1 files changed, 77 insertions, 2 deletions
diff --git a/spec/lib/gitlab/auth_spec.rb b/spec/lib/gitlab/auth_spec.rb
index 3b5ca7c950c..098c33f9cb1 100644
--- a/spec/lib/gitlab/auth_spec.rb
+++ b/spec/lib/gitlab/auth_spec.rb
@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'spec_helper'
 
 describe Gitlab::Auth do
@@ -84,7 +86,7 @@ describe Gitlab::Auth do
         let(:project) { build.project }
 
         before do
-          expect(gl_auth).to receive(:rate_limit!).with('ip', success: true, login: 'gitlab-ci-token')
+          expect(gl_auth).not_to receive(:rate_limit!).with('ip', success: true, login: 'gitlab-ci-token')
         end
 
         it 'recognises user-less build' do
@@ -104,7 +106,7 @@ describe Gitlab::Auth do
           let(:project) { build.project }
 
           before do
-            expect(gl_auth).to receive(:rate_limit!).with('ip', success: false, login: 'gitlab-ci-token')
+            expect(gl_auth).not_to receive(:rate_limit!).with('ip', success: false, login: 'gitlab-ci-token')
           end
 
           it 'denies authentication' do
@@ -297,6 +299,70 @@ describe Gitlab::Auth do
       let(:project) { create(:project) }
       let(:auth_failure) { Gitlab::Auth::Result.new(nil, nil) }
 
+      context 'when deploy token and user have the same username' do
+        let(:username) { 'normal_user' }
+        let(:user) { create(:user, username: username, password: 'my-secret') }
+        let(:deploy_token) { create(:deploy_token, username: username, read_registry: false, projects: [project]) }
+
+        before do
+          expect(gl_auth).to receive(:rate_limit!).with('ip', success: true, login: username)
+        end
+
+        it 'succeeds for the token' do
+          auth_success = Gitlab::Auth::Result.new(deploy_token, project, :deploy_token, [:download_code])
+
+          expect(gl_auth.find_for_git_client(username, deploy_token.token, project: project, ip: 'ip'))
+            .to eq(auth_success)
+        end
+
+        it 'succeeds for the user' do
+          auth_success = Gitlab::Auth::Result.new(user, nil, :gitlab_or_ldap, full_authentication_abilities)
+
+          expect(gl_auth.find_for_git_client(username, 'my-secret', project: project, ip: 'ip'))
+            .to eq(auth_success)
+        end
+      end
+
+      context 'when deploy tokens have the same username' do
+        context 'and belong to the same project' do
+          let!(:read_registry) { create(:deploy_token, username: 'deployer', read_repository: false, projects: [project]) }
+          let!(:read_repository) { create(:deploy_token, username: read_registry.username, read_registry: false, projects: [project]) }
+
+          it 'succeeds for the right token' do
+            auth_success = Gitlab::Auth::Result.new(read_repository, project, :deploy_token, [:download_code])
+
+            expect(gl_auth).to receive(:rate_limit!).with('ip', success: true, login: 'deployer')
+            expect(gl_auth.find_for_git_client('deployer', read_repository.token, project: project, ip: 'ip'))
+              .to eq(auth_success)
+          end
+
+          it 'fails for the wrong token' do
+            expect(gl_auth).to receive(:rate_limit!).with('ip', success: false, login: 'deployer')
+            expect(gl_auth.find_for_git_client('deployer', read_registry.token, project: project, ip: 'ip'))
+              .to eq(auth_failure)
+          end
+        end
+
+        context 'and belong to different projects' do
+          let!(:read_registry) { create(:deploy_token, username: 'deployer', read_repository: false, projects: [create(:project)]) }
+          let!(:read_repository) { create(:deploy_token, username: read_registry.username, read_registry: false, projects: [project]) }
+
+          it 'succeeds for the right token' do
+            auth_success = Gitlab::Auth::Result.new(read_repository, project, :deploy_token, [:download_code])
+
+            expect(gl_auth).to receive(:rate_limit!).with('ip', success: true, login: 'deployer')
+            expect(gl_auth.find_for_git_client('deployer', read_repository.token, project: project, ip: 'ip'))
+              .to eq(auth_success)
+          end
+
+          it 'fails for the wrong token' do
+            expect(gl_auth).to receive(:rate_limit!).with('ip', success: false, login: 'deployer')
+            expect(gl_auth.find_for_git_client('deployer', read_registry.token, project: project, ip: 'ip'))
+              .to eq(auth_failure)
+          end
+        end
+      end
+
       context 'when the deploy token has read_repository as scope' do
         let(:deploy_token) { create(:deploy_token, read_registry: false, projects: [project]) }
         let(:login) { deploy_token.username }
@@ -309,6 +375,15 @@ describe Gitlab::Auth do
             .to eq(auth_success)
         end
 
+        it 'succeeds when custom login and token are valid' do
+          deploy_token = create(:deploy_token, username: 'deployer', read_registry: false, projects: [project])
+          auth_success = Gitlab::Auth::Result.new(deploy_token, project, :deploy_token, [:download_code])
+
+          expect(gl_auth).to receive(:rate_limit!).with('ip', success: true, login: 'deployer')
+          expect(gl_auth.find_for_git_client('deployer', deploy_token.token, project: project, ip: 'ip'))
+            .to eq(auth_success)
+        end
+
         it 'fails when login is not valid' do
           expect(gl_auth).to receive(:rate_limit!).with('ip', success: false, login: 'random_login')
           expect(gl_auth.find_for_git_client('random_login', deploy_token.token, project: project, ip: 'ip'))