From f11caaf4692afdde0a2c458b3682aef3f9658b6a Mon Sep 17 00:00:00 2001
From: "Z.J. van de Weg" <git@zjvandeweg.nl>
Date: Mon, 12 Dec 2016 09:31:48 +0100
Subject: Setup mattermost session

---
 lib/mattermost/mattermost.rb           | 102 +++++++++++++++++++++++++++++++++
 spec/lib/mattermost/mattermost_spec.rb |  42 ++++++++++++++
 2 files changed, 144 insertions(+)
 create mode 100644 lib/mattermost/mattermost.rb
 create mode 100644 spec/lib/mattermost/mattermost_spec.rb

diff --git a/lib/mattermost/mattermost.rb b/lib/mattermost/mattermost.rb
new file mode 100644
index 00000000000..84d016bb197
--- /dev/null
+++ b/lib/mattermost/mattermost.rb
@@ -0,0 +1,102 @@
+module Mattermost
+  class NoSessionError < StandardError; end
+  # This class' prime objective is to obtain a session token on a Mattermost
+  # instance with SSO configured where this GitLab instance is the provider.
+  #
+  # The process depends on OAuth, but skips a step in the authentication cycle.
+  # For example, usually a user would click the 'login in GitLab' button on
+  # Mattermost, which would yield a 302 status code and redirects you to GitLab
+  # to approve the use of your account on Mattermost. Which would trigger a
+  # callback so Mattermost knows this request is approved and gets the required
+  # data to create the user account etc.
+  #
+  # This class however skips the button click, and also the approval phase to
+  # speed up the process and keep it without manual action and get a session
+  # going.
+  class Mattermost
+    include Doorkeeper::Helpers::Controller
+    include HTTParty
+
+    attr_accessor :current_resource_owner
+
+    def initialize(uri, current_user)
+      self.class.base_uri(uri)
+
+      @current_resource_owner = current_user
+    end
+
+    def with_session
+      raise NoSessionError unless create
+      yield
+      destroy
+    end
+
+    # Next methods are needed for Doorkeeper
+    def pre_auth
+      @pre_auth ||= Doorkeeper::OAuth::PreAuthorization.new(
+        Doorkeeper.configuration, server.client_via_uid, params)
+    end
+
+    def authorization
+      @authorization ||= strategy.request
+    end
+
+    def strategy
+      @strategy ||= server.authorization_request(pre_auth.response_type)
+    end
+
+    def request
+      @request ||= OpenStruct.new(parameters: params)
+    end
+
+    def params
+      Rack::Utils.parse_query(@oauth_uri.query).symbolize_keys
+    end
+
+    private
+
+    def create
+      return unless oauth_uri
+      return unless token_uri
+
+      self.class.headers("Cookie" => "MMAUTHTOKEN=#{request_token}")
+
+      request_token
+    end
+
+    def destroy
+      post('/api/v3/users/logout')
+    end
+
+    def oauth_uri
+      response = get("/api/v3/oauth/gitlab/login", follow_redirects: false)
+      return unless 300 <= response.code && response.code < 400
+
+      redirect_uri = response.headers['location']
+      return unless redirect_uri
+
+      @oauth_uri ||= URI.parse(redirect_uri)
+    end
+
+    def token_uri
+      @token_uri ||= if @oauth_uri
+                       authorization.authorize.redirect_uri if pre_auth.authorizable?
+                     end
+    end
+
+    def request_token
+      @request_token ||= if @token_uri
+                           response = get(@token_uri, follow_redirects: false)
+                           response.headers['token'] if 200 <= response.code && response.code < 400
+                         end
+    end
+
+    def get(path, options = {})
+      self.class.get(path, options)
+    end
+
+    def post(path, options = {})
+      self.class.post(path, options)
+    end
+  end
+end
diff --git a/spec/lib/mattermost/mattermost_spec.rb b/spec/lib/mattermost/mattermost_spec.rb
new file mode 100644
index 00000000000..7c99b4df9f3
--- /dev/null
+++ b/spec/lib/mattermost/mattermost_spec.rb
@@ -0,0 +1,42 @@
+require 'spec_helper'
+
+describe Mattermost::Mattermost do
+  let(:user) { create(:user) }
+
+  subject { described_class.new('http://localhost:8065', user) }
+
+  # Needed for doorman to function
+  it { is_expected.to respond_to(:current_resource_owner) }
+  it { is_expected.to respond_to(:request) }
+  it { is_expected.to respond_to(:authorization) }
+  it { is_expected.to respond_to(:strategy) }
+
+  describe '#with session' do
+    let!(:stub) do
+      WebMock.stub_request(:get, 'http://localhost:8065/api/v3/oauth/gitlab/login').
+        to_return(headers: { 'location' => 'http://mylocation.com' }, status: 307)
+    end
+
+    context 'without oauth uri' do
+      it 'makes a request to the oauth uri' do
+        expect { subject.with_session }.to raise_error(Mattermost::NoSessionError)
+      end
+
+      context 'with oauth_uri' do
+        let!(:doorkeeper) do
+          Doorkeeper::Application.create(name: "GitLab Mattermost",
+                                         redirect_uri: "http://localhost:8065/signup/gitlab/complete\nhttp://localhost:8065/login/gitlab/complete",
+                                         scopes: "")
+        end
+
+        context 'without token_uri' do
+          it 'can not create a session' do
+            expect do
+              subject.with_session
+            end.to raise_error(Mattermost::NoSessionError)
+          end
+        end
+      end
+    end
+  end
+end
-- 
cgit v1.2.1


