4 files changed, 227 insertions, 15 deletions

diff --git a/spec/models/deploy_token_spec.rb b/spec/models/deploy_token_spec.rb
index 5c14d57cf18..568699cf3f6 100644
--- a/spec/models/deploy_token_spec.rb
+++ b/spec/models/deploy_token_spec.rb
@@ -7,6 +7,8 @@ describe DeployToken do
 
   it { is_expected.to have_many :project_deploy_tokens }
   it { is_expected.to have_many(:projects).through(:project_deploy_tokens) }
+  it { is_expected.to have_many :group_deploy_tokens }
+  it { is_expected.to have_many(:groups).through(:group_deploy_tokens) }
 
   it_behaves_like 'having unique enum values'
 
@@ -17,6 +19,29 @@ describe DeployToken do
     it { is_expected.to allow_value('GitLab+deploy_token-3.14').for(:username) }
     it { is_expected.not_to allow_value('<script>').for(:username).with_message(username_format_message) }
     it { is_expected.not_to allow_value('').for(:username).with_message(username_format_message) }
+    it { is_expected.to validate_presence_of(:deploy_token_type) }
+  end
+
+  describe 'deploy_token_type validations' do
+    context 'when a deploy token is associated to a group' do
+      it 'does not allow setting a project to it' do
+        group_token = create(:deploy_token, :group)
+        group_token.projects << build(:project)
+
+        expect(group_token).not_to be_valid
+        expect(group_token.errors.full_messages).to include('Deploy token cannot have projects assigned')
+      end
+    end
+
+    context 'when a deploy token is associated to a project' do
+      it 'does not allow setting a group to it' do
+        project_token = create(:deploy_token)
+        project_token.groups << build(:group)
+
+        expect(project_token).not_to be_valid
+        expect(project_token.errors.full_messages).to include('Deploy token cannot have groups assigned')
+      end
+    end
   end
 
   describe '#ensure_token' do
@@ -125,33 +150,148 @@ describe DeployToken do
     end
   end
 
+  describe '#holder' do
+    subject { deploy_token.holder }
+
+    context 'when the token is of project type' do
+      it 'returns the relevant holder token' do
+        expect(subject).to eq(deploy_token.project_deploy_tokens.first)
+      end
+    end
+
+    context 'when the token is of group type' do
+      let(:group) { create(:group) }
+      let(:deploy_token) { create(:deploy_token, :group) }
+
+      it 'returns the relevant holder token' do
+        expect(subject).to eq(deploy_token.group_deploy_tokens.first)
+      end
+    end
+  end
+
   describe '#has_access_to?' do
     let(:project) { create(:project) }
 
     subject { deploy_token.has_access_to?(project) }
 
-    context 'when deploy token is active and related to project' do
-      let(:deploy_token) { create(:deploy_token, projects: [project]) }
+    context 'when a project is not passed in' do
+      let(:project) { nil }
 
-      it { is_expected.to be_truthy }
+      it { is_expected.to be_falsy }
     end
 
-    context 'when deploy token is active but not related to project' do
-      let(:deploy_token) { create(:deploy_token) }
+    context 'when a project is passed in' do
+      context 'when deploy token is active and related to project' do
+        let(:deploy_token) { create(:deploy_token, projects: [project]) }
 
-      it { is_expected.to be_falsy }
-    end
+        it { is_expected.to be_truthy }
+      end
 
-    context 'when deploy token is revoked and related to project' do
-      let(:deploy_token) { create(:deploy_token, :revoked, projects: [project]) }
+      context 'when deploy token is active but not related to project' do
+        let(:deploy_token) { create(:deploy_token) }
 
-      it { is_expected.to be_falsy }
-    end
+        it { is_expected.to be_falsy }
+      end
 
-    context 'when deploy token is revoked and not related to the project' do
-      let(:deploy_token) { create(:deploy_token, :revoked) }
+      context 'when deploy token is revoked and related to project' do
+        let(:deploy_token) { create(:deploy_token, :revoked, projects: [project]) }
 
