require 'spec_helper' describe 'Git LFS API and storage' do include WorkhorseHelpers include ProjectForksHelper let(:user) { create(:user) } let!(:lfs_object) { create(:lfs_object, :with_file) } let(:headers) do { 'Authorization' => authorization, 'X-Sendfile-Type' => sendfile }.compact end let(:authorization) { } let(:sendfile) { } let(:pipeline) { create(:ci_empty_pipeline, project: project) } let(:sample_oid) { lfs_object.oid } let(:sample_size) { lfs_object.size } describe 'when lfs is disabled' do let(:project) { create(:project) } let(:body) do { 'objects' => [ { 'oid' => '91eff75a492a3ed0dfcb544d7f31326bc4014c8551849c192fd1e48d4dd2c897', 'size' => 1575078 }, { 'oid' => sample_oid, 'size' => sample_size } ], 'operation' => 'upload' } end let(:authorization) { authorize_user } before do allow(Gitlab.config.lfs).to receive(:enabled).and_return(false) post_lfs_json "#{project.http_url_to_repo}/info/lfs/objects/batch", body, headers end it 'responds with 501' do expect(response).to have_gitlab_http_status(501) expect(json_response).to include('message' => 'Git LFS is not enabled on this GitLab server, contact your admin.') end end context 'project specific LFS settings' do let(:project) { create(:project) } let(:body) do { 'objects' => [ { 'oid' => '91eff75a492a3ed0dfcb544d7f31326bc4014c8551849c192fd1e48d4dd2c897', 'size' => 1575078 }, { 'oid' => sample_oid, 'size' => sample_size } ], 'operation' => 'upload' } end let(:authorization) { authorize_user } context 'with LFS disabled globally' do before do project.team << [user, :master] allow(Gitlab.config.lfs).to receive(:enabled).and_return(false) end describe 'LFS disabled in project' do before do project.update_attribute(:lfs_enabled, false) end it 'responds with a 501 message on upload' do post_lfs_json "#{project.http_url_to_repo}/info/lfs/objects/batch", body, headers expect(response).to have_gitlab_http_status(501) end it 'responds with a 501 message on download' do get "#{project.http_url_to_repo}/gitlab-lfs/objects/#{sample_oid}", nil, headers expect(response).to have_gitlab_http_status(501) end end describe 'LFS enabled in project' do before do project.update_attribute(:lfs_enabled, true) end it 'responds with a 501 message on upload' do post_lfs_json "#{project.http_url_to_repo}/info/lfs/objects/batch", body, headers expect(response).to have_gitlab_http_status(501) end it 'responds with a 501 message on download' do get "#{project.http_url_to_repo}/gitlab-lfs/objects/#{sample_oid}", nil, headers expect(response).to have_gitlab_http_status(501) end end end context 'with LFS enabled globally' do before do project.team << [user, :master] enable_lfs end describe 'LFS disabled in project' do before do project.update_attribute(:lfs_enabled, false) end it 'responds with a 403 message on upload' do post_lfs_json "#{project.http_url_to_repo}/info/lfs/objects/batch", body, headers expect(response).to have_gitlab_http_status(403) expect(json_response).to include('message' => 'Access forbidden. Check your access level.') end it 'responds with a 403 message on download' do get "#{project.http_url_to_repo}/gitlab-lfs/objects/#{sample_oid}", nil, headers expect(response).to have_gitlab_http_status(403) expect(json_response).to include('message' => 'Access forbidden. Check your access level.') end end describe 'LFS enabled in project' do before do project.update_attribute(:lfs_enabled, true) end it 'responds with a 200 message on upload' do post_lfs_json "#{project.http_url_to_repo}/info/lfs/objects/batch", body, headers expect(response).to have_gitlab_http_status(200) expect(json_response['objects'].first['size']).to eq(1575078) end it 'responds with a 200 message on download' do get "#{project.http_url_to_repo}/gitlab-lfs/objects/#{sample_oid}", nil, headers expect(response).to have_gitlab_http_status(200) end end end end describe 'deprecated API' do let(:project) { create(:project) } before do enable_lfs end shared_examples 'a deprecated' do it 'responds with 501' do expect(response).to have_gitlab_http_status(501) end it 'returns deprecated message' do expect(json_response).to include('message' => 'Server supports batch API only, please update your Git LFS client to version 1.0.1 and up.') end end context 'when fetching lfs object using deprecated API' do let(:authorization) { authorize_user } before do get "#{project.http_url_to_repo}/info/lfs/objects/#{sample_oid}", nil, headers end it_behaves_like 'a deprecated' end context 'when handling lfs request using deprecated API' do let(:authorization) { authorize_user } before do post_lfs_json "#{project.http_url_to_repo}/info/lfs/objects", nil, headers end it_behaves_like 'a deprecated' end end describe 'when fetching lfs object' do let(:project) { create(:project) } let(:update_permissions) { } before do enable_lfs update_permissions get "#{project.http_url_to_repo}/gitlab-lfs/objects/#{sample_oid}", nil, headers end context 'and request comes from gitlab-workhorse' do context 'without user being authorized' do it 'responds with status 401' do expect(response).to have_gitlab_http_status(401) end end