4 files changed, 96 insertions, 13 deletions
diff --git a/spec/requests/api/ci/runner/jobs_artifacts_spec.rb b/spec/requests/api/ci/runner/jobs_artifacts_spec.rb
index 9369b6aa464..017a12a4a40 100644
--- a/spec/requests/api/ci/runner/jobs_artifacts_spec.rb
+++ b/spec/requests/api/ci/runner/jobs_artifacts_spec.rb
@@ -127,7 +127,7 @@ RSpec.describe API::Ci::Runner, :clean_gitlab_redis_shared_state do
               authorize_artifacts_with_token_in_params
             end
 
-            it_behaves_like 'API::CI::Runner application context metadata', '/api/:version/jobs/:id/artifacts/authorize' do
+            it_behaves_like 'API::CI::Runner application context metadata', 'POST /api/:version/jobs/:id/artifacts/authorize' do
               let(:send_request) { subject }
             end
 
@@ -180,6 +180,18 @@ RSpec.describe API::Ci::Runner, :clean_gitlab_redis_shared_state do
                 it_behaves_like 'authorizes local file'
               end
             end
+
+            context 'when job does not exist anymore' do
+              before do
+                allow(job).to receive(:id).and_return(non_existing_record_id)
+              end
+
+              it 'returns 403 Forbidden' do
+                subject
+
+                expect(response).to have_gitlab_http_status(:forbidden)
+              end
+            end
           end
         end
 
@@ -262,7 +274,7 @@ RSpec.describe API::Ci::Runner, :clean_gitlab_redis_shared_state do
       end
 
       describe 'POST /api/v4/jobs/:id/artifacts' do
-        it_behaves_like 'API::CI::Runner application context metadata', '/api/:version/jobs/:id/artifacts' do
+        it_behaves_like 'API::CI::Runner application context metadata', 'POST /api/:version/jobs/:id/artifacts' do
           let(:send_request) do
             upload_artifacts(file_upload, headers_with_token)
           end
@@ -321,6 +333,18 @@ RSpec.describe API::Ci::Runner, :clean_gitlab_redis_shared_state do
             end
           end
 
+          context 'when job does not exist anymore' do
+            before do
+              allow(job).to receive(:id).and_return(non_existing_record_id)
+            end
+
+            it 'returns 403 Forbidden' do
+              upload_artifacts(file_upload, headers_with_token)
+
+              expect(response).to have_gitlab_http_status(:forbidden)
+            end
+          end
+
           context 'when job is running' do
             shared_examples 'successful artifacts upload' do
               it 'updates successfully' do
@@ -784,7 +808,7 @@ RSpec.describe API::Ci::Runner, :clean_gitlab_redis_shared_state do
       describe 'GET /api/v4/jobs/:id/artifacts' do
         let(:token) { job.token }
 
-        it_behaves_like 'API::CI::Runner application context metadata', '/api/:version/jobs/:id/artifacts' do
+        it_behaves_like 'API::CI::Runner application context metadata', 'GET /api/:version/jobs/:id/artifacts' do
           let(:send_request) { download_artifact }
         end
 
@@ -867,6 +891,18 @@ RSpec.describe API::Ci::Runner, :clean_gitlab_redis_shared_state do
           end
         end
 
+        context 'when job does not exist anymore' do
+          before do
+            allow(job).to receive(:id).and_return(non_existing_record_id)
+          end
+
+          it 'responds with 403 Forbidden' do
+            get api("/jobs/#{job.id}/artifacts"), params: { token: token }, headers: headers
+
+            expect(response).to have_gitlab_http_status(:forbidden)
+          end
+        end
+
         def download_artifact(params = {}, request_headers = headers)
           params = params.merge(token: token)
           job.reload
diff --git a/spec/requests/api/ci/runner/jobs_put_spec.rb b/spec/requests/api/ci/runner/jobs_put_spec.rb
index b5d2c4608c5..3d5021fba08 100644
--- a/spec/requests/api/ci/runner/jobs_put_spec.rb
+++ b/spec/requests/api/ci/runner/jobs_put_spec.rb
@@ -36,7 +36,7 @@ RSpec.describe API::Ci::Runner, :clean_gitlab_redis_shared_state do
         job.run!
       end
 
-      it_behaves_like 'API::CI::Runner application context metadata', '/api/:version/jobs/:id' do
+      it_behaves_like 'API::CI::Runner application context metadata', 'PUT /api/:version/jobs/:id' do
         let(:send_request) { update_job(state: 'success') }
       end
 
@@ -278,14 +278,22 @@ RSpec.describe API::Ci::Runner, :clean_gitlab_redis_shared_state do
         end
       end
 
