diff options
34 files changed, 426 insertions, 113 deletions
diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION index 44d2da1a434..21ff8d35786 100644 --- a/GITALY_SERVER_VERSION +++ b/GITALY_SERVER_VERSION @@ -1 +1 @@ -034cc7332fc1ebf67599f7f9e98e1588bc6d1823 +4ba8618078d9107d52c0d735f76286ab0b113a8a diff --git a/app/graphql/resolvers/users/participants_resolver.rb b/app/graphql/resolvers/users/participants_resolver.rb new file mode 100644 index 00000000000..9e87b60fa34 --- /dev/null +++ b/app/graphql/resolvers/users/participants_resolver.rb @@ -0,0 +1,13 @@ +# frozen_string_literal: true + +module Resolvers + module Users + class ParticipantsResolver < BaseResolver + type Types::UserType.connection_type, null: true + + def resolve(**args) + object.visible_participants(current_user) + end + end + end +end diff --git a/app/graphql/types/issue_type.rb b/app/graphql/types/issue_type.rb index 3b0f93d8dc1..498569f11ca 100644 --- a/app/graphql/types/issue_type.rb +++ b/app/graphql/types/issue_type.rb @@ -80,7 +80,8 @@ module Types description: 'Relative position of the issue (used for positioning in epic tree and issue boards).' field :participants, Types::UserType.connection_type, null: true, complexity: 5, - description: 'List of participants in the issue.' + description: 'List of participants in the issue.', + resolver: Resolvers::Users::ParticipantsResolver field :emails_disabled, GraphQL::Types::Boolean, null: false, method: :project_emails_disabled?, description: 'Indicates if a project has email notifications disabled: `true` if email notifications are disabled.' diff --git a/app/graphql/types/merge_request_type.rb b/app/graphql/types/merge_request_type.rb index 8ad313758e5..bd78643eb3d 100644 --- a/app/graphql/types/merge_request_type.rb +++ b/app/graphql/types/merge_request_type.rb @@ -148,7 +148,8 @@ module Types field :author, Types::UserType, null: true, description: 'User who created this merge request.' field :participants, Types::UserType.connection_type, null: true, complexity: 15, - description: 'Participants in the merge request. This includes the author, assignees, reviewers, and users mentioned in notes.' + description: 'Participants in the merge request. This includes the author, assignees, reviewers, and users mentioned in notes.', + resolver: Resolvers::Users::ParticipantsResolver field :subscribed, GraphQL::Types::Boolean, method: :subscribed?, null: false, complexity: 5, description: 'Indicates if the currently logged in user is subscribed to this merge request.' field :labels, Types::LabelType.connection_type, null: true, complexity: 5, diff --git a/app/models/application_setting.rb b/app/models/application_setting.rb index af5796d682f..06a5b95f40e 100644 --- a/app/models/application_setting.rb +++ b/app/models/application_setting.rb @@ -21,7 +21,7 @@ class ApplicationSetting < ApplicationRecord add_authentication_token_field :runners_registration_token, encrypted: -> { Feature.enabled?(:application_settings_tokens_optional_encryption) ? :optional : :required } add_authentication_token_field :health_check_access_token - add_authentication_token_field :static_objects_external_storage_auth_token + add_authentication_token_field :static_objects_external_storage_auth_token, encrypted: :optional belongs_to :self_monitoring_project, class_name: "Project", foreign_key: 'instance_administration_project_id' belongs_to :push_rule diff --git a/app/models/application_setting_implementation.rb b/app/models/application_setting_implementation.rb index 54ec8b2c3e4..5e20aac3b92 100644 --- a/app/models/application_setting_implementation.rb +++ b/app/models/application_setting_implementation.rb @@ -363,6 +363,14 @@ module ApplicationSettingImplementation super(levels&.map { |level| Gitlab::VisibilityLevel.level_value(level) }) end + def static_objects_external_storage_auth_token=(token) + if token.present? + set_static_objects_external_storage_auth_token(token) + else + self.static_objects_external_storage_auth_token_encrypted = nil + end + end + def performance_bar_allowed_group Group.find_by_id(performance_bar_allowed_group_id) end diff --git a/app/models/ci/build.rb b/app/models/ci/build.rb index 54967910f4d..428e440afba 100644 --- a/app/models/ci/build.rb +++ b/app/models/ci/build.rb @@ -59,7 +59,7 @@ module