Merge branch 'issue_16834'

# Conflicts:
#	doc/api/v3_to_v4.md

3 files changed, 400 insertions, 104 deletions

diff --git a/spec/requests/api/files_spec.rb b/spec/requests/api/files_spec.rb
index 91f8a35e045..a7fad7f0bdb 100644
--- a/spec/requests/api/files_spec.rb
+++ b/spec/requests/api/files_spec.rb
@@ -5,10 +5,9 @@ describe API::Files, api: true  do
   let(:user) { create(:user) }
   let!(:project) { create(:project, :repository, namespace: user.namespace ) }
   let(:guest) { create(:user) { |u| project.add_guest(u) } }
-  let(:file_path) { 'files/ruby/popen.rb' }
+  let(:file_path) { "files%2Fruby%2Fpopen%2Erb" }
   let(:params) do
     {
-      file_path: file_path,
       ref: 'master'
     }
   end
@@ -30,36 +29,54 @@ describe API::Files, api: true  do
 
   before { project.team << [user, :developer] }
 
-  describe "GET /projects/:id/repository/files" do
-    let(:route) { "/projects/#{project.id}/repository/files" }
+  def route(file_path = nil)
+    "/projects/#{project.id}/repository/files/#{file_path}"
+  end
 
+  describe "GET /projects/:id/repository/files/:file_path" do
     shared_examples_for 'repository files' do
-      it "returns file info" do
-        get api(route, current_user), params
+      it 'returns file attributes as json' do
+        get api(route(file_path), current_user), params
 
         expect(response).to have_http_status(200)
-        expect(json_response['file_path']).to eq(file_path)
+        expect(json_response['file_path']).to eq(CGI.unescape(file_path))
         expect(json_response['file_name']).to eq('popen.rb')
         expect(json_response['last_commit_id']).to eq('570e7b2abdd848b95f2f578043fc23bd6f6fd24d')
         expect(Base64.decode64(json_response['content']).lines.first).to eq("require 'fileutils'\n")
       end
 
-      context 'when no params are given' do
+      it 'returns file by commit sha' do
+        # This file is deleted on HEAD
+        file_path = "files%2Fjs%2Fcommit%2Ejs%2Ecoffee"
+        params[:ref] = "6f6d7e7ed97bb5f0054f2b1df789b39ca89b6ff9"
+
+        get api(route(file_path), current_user), params
+
+        expect(response).to have_http_status(200)
+        expect(json_response['file_name']).to eq('commit.js.coffee')
+        expect(Base64.decode64(json_response['content']).lines.first).to eq("class Commit\n")
+      end
+
+      it 'returns raw file info' do
+        url = route(file_path) + "/raw"
+        expect(Gitlab::Workhorse).to receive(:send_git_blob)
+
+        get api(url, current_user), params
+
+        expect(response).to have_http_status(200)
+      end
+
+      context 'when mandatory params are not given' do
         it_behaves_like '400 response' do
-          let(:request) { get api(route, current_user) }
+          let(:request) { get api(route("any%2Ffile"), current_user) }
         end
       end
 
       context 'when file_path does not exist' do
-        let(:params) do
-          {
-            file_path: 'app/models/application.rb',
-            ref: 'master',
-          }
-        end
+        let(:params) { { ref: 'master' } }
 
         it_behaves_like '404 response' do
-          let(:request) { get api(route, current_user), params }
+          let(:request) { get api(route('app%2Fmodels%2Fapplication%2Erb'), current_user), params }
           let(:message) { '404 File Not Found' }
         end
       end
@@ -68,7 +85,7 @@ describe API::Files, api: true  do
         include_context 'disabled repository'
 
         it_behaves_like '403 response' do
-          let(:request) { get api(route, current_user), params }
+          let(:request) { get api(route(file_path), current_user), params }
         end
       end
     end
@@ -82,7 +99,7 @@ describe API::Files, api: true  do
 
     context 'when unauthenticated', 'and project is private' do
       it_behaves_like '404 response' do
-        let(:request) { get api(route), params }
+        let(:request) { get api(route(file_path)), params }
         let(:message) { '404 Project Not Found' }
       end
     end
@@ -95,33 +112,106 @@ describe API::Files, api: true  do
 
     context 'when authenticated', 'as a guest' do
       it_behaves_like '403 response' do
-        let(:request) { get api(route, guest), params }
+        let(:request) { get api(route(file_path), guest), params }
       end
     end
   end
 
