issues/post_projects_issues_spec.rb b/spec/requests/api/issues/post_projects_issues_spec.rb
index 7f1db620d4f..9d3bd26a200 100644
--- a/spec/requests/api/issues/post_projects_issues_spec.rb
+++ b/spec/requests/api/issues/post_projects_issues_spec.rb
@@ -330,15 +330,21 @@ RSpec.describe API::Issues do
end
context 'setting created_at' do
+ let(:fixed_time) { Time.new(2001, 1, 1) }
let(:creation_time) { 2.weeks.ago }
let(:params) { { title: 'new issue', labels: 'label, label2', created_at: creation_time } }
+ before do
+ travel_to fixed_time
+ end
+
context 'by an admin' do
it 'sets the creation time on the new issue' do
post api("/projects/#{project.id}/issues", admin), params: params
expect(response).to have_gitlab_http_status(:created)
expect(Time.parse(json_response['created_at'])).to be_like_time(creation_time)
+ expect(ResourceLabelEvent.last.created_at).to be_like_time(creation_time)
end
end
@@ -348,6 +354,7 @@ RSpec.describe API::Issues do
expect(response).to have_gitlab_http_status(:created)
expect(Time.parse(json_response['created_at'])).to be_like_time(creation_time)
+ expect(ResourceLabelEvent.last.created_at).to be_like_time(creation_time)
end
end
@@ -356,19 +363,24 @@ RSpec.describe API::Issues do
group = create(:group)
group_project = create(:project, :public, namespace: group)
group.add_owner(user2)
+
post api("/projects/#{group_project.id}/issues", user2), params: params
expect(response).to have_gitlab_http_status(:created)
expect(Time.parse(json_response['created_at'])).to be_like_time(creation_time)
+ expect(ResourceLabelEvent.last.created_at).to be_like_time(creation_time)
end
end
context 'by another user' do
it 'ignores the given creation time' do
+ project.add_developer(user2)
+
post api("/projects/#{project.id}/issues", user2), params: params
expect(response).to have_gitlab_http_status(:created)
- expect(Time.parse(json_response['created_at'])).not_to be_like_time(creation_time)
+ expect(Time.parse(json_response['created_at'])).to be_like_time(fixed_time)
+ expect(ResourceLabelEvent.last.created_at).to be_like_time(fixed_time)
end
end
end