1 files changed, 60 insertions, 9 deletions
diff --git a/spec/services/google_cloud/service_accounts_service_spec.rb b/spec/services/google_cloud/service_accounts_service_spec.rb
index a0d09affa72..505c623c02a 100644
--- a/spec/services/google_cloud/service_accounts_service_spec.rb
+++ b/spec/services/google_cloud/service_accounts_service_spec.rb
@@ -3,11 +3,11 @@
 require 'spec_helper'
 
 RSpec.describe GoogleCloud::ServiceAccountsService do
-  let_it_be(:project) { create(:project) }
-
   let(:service) { described_class.new(project) }
 
   describe 'find_for_project' do
+    let_it_be(:project) { create(:project) }
+
     context 'when a project does not have GCP service account vars' do
       before do
         project.variables.build(key: 'blah', value: 'foo', environment_scope: 'world')
@@ -21,13 +21,13 @@ RSpec.describe GoogleCloud::ServiceAccountsService do
 
     context 'when a project has GCP service account ci vars' do
       before do
-        project.variables.build(environment_scope: '*', key: 'GCP_PROJECT_ID', value: 'prj1')
-        project.variables.build(environment_scope: '*', key: 'GCP_SERVICE_ACCOUNT_KEY', value: 'mock')
-        project.variables.build(environment_scope: 'staging', key: 'GCP_PROJECT_ID', value: 'prj2')
-        project.variables.build(environment_scope: 'staging', key: 'GCP_SERVICE_ACCOUNT', value: 'mock')
-        project.variables.build(environment_scope: 'production', key: 'GCP_PROJECT_ID', value: 'prj3')
-        project.variables.build(environment_scope: 'production', key: 'GCP_SERVICE_ACCOUNT', value: 'mock')
-        project.variables.build(environment_scope: 'production', key: 'GCP_SERVICE_ACCOUNT_KEY', value: 'mock')
+        project.variables.build(protected: true, environment_scope: '*', key: 'GCP_PROJECT_ID', value: 'prj1')
+        project.variables.build(protected: true, environment_scope: '*', key: 'GCP_SERVICE_ACCOUNT_KEY', value: 'mock')
+        project.variables.build(protected: true, environment_scope: 'staging', key: 'GCP_PROJECT_ID', value: 'prj2')
+        project.variables.build(protected: true, environment_scope: 'staging', key: 'GCP_SERVICE_ACCOUNT', value: 'mock')
+        project.variables.build(protected: true, environment_scope: 'production', key: 'GCP_PROJECT_ID', value: 'prj3')
+        project.variables.build(protected: true, environment_scope: 'production', key: 'GCP_SERVICE_ACCOUNT', value: 'mock')
+        project.variables.build(protected: true, environment_scope: 'production', key: 'GCP_SERVICE_ACCOUNT_KEY', value: 'mock')
         project.save!
       end
 
@@ -55,4 +55,55 @@ RSpec.describe GoogleCloud::ServiceAccountsService do
       end
     end
   end
+
+  describe 'add_for_project' do
+    let_it_be(:project) { create(:project) }
+
+    it 'saves GCP creds as project CI vars' do
+      service.add_for_project('env_1', 'gcp_prj_id_1', 'srv_acc_1', 'srv_acc_key_1')
+      service.add_for_project('env_2', 'gcp_prj_id_2', 'srv_acc_2', 'srv_acc_key_2')
+
+      list = service.find_for_project
+
+      aggregate_failures 'testing list of service accounts' do
+        expect(list.length).to eq(2)
+
+        expect(list.first[:environment]).to eq('env_1')
+        expect(list.first[:gcp_project]).to eq('gcp_prj_id_1')
+        expect(list.first[:service_account_exists]).to eq(true)
+        expect(list.first[:service_account_key_exists]).to eq(true)
+
+        expect(list.second[:environment]).to eq('env_2')
+        expect(list.second[:gcp_project]).to eq('gcp_prj_id_2')
+        expect(list.second[:service_account_exists]).to eq(true)
+        expect(list.second[:service_account_key_exists]).to eq(true)
+      end
+    end
+
+    it 'replaces previously stored CI vars with new CI vars' do
+      service.add_for_project('env_1', 'new_project', 'srv_acc_1', 'srv_acc_key_1')
+
+      list = service.find_for_project
+
+      aggregate_failures 'testing list of service accounts' do
+        expect(list.length).to eq(2)
+
+        # asserting that the first service account is replaced
+        expect(list.first[:environment]).to eq('env_1')
+        expect(list.first[:gcp_project]).to eq('new_project')
+        expect(list.first[:service_account_exists]).to eq(true)
+        expect(list.first[:service_account_key_exists]).to eq(true)
+
+        expect(list.second[:environment]).to eq('env_2')
+        expect(list.second[:gcp_project]).to eq('gcp_prj_id_2')
+        expect(list.second[:service_account_exists]).to eq(true)
+        expect(list.second[:service_account_key_exists]).to eq(true)
+      end
+    end
+
+    it 'underlying project CI vars must be protected' do
+      expect(project.variables.first.protected).to eq(true)
+      expect(project.variables.second.protected).to eq(true)
+    end
+  end
 end