1 files changed, 67 insertions, 20 deletions

diff --git a/spec/policies/group_policy_spec.rb b/spec/policies/group_policy_spec.rb
index be55d94daec..603e7e874c9 100644
--- a/spec/policies/group_policy_spec.rb
+++ b/spec/policies/group_policy_spec.rb
@@ -3,12 +3,13 @@ require 'spec_helper'
 describe GroupPolicy do
   include_context 'GroupPolicy context'
 
-  context 'with no user' do
+  context 'public group with no user' do
     let(:group) { create(:group, :public) }
     let(:current_user) { nil }
 
     it do
       expect_allowed(:read_group)
+      expect_allowed(*read_group_permissions)
       expect_disallowed(:upload_file)
       expect_disallowed(*reporter_permissions)
       expect_disallowed(*developer_permissions)
@@ -27,11 +28,11 @@ describe GroupPolicy do
     end
 
     it { expect_disallowed(:read_group) }
+    it { expect_disallowed(*read_group_permissions) }
   end
 
   context 'with foreign user and public project' do
     let(:project) { create(:project, :public) }
-    let(:user) { create(:user) }
     let(:current_user) { create(:user) }
 
     before do
@@ -39,6 +40,7 @@ describe GroupPolicy do
     end
 
     it { expect_disallowed(:read_group) }
+    it { expect_disallowed(*read_group_permissions) }
   end
 
   context 'has projects' do
@@ -49,13 +51,13 @@ describe GroupPolicy do
       project.add_developer(current_user)
     end
 
-    it { expect_allowed(:read_label, :read_list) }
+    it { expect_allowed(*read_group_permissions) }
 
     context 'in subgroups' do
       let(:subgroup) { create(:group, :private, parent: group) }
       let(:project) { create(:project, namespace: subgroup) }
 
-      it { expect_allowed(:read_label, :read_list) }
+      it { expect_allowed(*read_group_permissions) }
     end
   end
 
@@ -63,6 +65,7 @@ describe GroupPolicy do
     let(:current_user) { guest }
 
     it do
+      expect_allowed(*read_group_permissions)
       expect_allowed(*guest_permissions)
       expect_disallowed(*reporter_permissions)
       expect_disallowed(*developer_permissions)
@@ -75,6 +78,7 @@ describe GroupPolicy do
     let(:current_user) { reporter }
 
     it do
+      expect_allowed(*read_group_permissions)
       expect_allowed(*guest_permissions)
       expect_allowed(*reporter_permissions)
       expect_disallowed(*developer_permissions)
@@ -87,6 +91,7 @@ describe GroupPolicy do
     let(:current_user) { developer }
 
     it do
+      expect_allowed(*read_group_permissions)
       expect_allowed(*guest_permissions)
       expect_allowed(*reporter_permissions)
       expect_allowed(*developer_permissions)
@@ -99,8 +104,8 @@ describe GroupPolicy do
     let(:current_user) { maintainer }
 
     context 'with subgroup_creation level set to maintainer' do
-      let(:group) do
-        create(:group, :private, subgroup_creation_level: ::Gitlab::Access::MAINTAINER_SUBGROUP_ACCESS)
+      before_all do
+        group.update(subgroup_creation_level: ::Gitlab::Access::MAINTAINER_SUBGROUP_ACCESS)
       end
 
       it 'allows every maintainer permission plus creating subgroups' do
@@ -110,6 +115,7 @@ describe GroupPolicy do
         updated_owner_permissions =
           owner_permissions - create_subgroup_permission
 
+        expect_allowed(*read_group_permissions)
         expect_allowed(*guest_permissions)
         expect_allowed(*reporter_permissions)
         expect_allowed(*developer_permissions)
@@ -120,6 +126,7 @@ describe GroupPolicy do
 
     context 'with subgroup_creation_level set to owner' do
       it 'allows every maintainer permission' do
+        expect_allowed(*read_group_permissions)
         expect_allowed(*guest_permissions)
         expect_allowed(*reporter_permissions)
         expect_allowed(*developer_permissions)
@@ -133,6 +140,7 @@ describe GroupPolicy do
     let(:current_user) { owner }
 
     it do
+      expect_allowed(*read_group_permissions)
       expect_allowed(*guest_permissions)
       expect_allowed(*reporter_permissions)
       expect_allowed(*developer_permissions)
@@ -145,6 +153,7 @@ describe GroupPolicy do
     let(:current_user) { admin }
 
     it do
+      expect_allowed(*read_group_permissions)
       expect_allowed(*guest_permissions)
       expect_allowed(*reporter_permissions)
       expect_allowed(*developer_permissions)
@@ -154,11 +163,11 @@ describe GroupPolicy do
   end
 
   describe 'private nested group use the highest access level from the group and inherited permissions' do
-    let(:nested_group) do
+    let_it_be(:nested_group) do
       create(:group, :private, :owner_subgroup_creation_only, parent: group)
     end
 
