1 files changed, 101 insertions, 13 deletions

diff --git a/spec/lib/gitlab/ci/pipeline/chain/build_spec.rb b/spec/lib/gitlab/ci/pipeline/chain/build_spec.rb
index 6da565a2bf6..20406acb658 100644
--- a/spec/lib/gitlab/ci/pipeline/chain/build_spec.rb
+++ b/spec/lib/gitlab/ci/pipeline/chain/build_spec.rb
@@ -3,7 +3,7 @@
 require 'spec_helper'
 
 RSpec.describe Gitlab::Ci::Pipeline::Chain::Build do
-  let_it_be(:project) { create(:project, :repository) }
+  let_it_be(:project, reload: true) { create(:project, :repository) }
   let_it_be(:user) { create(:user, developer_projects: [project]) }
   let(:pipeline) { Ci::Pipeline.new }
 
@@ -29,29 +29,96 @@ RSpec.describe Gitlab::Ci::Pipeline::Chain::Build do
 
   let(:step) { described_class.new(pipeline, command) }
 
-  before do
-    stub_ci_pipeline_yaml_file(gitlab_ci_yaml)
+  shared_examples 'builds pipeline' do
+    it 'builds a pipeline with the expected attributes' do
+      step.perform!
+
+      expect(pipeline.sha).not_to be_empty
+      expect(pipeline.sha).to eq project.commit.id
+      expect(pipeline.ref).to eq 'master'
+      expect(pipeline.tag).to be false
+      expect(pipeline.user).to eq user
+      expect(pipeline.project).to eq project
+    end
   end
 
-  it 'never breaks the chain' do
-    step.perform!
+  shared_examples 'breaks the chain' do
+    it 'returns true' do
+      step.perform!
+
+      expect(step.break?).to be true
+    end
+  end
+
+  shared_examples 'does not break the chain' do
+    it 'returns false' do
+      step.perform!
+
+      expect(step.break?).to be false
+    end
+  end
 
-    expect(step.break?).to be false
+  before do
+    stub_ci_pipeline_yaml_file(gitlab_ci_yaml)
   end
 
-  it 'fills pipeline object with data' do
+  it_behaves_like 'does not break the chain'
+  it_behaves_like 'builds pipeline'
+
+  it 'sets pipeline variables' do
     step.perform!
 
-    expect(pipeline.sha).not_to be_empty
-    expect(pipeline.sha).to eq project.commit.id
-    expect(pipeline.ref).to eq 'master'
-    expect(pipeline.tag).to be false
-    expect(pipeline.user).to eq user
-    expect(pipeline.project).to eq project
     expect(pipeline.variables.map { |var| var.slice(:key, :secret_value) })
       .to eq variables_attributes.map(&:with_indifferent_access)
   end
 
+  context 'when project setting restrict_user_defined_variables is enabled' do
+    before do
+      project.update!(restrict_user_defined_variables: true)
+    end
+
+    context 'when user is developer' do
+      it_behaves_like 'breaks the chain'
+      it_behaves_like 'builds pipeline'
+
+      it 'returns an error on variables_attributes', :aggregate_failures do
+        step.perform!
+
+        expect(pipeline.errors.full_messages).to eq(['Insufficient permissions to set pipeline variables'])
+        expect(pipeline.variables).to be_empty
+      end
+
+      context 'when variables_attributes is not specified' do
+        let(:variables_attributes) { nil }
+
+        it_behaves_like 'does not break the chain'
+        it_behaves_like 'builds pipeline'
+
+        it 'assigns empty variables' do
+          step.perform!
+
+          expect(pipeline.variables).to be_empty
+        end
+      end
+    end
+
+    context 'when user is maintainer' do
+      before do
+        project.add_maintainer(user)
+      end
+
+      it_behaves_like 'does not break the chain'
+      it_behaves_like 'builds pipeline'
+
+      it 'assigns variables_attributes' do
+        step.perform!
+
+        expect(pipeline.variables.map { |var| var.slice(:key, :secret_value) })
+          .to eq variables_attributes.map(&:with_indifferent_access)
+      end
+    end
+  end
+
   it 'returns a valid pipeline' do
     step.perform!
 
@@ -157,4 +224,25 @@ RSpec.describe Gitlab::Ci::Pipeline::Chain::Build do
       expect(pipeline.target_sha).to eq(external_pull_request.target_sha)
     end
   end
+
+  context 'when keep_latest_artifact is set' do
+    using RSpec::Parameterized::TableSyntax
+
+    where(:keep_latest_artifact, :locking_result) do
+      true          | 'artifacts_locked'
+      false         | 'unlocked'
+    end
+
+    with_them do
+      before do
+        project.update!(ci_keep_latest_artifact: keep_latest_artifact)
+      end
+
+      it 'builds a pipeline with appropriate locked value' do
+        step.perform!
+
+        expect(pipeline.locked).to eq(locking_result)
+      end
+    end
+  end
 end