Ci has_one :runner_session, class_name: 'Ci::BuildRunnerSession', validate: true, inverse_of: :build has_one :trace_metadata, class_name: 'Ci::BuildTraceMetadata', inverse_of: :build - has_many :terraform_state_versions, class_name: 'Terraform::StateVersion', dependent: :nullify, inverse_of: :build, foreign_key: :ci_build_id # rubocop:disable Cop/ActiveRecordDependent + has_many :terraform_state_versions, class_name: 'Terraform::StateVersion', inverse_of: :build, foreign_key: :ci_build_id accepts_nested_attributes_for :runner_session, update_only: true accepts_nested_attributes_for :job_variables diff --git a/app/models/concerns/participable.rb b/app/models/concerns/participable.rb index 25410a859e9..1663aa6c886 100644 --- a/app/models/concerns/participable.rb +++ b/app/models/concerns/participable.rb @@ -60,6 +60,15 @@ module Participable filtered_participants_hash[user] end + # Returns only participants visible for the user + # + # Returns an Array of User instances. + def visible_participants(user) + return participants(user) unless Feature.enabled?(:verify_participants_access, project, default_enabled: :yaml) + + filter_by_ability(raw_participants(user, verify_access: true)) + end + # Checks if the user is a participant in a discussion. # # This method processes attributes of objects in breadth-first order. @@ -84,8 +93,7 @@ module Participable end end - def raw_participants(current_user = nil) - current_user ||= author + def raw_participants(current_user = nil, verify_access: false) ext = Gitlab::ReferenceExtractor.new(project, current_user) participants = Set.new process = [self] @@ -97,6 +105,8 @@ module Participable when User participants << source when Participable + next unless !verify_access || source_visible_to_user?(source, current_user) + source.class.participant_attrs.each do |attr| if attr.respond_to?(:call) source.instance_exec(current_user, ext, &attr) @@ -116,6 +126,10 @@ module Participable participants.merge(ext.users) end + def source_visible_to_user?(source, user) + Ability.allowed?(user, "read_#{source.model_name.element}".to_sym, source) + end + def filter_by_ability(participants) case self when PersonalSnippet diff --git a/app/services/ci/parse_dotenv_artifact_service.rb b/app/services/ci/parse_dotenv_artifact_service.rb index 725ecbcce5d..94f7496ed04 100644 --- a/app/services/ci/parse_dotenv_artifact_service.rb +++ b/app/services/ci/parse_dotenv_artifact_service.rb @@ -14,7 +14,7 @@ module Ci Ci::JobVariable.bulk_insert!(variables) success - rescue SizeLimitError, ParserError, ActiveRecord::RecordInvalid => error + rescue SizeLimitError, ParserError, ActiveRecord::RecordInvalid, ActiveRecord::RecordNotUnique => error Gitlab::ErrorTracking.track_exception(error, job_id: artifact.job_id) error(error.message, :bad_request) end diff --git a/app/views/projects/buttons/_dropdown.html.haml b/app/views/projects/buttons/_dropdown.html.haml deleted file mode 100644 index 12ce4667e1a..00000000000 --- a/app/views/projects/buttons/_dropdown.html.haml +++ /dev/null @@ -1,42 +0,0 @@ -- can_create_issue = show_new_issue_link?(@project) -- can_create_project_snippet = can?(current_user, :create_snippet, @project) -- can_push_code = can?(current_user, :push_code, @project) -- create_mr_from_new_fork = can?(current_user, :fork_project, @project) && can?(current_user, :create_merge_request_in, @project) -- merge_project = merge_request_source_project_for_project(@project) - -- show_menu = can_create_issue || can_create_project_snippet || can_push_code || create_mr_from_new_fork || merge_project - -- if show_menu - .project-action-button.dropdown.inline< - %a.btn.btn-default.gl-button.dropdown-toggle.has-tooltip.qa-create-new-dropdown{ href: '#', title: _('Create new...'), 'data-toggle' => 'dropdown', 'data-container' => 'body', 'aria-label' => _('Create new...'), 'data-display' => 'static' } - = sprite_icon('plus', css_class: 'gl-icon') - = sprite_icon("chevron-down", css_class: 'gl-icon') - %ul.dropdown-menu.dropdown-menu-right.project-home-dropdown - - if can_create_issue || merge_project || can_create_project_snippet - %li.dropdown-header= _('This project') - - - if can_create_issue - %li= link_to _('New issue'), new_project_issue_path(@project) - - - if merge_project - %li= link_to _('New merge request'), project_new_merge_request_path(merge_project) - - - if can_create_project_snippet - %li= link_to _('New snippet'), new_project_snippet_path(@project) - - - if can_push_code - %li.dropdown-header= _('This repository') - - - if can_push_code - %li.qa-new-file-option= link_to _('New file'), project_new_blob_path(@project, @project.default_branch_or_main) - - unless @project.empty_repo? - %li= link_to _('New branch'), new_project_branch_path(@project) - %li= link_to _('New tag'), new_project_tag_path(@project) - - elsif can_collaborate_with_project?