-    before do
+    before_all do
       nested_group.add_guest(guest)
       nested_group.add_guest(reporter)
       nested_group.add_guest(developer)
@@ -176,6 +185,7 @@ describe GroupPolicy do
       let(:current_user) { nil }
 
       it do
+        expect_disallowed(*read_group_permissions)
         expect_disallowed(*guest_permissions)
         expect_disallowed(*reporter_permissions)
         expect_disallowed(*developer_permissions)
@@ -188,6 +198,7 @@ describe GroupPolicy do
       let(:current_user) { guest }
 
       it do
+        expect_allowed(*read_group_permissions)
         expect_allowed(*guest_permissions)
         expect_disallowed(*reporter_permissions)
         expect_disallowed(*developer_permissions)
@@ -200,6 +211,7 @@ describe GroupPolicy do
       let(:current_user) { reporter }
 
       it do
+        expect_allowed(*read_group_permissions)
         expect_allowed(*guest_permissions)
         expect_allowed(*reporter_permissions)
         expect_disallowed(*developer_permissions)
@@ -212,6 +224,7 @@ describe GroupPolicy do
       let(:current_user) { developer }
 
       it do
+        expect_allowed(*read_group_permissions)
         expect_allowed(*guest_permissions)
         expect_allowed(*reporter_permissions)
         expect_allowed(*developer_permissions)
@@ -224,6 +237,7 @@ describe GroupPolicy do
       let(:current_user) { maintainer }
 
       it do
+        expect_allowed(*read_group_permissions)
         expect_allowed(*guest_permissions)
         expect_allowed(*reporter_permissions)
         expect_allowed(*developer_permissions)
@@ -236,6 +250,7 @@ describe GroupPolicy do
       let(:current_user) { owner }
 
       it do
+        expect_allowed(*read_group_permissions)
         expect_allowed(*guest_permissions)
         expect_allowed(*reporter_permissions)
         expect_allowed(*developer_permissions)
@@ -252,6 +267,10 @@ describe GroupPolicy do
       context 'when the group share_with_group_lock is enabled' do
         let(:group) { create(:group, share_with_group_lock: true, parent: parent) }
 
+        before do
+          group.add_owner(owner)
+        end
+
         context 'when the parent group share_with_group_lock is enabled' do
           context 'when the group has a grandparent' do
             let(:parent) { create(:group, share_with_group_lock: true, parent: grandparent) }
@@ -337,7 +356,9 @@ describe GroupPolicy do
 
   context "create_projects" do
     context 'when group has no project creation level set' do
-      let(:group) { create(:group, project_creation_level: nil) }
+      before_all do
+        group.update(project_creation_level: nil)
+      end
 
       context 'reporter' do
         let(:current_user) { reporter }
@@ -365,7 +386,9 @@ describe GroupPolicy do
     end
 
     context 'when group has project creation level set to no one' do
-      let(:group) { create(:group, project_creation_level: ::Gitlab::Access::NO_ONE_PROJECT_ACCESS) }
+      before_all do
+        group.update(project_creation_level: ::Gitlab::Access::NO_ONE_PROJECT_ACCESS)
+      end
 
       context 'reporter' do
         let(:current_user) { reporter }
@@ -393,7 +416,9 @@ describe GroupPolicy do
     end
 
     context 'when group has project creation level set to maintainer only' do
-      let(:group) { create(:group, project_creation_level: ::Gitlab::Access::MAINTAINER_PROJECT_ACCESS) }
+      before_all do
+        group.update(project_creation_level: ::Gitlab::Access::MAINTAINER_PROJECT_ACCESS)
+      end
 
       context 'reporter' do
         let(:current_user) { reporter }
@@ -421,7 +446,9 @@ describe GroupPolicy do
     end
 
     context 'when group has project creation level set to developers + maintainer' do
-      let(:group) { create(:group, project_creation_level: ::Gitlab::Access::DEVELOPER_MAINTAINER_PROJECT_ACCESS) }
+      before_all do
+        group.update(project_creation_level: ::Gitlab::Access::DEVELOPER_MAINTAINER_PROJECT_ACCESS)
+      end
 
       context 'reporter' do
         let(:current_user) { reporter }
@@ -451,10 +478,8 @@ describe GroupPolicy do
 
   context "create_subgroup" do
     context 'when group has subgroup creation level set to owner' do
-      let(:group) do
-        create(
-          :group,
-          subgroup_creation_level: ::Gitlab::Access::OWNER_SUBGROUP_ACCESS)
+      before_all do
+        group.update(subgroup_creation_level: ::Gitlab::Access::OWNER_SUBGROUP_ACCESS)
       end
 
       context 'reporter' do
@@ -483,10 +508,8 @@ describe GroupPolicy do
     end
 
     context 'when group has subgroup creation level set to maintainer' do
-      let(:group) do
-        create(
-          :group,
-          subgroup_creation_level: ::Gitlab::Access::MAINTAINER_SUBGROUP_ACCESS)
+      before_all do
+        group.update(subgroup_creation_level: ::Gitlab::Access::MAINTAINER_SUBGROUP_ACCESS)
       end
 
       context 'reporter' do
@@ -524,4 +547,28 @@ describe GroupPolicy do
              groups: [clusterable])
     end
   end
+
+  describe 'update_max_artifacts_size' do
+    let(:group) { create(:group, :public) }
+
+    context 'when no user' do
+      let(:current_user) { nil }
+
+      it { expect_disallowed(:update_max_artifacts_size) }
+    end
+
+    context 'admin' do
+      let(:current_user) { admin }
+
+      it { expect_allowed(:update_max_artifacts_size) }
+    end
+
+    %w(guest reporter developer maintainer owner).each do |role|
+      context role do
+        let(:current_user) { send(role) }
+
+        it { expect_disallowed(:update_max_artifacts_size) }
+      end
+    end
+  end
 end