From a31cdb29e49b62f0227963cbc54b6564a3ee9da8 Mon Sep 17 00:00:00 2001
From: "Z.J. van de Weg" <git@zjvandeweg.nl>
Date: Thu, 15 Dec 2016 14:32:50 +0100
Subject: Improve session tests

---
 lib/mattermost/mattermost.rb           | 102 --------------------------------
 lib/mattermost/session.rb              | 105 +++++++++++++++++++++++++++++++++
 spec/lib/mattermost/mattermost_spec.rb |  42 -------------
 spec/lib/mattermost/session_spec.rb    |  68 +++++++++++++++++++++
 4 files changed, 173 insertions(+), 144 deletions(-)
 delete mode 100644 lib/mattermost/mattermost.rb
 create mode 100644 lib/mattermost/session.rb
 delete mode 100644 spec/lib/mattermost/mattermost_spec.rb
 create mode 100644 spec/lib/mattermost/session_spec.rb

diff --git a/lib/mattermost/mattermost.rb b/lib/mattermost/mattermost.rb
deleted file mode 100644
index 84d016bb197..00000000000
--- a/lib/mattermost/mattermost.rb
+++ /dev/null
@@ -1,102 +0,0 @@
-module Mattermost
-  class NoSessionError < StandardError; end
-  # This class' prime objective is to obtain a session token on a Mattermost
-  # instance with SSO configured where this GitLab instance is the provider.
-  #
-  # The process depends on OAuth, but skips a step in the authentication cycle.
-  # For example, usually a user would click the 'login in GitLab' button on
-  # Mattermost, which would yield a 302 status code and redirects you to GitLab
-  # to approve the use of your account on Mattermost. Which would trigger a
-  # callback so Mattermost knows this request is approved and gets the required
-  # data to create the user account etc.
-  #
-  # This class however skips the button click, and also the approval phase to
-  # speed up the process and keep it without manual action and get a session
-  # going.
-  class Mattermost
-    include Doorkeeper::Helpers::Controller
-    include HTTParty
-
-    attr_accessor :current_resource_owner
-
-    def initialize(uri, current_user)
-      self.class.base_uri(uri)
-
-      @current_resource_owner = current_user
-    end
-
-    def with_session
-      raise NoSessionError unless create
-      yield
-      destroy
-    end
-
-    # Next methods are needed for Doorkeeper
-    def pre_auth
-      @pre_auth ||= Doorkeeper::OAuth::PreAuthorization.new(
-        Doorkeeper.configuration, server.client_via_uid, params)
-    end
-
-    def authorization
-      @authorization ||= strategy.request
-    end
-
-    def strategy
-      @strategy ||= server.authorization_request(pre_auth.response_type)
-    end
-
-    def request
-      @request ||= OpenStruct.new(parameters: params)
-    end
-
-    def params
-      Rack::Utils.parse_query(@oauth_uri.query).symbolize_keys
-    end
-
-    private
-
-    def create
-      return unless oauth_uri
-      return unless token_uri
-
-      self.class.headers("Cookie" => "MMAUTHTOKEN=#{request_token}")
-
-      request_token
-    end
-
-    def destroy
-      post('/api/v3/users/logout')
-    end
-
-    def oauth_uri
-      response = get("/api/v3/oauth/gitlab/login", follow_redirects: false)
-      return unless 300 <= response.code && response.code < 400
-
-      redirect_uri = response.headers['location']
-      return unless redirect_uri
-
-      @oauth_uri ||= URI.parse(redirect_uri)
-    end
-
-    def token_uri
-      @token_uri ||= if @oauth_uri
-                       authorization.authorize.redirect_uri if pre_auth.authorizable?
-                     end
-    end
-
-    def request_token
-      @request_token ||= if @token_uri
-                           response = get(@token_uri, follow_redirects: false)
-                           response.headers['token'] if 200 <= response.code && response.code < 400
-                         end
-    end
-
-    def get(path, options = {})
-      self.class.get(path, options)
-    end
-
-    def post(path, options = {})