(@project) - %li= link_to _('New file'), project_new_blob_path(@project, @project.default_branch_or_main) - - elsif create_mr_from_new_fork - - continue_params = { to: project_new_blob_path(@project, @project.default_branch_or_main), - notice: edit_in_new_fork_notice, - notice_now: edit_in_new_fork_notice_now } - - fork_path = project_forks_path(@project, namespace_key: current_user.namespace.id, continue: continue_params) - %li= link_to _('New file'), fork_path, method: :post diff --git a/app/views/projects/pipeline_schedules/edit.html.haml b/app/views/projects/pipeline_schedules/edit.html.haml index 29896500ea1..51f0c58330d 100644 --- a/app/views/projects/pipeline_schedules/edit.html.haml +++ b/app/views/projects/pipeline_schedules/edit.html.haml @@ -4,7 +4,7 @@ - add_page_specific_style 'page_bundles/pipeline_schedules' %h3.page-title - = _("Edit Pipeline Schedule %{id}") % { id: @schedule.id } + = _("Edit Pipeline Schedule") %hr = render "form" diff --git a/app/views/projects/tags/_tag.html.haml b/app/views/projects/tags/_tag.html.haml index 83a3cac487f..d2a41dcdb90 100644 --- a/app/views/projects/tags/_tag.html.haml +++ b/app/views/projects/tags/_tag.html.haml @@ -2,7 +2,7 @@ - release = @releases.find { |release| release.tag == tag.name } - commit_status = @tag_pipeline_statuses[tag.name] unless @tag_pipeline_statuses.nil? -%li.flex-row.js-tag-list{ class: "gl-white-space-normal!" } +%li.flex-row.js-tag-list{ class: "gl-white-space-normal! gl-align-items-flex-start!" } .row-main-content = sprite_icon('tag') = link_to tag.name, project_tag_path(@project, tag.name), class: 'item-title ref-name' @@ -11,10 +11,6 @@ %span.badge.badge-success.gl-ml-2.gl-badge.sm.badge-pill = s_('TagsPage|protected') - - if tag.message.present? - - = strip_signature(tag.message) - - if commit .block-truncated = render 'projects/branches/commit', commit: commit, project: @project @@ -28,6 +24,10 @@ = _("Release") = link_to release.name, project_releases_path(@project, anchor: release.tag), class: 'gl-text-blue-600!' + - if tag.message.present? + %pre.wrap + = strip_signature(tag.message) + .row-fixed-content.controls.flex-row - if tag.has_signature? = render partial: 'projects/commit/signature', object: tag.signature diff --git a/config/feature_flags/development/verify_participants_access.yml b/config/feature_flags/development/verify_participants_access.yml new file mode 100644 index 00000000000..8857003fd47 --- /dev/null +++ b/config/feature_flags/development/verify_participants_access.yml @@ -0,0 +1,8 @@ +--- +name: verify_participants_access +introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/74906 +rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/347407 +milestone: '14.6' +type: development +group: group::source code +default_enabled: false diff --git a/db/migrate/20211126115449_encrypt_static_objects_external_storage_auth_token.rb b/db/migrate/20211126115449_encrypt_static_objects_external_storage_auth_token.rb new file mode 100644 index 00000000000..9ce034b0065 --- /dev/null +++ b/db/migrate/20211126115449_encrypt_static_objects_external_storage_auth_token.rb @@ -0,0 +1,29 @@ +# frozen_string_literal: true + +class EncryptStaticObjectsExternalStorageAuthToken < Gitlab::Database::Migration[1.0] + class ApplicationSetting < ActiveRecord::Base + self.table_name = 'application_settings' + + scope :encrypted_token_is_null, -> { where(static_objects_external_storage_auth_token_encrypted: nil) } + scope :encrypted_token_is_not_null, -> { where.not(static_objects_external_storage_auth_token_encrypted: nil) } + scope :plaintext_token_is_not_null, -> { where.not(static_objects_external_storage_auth_token: nil) } + end + + def up + ApplicationSetting.reset_column_information + + ApplicationSetting.encrypted_token_is_null.plaintext_token_is_not_null.find_each do |application_setting| + token_encrypted = Gitlab::CryptoHelper.aes256_gcm_encrypt(application_setting.static_objects_external_storage_auth_token) + application_setting.update!