1 files changed, 114 insertions, 44 deletions
diff --git a/spec/lib/gitlab/checks/change_access_spec.rb b/spec/lib/gitlab/checks/change_access_spec.rb
index e22f88b7a32..8d81ed5856e 100644
--- a/spec/lib/gitlab/checks/change_access_spec.rb
+++ b/spec/lib/gitlab/checks/change_access_spec.rb
@@ -5,13 +5,10 @@ describe Gitlab::Checks::ChangeAccess, lib: true do
     let(:user) { create(:user) }
     let(:project) { create(:project, :repository) }
     let(:user_access) { Gitlab::UserAccess.new(user, project: project) }
-    let(:changes) do
-      {
-        oldrev: 'be93687618e4b132087f430a4d8fc3a609c9b77c',
-        newrev: '54fcc214b94e78d7a41a9a8fe6d87a5e59500e51',
-        ref: 'refs/heads/master'
-      }
-    end
+    let(:oldrev) { 'be93687618e4b132087f430a4d8fc3a609c9b77c' }
+    let(:newrev) { '54fcc214b94e78d7a41a9a8fe6d87a5e59500e51' }
+    let(:ref) { 'refs/heads/master' }
+    let(:changes) { { oldrev: oldrev, newrev: newrev, ref: ref } }
     let(:protocol) { 'ssh' }
 
     subject do
@@ -23,7 +20,7 @@ describe Gitlab::Checks::ChangeAccess, lib: true do
       ).exec
     end
 
-    before { allow(user_access).to receive(:can_do_action?).with(:push_code).and_return(true) }
+    before { project.add_developer(user) }
 
     context 'without failed checks' do
       it "doesn't return any error" do
@@ -41,62 +38,135 @@ describe Gitlab::Checks::ChangeAccess, lib: true do
     end
 
     context 'tags check' do
-      let(:changes) do
-        {
-          oldrev: 'be93687618e4b132087f430a4d8fc3a609c9b77c',
-          newrev: '54fcc214b94e78d7a41a9a8fe6d87a5e59500e51',
-          ref: 'refs/tags/v1.0.0'
-        }
-      end
+      let(:ref) { 'refs/tags/v1.0.0' }
 
       it 'returns an error if the user is not allowed to update tags' do
+        allow(user_access).to receive(:can_do_action?).with(:push_code).and_return(true)
         expect(user_access).to receive(:can_do_action?).with(:admin_project).and_return(false)
 
         expect(subject.status).to be(false)
         expect(subject.message).to eq('You are not allowed to change existing tags on this project.')
       end
-    end
 
-    context 'protected branches check' do
-      before do
-        allow(project).to receive(:protected_branch?).with('master').and_return(true)
-      end
+      context 'with protected tag' do
+        let!(:protected_tag) { create(:protected_tag, project: project, name: 'v*') }
 
-      it 'returns an error if the user is not allowed to do forced pushes to protected branches' do
-        expect(Gitlab::Checks::ForcePush).to receive(:force_push?).and_return(true)
+        context 'as master' do
+          before { project.add_master(user) }
 
-        expect(subject.status).to be(false)
-        expect(subject.message).to eq('You are not allowed to force push code to a protected branch on this project.')
-      end
+          context 'deletion' do
+            let(:oldrev) { 'be93687618e4b132087f430a4d8fc3a609c9b77c' }
+            let(:newrev) { '0000000000000000000000000000000000000000' }
 
-      it 'returns an error if the user is not allowed to merge to protected branches' do
-        expect_any_instance_of(Gitlab::Checks::MatchingMergeRequest).to receive(:match?).and_return(true)
-        expect(user_access).to receive(:can_merge_to_branch?).and_return(false)
-        expect(user_access).to receive(:can_push_to_branch?).and_return(false)
+            it 'is prevented' do
+              expect(subject.status).to be(false)
+              expect(subject.message).to include('cannot be deleted')
+            end
+          end
 