-      self.class.post(path, options)
-    end
-  end
-end
diff --git a/lib/mattermost/session.rb b/lib/mattermost/session.rb
new file mode 100644
index 00000000000..d14121c91a0
--- /dev/null
+++ b/lib/mattermost/session.rb
@@ -0,0 +1,105 @@
+module Mattermost
+  class NoSessionError < StandardError; end
+  # This class' prime objective is to obtain a session token on a Mattermost
+  # instance with SSO configured where this GitLab instance is the provider.
+  #
+  # The process depends on OAuth, but skips a step in the authentication cycle.
+  # For example, usually a user would click the 'login in GitLab' button on
+  # Mattermost, which would yield a 302 status code and redirects you to GitLab
+  # to approve the use of your account on Mattermost. Which would trigger a
+  # callback so Mattermost knows this request is approved and gets the required
+  # data to create the user account etc.
+  #
+  # This class however skips the button click, and also the approval phase to
+  # speed up the process and keep it without manual action and get a session
+  # going.
+  class Session
+    include Doorkeeper::Helpers::Controller
+    include HTTParty
+
+    attr_accessor :current_resource_owner
+
+    def initialize(uri, current_user)
+      # Sets the base uri for HTTParty, so we can use paths
+      self.class.base_uri(uri)
+
+      @current_resource_owner = current_user
+    end
+
+    def with_session
+      raise NoSessionError unless create
+      result = yield
+      destroy
+
+      result
+    end
+
+    # Next methods are needed for Doorkeeper
+    def pre_auth
+      @pre_auth ||= Doorkeeper::OAuth::PreAuthorization.new(
+        Doorkeeper.configuration, server.client_via_uid, params)
+    end
+
+    def authorization
+      @authorization ||= strategy.request
+    end
+
+    def strategy
+      @strategy ||= server.authorization_request(pre_auth.response_type)
+    end
+
+    def request
+      @request ||= OpenStruct.new(parameters: params)
+    end
+
+    def params
+      Rack::Utils.parse_query(@oauth_uri.query).symbolize_keys
+    end
+
+    private
+
+    def create
+      return unless oauth_uri
+      return unless token_uri
+
+      self.class.headers("Cookie" => "MMAUTHTOKEN=#{request_token}")
+
+      request_token
+    end
+
+    def destroy
+      post('/api/v3/users/logout')
+    end
+
+    def oauth_uri
+      response = get("/api/v3/oauth/gitlab/login", follow_redirects: false)
+      return unless 300 <= response.code && response.code < 400
+
+      redirect_uri = response.headers['location']
+      return unless redirect_uri
+
+      @oauth_uri ||= URI.parse(redirect_uri)
+    end
+
+    def token_uri
+      @token_uri ||= if @oauth_uri
+                       authorization.authorize.redirect_uri if pre_auth.authorizable?
+                     end
+    end
+
+    def request_token
+      @request_token ||= begin
+                           response = get(@token_uri, follow_redirects: false)
+                           response.headers['token'] if 200 <= response.code && response.code < 400
+                         end
+    end
+
+    def get(path, options = {})
+      self.class.get(path, options)
+    end
+
+    def post(path, options = {})
+      self.class.post(path, options)
+    end
+  end
+end
diff --git a/spec/lib/mattermost/mattermost_spec.rb b/spec/lib/mattermost/mattermost_spec.rb
deleted file mode 100644
index 7c99b4df9f3..00000000000
--- a/spec/lib/mattermost/mattermost_spec.rb
+++ /dev/null
@@ -1,42 +0,0 @@
-require 'spec_helper'
-
-describe Mattermost::Mattermost do
-  let(:user) { create(:user) }
-
-  subject { described_class.new('http://localhost:8065', user) }
-
-  # Needed for doorman to function
-  it { is_expected.to respond_to(:current_resource_owner) }
-  it { is_expected.to respond_to(:request) }