-  describe "POST /projects/:id/repository/files" do
+  describe "GET /projects/:id/repository/files/:file_path/raw" do
+    shared_examples_for 'repository raw files' do
+      it 'returns raw file info' do
+        url = route(file_path) + "/raw"
+        expect(Gitlab::Workhorse).to receive(:send_git_blob)
+
+        get api(url, current_user), params
+
+        expect(response).to have_http_status(200)
+      end
+
+      it 'returns file by commit sha' do
+        # This file is deleted on HEAD
+        file_path = "files%2Fjs%2Fcommit%2Ejs%2Ecoffee"
+        params[:ref] = "6f6d7e7ed97bb5f0054f2b1df789b39ca89b6ff9"
+        expect(Gitlab::Workhorse).to receive(:send_git_blob)
+
+        get api(route(file_path) + "/raw", current_user), params
+
+        expect(response).to have_http_status(200)
+      end
+
+      context 'when mandatory params are not given' do
+        it_behaves_like '400 response' do
+          let(:request) { get api(route("any%2Ffile"), current_user) }
+        end
+      end
+
+      context 'when file_path does not exist' do
+        let(:params) { { ref: 'master' } }
+
+        it_behaves_like '404 response' do
+          let(:request) { get api(route('app%2Fmodels%2Fapplication%2Erb'), current_user), params }
+          let(:message) { '404 File Not Found' }
+        end
+      end
+
+      context 'when repository is disabled' do
+        include_context 'disabled repository'
+
+        it_behaves_like '403 response' do
+          let(:request) { get api(route(file_path), current_user), params }
+        end
+      end
+    end
+
+    context 'when unauthenticated', 'and project is public' do
+      it_behaves_like 'repository raw files' do
+        let(:project) { create(:project, :public) }
+        let(:current_user) { nil }
+      end
+    end
+
+    context 'when unauthenticated', 'and project is private' do
+      it_behaves_like '404 response' do
+        let(:request) { get api(route(file_path)), params }
+        let(:message) { '404 Project Not Found' }
+      end
+    end
+
+    context 'when authenticated', 'as a developer' do
+      it_behaves_like 'repository raw files' do
+        let(:current_user) { user }
+      end
+    end
+
+    context 'when authenticated', 'as a guest' do
+      it_behaves_like '403 response' do
+        let(:request) { get api(route(file_path), guest), params }
+      end
+    end
+  end
+
+  describe "POST /projects/:id/repository/files/:file_path" do
+    let!(:file_path) { "new_subfolder%2Fnewfile%2Erb" }
     let(:valid_params) do
       {
-        file_path: 'newfile.rb',
-        branch: 'master',
-        content: 'puts 8',
-        commit_message: 'Added newfile'
+        branch: "master",
+        content: "puts 8",
+        commit_message: "Added newfile"
       }
     end
 
     it "creates a new file in project repo" do
-      post api("/projects/#{project.id}/repository/files", user), valid_params
+      post api(route(file_path), user), valid_params
 
       expect(response).to have_http_status(201)
-      expect(json_response['file_path']).to eq('newfile.rb')
+      expect(json_response["file_path"]).to eq(CGI.unescape(file_path))
       last_commit = project.repository.commit.raw
       expect(last_commit.author_email).to eq(user.email)
       expect(last_commit.author_name).to eq(user.name)
     end
 
-    it "returns a 400 bad request if no params given" do
-      post api("/projects/#{project.id}/repository/files", user)
+    it "returns a 400 bad request if no mandatory params given" do
+      post api(route("any%2Etxt"), user)
 
       expect(response).to have_http_status(400)
     end
@@ -130,7 +220,7 @@ describe API::Files, api: true  do
       allow_any_instance_of(Repository).to receive(:create_file).
         and_return(false)
 