(static_objects_external_storage_auth_token_encrypted: token_encrypted) + end + end + + def down + ApplicationSetting.reset_column_information + + ApplicationSetting.encrypted_token_is_not_null.find_each do |application_setting| + token = Gitlab::CryptoHelper.aes256_gcm_decrypt(application_setting.static_objects_external_storage_auth_token_encrypted) + application_setting.update!(static_objects_external_storage_auth_token: token, static_objects_external_storage_auth_token_encrypted: nil) + end + end +end diff --git a/db/schema_migrations/20211126115449 b/db/schema_migrations/20211126115449 new file mode 100644 index 00000000000..693dfb46149 --- /dev/null +++ b/db/schema_migrations/20211126115449 @@ -0,0 +1 @@ +2e6e432ecf7b2c885905fd4df6b57fa99b324f56cb0850d9fc792b4a9b363423
\ No newline at end of file diff --git a/lib/api/issues.rb b/lib/api/issues.rb index 06d5e4cb504..0f91cc4a837 100644 --- a/lib/api/issues.rb +++ b/lib/api/issues.rb @@ -472,7 +472,7 @@ module API end get ':id/issues/:issue_iid/participants' do issue = find_project_issue(params[:issue_iid]) - participants = ::Kaminari.paginate_array(issue.participants) + participants = ::Kaminari.paginate_array(issue.visible_participants(current_user)) present paginate(participants), with: Entities::UserBasic, current_user: current_user, project: user_project end diff --git a/lib/api/merge_requests.rb b/lib/api/merge_requests.rb index 063fff4023a..3f39af7f909 100644 --- a/lib/api/merge_requests.rb +++ b/lib/api/merge_requests.rb @@ -282,7 +282,7 @@ module API get ':id/merge_requests/:merge_request_iid/participants', feature_category: :code_review, urgency: :low do merge_request = find_merge_request_with_access(params[:merge_request_iid]) - participants = ::Kaminari.paginate_array(merge_request.participants) + participants = ::Kaminari.paginate_array(merge_request.visible_participants(current_user)) present paginate(participants), with: Entities::UserBasic end diff --git a/lib/gitlab/config/entry/undefined.rb b/lib/gitlab/config/entry/undefined.rb index 5f708abc80c..55393890693 100644 --- a/lib/gitlab/config/entry/undefined.rb +++ b/lib/gitlab/config/entry/undefined.rb @@ -31,6 +31,10 @@ module Gitlab false end + def type + nil + end + def inspect "#<#{self.class.name}>" end diff --git a/lib/gitlab/database/gitlab_loose_foreign_keys.yml b/lib/gitlab/database/gitlab_loose_foreign_keys.yml index aac1af4cd0f..782ce61b8ad 100644 --- a/lib/gitlab/database/gitlab_loose_foreign_keys.yml +++ b/lib/gitlab/database/gitlab_loose_foreign_keys.yml @@ -41,3 +41,7 @@ pages_deployments: - table: ci_builds column: ci_build_id on_delete: async_nullify +terraform_state_versions: + - table: ci_builds + column: ci_build_id + on_delete: async_nullify diff --git a/locale/gitlab.pot b/locale/gitlab.pot index 323287837f3..d841baad094 100644 --- a/locale/gitlab.pot +++ b/locale/gitlab.pot @@ -9932,9 +9932,6 @@ msgstr "" msgid "Create new project" msgstr "" -msgid "Create new..." -msgstr "" - msgid "Create or import your first project" msgstr "" @@ -12665,7 +12662,7 @@ msgstr "" msgid "Edit Password" msgstr "" -msgid "Edit Pipeline Schedule %{id}" +msgid "Edit Pipeline Schedule" msgstr "" msgid "Edit Release" @@ -38792,12 +38789,21 @@ msgstr "" msgid "VulnerabilityManagement|%{statusStart}Resolved%{statusEnd} %{timeago} by %{user}" msgstr "" +msgid "VulnerabilityManagement|A removed or remediated vulnerability" +msgstr "" + msgid "VulnerabilityManagement|A true-positive and will fix" msgstr "" +msgid "VulnerabilityManagement|A verified true-positive vulnerability" +msgstr "" + msgid "VulnerabilityManagement|Add vulnerability finding" msgstr "" +msgid "VulnerabilityManagement|An unverified non-confirmed finding" +msgstr "" + msgid "VulnerabilityManagement|Change status" msgstr "" @@ -38825,6 +38831,9 @@ msgstr "" msgid "VulnerabilityManagement|Requires assessment" msgstr "" +msgid "VulnerabilityManagement|Select a method" +msgstr "" + msgid "VulnerabilityManagement|Something went wrong while trying to delete the comment. Please try again later." msgstr "" @@ -38894,9 +38903,18 @@ msgstr "" msgid "Vulnerability|Additional Info" msgstr "" +msgid "Vulnerability|Bug Bounty" +msgstr "" + +msgid "Vulnerability|CVSS v3" +msgstr "" + msgid "Vulnerability|Class" msgstr "" +msgid "Vulnerability|Code Review" +msgstr "" + msgid "Vulnerability|Comments" msgstr "" @@ -38912,21 +38930,33 @@ msgstr "" msgid "Vulnerability|Description" msgstr "" +msgid "Vulnerability|Details" +msgstr "" + msgid "Vulnerability|Detected" msgstr "" +msgid "Vulnerability|Detection method" +msgstr "" + msgid "Vulnerability|Download" msgstr "" msgid "Vulnerability|Evidence" msgstr "" +msgid "Vulnerability|External Security Report" +msgstr "" + msgid "Vulnerability|False positive detected" msgstr "" msgid "Vulnerability|File" msgstr "" +msgid "Vulnerability|GitLab Security Report" +msgstr "" + msgid "Vulnerability|Identifier" msgstr "" @@ -38936,6 +38966,9 @@ msgstr "" msgid "Vulnerability|Image" msgstr "" +msgid "Vulnerability|Information related how the vulnerability was discovered and its impact to the system." +msgstr "" + msgid "Vulnerability|Links" msgstr "" @@ -38960,6 +38993,15 @@ msgstr "" msgid "Vulnerability|Scanner Provider" msgstr "" +msgid "Vulnerability|Security Audit" +msgstr "" + +msgid "Vulnerability|Select a severity" +msgstr "" + +msgid "Vulnerability|Set the status of the vulnerability finding based on the information available to you." +msgstr "" + msgid "Vulnerability|Severity" msgstr "" diff --git a/qa/qa/page/project/show.rb b/qa/qa/page/project/show.rb index 65a1f726a8a..8074b6f833b 100644 --- a/qa/qa/page/project/show.rb +++ b/qa/qa/page/project/show.rb @@ -45,10 +45,6 @@ module QA element :tree_holder, '.tree-holder' # rubocop:disable QA/ElementWithPattern end - view 'app/views/projects/buttons/_dropdown.html.haml' do - element :create_new_dropdown - end - view 'app/views/projects/buttons/_fork.html.haml' do element :fork_label, "%span= s_('ProjectOverview|Fork')" # rubocop:disable QA/ElementWithPattern element :fork_link, "link_to new_project_fork_path(@project)" # rubocop:disable QA/ElementWithPattern diff --git a/spec/db/schema_spec.rb b/spec/db/schema_spec.rb index e8a0e63b0d7..a8b28b32bd7 100644 --- a/spec/db/schema_spec.rb +++ b/spec/db/schema_spec.rb @@ -81,7 +81,6 @@ RSpec.describe 'Database schema' do subscriptions: %w[user_id subscribable_id], suggestions: %w[commit_id], taggings: %w[tag_id taggable_id tagger_id], - terraform_state_versions: %w[ci_build_id], timelogs: %w[user_id], todos: %w[target_id commit_id], uploads: %w[model_id], diff --git a/spec/features/admin/admin_settings_spec.rb b/spec/features/admin/admin_settings_spec.rb index 0a39baca259..29323c604ef 100644 --- a/spec/features/admin/admin_settings_spec.rb +++ b/spec/features/admin/admin_settings_spec.rb @@ -445,6 +445,24 @@ RSpec.describe 'Admin updates settings' do expect(current_settings.repository_storages_weighted).to eq('default' => 50) end + + context 'External storage for repository static objects' do + it 'changes Repository external storage settings' do + encrypted_token = Gitlab::CryptoHelper.aes256_gcm_encrypt('OldToken') + current_settings.update_attribute :static_objects_external_storage_auth_token_encrypted, encrypted_token + + visit repository_admin_application_settings_path + + page.within('.as-repository-static-objects') do + fill_in 'application_setting_static_objects_external_storage_url', with: 'http://example.com' + fill_in 'application_setting_static_objects_external_storage_auth_token', with: 'Token' + click_button 'Save changes' + end + + expect(current_settings.static_objects_external_storage_url).to eq('http://example.com') + expect(current_settings.static_objects_external_storage_auth_token).to eq('Token') + end + end end context 'Reporting page' do diff --git a/spec/features/projects/tags/user_edits_tags_spec.rb b/spec/features/projects/tags/user_edits_tags_spec.rb index 9f66b7274e8..17080043b6d 100644 --- a/spec/features/projects/tags/user_edits_tags_spec.rb +++ b/spec/features/projects/tags/user_edits_tags_spec.rb @@ -21,7 +21,8 @@ RSpec.describe 'Project > Tags', :js do context 'page with tags list' do it 'shows tag name' do - expect(page).to have_content 'v1.1.0 Version 1.1.0' + expect(page).to have_content 'v1.1.0' + expect(page).to have_content 'Version 1.1.0' end it 'shows tag edit button' do