-  it { is_expected.to respond_to(:authorization) }
-  it { is_expected.to respond_to(:strategy) }
-
-  describe '#with session' do
-    let!(:stub) do
-      WebMock.stub_request(:get, 'http://localhost:8065/api/v3/oauth/gitlab/login').
-        to_return(headers: { 'location' => 'http://mylocation.com' }, status: 307)
-    end
-
-    context 'without oauth uri' do
-      it 'makes a request to the oauth uri' do
-        expect { subject.with_session }.to raise_error(Mattermost::NoSessionError)
-      end
-
-      context 'with oauth_uri' do
-        let!(:doorkeeper) do
-          Doorkeeper::Application.create(name: "GitLab Mattermost",
-                                         redirect_uri: "http://localhost:8065/signup/gitlab/complete\nhttp://localhost:8065/login/gitlab/complete",
-                                         scopes: "")
-        end
-
-        context 'without token_uri' do
-          it 'can not create a session' do
-            expect do
-              subject.with_session
-            end.to raise_error(Mattermost::NoSessionError)
-          end
-        end
-      end
-    end
-  end
-end
diff --git a/spec/lib/mattermost/session_spec.rb b/spec/lib/mattermost/session_spec.rb
new file mode 100644
index 00000000000..a93bab877da
--- /dev/null
+++ b/spec/lib/mattermost/session_spec.rb
@@ -0,0 +1,68 @@
+require 'spec_helper'
+
+describe Mattermost::Session do
+  let(:user) { create(:user) }
+
+  subject { described_class.new('http://localhost:8065', user) }
+
+  # Needed for doorkeeper to function
+  it { is_expected.to respond_to(:current_resource_owner) }
+  it { is_expected.to respond_to(:request) }
+  it { is_expected.to respond_to(:authorization) }
+  it { is_expected.to respond_to(:strategy) }
+
+  describe '#with session' do
+    let(:location) { 'http://location.tld' }
+    let!(:stub) do
+      WebMock.stub_request(:get, 'http://localhost:8065/api/v3/oauth/gitlab/login').
+        to_return(headers: { 'location' => location }, status: 307)
+    end
+
+    context 'without oauth uri' do
+      it 'makes a request to the oauth uri' do
+        expect { subject.with_session }.to raise_error(Mattermost::NoSessionError)
+      end
+    end
+
+    context 'with oauth_uri' do
+      let!(:doorkeeper) do
+        Doorkeeper::Application.create(name: "GitLab Mattermost",
+                                       redirect_uri: "http://localhost:8065/signup/gitlab/complete\nhttp://localhost:8065/login/gitlab/complete",
+                                       scopes: "")
+      end
+
+      context 'without token_uri' do
+        it 'can not create a session' do
+          expect do
+            subject.with_session
+          end.to raise_error(Mattermost::NoSessionError)
+        end
+      end
+
+      context 'with token_uri' do
+        let(:state) { "eyJhY3Rpb24iOiJsb2dpbiIsImhhc2giOiIkMmEkMTAkVC9wYVlEaTdIUS8vcWdKRmdOOUllZUptaUNJWUlvNVNtNEcwU2NBMXFqelNOVmVPZ1cxWUsifQ%3D%3D" }
+        let(:location) { "http://locahost:8065/oauth/authorize?response_type=code&client_id=#{doorkeeper.uid}&redirect_uri=http%3A%2F%2Flocalhost:8065%2Fsignup%2Fgitlab%2Fcomplete&state=#{state}" }
+
+        before do
+          WebMock.stub_request(:get, /http:\/\/localhost:8065\/signup\/gitlab\/complete*/).
+            to_return(headers: { 'token' => 'thisworksnow' }, status: 202)
+        end
+
+        it 'can setup a session' do
+          expect(subject).to receive(:destroy)
+
+          subject.with_session { 1 + 1 }
+        end
+
+        it 'returns the value of the block' do
+          WebMock.stub_request(:post, "http://localhost:8065/api/v3/users/logout").
+            to_return(headers: { 'token' => 'thisworksnow' }, status: 200)
+
+          value = subject.with_session { 1 + 1 }
+
+          expect(value).to be(2)
+        end
+      end
+    end
+  end
+end
-- 
cgit v1.2.1