-      post api("/projects/#{project.id}/repository/files", user), valid_params
+      post api(route("any%2Etxt"), user), valid_params
 
       expect(response).to have_http_status(400)
     end
@@ -139,7 +229,7 @@ describe API::Files, api: true  do
       it "creates a new file with the specified author" do
         valid_params.merge!(author_email: author_email, author_name: author_name)
 
-        post api("/projects/#{project.id}/repository/files", user), valid_params
+        post api(route("new_file_with_author%2Etxt"), user), valid_params
 
         expect(response).to have_http_status(201)
         last_commit = project.repository.commit.raw
@@ -152,7 +242,7 @@ describe API::Files, api: true  do
       let!(:project) { create(:project_empty_repo, namespace: user.namespace ) }
 
       it "creates a new file in project repo" do
-        post api("/projects/#{project.id}/repository/files", user), valid_params
+        post api(route("newfile%2Erb"), user), valid_params
 
         expect(response).to have_http_status(201)
         expect(json_response['file_path']).to eq('newfile.rb')
@@ -166,7 +256,6 @@ describe API::Files, api: true  do
   describe "PUT /projects/:id/repository/files" do
     let(:valid_params) do
       {
-        file_path: file_path,
         branch: 'master',
         content: 'puts 8',
         commit_message: 'Changed file'
@@ -174,17 +263,17 @@ describe API::Files, api: true  do
     end
 
     it "updates existing file in project repo" do
-      put api("/projects/#{project.id}/repository/files", user), valid_params
+      put api(route(file_path), user), valid_params
 
       expect(response).to have_http_status(200)
-      expect(json_response['file_path']).to eq(file_path)
+      expect(json_response['file_path']).to eq(CGI.unescape(file_path))
       last_commit = project.repository.commit.raw
       expect(last_commit.author_email).to eq(user.email)
       expect(last_commit.author_name).to eq(user.name)
     end
 
     it "returns a 400 bad request if no params given" do
-      put api("/projects/#{project.id}/repository/files", user)
+      put api(route(file_path), user)
 
       expect(response).to have_http_status(400)
     end
@@ -193,7 +282,7 @@ describe API::Files, api: true  do
       it "updates a file with the specified author" do
         valid_params.merge!(author_email: author_email, author_name: author_name, content: "New content")
 
-        put api("/projects/#{project.id}/repository/files", user), valid_params
+        put api(route(file_path), user), valid_params
 
         expect(response).to have_http_status(200)
         last_commit = project.repository.commit.raw
@@ -206,20 +295,19 @@ describe API::Files, api: true  do
   describe "DELETE /projects/:id/repository/files" do
     let(:valid_params) do
       {
-        file_path: file_path,
         branch: 'master',
         commit_message: 'Changed file'
       }
     end
 
     it "deletes existing file in project repo" do
-      delete api("/projects/#{project.id}/repository/files", user), valid_params
+      delete api(route(file_path), user), valid_params
 
       expect(response).to have_http_status(204)
     end
 
     it "returns a 400 bad request if no params given" do
-      delete api("/projects/#{project.id}/repository/files", user)
+      delete api(route(file_path), user)
 
       expect(response).to have_http_status(400)
     end
@@ -227,7 +315,7 @@ describe API::Files, api: true  do
     it "returns a 400 if fails to create file" do
       allow_any_instance_of(Repository).to receive(:delete_file).and_return(false)
 
-      delete api("/projects/#{project.id}/repository/files", user), valid_params
+      delete api(route(file_path), user), valid_params
 
       expect(response).to have_http_status(400)
     end
@@ -236,7 +324,7 @@ describe API::Files, api: true  do
       it "removes a file with the specified author" do
         valid_params.merge!(author_email: author_email, author_name: author_name)
 