diff --git a/spec/graphql/resolvers/users/participants_resolver_spec.rb b/spec/graphql/resolvers/users/participants_resolver_spec.rb new file mode 100644 index 00000000000..c857eb9f63d --- /dev/null +++ b/spec/graphql/resolvers/users/participants_resolver_spec.rb @@ -0,0 +1,54 @@ +# frozen_string_literal: true + +require 'spec_helper' + +RSpec.describe Resolvers::Users::ParticipantsResolver do + include GraphqlHelpers + + describe '#resolve' do + let_it_be(:user) { create(:user) } + let_it_be(:guest) { create(:user) } + let_it_be(:project) { create(:project, :public) } + let_it_be(:issue) { create(:issue, project: project) } + let_it_be(:note) do + create( + :note, + :confidential, + project: project, + noteable: issue, + author: create(:user) + ) + end + + subject(:resolved_items) { resolve(described_class, args: {}, ctx: { current_user: current_user }, obj: issue)&.items } + + before do + project.add_guest(guest) + project.add_developer(user) + end + + context 'when current user is not set' do + let(:current_user) { nil } + + it 'returns only publicly visible participants for this user' do + is_expected.to match_array([issue.author]) + end + end + + context 'when current user does not have enough permissions' do + let(:current_user) { guest } + + it 'returns only publicly visible participants for this user' do + is_expected.to match_array([issue.author]) + end + end + + context 'when current user has access to confidential notes' do + let(:current_user) { user } + + it 'returns all participants for this user' do + is_expected.to match_array([issue.author, note.author]) + end + end + end +end diff --git a/spec/lib/gitlab/config/entry/undefined_spec.rb b/spec/lib/gitlab/config/entry/undefined_spec.rb index 36faabd8e31..31e0f9487aa 100644 --- a/spec/lib/gitlab/config/entry/undefined_spec.rb +++ b/spec/lib/gitlab/config/entry/undefined_spec.rb @@ -40,4 +40,10 @@ RSpec.describe Gitlab::Config::Entry::Undefined do expect(entry.specified?).to eq false end end + + describe '#type' do + it 'returns nil' do + expect(entry.type).to eq nil + end + end end diff --git a/spec/migrations/20211126115449_encrypt_static_objects_external_storage_auth_token_spec.rb b/spec/migrations/20211126115449_encrypt_static_objects_external_storage_auth_token_spec.rb new file mode 100644 index 00000000000..bc8b7c56676 --- /dev/null +++ b/spec/migrations/20211126115449_encrypt_static_objects_external_storage_auth_token_spec.rb @@ -0,0 +1,56 @@ +# frozen_string_literal: true + +require 'spec_helper' +require_migration! + +RSpec.describe EncryptStaticObjectsExternalStorageAuthToken, :migration do + let(:application_settings) do + Class.new(ActiveRecord::Base) do + self.table_name = 'application_settings' + end + end + + context 'when static_objects_external_storage_auth_token is not set' do + it 'does nothing' do + application_settings.create! + + reversible_migration do |migration| + migration.before -> { + settings = application_settings.first + + expect(settings.static_objects_external_storage_auth_token).to be_nil + expect(settings.static_objects_external_storage_auth_token_encrypted).to be_nil + } + + migration.after -> { + settings = application_settings.first + + expect(settings.static_objects_external_storage_auth_token).to be_nil + expect(settings.static_objects_external_storage_auth_token_encrypted).to be_nil + } + end + end + end + + context 'when static_objects_external_storage_auth_token is set' do + it 'encrypts static_objects_external_storage_auth_token' do + settings = application_settings.create! + settings.update_column(:static_objects_external_storage_auth_token, 'Test') + + reversible_migration do |migration| + migration.before -> { + settings = application_settings.first + + expect(settings.static_objects_external_storage_auth_token).to eq('Test') + expect(settings.static_objects_external_storage_auth_token_encrypted).to be_nil + } + migration.after -> { + settings = application_settings.first + + expect(settings.static_objects_external_storage_auth_token).to eq('Test') + expect(settings.static_objects_external_storage_auth_token_encrypted).to be_present + } + end + end + end +end diff --git a/spec/models/application_setting_spec.rb b/spec/models/application_setting_spec.rb index 8ad83da61f3..8f6e94cc46e 100644 --- a/spec/models/application_setting_spec.rb +++ b/spec/models/application_setting_spec.rb @@ -1239,4 +1239,30 @@ RSpec.describe ApplicationSetting do expect(subject.kroki_formats_excalidraw).to eq(true) end end + + describe '#static_objects_external_storage_auth_token=' do + subject { setting.static_objects_external_storage_auth_token = token } + + let(:token) { 'Test' } + + it 'stores an encrypted version of the token' do + subject + + expect(setting[:static_objects_external_storage_auth_token]).to be_nil + expect(setting[:static_objects_external_storage_auth_token_encrypted]).to be_present + expect(setting.static_objects_external_storage_auth_token).to eq('Test') + end + + context 'when token is empty' do + let(:token) { '' } + + it 'removes an encrypted version of the token' do + subject + + expect(setting[:static_objects_external_storage_auth_token]).to be_nil + expect(setting[:static_objects_external_storage_auth_token_encrypted]).to be_nil + expect(setting.static_objects_external_storage_auth_token).to be_nil + end + end + end end diff --git a/spec/models/ci/build_spec.rb b/spec/models/ci/build_spec.rb index 6f5bb75314e..ad2d646edc9 100644 --- a/spec/models/ci/build_spec.rb +++ b/spec/models/ci/build_spec.rb @@ -29,7 +29,7 @@ RSpec.describe Ci::Build do it { is_expected.to have_one(:deployment) } it { is_expected.to have_one(:runner_session) } it { is_expected.to have_one(:trace_metadata) } - it { is_expected.to have_many(:terraform_state_versions).dependent(:nullify).inverse_of(:build) } + it { is_expected.to have_many(:terraform_state_versions).inverse_of(:build) } it { is_expected.to validate_presence_of(:ref) } diff --git a/spec/models/concerns/participable_spec.rb b/spec/models/concerns/participable_spec.rb index 903c7ae16b6..50cf7377b99 100644 --- a/spec/models/concerns/participable_spec.rb +++ b/spec/models/concerns/participable_spec.rb @@ -51,7 +51,9 @@ RSpec.describe Participable do end it 'supports attributes returning another Participable' do - other_model = Class.new { include Participable } + other_model = Class.new do + include Participable + end other_model.participant(:bar) model.participant(:foo) @@ -115,6 +117,76 @@ RSpec.describe Participable do end end + describe '#visible_participants' do + before do + allow(Ability).to receive(:allowed?).and_call_original + allow(Ability).to receive(:allowed?).with(anything, :read_class, anything) { readable } + end + + let(:readable) { true } + + it 'returns the list of participants' do + model.participant(:foo) + model.participant(:bar) + + user1 = build(:user) + user2 = build(:user) + user3 = build(:user) + project = build(:project, :public) + instance = model.new + + allow(instance).to receive_message_chain(:model_name, :element) { 'class' } + expect(instance).to receive(:foo).and_return(user2) + expect(instance).to receive(:bar).and_return(user3) + expect(instance).to receive(:project).thrice.and_return(project) + + participants = instance.visible_participants(user1) + + expect(participants).to include(user2) + expect(participants).to include(user3) + end + + context 'when Participable is not readable by the user' do + let(:readable) { false } + + it 'does not return unavailable participants' do + model.participant(:bar) + + instance = model.new + user1 = build(:user) + user2 = build(:user) + project = build(:project, :public) + + allow(instance).to receive_message_chain(:model_name, :element) { 'class' } + allow(instance).to receive(:bar).and_return(user2) + expect(instance).to receive(:project).thrice.and_return(project) + + expect(instance.visible_participants(user1)).to be_empty + end + + context 'when feature flag is disabled' do + before do + stub_feature_flags(verify_participants_access: false) + end + + it 'returns unavailable participants' do + model.participant(:bar) + + instance = model.new + user1 = build(:user) + user2 = build(:user) + project = build(:project, :public) + + allow(instance).to receive_message_chain(:model_name, :element) { 'class' } + allow(instance).to receive(:bar).and_return(user2) + expect(instance).to receive(:project).thrice.and_return(project) + + expect(instance.visible_participants(user1)).to match_array([user2]) + end + end + end + end + describe '#participant?' do let(:instance) { model.new } diff --git a/spec/requests/api/issues/get_project_issues_spec.rb