From 9bcc4d4de5510a14ae891105645b4d59891ba78d Mon Sep 17 00:00:00 2001
From: "Z.J. van de Weg" <git@zjvandeweg.nl>
Date: Thu, 15 Dec 2016 21:06:17 +0100
Subject: Ensure the session is destroyed

---
 lib/mattermost/session.rb | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/lib/mattermost/session.rb b/lib/mattermost/session.rb
index d14121c91a0..f4629585da7 100644
--- a/lib/mattermost/session.rb
+++ b/lib/mattermost/session.rb
@@ -28,10 +28,12 @@ module Mattermost
 
     def with_session
       raise NoSessionError unless create
-      result = yield
-      destroy
 
-      result
+      begin
+        yield
+      ensure
+        destroy
+      end
     end
 
     # Next methods are needed for Doorkeeper
-- 
cgit v1.2.1


From 48ebfaa49146b8f6fcb24b063f22d553b2f20395 Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Fri, 16 Dec 2016 11:31:26 +0100
Subject: Improve Mattermost Session specs

---
 lib/mattermost/session.rb           | 23 ++++++++--------
 spec/lib/mattermost/session_spec.rb | 53 ++++++++++++++++++++++++++-----------
 2 files changed, 50 insertions(+), 26 deletions(-)

diff --git a/lib/mattermost/session.rb b/lib/mattermost/session.rb
index f4629585da7..7d0290be5a1 100644
--- a/lib/mattermost/session.rb
+++ b/lib/mattermost/session.rb
@@ -17,7 +17,7 @@ module Mattermost
     include Doorkeeper::Helpers::Controller
     include HTTParty
 
-    attr_accessor :current_resource_owner
+    attr_accessor :current_resource_owner, :token
 
     def initialize(uri, current_user)
       # Sets the base uri for HTTParty, so we can use paths
@@ -64,9 +64,9 @@ module Mattermost
       return unless oauth_uri
       return unless token_uri
 
-      self.class.headers("Cookie" => "MMAUTHTOKEN=#{request_token}")
-
-      request_token
+      self.token = request_token
+      self.class.headers("Cookie" => "MMAUTHTOKEN=#{self.token}")
+      self.token
     end
 
     def destroy
@@ -84,16 +84,17 @@ module Mattermost
     end
 
     def token_uri
-      @token_uri ||= if @oauth_uri
-                       authorization.authorize.redirect_uri if pre_auth.authorizable?
-                     end
+      @token_uri ||=
+        if @oauth_uri
+          authorization.authorize.redirect_uri if pre_auth.authorizable?
+        end
     end
 
     def request_token
-      @request_token ||= begin
-                           response = get(@token_uri, follow_redirects: false)
-                           response.headers['token'] if 200 <= response.code && response.code < 400
-                         end
+      response = get(@token_uri, follow_redirects: false)
+      if 200 <= response.code && response.code < 400
+        response.headers['token']
+      end
     end
 
     def get(path, options = {})
diff --git a/spec/lib/mattermost/session_spec.rb b/spec/lib/mattermost/session_spec.rb
index a93bab877da..69d677930bc 100644
--- a/spec/lib/mattermost/session_spec.rb
+++ b/spec/lib/mattermost/session_spec.rb
@@ -1,9 +1,12 @@
 require 'spec_helper'
 
-describe Mattermost::Session do
+describe Mattermost::Session, type: :request do
   let(:user) { create(:user) }
 
-  subject { described_class.new('http://localhost:8065', user) }
+  let(:gitlab_url) { "http://gitlab.com" }
+  let(:mattermost_url) { "http://mattermost.com" }
+
+  subject { described_class.new(mattermost_url, user) }
 