context 'with required headers' do shared_examples 'responds with a file' do let(:sendfile) { 'X-Sendfile' } it 'responds with status 200' do expect(response).to have_gitlab_http_status(200) end it 'responds with the file location' do expect(response.headers['Content-Type']).to eq('application/octet-stream') expect(response.headers['X-Sendfile']).to eq(lfs_object.file.path) end end context 'with user is authorized' do let(:authorization) { authorize_user } context 'and does not have project access' do let(:update_permissions) do project.lfs_objects << lfs_object end it 'responds with status 404' do expect(response).to have_gitlab_http_status(404) end end context 'and does have project access' do let(:update_permissions) do project.team << [user, :master] project.lfs_objects << lfs_object end it_behaves_like 'responds with a file' end end context 'when deploy key is authorized' do let(:key) { create(:deploy_key) } let(:authorization) { authorize_deploy_key } let(:update_permissions) do project.deploy_keys << key project.lfs_objects << lfs_object end it_behaves_like 'responds with a file' end describe 'when using a user key' do let(:authorization) { authorize_user_key } context 'when user allowed' do let(:update_permissions) do project.team << [user, :master] project.lfs_objects << lfs_object end it_behaves_like 'responds with a file' end context 'when user not allowed' do let(:update_permissions) do project.lfs_objects << lfs_object end it 'responds with status 404' do expect(response).to have_gitlab_http_status(404) end end end context 'when build is authorized as' do let(:authorization) { authorize_ci_project } shared_examples 'can download LFS only from own projects' do context 'for owned project' do let(:project) { create(:project, namespace: user.namespace) } let(:update_permissions) do project.lfs_objects << lfs_object end it_behaves_like 'responds with a file' end context 'for member of project' do let(:pipeline) { create(:ci_empty_pipeline, project: project) } let(:update_permissions) do project.team << [user, :reporter] project.lfs_objects << lfs_object end it_behaves_like 'responds with a file' end context 'for other project' do let(:other_project) { create(:project) } let(:pipeline) { create(:ci_empty_pipeline, project: other_project) } let(:update_permissions) do project.lfs_objects << lfs_object end it 'rejects downloading code' do expect(response).to have_gitlab_http_status(other_project_status) end end end context 'administrator' do let(:user) { create(:admin) } let(:build) { create(:ci_build, :running, pipeline: pipeline, user: user) } it_behaves_like 'can download LFS only from own projects' do # We render 403, because administrator does have normally access let(:other_project_status) { 403 } end end context 'regular user' do let(:user) { create(:user) } let(:build) { create(:ci_build, :running, pipeline: pipeline, user: user) } it_behaves_like 'can download LFS only from own projects' do # We render 404, to prevent data leakage about existence of the project let(:other_project_status) { 404 } end end context 'does not have user' do let(:build) { create(:ci_build, :running, pipeline: pipeline) } it_behaves_like 'can download LFS only from own projects' do # We render 404, to prevent data leakage about existence of the project let(:other_project_status) { 404 } end end end end context 'without required headers' do let(:authorization) { authorize_user } it 'responds with status 404' do expect(response).to have_gitlab_http_status(404) end end end end describe 'when handling lfs batch request' do let(:update_lfs_permissions) { } let(:update_user_permissions) { } before do enable_lfs update_lfs_permissions update_user_permissions post_lfs_json "#{project.http_url_to_repo}/info/lfs/objects/batch", body, headers end describe 'download' do let(:project) { create(:project) } let(:body) do { 'operation' => 'download', 'objects' => [ { 'oid' => sample_oid, 'size' => sample_size } ] } end shared_examples 'an authorized requests' do context 'when downloading an lfs object that is assigned to our project' do let(:update_lfs_permissions) do project.lfs_objects << lfs_object end it 'responds with status 200' do expect(response).to have_gitlab_http_status(200) end it 'with href to download' do expect(json_response).to eq({ 'objects' => [ { 'oid' => sample_oid, 'size' => sample_size, 'actions' => { 'download' => { 'href' => "#{project.http_url_to_repo}/gitlab-lfs/objects/#{sample_oid}", 'header' => { 'Authorization' => authorization } } } } ] }) end end context 'when downloading an lfs object that is assigned to other project' do let(:other_project) { create(:project) } let(:update_lfs_permissions) do other_project.lfs_objects << lfs_object end it 'responds with status 200' do expect(response).to have_gitlab_http_status(200) end it 'with href to download' do expect(json_response).to eq({ 'objects' => [ { 'oid' => sample_oid, 'size' => sample_size, 'error' => { 'code' => 404, 'message' => "Object does not exist on the server or you don't have permissions to access it" } } ] }) end end context 