-      it { is_expected.to be_falsy }
+        it { is_expected.to be_falsy }
+      end
+
+      context 'when deploy token is revoked and not related to the project' do
+        let(:deploy_token) { create(:deploy_token, :revoked) }
+
+        it { is_expected.to be_falsy }
+      end
+
+      context 'and when the token is of group type' do
+        let_it_be(:group) { create(:group) }
+        let(:deploy_token) { create(:deploy_token, :group) }
+
+        before do
+          deploy_token.groups << group
+        end
+
+        context 'and the allow_group_deploy_token feature flag is turned off' do
+          it 'is false' do
+            stub_feature_flags(allow_group_deploy_token: false)
+
+            is_expected.to be_falsy
+          end
+        end
+
+        context 'and the allow_group_deploy_token feature flag is turned on' do
+          before do
+            stub_feature_flags(allow_group_deploy_token: true)
+          end
+
+          context 'and the passed-in project does not belong to any group' do
+            it { is_expected.to be_falsy }
+          end
+
+          context 'and the passed-in project belongs to the token group' do
+            it 'is true' do
+              group.projects << project
+
+              is_expected.to be_truthy
+            end
+          end
+
+          context 'and the passed-in project belongs to a subgroup' do
+            let(:child_group) { create(:group, parent_id: group.id) }
+            let(:grandchild_group) { create(:group, parent_id: child_group.id) }
+
+            before do
+              grandchild_group.projects << project
+            end
+
+            context 'and the token group is an ancestor (grand-parent) of this group' do
+              it { is_expected.to be_truthy }
+            end
+
+            context 'and the token group is not ancestor of this group' do
+              let(:child2_group) { create(:group, parent_id: group.id) }
+
+              it 'is false' do
+                deploy_token.groups = [child2_group]
+
+                is_expected.to be_falsey
+              end
+            end
+          end
+
+          context 'and the passed-in project does not belong to the token group' do
+            it { is_expected.to be_falsy }
+          end
+
+          context 'and the project belongs to a group that is parent of the token group' do
+            let(:super_group) { create(:group) }
+            let(:deploy_token) { create(:deploy_token, :group) }
+            let(:group) { create(:group, parent_id: super_group.id) }
+
+            it 'is false' do
+              super_group.projects << project
+
+              is_expected.to be_falsey
+            end
+          end
+        end
+      end
+
+      context 'and the token is of project type' do
+        let(:deploy_token) { create(:deploy_token, projects: [project]) }
+
+        context 'and the passed-in project is the same as the token project' do
+          it { is_expected.to be_truthy }
+        end
+
+        context 'and the passed-in project is not the same as the token project' do
+          subject { deploy_token.has_access_to?(create(:project)) }
+
+          it { is_expected.to be_falsey }
+        end
+      end
     end
   end
 
@@ -183,7 +323,7 @@ describe DeployToken do
       end
     end
 
-    context 'when passign a value' do
+    context 'when passing a value' do
       let(:expires_at) { Date.today + 5.months }
       let(:deploy_token) { create(:deploy_token, expires_at: expires_at) }
 
diff --git a/spec/models/group_deploy_token_spec.rb b/spec/models/group_deploy_token_spec.rb
new file mode 100644
index 00000000000..d38abafa7ed
--- /dev/null
+++ b/spec/models/group_deploy_token_spec.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe GroupDeployToken, type: :model do
+  let(:group) { create(:group) }
+  let(:deploy_token) { create(:deploy_token) }
+
+  subject(:group_deploy_token) { create(:group_deploy_token, group: group, deploy_token: deploy_token) }
+
+  it { is_expected.to belong_to :group }
+  it { is_expected.to belong_to :deploy_token }
+
+  it { is_expected.to validate_presence_of :deploy_token }
+  it { is_expected.to validate_presence_of :group }
+  it { is_expected.to validate_uniqueness_of(:deploy_token_id).scoped_to(:group_id) }
+end
diff --git a/spec/models/user_preference_spec.rb b/spec/models/user_preference_spec.rb
index bb88983e140..7884b87cc26 100644
--- a/spec/models/user_preference_spec.rb
+++ b/spec/models/user_preference_spec.rb
@@ -85,4 +85,19 @@ describe UserPreference do
       expect(user_preference.timezone).to eq(Time.zone.tzinfo.name)
     end
   end
+
+  describe '#tab_width' do
+    it 'is set to 8 by default' do
+      # Intentionally not using factory here to test the constructor.
+      pref = UserPreference.new
+      expect(pref.tab_width).to eq(8)
+    end
+
+    it do
+      is_expected.to validate_numericality_of(:tab_width)
+        .only_integer
+        .is_greater_than_or_equal_to(1)
+        .is_less_than_or_equal_to(12)
+    end
+  end
 end
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index 74e38e79616..855b8e3a8a7 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -20,6 +20,9 @@ describe User, :do_not_mock_admin_mode do
 
   describe 'delegations' do
     it { is_expected.to delegate_method(:path).to(:namespace).with_prefix }
+
+    it { is_expected.to delegate_method(:tab_width).to(:user_preference) }
+    it { is_expected.to delegate_method(:tab_width=).to(:user_preference).with_arguments(5) }
   end
 
   describe 'associations' do
@@ -4126,4 +4129,41 @@ describe User, :do_not_mock_admin_mode do
       end
     end
   end
+
+  describe 'internal methods' do
+    let_it_be(:user) { create(:user) }
+    let!(:ghost) { described_class.ghost }
+    let!(:alert_bot) { described_class.alert_bot }
+    let!(:non_internal) { [user] }
+    let!(:internal) { [ghost, alert_bot] }
+
+    it 'returns non internal users' do
+      expect(described_class.internal).to eq(internal)
+      expect(internal.all?(&:internal?)).to eq(true)
+    end
+
+    it 'returns internal users' do
+      expect(described_class.non_internal).to eq(non_internal)
+      expect(non_internal.all?(&:internal?)).to eq(false)
+    end
+
+    describe '#bot?' do
+      it 'marks bot users' do
+        expect(user.bot?).to eq(false)
+        expect(ghost.bot?).to eq(false)
+
+        expect(alert_bot.bot?).to eq(true)
+      end
+    end
+  end
+
+  describe 'bots & humans' do
+    it 'returns corresponding users' do
+      human = create(:user)
+      bot = create(:user, :bot)
+
+      expect(described_class.humans).to match_array([human])
+      expect(described_class.bots).to match_array([bot])
+    end
+  end
 end