-        delete api("/projects/#{project.id}/repository/files", user), valid_params
+        delete api(route(file_path), user), valid_params
 
         expect(response).to have_http_status(204)
       end
@@ -244,10 +332,9 @@ describe API::Files, api: true  do
   end
 
   describe "POST /projects/:id/repository/files with binary file" do
-    let(:file_path) { 'test.bin' }
+    let(:file_path) { 'test%2Ebin' }
     let(:put_params) do
       {
-        file_path: file_path,
         branch: 'master',
         content: 'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABAQMAAAAl21bKAAAAA1BMVEUAAACnej3aAAAAAXRSTlMAQObYZgAAAApJREFUCNdjYAAAAAIAAeIhvDMAAAAASUVORK5CYII=',
         commit_message: 'Binary file with a \n should not be touched',
@@ -256,21 +343,20 @@ describe API::Files, api: true  do
     end
     let(:get_params) do
       {
-        file_path: file_path,
         ref: 'master',
       }
     end
 
     before do
-      post api("/projects/#{project.id}/repository/files", user), put_params
+      post api(route(file_path), user), put_params
     end
 
     it "remains unchanged" do
-      get api("/projects/#{project.id}/repository/files", user), get_params
+      get api(route(file_path), user), get_params
 
       expect(response).to have_http_status(200)
-      expect(json_response['file_path']).to eq(file_path)
-      expect(json_response['file_name']).to eq(file_path)
+      expect(json_response['file_path']).to eq(CGI.unescape(file_path))
+      expect(json_response['file_name']).to eq(CGI.unescape(file_path))
       expect(json_response['content']).to eq(put_params[:content])
     end
   end
diff --git a/spec/requests/api/repositories_spec.rb b/spec/requests/api/repositories_spec.rb
index 7652606a491..4783d011d54 100644
--- a/spec/requests/api/repositories_spec.rb
+++ b/spec/requests/api/repositories_spec.rb
@@ -30,7 +30,7 @@ describe API::Repositories, api: true  do
 
       context 'when ref does not exist' do
         it_behaves_like '404 response' do
-          let(:request) { get api("#{route}?ref_name=foo", current_user) }
+          let(:request) { get api("#{route}?ref=foo", current_user) }
           let(:message) { '404 Tree Not Found' }
         end
       end
@@ -66,7 +66,7 @@ describe API::Repositories, api: true  do
 
         context 'when ref does not exist' do
           it_behaves_like '404 response' do
-            let(:request) { get api("#{route}?recursive=1&ref_name=foo", current_user) }
+            let(:request) { get api("#{route}?recursive=1&ref=foo", current_user) }
             let(:message) { '404 Tree Not Found' }
           end
         end
@@ -100,82 +100,70 @@ describe API::Repositories, api: true  do
     end
   end
 
-  {
-    'blobs/:sha' => 'blobs/master',
-    'commits/:sha/blob' => 'commits/master/blob'
-  }.each do |desc_path, example_path|
-    describe "GET /projects/:id/repository/#{desc_path}" do
-      let(:route) { "/projects/#{project.id}/repository/#{example_path}?filepath=README.md" }
+  describe "GET /projects/:id/repository/blobs/:sha" do
+    let(:route) { "/projects/#{project.id}/repository/blobs/#{sample_blob.oid}" }
 
-      shared_examples_for 'repository blob' do
-        it 'returns the repository blob' do
-          get api(route, current_user)
-
-          expect(response).to have_http_status(200)
-        end
-
-        context 'when sha does not exist' do
-          it_behaves_like '404 response' do
-            let(:request) { get api(route.sub('master', 'invalid_branch_name'), current_user) }
-            let(:message) { '404 Commit Not Found' }
-          end
-        end
+    shared_examples_for 'repository blob' do
+      it 'returns blob attributes as json' do
+        get api(route, current_user)
 
-        context 'when filepath does not exist' do
-          it_behaves_like '404 response' do
-            let(:request) { get api(route.sub('README.md', 'README.invalid'), current_user) }
-            let(:message) { '404 File Not Found' }
-          end
-        end
+        expect(response).to have_http_status(200)
+        expect(json_response['size']).to eq(111)
+        expect(json_response['encoding']).to eq("base64")
+        expect(Base64.decode64(json_response['content']).lines.first).to eq("class Commit\n")
+        expect(json_response['sha']).to eq(sample_blob.oid)
+      end
 