-        expect(subject.status).to be(false)
-        expect(subject.message).to eq('You are not allowed to merge code into protected branches on this project.')
+          context 'update' do
+            let(:oldrev) { 'be93687618e4b132087f430a4d8fc3a609c9b77c' }
+            let(:newrev) { '54fcc214b94e78d7a41a9a8fe6d87a5e59500e51' }
+
+            it 'is prevented' do
+              expect(subject.status).to be(false)
+              expect(subject.message).to include('cannot be updated')
+            end
+          end
+        end
+
+        context 'creation' do
+          let(:oldrev) { '0000000000000000000000000000000000000000' }
+          let(:newrev) { '54fcc214b94e78d7a41a9a8fe6d87a5e59500e51' }
+          let(:ref) { 'refs/tags/v9.1.0' }
+
+          it 'prevents creation below access level' do
+            expect(subject.status).to be(false)
+            expect(subject.message).to include('allowed to create this tag as it is protected')
+          end
+
+          context 'when user has access' do
+            let!(:protected_tag) { create(:protected_tag, :developers_can_create, project: project, name: 'v*') }
+
+            it 'allows tag creation' do
+              expect(subject.status).to be(true)
+            end
+          end
+        end
       end
+    end
 
-      it 'returns an error if the user is not allowed to push to protected branches' do
-        expect(user_access).to receive(:can_push_to_branch?).and_return(false)
+    context 'branches check' do
+      context 'trying to delete the default branch' do
+        let(:newrev) { '0000000000000000000000000000000000000000' }
+        let(:ref) { 'refs/heads/master' }
 
-        expect(subject.status).to be(false)
-        expect(subject.message).to eq('You are not allowed to push code to protected branches on this project.')
+        it 'returns an error' do
+          expect(subject.status).to be(false)
+          expect(subject.message).to eq('The default branch of a project cannot be deleted.')
+        end
       end
 
-      context 'branch deletion' do
-        let(:changes) do
-          {
-            oldrev: 'be93687618e4b132087f430a4d8fc3a609c9b77c',
-            newrev: '0000000000000000000000000000000000000000',
-            ref: 'refs/heads/master'
-          }
+      context 'protected branches check' do
+        before do
+          allow(ProtectedBranch).to receive(:protected?).with(project, 'master').and_return(true)
+          allow(ProtectedBranch).to receive(:protected?).with(project, 'feature').and_return(true)
+        end
+
+        it 'returns an error if the user is not allowed to do forced pushes to protected branches' do
+          expect(Gitlab::Checks::ForcePush).to receive(:force_push?).and_return(true)
+
+          expect(subject.status).to be(false)
+          expect(subject.message).to eq('You are not allowed to force push code to a protected branch on this project.')
+        end
+
+        it 'returns an error if the user is not allowed to merge to protected branches' do
+          expect_any_instance_of(Gitlab::Checks::MatchingMergeRequest).to receive(:match?).and_return(true)
+          expect(user_access).to receive(:can_merge_to_branch?).and_return(false)
+          expect(user_access).to receive(:can_push_to_branch?).and_return(false)
+
+          expect(subject.status).to be(false)
+          expect(subject.message).to eq('You are not allowed to merge code into protected branches on this project.')
         end
 
-        it 'returns an error if the user is not allowed to delete protected branches' do
+        it 'returns an error if the user is not allowed to push to protected branches' do
+          expect(user_access).to receive(:can_push_to_branch?).and_return(false)
+
           expect(subject.status).to be(false)
-          expect(subject.message).to eq('You are not allowed to delete protected branches from this project.')
+          expect(subject.message).to eq('You are not allowed to push code to protected branches on this project.')
+        end
+
+        context 'branch deletion' do
+          let(:newrev) { '0000000000000000000000000000000000000000' }
+          let(:ref) { 'refs/heads/feature' }
+
+          context 'if the user is not allowed to delete protected branches' do
+            it 'returns an error' do
+              expect(subject.status).to be(false)
+              expect(subject.message).to eq('You are not allowed to delete protected branches from this project. Only a project master or owner can delete a protected branch.')
+            end
+          end
+
+          context 'if the user is allowed to delete protected branches' do
+            before do
+              project.add_master(user)
+            end
+
+            context 'through the web interface' do
+              let(:protocol) { 'web' }
+
+              it 'allows branch deletion' do
+                expect(subject.status).to be(true)
+              end
+            end
+
+            context 'over SSH or HTTP' do
+              it 'returns an error' do
+                expect(subject.status).to be(false)
+                expect(subject.message).to eq('You can only delete protected branches using the web interface.')
+              end
+            end
+          end
         end
       end
     end