   # Needed for doorkeeper to function
   it { is_expected.to respond_to(:current_resource_owner) }
@@ -14,7 +17,7 @@ describe Mattermost::Session do
   describe '#with session' do
     let(:location) { 'http://location.tld' }
     let!(:stub) do
-      WebMock.stub_request(:get, 'http://localhost:8065/api/v3/oauth/gitlab/login').
+      WebMock.stub_request(:get, "#{mattermost_url}/api/v3/oauth/gitlab/login").
         to_return(headers: { 'location' => location }, status: 307)
     end
 
@@ -26,9 +29,10 @@ describe Mattermost::Session do
 
     context 'with oauth_uri' do
       let!(:doorkeeper) do
-        Doorkeeper::Application.create(name: "GitLab Mattermost",
-                                       redirect_uri: "http://localhost:8065/signup/gitlab/complete\nhttp://localhost:8065/login/gitlab/complete",
-                                       scopes: "")
+        Doorkeeper::Application.create(
+          name: "GitLab Mattermost",
+          redirect_uri: "#{mattermost_url}/signup/gitlab/complete\n#{mattermost_url}/login/gitlab/complete",
+          scopes: "")
       end
 
       context 'without token_uri' do
@@ -40,24 +44,43 @@ describe Mattermost::Session do
       end
 
       context 'with token_uri' do
-        let(:state) { "eyJhY3Rpb24iOiJsb2dpbiIsImhhc2giOiIkMmEkMTAkVC9wYVlEaTdIUS8vcWdKRmdOOUllZUptaUNJWUlvNVNtNEcwU2NBMXFqelNOVmVPZ1cxWUsifQ%3D%3D" }
-        let(:location) { "http://locahost:8065/oauth/authorize?response_type=code&client_id=#{doorkeeper.uid}&redirect_uri=http%3A%2F%2Flocalhost:8065%2Fsignup%2Fgitlab%2Fcomplete&state=#{state}" }
+        let(:state) { "state" }
+        let(:params) do
+          { response_type: "code",
+            client_id: doorkeeper.uid,
+            redirect_uri: "#{mattermost_url}/signup/gitlab/complete",
+            state: state }
+        end
+        let(:location) do
+          "#{gitlab_url}/oauth/authorize?#{URI.encode_www_form(params)}"
+        end
 
         before do
-          WebMock.stub_request(:get, /http:\/\/localhost:8065\/signup\/gitlab\/complete*/).
-            to_return(headers: { 'token' => 'thisworksnow' }, status: 202)
+          WebMock.stub_request(:get, "#{mattermost_url}/signup/gitlab/complete").
+            with(query: hash_including({ 'state' => state })).
+            to_return do |request|
+              post "/oauth/token",
+                client_id: doorkeeper.uid,
+                client_secret: doorkeeper.secret,
+                redirect_uri: params[:redirect_uri],
+                grant_type: 'authorization_code',
+                code: request.uri.query_values['code']
+
+              if response.status == 200
+                { headers: { 'token' => 'thisworksnow' }, status: 202 }
+              end
+            end
+
+          WebMock.stub_request(:post, "#{mattermost_url}/api/v3/users/logout").
+            to_return(headers: { Cookie: 'MMAUTHTOKEN=thisworksnow' }, status: 200)
         end
 
         it 'can setup a session' do
-          expect(subject).to receive(:destroy)
-
           subject.with_session { 1 + 1 }
+          expect(subject.token).not_to be_nil
         end
 
         it 'returns the value of the block' do
-          WebMock.stub_request(:post, "http://localhost:8065/api/v3/users/logout").
-            to_return(headers: { 'token' => 'thisworksnow' }, status: 200)
-
           value = subject.with_session { 1 + 1 }
 
           expect(value).to be(2)
-- 
cgit v1.2.1


From e663725961de66ac838d0a5a85978656938e74f4 Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Fri, 16 Dec 2016 12:20:42 +0100
Subject: Store mattermost_url in settings