-      def update_job(token = job.token, **params)
+      context 'when job does not exist anymore' do
+        it 'returns 403 Forbidden' do
+          update_job(non_existing_record_id, state: 'success', trace: 'BUILD TRACE UPDATED')
+
+          expect(response).to have_gitlab_http_status(:forbidden)
+        end
+      end
+
+      def update_job(job_id = job.id, token = job.token, **params)
         new_params = params.merge(token: token)
-        put api("/jobs/#{job.id}"), params: new_params
+        put api("/jobs/#{job_id}"), params: new_params
       end
 
       def update_job_after_time(update_interval = 20.minutes, state = 'running')
         travel_to(job.updated_at + update_interval) do
-          update_job(job.token, state: state)
+          update_job(job.id, job.token, state: state)
         end
       end
     end
diff --git a/spec/requests/api/ci/runner/jobs_request_post_spec.rb b/spec/requests/api/ci/runner/jobs_request_post_spec.rb
index aced094e219..cf0d8a632f1 100644
--- a/spec/requests/api/ci/runner/jobs_request_post_spec.rb
+++ b/spec/requests/api/ci/runner/jobs_request_post_spec.rb
@@ -143,7 +143,8 @@ RSpec.describe API::Ci::Runner, :clean_gitlab_redis_shared_state do
 
         context 'when there is a pending job' do
           let(:expected_job_info) do
-            { 'name' => job.name,
+            { 'id' => job.id,
+              'name' => job.name,
               'stage' => job.stage,
               'project_id' => job.project.id,
               'project_name' => job.project.name }
@@ -490,6 +491,36 @@ RSpec.describe API::Ci::Runner, :clean_gitlab_redis_shared_state do
                 { 'id' => job.id, 'name' => job.name, 'token' => job.token },
                 { 'id' => job2.id, 'name' => job2.name, 'token' => job2.token })
             end
+
+            describe 'preloading job_artifacts_archive' do
+              context 'when the feature flag is disabled' do
+                before do
+                  stub_feature_flags(preload_associations_jobs_request_api_endpoint: false)
+                end
+
+                it 'queries the ci_job_artifacts table multiple times' do
+                  expect { request_job }.to exceed_all_query_limit(1).for_model(::Ci::JobArtifact)
+                end
+
+                it 'queries the ci_builds table more than five times' do
+                  expect { request_job }.to exceed_all_query_limit(5).for_model(::Ci::Build)
+                end
+              end
+
+              context 'when the feature flag is enabled' do
+                before do
+                  stub_feature_flags(preload_associations_jobs_request_api_endpoint: true)
+                end
+
+                it 'queries the ci_job_artifacts table once only' do
+                  expect { request_job }.not_to exceed_all_query_limit(1).for_model(::Ci::JobArtifact)
+                end
+
+                it 'queries the ci_builds table five times' do
+                  expect { request_job }.not_to exceed_all_query_limit(5).for_model(::Ci::Build)
+                end
+              end
+            end
           end
 
           context 'when pipeline have jobs with artifacts' do
diff --git a/spec/requests/api/ci/runner/jobs_trace_spec.rb b/spec/requests/api/ci/runner/jobs_trace_spec.rb
index 659cf055023..e077a174b08 100644
--- a/spec/requests/api/ci/runner/jobs_trace_spec.rb
+++ b/spec/requests/api/ci/runner/jobs_trace_spec.rb
@@ -41,7 +41,7 @@ RSpec.describe API::Ci::Runner, :clean_gitlab_redis_shared_state do
         initial_patch_the_trace
       end
 
-      it_behaves_like 'API::CI::Runner application context metadata', '/api/:version/jobs/:id/trace' do
+      it_behaves_like 'API::CI::Runner application context metadata', 'PATCH /api/:version/jobs/:id/trace' do
         let(:send_request) { patch_the_trace }
       end
 
@@ -210,15 +210,23 @@ RSpec.describe API::Ci::Runner, :clean_gitlab_redis_shared_state do
         end
 
         context 'when build trace is not being watched' do
-          it 'returns X-GitLab-Trace-Update-Interval as 30' do
+          it 'returns the interval in X-GitLab-Trace-Update-Interval' do
             patch_the_trace
 
             expect(response).to have_gitlab_http_status(:accepted)
-            expect(response.header['X-GitLab-Trace-Update-Interval']).to eq('30')
+            expect(response.header['X-GitLab-Trace-Update-Interval']).to eq('60')
           end
         end
       end
 
+      context 'when job does not exist anymore' do
+        it 'returns 403 Forbidden' do
+          patch_the_trace(job_id: non_existing_record_id)
+
+          expect(response).to have_gitlab_http_status(:forbidden)
+        end
+      end
+
       context 'when Runner makes a force-patch' do
         before do
           force_patch_the_trace
@@ -264,7 +272,7 @@ RSpec.describe API::Ci::Runner, :clean_gitlab_redis_shared_state do
         it { expect(response).to have_gitlab_http_status(:forbidden) }
       end
 
-      def patch_the_trace(content = ' appended', request_headers = nil)
+      def patch_the_trace(content = ' appended', request_headers = nil, job_id: job.id)
         unless request_headers
           job.trace.read do |stream|
             offset = stream.size
@@ -274,7 +282,7 @@ RSpec.describe API::Ci::Runner, :clean_gitlab_redis_shared_state do
         end
 
         Timecop.travel(job.updated_at + update_interval) do
-          patch api("/jobs/#{job.id}/trace"), params: content, headers: request_headers
+          patch api("/jobs/#{job_id}/trace"), params: content, headers: request_headers
           job.reload
         end
       end