1 files changed, 94 insertions, 46 deletions
diff --git a/spec/requests/api/metrics/dashboard/annotations_spec.rb b/spec/requests/api/metrics/dashboard/annotations_spec.rb
index 0b51c46e474..6377ef2435a 100644
--- a/spec/requests/api/metrics/dashboard/annotations_spec.rb
+++ b/spec/requests/api/metrics/dashboard/annotations_spec.rb
@@ -11,77 +11,125 @@ describe API::Metrics::Dashboard::Annotations do
   let(:ending_at) { 1.hour.from_now.iso8601 }
   let(:params) { attributes_for(:metrics_dashboard_annotation, environment: environment, starting_at: starting_at, ending_at: ending_at, dashboard_path: dashboard)}
 
-  describe 'POST /environments/:environment_id/metrics_dashboard/annotations' do
-    before :all do
+  shared_examples 'POST /:source_type/:id/metrics_dashboard/annotations' do |source_type|
+    let(:url) { "/#{source_type.pluralize}/#{source.id}/metrics_dashboard/annotations" }
+
+    before do
       project.add_developer(user)
     end
 
-    context 'feature flag metrics_dashboard_annotations' do
-      context 'is on' do
-        before do
-          stub_feature_flags(metrics_dashboard_annotations: { enabled: true, thing: project })
-        end
-        context 'with correct permissions' do
-          context 'with valid parameters' do
-            it 'creates a new annotation', :aggregate_failures do
-              post api("/environments/#{environment.id}/metrics_dashboard/annotations", user), params: params
-
-              expect(response).to have_gitlab_http_status(:created)
-              expect(json_response['environment_id']).to eq(environment.id)
-              expect(json_response['starting_at'].to_time).to eq(starting_at.to_time)
-              expect(json_response['ending_at'].to_time).to eq(ending_at.to_time)
-              expect(json_response['description']).to eq(params[:description])
-              expect(json_response['dashboard_path']).to eq(dashboard)
-            end
+    context "with :source_type == #{source_type.pluralize}" do
+      context 'with correct permissions' do
+        context 'with valid parameters' do
+          it 'creates a new annotation', :aggregate_failures do
+            post api(url, user), params: params
+
+            expect(response).to have_gitlab_http_status(:created)
+            expect(json_response["#{source_type}_id"]).to eq(source.id)
+            expect(json_response['starting_at'].to_time).to eq(starting_at.to_time)
+            expect(json_response['ending_at'].to_time).to eq(ending_at.to_time)
+            expect(json_response['description']).to eq(params[:description])
+            expect(json_response['dashboard_path']).to eq(dashboard)
           end
+        end
 
-          context 'with invalid parameters' do
-            it 'returns error messsage' do
-              post api("/environments/#{environment.id}/metrics_dashboard/annotations", user),
-                  params: { dashboard_path: nil, starting_at: nil, description: nil }
+        context 'with invalid parameters' do
+          it 'returns error messsage' do
+            post api(url, user), params: { dashboard_path: '', starting_at: nil, description: nil }
 
-              expect(response).to have_gitlab_http_status(:bad_request)
-              expect(json_response['message']).to include({ "starting_at" => ["can't be blank"], "description" => ["can't be blank"], "dashboard_path" => ["can't be blank"] })
-            end
+            expect(response).to have_gitlab_http_status(:bad_request)
+            expect(json_response['message']).to include({ "starting_at" => ["can't be blank"], "description" => ["can't be blank"], "dashboard_path" => ["can't be blank"] })
           end
+        end
 
-          context 'with undeclared params' do
-            before do
-              params[:undeclared_param] = 'xyz'
-            end
-            it 'filters out undeclared params' do
-              expect(::Metrics::Dashboard::Annotations::CreateService).to receive(:new).with(user, hash_excluding(:undeclared_param))
+        context 'with undeclared params' do
+          before do
+            params[:undeclared_param] = 'xyz'
+          end
 
-              post api("/environments/#{environment.id}/metrics_dashboard/annotations", user), params: params
-            end
+          it 'filters out undeclared params' do
+            expect(::Metrics::Dashboard::Annotations::CreateService).to receive(:new).with(user, hash_excluding(:undeclared_param))
+
+            post api(url, user), params: params
           end
         end
 
-        context 'without correct permissions' do
-          let_it_be(:guest) { create(:user) }
+        context 'with special characers in dashboard_path in request body' do
+          let(:dashboard_escaped) { 'config/prometheus/common_metrics%26copy.yml' }
+          let(:dashboard_unescaped) { 'config/prometheus/common_metrics&copy.yml' }
 
-          before do
-            project.add_guest(guest)
+          shared_examples 'special characters unescaped' do
+            let(:expected_params) do
+              {
+                'starting_at' => starting_at.to_time,
+                'ending_at' => ending_at.to_time,
+                "#{source_type}" => source,
+                'dashboard_path' => dashboard_unescaped,
+                'description' => params[:description]
+              }
+            end
+
+            it 'unescapes the dashboard_path', :aggregate_failures do
+              expect(::Metrics::Dashboard::Annotations::CreateService).to receive(:new).with(user, expected_params)
+
+              post api(url, user), params: params
+            end
           end
 
-          it 'returns error messsage' do
-            post api("/environments/#{environment.id}/metrics_dashboard/annotations", guest), params: params
+          context 'with escaped characters' do
+            it_behaves_like 'special characters unescaped' do
+              let(:dashboard) { dashboard_escaped }
+            end
+          end
 
-            expect(response).to have_gitlab_http_status(:forbidden)
+          context 'with unescaped characers' do
+            it_behaves_like 'special characters unescaped' do
+              let(:dashboard) { dashboard_unescaped }
+            end
           end
         end
       end
-      context 'is off' do
+
+      context 'without correct permissions' do
+        let_it_be(:guest) { create(:user) }
+
         before do
-          stub_feature_flags(metrics_dashboard_annotations: { enabled: false, thing: project })
+          project.add_guest(guest)
         end
 
-        it 'returns error messsage' do
-          post api("/environments/#{environment.id}/metrics_dashboard/annotations", user), params: params
+        it 'returns error message' do
+          post api(url, guest), params: params
 
-          expect(response).to have_gitlab_http_status(:not_found)
+          expect(response).to have_gitlab_http_status(:forbidden)
         end
       end
     end
   end
+
+  describe 'environment' do
+    it_behaves_like 'POST /:source_type/:id/metrics_dashboard/annotations', 'environment' do
+      let(:source) { environment }
+    end
+  end
+
+  describe 'group cluster' do
+    it_behaves_like 'POST /:source_type/:id/metrics_dashboard/annotations', 'cluster' do
+      let_it_be(:group) { create(:group) }
+      let_it_be(:cluster) { create(:cluster_for_group, groups: [group]) }
+
+      before do
+        group.add_developer(user)
+      end
+
+      let(:source) { cluster }
+    end
+  end
+
+  describe 'project cluster' do
+    it_behaves_like 'POST /:source_type/:id/metrics_dashboard/annotations', 'cluster' do
+      let_it_be(:cluster) { create(:cluster, projects: [project]) }
+
+      let(:source) { cluster }
+    end
+  end
 end