1 files changed, 60 insertions, 17 deletions

diff --git a/spec/features/groups_spec.rb b/spec/features/groups_spec.rb
index d243f9478bb..6f8c8999f98 100644
--- a/spec/features/groups_spec.rb
+++ b/spec/features/groups_spec.rb
@@ -2,7 +2,7 @@ require 'spec_helper'
 
 feature 'Group', feature: true do
   before do
-    login_as(:admin)
+    sign_in(create(:admin))
   end
 
   matcher :have_namespace_error_message do
@@ -12,7 +12,9 @@ feature 'Group', feature: true do
   end
 
   describe 'create a group' do
-    before { visit new_group_path }
+    before do
+      visit new_group_path
+    end
 
     describe 'with space in group path' do
       it 'renders new group form with validation errors' do
@@ -46,7 +48,7 @@ feature 'Group', feature: true do
 
     describe 'Mattermost team creation' do
       before do
-        allow(Settings.mattermost).to receive_messages(enabled: mattermost_enabled)
+        stub_mattermost_setting(enabled: mattermost_enabled)
 
         visit new_group_path
       end
@@ -83,29 +85,64 @@ feature 'Group', feature: true do
     end
   end
 
-  describe 'create a nested group' do
+  describe 'create a nested group', :nested_groups, js: true do
     let(:group) { create(:group, path: 'foo') }
 
-    before do
-      visit subgroups_group_path(group)
-      click_link 'New Subgroup'
+    context 'as admin' do
+      before do
+        visit subgroups_group_path(group)
+        click_link 'New Subgroup'
+      end
+
+      it 'creates a nested group' do
+        fill_in 'Group path', with: 'bar'
+        click_button 'Create group'
+
+        expect(current_path).to eq(group_path('foo/bar'))
+        expect(page).to have_content("Group 'bar' was successfully created.")
+      end
     end
 
-    it 'creates a nested group' do
-      fill_in 'Group path', with: 'bar'
-      click_button 'Create group'
+    context 'as group owner' do
+      let(:user) { create(:user) }
+
+      before do
+        group.add_owner(user)
+        sign_out(:user)
+        sign_in(user)
+
+        visit subgroups_group_path(group)
+        click_link 'New Subgroup'
+      end
+
+      it 'creates a nested group' do
+        fill_in 'Group path', with: 'bar'
+        click_button 'Create group'
 
-      expect(current_path).to eq(group_path('foo/bar'))
-      expect(page).to have_content("Group 'bar' was successfully created.")
+        expect(current_path).to eq(group_path('foo/bar'))
+        expect(page).to have_content("Group 'bar' was successfully created.")
+      end
     end
   end
 
-  describe 'group edit' do
+  it 'checks permissions to avoid exposing groups by parent_id' do
+    group = create(:group, :private, path: 'secret-group')
+
+    sign_out(:user)
+    sign_in(create(:user))
+    visit new_group_path(parent_id: group.id)
+
+    expect(page).not_to have_content('secret-group')
+  end
+
+  describe 'group edit', js: true do
     let(:group) { create(:group) }
     let(:path)  { edit_group_path(group) }
     let(:new_name) { 'new-name' }
 
-    before { visit path }
+    before do
+      visit path
+    end
 
     it 'saves new settings' do
       fill_in 'group_name', with: new_name
@@ -120,8 +157,8 @@ feature 'Group', feature: true do
     end
 
     it 'removes group' do
-      click_link 'Remove Group'
-
+      expect { remove_with_confirm('Remove group', group.path) }.to change {Group.count}.by(-1)
+      expect(group.members.all.count).to be_zero
       expect(page).to have_content "scheduled for deletion"
     end
   end
@@ -163,7 +200,7 @@ feature 'Group', feature: true do
     end
   end
 
-  describe 'group page with nested groups', js: true do
+  describe 'group page with nested groups', :nested_groups, js: true do
     let!(:group) { create(:group) }
     let!(:nested_group) { create(:group, parent: group) }
     let!(:path)  { group_path(group) }
@@ -175,4 +212,10 @@ feature 'Group', feature: true do
       expect(page).to have_content(nested_group.name)
     end
   end
+
+  def remove_with_confirm(button_text, confirm_with)
+    click_button button_text
+    fill_in 'confirm_name_input', with: confirm_with
+    click_button 'Confirm'
+  end
 end