summaryrefslogtreecommitdiff
path: root/spec/requests/api/doorkeeper_access_spec.rb
Commit message (Collapse)AuthorAgeFilesLines
* Add sudo API scopeDouwe Maan2017-11-021-4/+4
|
* Remove authentication using user.private_tokenDouwe Maan2017-11-021-1/+1
|
* Refactor `have_http_status` into `have_gitlab_http_status` in the specsJacopo2017-10-201-5/+5
|
* Enable RSpec/FilePath copenable-spec-file-name-copSean McGivern2017-04-261-1/+1
| | | | | | - Ignore JS fixtures - Ignore qa directory - Rewrite concern specs to put concern name first
* Unnecessary "include WaitForAjax" and "include ApiHelpers"Jacopo2017-04-211-3/+1
| | | | | Removed all the unnecessary include of `WaitForAjax` and `ApiHelpers` in the specs. Removed unnecessary usage of `api:true`
* Don't allow blocked users to authenticate through other meansMarkus Koller2017-03-071-0/+18
| | | | | | | | | | | | | Gitlab::Auth.find_with_user_password is currently used in these places: - resource_owner_from_credentials in config/initializers/doorkeeper.rb, which is used for the OAuth Resource Owner Password Credentials flow - the /session API call in lib/api/session.rb, which is used to reveal the user's current authentication_token In both cases users should only be authenticated if they're in the active state.
* Make Warden set_user hook validate user ip uniqunessPawel Chojnacki2017-03-061-11/+11
| | | | + rename shared context
* Cleanup common code in Unique Ips testsPawel Chojnacki2017-03-061-23/+0
|
* Cleanup RSpec testsPawel Chojnacki2017-03-061-31/+28
|
* Test various login scenarios if the limit gets enforcedPawel Chojnacki2017-03-061-11/+49
|
* Calls to the API are checked for scope.Timothy Andrew2016-12-161-1/+1
| | | | | | | | | | | | | | - Move the `Oauth2::AccessTokenValidationService` class to `AccessTokenValidationService`, since it is now being used for personal access token validation as well. - Each API endpoint declares the scopes it accepts (if any). Currently, the top level API module declares the `api` scope, and the `Users` API module declares the `read_user` scope (for GET requests). - Move the `find_user_by_private_token` from the API `Helpers` module to the `APIGuard` module, to avoid littering `Helpers` with more auth-related methods to support `find_user_by_private_token`
* Enable Style/EmptyLines cop, remove redundant onesrubocop/enable-cops-for-empty-linesGrzegorz Bizon2016-07-011-1/+0
|
* Use HTTP matchers if possibleZ.J. van de Weg2016-06-271-3/+3
|
* Fix part of api specs for rubocopDmitriy Zaporozhets2015-06-221-5/+5
| | | | Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
* Updated rspec to rspec 3.x syntaxJeroen van Baarsen2015-02-121-3/+3
| | | | Signed-off-by: Jeroen van Baarsen <jeroenvanbaarsen@gmail.com>
* Doorkeeper integrationValery Sizov2014-12-241-0/+31
View Lorry Controller Status