-        context 'when no filepath is given' do
-          it_behaves_like '400 response' do
-            let(:request) { get api(route.sub('?filepath=README.md', ''), current_user) }
-          end
+      context 'when sha does not exist' do
+        it_behaves_like '404 response' do
+          let(:request) { get api(route.sub(sample_blob.oid, '123456'), current_user) }
+          let(:message) { '404 Blob Not Found' }
         end
+      end
 
-        context 'when repository is disabled' do
-          include_context 'disabled repository'
+      context 'when repository is disabled' do
+        include_context 'disabled repository'
 
-          it_behaves_like '403 response' do
-            let(:request) { get api(route, current_user) }
-          end
+        it_behaves_like '403 response' do
+          let(:request) { get api(route, current_user) }
         end
       end
+    end
 
-      context 'when unauthenticated', 'and project is public' do
-        it_behaves_like 'repository blob' do
-          let(:project) { create(:project, :public, :repository) }
-          let(:current_user) { nil }
-        end
+    context 'when unauthenticated', 'and project is public' do
+      it_behaves_like 'repository blob' do
+        let(:project) { create(:project, :public, :repository) }
+        let(:current_user) { nil }
       end
+    end
 
-      context 'when unauthenticated', 'and project is private' do
-        it_behaves_like '404 response' do
-          let(:request) { get api(route) }
-          let(:message) { '404 Project Not Found' }
-        end
+    context 'when unauthenticated', 'and project is private' do
+      it_behaves_like '404 response' do
+        let(:request) { get api(route) }
+        let(:message) { '404 Project Not Found' }
       end
+    end
 
-      context 'when authenticated', 'as a developer' do
-        it_behaves_like 'repository blob' do
-          let(:current_user) { user }
-        end
+    context 'when authenticated', 'as a developer' do
+      it_behaves_like 'repository blob' do
+        let(:current_user) { user }
       end
+    end
 
-      context 'when authenticated', 'as a guest' do
-        it_behaves_like '403 response' do
-          let(:request) { get api(route, guest) }
-        end
+    context 'when authenticated', 'as a guest' do
+      it_behaves_like '403 response' do
+        let(:request) { get api(route, guest) }
       end
     end
   end
 
-  describe "GET /projects/:id/repository/raw_blobs/:sha" do
-    let(:route) { "/projects/#{project.id}/repository/raw_blobs/#{sample_blob.oid}" }
+  describe "GET /projects/:id/repository/blobs/:sha/raw" do
+    let(:route) { "/projects/#{project.id}/repository/blobs/#{sample_blob.oid}/raw" }
 
     shared_examples_for 'repository raw blob' do
       it 'returns the repository raw blob' do
+        expect(Gitlab::Workhorse).to receive(:send_git_blob)
+
         get api(route, current_user)
 
         expect(response).to have_http_status(200)
diff --git a/spec/requests/api/v3/repositories_spec.rb b/spec/requests/api/v3/repositories_spec.rb
index c696721c1c9..fef6fb641fa 100644
--- a/spec/requests/api/v3/repositories_spec.rb
+++ b/spec/requests/api/v3/repositories_spec.rb
@@ -3,6 +3,8 @@ require 'mime/types'
 
 describe API::V3::Repositories, api: true  do
   include ApiHelpers
+  include RepoHelpers
+  include WorkhorseHelpers
 
   let(:user) { create(:user) }
   let(:guest) { create(:user).tap { |u| create(:project_member, :guest, user: u, project: project) } }
@@ -96,6 +98,226 @@ describe API::V3::Repositories, api: true  do
     end
   end
 