b/spec/requests/api/issues/get_project_issues_spec.rb index 07fa1d40f7b..9948e13e9ae 100644 --- a/spec/requests/api/issues/get_project_issues_spec.rb +++ b/spec/requests/api/issues/get_project_issues_spec.rb @@ -873,7 +873,7 @@ RSpec.describe API::Issues do end it 'returns 404 if the issue is confidential' do - post api("/projects/#{project.id}/issues/#{confidential_issue.iid}/participants", non_member) + get api("/projects/#{project.id}/issues/#{confidential_issue.iid}/participants", non_member) expect(response).to have_gitlab_http_status(:not_found) end diff --git a/spec/services/ci/parse_dotenv_artifact_service_spec.rb b/spec/services/ci/parse_dotenv_artifact_service_spec.rb index c4040a426f2..ba71ddab40e 100644 --- a/spec/services/ci/parse_dotenv_artifact_service_spec.rb +++ b/spec/services/ci/parse_dotenv_artifact_service_spec.rb @@ -23,6 +23,20 @@ RSpec.describe Ci::ParseDotenvArtifactService do hash_including('key' => 'KEY2', 'value' => 'VAR2')) end + context 'when dotenv variables are conflicting against manual variables' do + before do + create(:ci_job_variable, job: build, key: 'KEY1') + end + + it 'returns an error message that there is a duplicate variable' do + subject + + expect(subject[:status]).to eq(:error) + expect(subject[:message]).to include("Key (key, job_id)=(KEY1, #{build.id}) already exists.") + expect(subject[:http_status]).to eq(:bad_request) + end + end + context 'when parse error happens' do before do allow(service).to receive(:scan_line!) { raise described_class::ParserError, 'Invalid Format' } diff --git a/spec/support/shared_examples/requests/api/issuable_participants_examples.rb b/spec/support/shared_examples/requests/api/issuable_participants_examples.rb index 673d7741017..c5e5803c0a7 100644 --- a/spec/support/shared_examples/requests/api/issuable_participants_examples.rb +++ b/spec/support/shared_examples/requests/api/issuable_participants_examples.rb @@ -28,4 +28,34 @@ RSpec.shared_examples 'issuable participants endpoint' do expect(response).to have_gitlab_http_status(:not_found) end + + context 'with a confidential note' do + let!(:note) do + create( + :note, + :confidential, + project: project, + noteable: entity, + author: create(:user) + ) + end + + it 'returns a full list of participants' do + get api("/projects/#{project.id}/#{area}/#{entity.iid}/participants", user) + + expect(response).to have_gitlab_http_status(:ok) + participant_ids = json_response.map { |el| el['id'] } + expect(participant_ids).to match_array([entity.author_id, note.author_id]) + end + + context 'when user cannot see a confidential note' do + it 'returns a limited list of participants' do + get api("/projects/#{project.id}/#{area}/#{entity.iid}/participants", create(:user)) + + expect(response).to have_gitlab_http_status(:ok) + participant_ids = json_response.map { |el| el['id'] } + expect(participant_ids).to match_array([entity.author_id]) + end + end + end end diff --git a/spec/views/projects/buttons/_dropdown.html.haml_spec.rb b/spec/views/projects/buttons/_dropdown.html.haml_spec.rb deleted file mode 100644 index fc9d7c3ea91..00000000000 --- a/spec/views/projects/buttons/_dropdown.html.haml_spec.rb +++ /dev/null @@ -1,42 +0,0 @@ -# frozen_string_literal: true - -require 'spec_helper' - -RSpec.describe 'projects/buttons/_dropdown' do - let(:user) { create(:user) } - - context 'user with all abilities' do - before do - assign(:project, project) - - allow(view).to receive(:current_user).and_return(user) - allow(view).to receive(:can?).with(user, :push_code, project).and_return(true) - allow(view).to receive(:can_collaborate_with_project?).and_return(true) - end - - context 'empty repository' do - let(:project) { create(:project, :empty_repo) } - - it 'has a link to create a new file' do - render - - expect(view).to render_template('projects/buttons/_dropdown') - expect(rendered).to have_link('New file') - end - - it 'does not have a link to create a new branch' do - render - - expect(view).to render_template('projects/buttons/_dropdown') - expect(rendered).not_to have_link('New branch') - end - - it 'does not have a link to create a new tag' do - render - - expect(view).to render_template('projects/buttons/_dropdown') - expect(rendered).not_to have_link('New tag') - end - end - end -end |