---
 config/gitlab.yml.example           |  6 ++++++
 config/initializers/1_settings.rb   |  7 +++++++
 lib/mattermost/session.rb           | 17 +++++++++--------
 spec/lib/mattermost/session_spec.rb | 18 +++++++++++++-----
 4 files changed, 35 insertions(+), 13 deletions(-)

diff --git a/config/gitlab.yml.example b/config/gitlab.yml.example
index 327e4a7937c..b8b41a0d86c 100644
--- a/config/gitlab.yml.example
+++ b/config/gitlab.yml.example
@@ -153,6 +153,12 @@ production: &base
     # The location where LFS objects are stored (default: shared/lfs-objects).
     # storage_path: shared/lfs-objects
 
+  ## Mattermost
+  ## For enabling Add to Mattermost button
+  mattermost:
+    enabled: false
+    host: 'https://mattermost.example.com'
+
   ## Gravatar
   ## For Libravatar see: http://doc.gitlab.com/ce/customization/libravatar.html
   gravatar:
diff --git a/config/initializers/1_settings.rb b/config/initializers/1_settings.rb
index 0ee1b1ec634..45404e579ae 100644
--- a/config/initializers/1_settings.rb
+++ b/config/initializers/1_settings.rb
@@ -261,6 +261,13 @@ Settings['lfs'] ||= Settingslogic.new({})
 Settings.lfs['enabled']      = true if Settings.lfs['enabled'].nil?
 Settings.lfs['storage_path'] = File.expand_path(Settings.lfs['storage_path'] || File.join(Settings.shared['path'], "lfs-objects"), Rails.root)
 
+#
+# Mattermost
+#
+Settings['mattermost'] ||= Settingslogic.new({})
+Settings.mattermost['enabled']      = false if Settings.mattermost['enabled'].nil?
+Settings.mattermost['host']         = nil unless Settings.mattermost.enabled
+
 #
 # Gravatar
 #
diff --git a/lib/mattermost/session.rb b/lib/mattermost/session.rb
index 7d0290be5a1..a3715bed482 100644
--- a/lib/mattermost/session.rb
+++ b/lib/mattermost/session.rb
@@ -17,12 +17,11 @@ module Mattermost
     include Doorkeeper::Helpers::Controller
     include HTTParty
 
-    attr_accessor :current_resource_owner, :token
+    base_uri Settings.mattermost.host
 
-    def initialize(uri, current_user)
-      # Sets the base uri for HTTParty, so we can use paths
-      self.class.base_uri(uri)
+    attr_accessor :current_resource_owner, :token
 
+    def initialize(current_user)
       @current_resource_owner = current_user
     end
 
@@ -30,7 +29,7 @@ module Mattermost
       raise NoSessionError unless create
 
       begin
-        yield
+        yield self
       ensure
         destroy
       end
@@ -65,7 +64,9 @@ module Mattermost
       return unless token_uri
 
       self.token = request_token
-      self.class.headers("Cookie" => "MMAUTHTOKEN=#{self.token}")
+      @headers = {
+        "Authorization": "Bearer #{self.token}"
+      }
       self.token
     end
 
@@ -98,11 +99,11 @@ module Mattermost
     end
 
     def get(path, options = {})
-      self.class.get(path, options)
+      self.class.get(path, options.merge(headers: @headers))
     end
 
     def post(path, options = {})
-      self.class.post(path, options)
+      self.class.post(path, options.merge(headers: @headers))
     end
   end
 end
diff --git a/spec/lib/mattermost/session_spec.rb b/spec/lib/mattermost/session_spec.rb
index 69d677930bc..3c2eddbd221 100644
--- a/spec/lib/mattermost/session_spec.rb
+++ b/spec/lib/mattermost/session_spec.rb
@@ -6,7 +6,7 @@ describe Mattermost::Session, type: :request do
   let(:gitlab_url) { "http://gitlab.com" }
   let(:mattermost_url) { "http://mattermost.com" }
 
-  subject { described_class.new(mattermost_url, user) }
+  subject { described_class.new(user) }
 
   # Needed for doorkeeper to function
   it { is_expected.to respond_to(:current_resource_owner) }
@@ -14,6 +14,10 @@ describe Mattermost::Session, type: :request do
   it { is_expected.to respond_to(:authorization) }
   it { is_expected.to respond_to(:strategy) }
 
+  before do
+    described_class.base_uri(mattermost_url)
+  end
+
   describe '#with session' do
     let(:location) { 'http://location.tld' }
     let!(:stub) do
@@ -72,18 +76,22 @@ describe Mattermost::Session, type: :request do
             end
 