+  {
+    'blobs/:sha' => 'blobs/master',
+    'commits/:sha/blob' => 'commits/master/blob'
+  }.each do |desc_path, example_path|
+    describe "GET /projects/:id/repository/#{desc_path}" do
+      let(:route) { "/projects/#{project.id}/repository/#{example_path}?filepath=README.md" }
+      shared_examples_for 'repository blob' do
+        it 'returns the repository blob' do
+          get v3_api(route, current_user)
+          expect(response).to have_http_status(200)
+        end
+        context 'when sha does not exist' do
+          it_behaves_like '404 response' do
+            let(:request) { get v3_api(route.sub('master', 'invalid_branch_name'), current_user) }
+            let(:message) { '404 Commit Not Found' }
+          end
+        end
+        context 'when filepath does not exist' do
+          it_behaves_like '404 response' do
+            let(:request) { get v3_api(route.sub('README.md', 'README.invalid'), current_user) }
+            let(:message) { '404 File Not Found' }
+          end
+        end
+        context 'when no filepath is given' do
+          it_behaves_like '400 response' do
+            let(:request) { get v3_api(route.sub('?filepath=README.md', ''), current_user) }
+          end
+        end
+        context 'when repository is disabled' do
+          include_context 'disabled repository'
+          it_behaves_like '403 response' do
+            let(:request) { get v3_api(route, current_user) }
+          end
+        end
+      end
+      context 'when unauthenticated', 'and project is public' do
+        it_behaves_like 'repository blob' do
+          let(:project) { create(:project, :public, :repository) }
+          let(:current_user) { nil }
+        end
+      end
+      context 'when unauthenticated', 'and project is private' do
+        it_behaves_like '404 response' do
+          let(:request) { get v3_api(route) }
+          let(:message) { '404 Project Not Found' }
+        end
+      end
+      context 'when authenticated', 'as a developer' do
+        it_behaves_like 'repository blob' do
+          let(:current_user) { user }
+        end
+      end
+      context 'when authenticated', 'as a guest' do
+        it_behaves_like '403 response' do
+          let(:request) { get v3_api(route, guest) }
+        end
+      end
+    end
+  end
+  describe "GET /projects/:id/repository/raw_blobs/:sha" do
+    let(:route) { "/projects/#{project.id}/repository/raw_blobs/#{sample_blob.oid}" }
+    shared_examples_for 'repository raw blob' do
+      it 'returns the repository raw blob' do
+        get v3_api(route, current_user)
+        expect(response).to have_http_status(200)
+      end
+      context 'when sha does not exist' do
+        it_behaves_like '404 response' do
+          let(:request) { get v3_api(route.sub(sample_blob.oid, '123456'), current_user) }
+          let(:message) { '404 Blob Not Found' }
+        end
+      end
+      context 'when repository is disabled' do
+        include_context 'disabled repository'
+        it_behaves_like '403 response' do
+          let(:request) { get v3_api(route, current_user) }
+        end
+      end
+    end
+    context 'when unauthenticated', 'and project is public' do
+      it_behaves_like 'repository raw blob' do
+        let(:project) { create(:project, :public, :repository) }
+        let(:current_user) { nil }
+      end
+    end
+    context 'when unauthenticated', 'and project is private' do
+      it_behaves_like '404 response' do
+        let(:request) { get v3_api(route) }
+        let(:message) { '404 Project Not Found' }
+      end
+    end
+    context 'when authenticated', 'as a developer' do
+      it_behaves_like 'repository raw blob' do
+        let(:current_user) { user }
+      end
+    end
+    context 'when authenticated', 'as a guest' do
+      it_behaves_like '403 response' do
+        let(:request) { get v3_api(route, guest) }
+      end
+    end
+  end
+  describe "GET /projects/:id/repository/archive(.:format)?:sha" do
+    let(:route) { "/projects/#{project.id}/repository/archive" }
+    shared_examples_for 'repository archive' do
+      it 'returns the repository archive' do
+        get v3_api(route, current_user)
+        expect(response).to have_http_status(200)
+        repo_name = project.repository.name.gsub("\.git", "")
+        type, params = workhorse_send_data
+        expect(type).to eq('git-archive')
+        expect(params['ArchivePath']).to match(/#{repo_name}\-[^\.]+\.tar.gz/)
+      end
+      it 'returns the repository archive archive.zip' do
+        get v3_api("/projects/#{project.id}/repository/archive.zip", user)
+        expect(response).to have_http_status(200)
+        repo_name = project.repository.name.gsub("\.git", "")
+        type, params = workhorse_send_data
+        expect(type).to eq('git-archive')
+        expect(params['ArchivePath']).to match(/#{repo_name}\-[^\.]+\.zip/)
+      end
+      it 'returns the repository archive archive.tar.bz2' do
+        get v3_api("/projects/#{project.id}/repository/archive.tar.bz2", user)
+        expect(response).to have_http_status(200)
+        repo_name = project.repository.name.gsub("\.git", "")
+        type, params = workhorse_send_data
+        expect(type).to eq('git-archive')
+        expect(params['ArchivePath']).to match(/#{repo_name}\-[^\.]+\.tar.bz2/)
+      end
+      context 'when sha does not exist' do
+        it_behaves_like '404 response' do
+          let(:request) { get v3_api("#{route}?sha=xxx", current_user) }
+          let(:message) { '404 File Not Found' }
+        end
+      end
+    end
+    context 'when unauthenticated', 'and project is public' do
+      it_behaves_like 'repository archive' do
+        let(:project) { create(:project, :public, :repository) }
+        let(:current_user) { nil }
+      end
+    end
+    context 'when unauthenticated', 'and project is private' do
+      it_behaves_like '404 response' do
+        let(:request) { get v3_api(route) }
+        let(:message) { '404 Project Not Found' }
+      end
+    end
+    context 'when authenticated', 'as a developer' do
+      it_behaves_like 'repository archive' do
+        let(:current_user) { user }
+      end
+    end
+    context 'when authenticated', 'as a guest' do
+      it_behaves_like '403 response' do
+        let(:request) { get v3_api(route, guest) }
+      end
+    end
+  end
+
+  describe 'GET /projects/:id/repository/compare' do
+    let(:route) { "/projects/#{project.id}/repository/compare" }
+    shared_examples_for 'repository compare' do
+      it "compares branches" do
+        get v3_api(route, current_user), from: 'master', to: 'feature'
+        expect(response).to have_http_status(200)
+        expect(json_response['commits']).to be_present
+        expect(json_response['diffs']).to be_present
+      end
+      it "compares tags" do
+        get v3_api(route, current_user), from: 'v1.0.0', to: 'v1.1.0'
+        expect(response).to have_http_status(200)
+        expect(json_response['commits']).to be_present
+        expect(json_response['diffs']).to be_present
+      end
+      it "compares commits" do
+        get v3_api(route, current_user), from: sample_commit.id, to: sample_commit.parent_id
+        expect(response).to have_http_status(200)
+        expect(json_response['commits']).to be_empty
+        expect(json_response['diffs']).to be_empty
+        expect(json_response['compare_same_ref']).to be_falsey
+      end
+      it "compares commits in reverse order" do
+        get v3_api(route, current_user), from: sample_commit.parent_id, to: sample_commit.id
+        expect(response).to have_http_status(200)
+        expect(json_response['commits']).to be_present
+        expect(json_response['diffs']).to be_present
+      end
+      it "compares same refs" do
+        get v3_api(route, current_user), from: 'master', to: 'master'
+        expect(response).to have_http_status(200)
+        expect(json_response['commits']).to be_empty
+        expect(json_response['diffs']).to be_empty
+        expect(json_response['compare_same_ref']).to be_truthy
+      end
+    end
+    context 'when unauthenticated', 'and project is public' do
+      it_behaves_like 'repository compare' do
+        let(:project) { create(:project, :public, :repository) }
+        let(:current_user) { nil }
+      end
+    end
+    context 'when unauthenticated', 'and project is private' do
+      it_behaves_like '404 response' do
+        let(:request) { get v3_api(route) }
+        let(:message) { '404 Project Not Found' }
+      end
+    end
+    context 'when authenticated', 'as a developer' do
+      it_behaves_like 'repository compare' do
+        let(:current_user) { user }
+      end
+    end
+    context 'when authenticated', 'as a guest' do
+      it_behaves_like '403 response' do
+        let(:request) { get v3_api(route, guest) }
+      end
+    end
+  end
+
   describe 'GET /projects/:id/repository/contributors' do
     let(:route) { "/projects/#{project.id}/repository/contributors" }