           WebMock.stub_request(:post, "#{mattermost_url}/api/v3/users/logout").
-            to_return(headers: { Cookie: 'MMAUTHTOKEN=thisworksnow' }, status: 200)
+            to_return(headers: { Authorization: 'token thisworksnow' }, status: 200)
         end
 
         it 'can setup a session' do
-          subject.with_session { 1 + 1 }
+          subject.with_session do |session|
+          end
+
           expect(subject.token).not_to be_nil
         end
 
         it 'returns the value of the block' do
-          value = subject.with_session { 1 + 1 }
+          result = subject.with_session do |session|
+            "value"
+          end
 
-          expect(value).to be(2)
+          expect(result).to eq("value")
         end
       end
     end
-- 
cgit v1.2.1


From c9610e0a052526adb3138dccf6114d710979a0b7 Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Fri, 16 Dec 2016 13:43:01 +0100
Subject: Fix rubocop failures

---
 config/initializers/1_settings.rb |  4 ++--
 lib/mattermost/session.rb         | 36 +++++++++++++++++++++---------------
 2 files changed, 23 insertions(+), 17 deletions(-)

diff --git a/config/initializers/1_settings.rb b/config/initializers/1_settings.rb
index 45404e579ae..ddea325c6ca 100644
--- a/config/initializers/1_settings.rb
+++ b/config/initializers/1_settings.rb
@@ -265,8 +265,8 @@ Settings.lfs['storage_path'] = File.expand_path(Settings.lfs['storage_path'] ||
 # Mattermost
 #
 Settings['mattermost'] ||= Settingslogic.new({})
-Settings.mattermost['enabled']      = false if Settings.mattermost['enabled'].nil?
-Settings.mattermost['host']         = nil unless Settings.mattermost.enabled
+Settings.mattermost['enabled'] = false if Settings.mattermost['enabled'].nil?
+Settings.mattermost['host'] = nil unless Settings.mattermost.enabled
 
 #
 # Gravatar
diff --git a/lib/mattermost/session.rb b/lib/mattermost/session.rb
index a3715bed482..fb8d7d97f8a 100644
--- a/lib/mattermost/session.rb
+++ b/lib/mattermost/session.rb
@@ -54,7 +54,15 @@ module Mattermost
     end
 
     def params
-      Rack::Utils.parse_query(@oauth_uri.query).symbolize_keys
+      Rack::Utils.parse_query(oauth_uri.query).symbolize_keys
+    end
+
+    def get(path, options = {})
+      self.class.get(path, options.merge(headers: @headers))
+    end
+
+    def post(path, options = {})
+      self.class.post(path, options.merge(headers: @headers))
     end
 
     private
@@ -63,11 +71,12 @@ module Mattermost
       return unless oauth_uri
       return unless token_uri
 
-      self.token = request_token
+      @token = request_token
       @headers = {
-        "Authorization": "Bearer #{self.token}"
+        Authorization: "Bearer #{@token}"
       }
-      self.token
+
+      @token
     end
 
     def destroy
@@ -75,35 +84,32 @@ module Mattermost
     end
 
     def oauth_uri
+      return @oauth_uri if defined?(@oauth_uri)
+
+      @oauth_uri = nil
+
       response = get("/api/v3/oauth/gitlab/login", follow_redirects: false)
       return unless 300 <= response.code && response.code < 400
 
       redirect_uri = response.headers['location']
       return unless redirect_uri
 
-      @oauth_uri ||= URI.parse(redirect_uri)
+      @oauth_uri = URI.parse(redirect_uri)
     end
 
     def token_uri
       @token_uri ||=
-        if @oauth_uri
+        if oauth_uri
           authorization.authorize.redirect_uri if pre_auth.authorizable?
         end
     end
 
     def request_token
-      response = get(@token_uri, follow_redirects: false)
+      response = get(token_uri, follow_redirects: false)
+
       if 200 <= response.code && response.code < 400
         response.headers['token']
       end
     end
-
-    def get(path, options = {})
-      self.class.get(path, options.merge(headers: @headers))
-    end
-
-    def post(path, options = {})
-      self.class.post(path, options.merge(headers: @headers))
-    end
   end
 end
-- 
cgit v1.2.1