'when downloading a lfs object that does not exist' do let(:body) do { 'operation' => 'download', 'objects' => [ { 'oid' => '91eff75a492a3ed0dfcb544d7f31326bc4014c8551849c192fd1e48d4dd2c897', 'size' => 1575078 } ] } end it 'responds with status 200' do expect(response).to have_gitlab_http_status(200) end it 'with an 404 for specific object' do expect(json_response).to eq({ 'objects' => [ { 'oid' => '91eff75a492a3ed0dfcb544d7f31326bc4014c8551849c192fd1e48d4dd2c897', 'size' => 1575078, 'error' => { 'code' => 404, 'message' => "Object does not exist on the server or you don't have permissions to access it" } } ] }) end end context 'when downloading one new and one existing lfs object' do let(:body) do { 'operation' => 'download', 'objects' => [ { 'oid' => '91eff75a492a3ed0dfcb544d7f31326bc4014c8551849c192fd1e48d4dd2c897', 'size' => 1575078 }, { 'oid' => sample_oid, 'size' => sample_size } ] } end let(:update_lfs_permissions) do project.lfs_objects << lfs_object end it 'responds with status 200' do expect(response).to have_gitlab_http_status(200) end it 'responds with upload hypermedia link for the new object' do expect(json_response).to eq({ 'objects' => [ { 'oid' => '91eff75a492a3ed0dfcb544d7f31326bc4014c8551849c192fd1e48d4dd2c897', 'size' => 1575078, 'error' => { 'code' => 404, 'message' => "Object does not exist on the server or you don't have permissions to access it" } }, { 'oid' => sample_oid, 'size' => sample_size, 'actions' => { 'download' => { 'href' => "#{project.http_url_to_repo}/gitlab-lfs/objects/#{sample_oid}", 'header' => { 'Authorization' => authorization } } } } ] }) end end end context 'when user is authenticated' do let(:authorization) { authorize_user } let(:update_user_permissions) do project.team << [user, role] end it_behaves_like 'an authorized requests' do let(:role) { :reporter } end context 'when user does is not member of the project' do let(:update_user_permissions) { nil } it 'responds with 404' do expect(response).to have_gitlab_http_status(404) end end context 'when user does not have download access' do let(:role) { :guest } it 'responds with 403' do expect(response).to have_gitlab_http_status(403) end end end context 'when build is authorized as' do let(:authorization) { authorize_ci_project } let(:update_lfs_permissions) do project.lfs_objects << lfs_object end shared_examples 'can download LFS only from own projects' do context 'for own project' do let(:pipeline) { create(:ci_empty_pipeline, project: project) } let(:update_user_permissions) do project.team << [user, :reporter] end it_behaves_like 'an authorized requests' end context 'for other project' do let(:other_project) { create(:project) } let(:pipeline) { create(:ci_empty_pipeline, project: other_project) } it 'rejects downloading code' do expect(response).to have_gitlab_http_status(other_project_status) end end end context 'administrator' do let(:user) { create(:admin) } let(:build) { create(:ci_build, :running, pipeline: pipeline, user: user) } it_behaves_like 'can download LFS only from own projects' do # We render 403, because administrator does have normally access let(:other_project_status) { 403 } end end context 'regular user' do let(:user) { create(:user) } let(:build) { create(:ci_build, :running, pipeline: pipeline, user: user) } it_behaves_like 'can download LFS only from own projects' do # We render 404, to prevent data leakage about existence of the project let(:other_project_status) { 404 } end end context 'does not have user' do let(:build) { create(:ci_build, :running, pipeline: pipeline) } it_behaves_like 'can download LFS only from own projects' do # We render 404, to prevent data leakage about existence of the project let(:other_project_status) { 404 } end end end context 'when user is not authenticated' do describe 'is accessing public project' do let(:project) { create(:project, :public) } let(:update_lfs_permissions) do project.lfs_objects << lfs_object end it 'responds with status 200 and href to download' do expect(response).to have_gitlab_http_status(200) end it 'responds with status 200 and href to download' do expect(json_response).to eq({ 'objects' => [ { 'oid' => sample_oid, 'size' => sample_size, 'authenticated' => true, 'actions' => { 'download' => { 'href' => "#{project.http_url_to_repo}/gitlab-lfs/objects/#{sample_oid}", 'header' => {} } } } ] }) end end describe 'is accessing non-public project' do let(:update_lfs_permissions) do project.lfs_objects << lfs_object end it 'responds with authorization required' do expect(response).to have_gitlab_http_status(401) end end end end describe 'upload' do let(:project) { create(:project, :public) } let(:body) do { 'operation' => 'upload', 'objects' => [ { 'oid' => sample_oid, 'size' => sample_size } ] } end describe 'when request is authenticated' do describe 'when user has project push access' do let(:authorization) { authorize_user } let(:update_user_permissions) do project.team << [user, :developer] end context 'when pushing an lfs object that already exists' do let(:other_project) { create(:project) } let(:update_lfs_permissions) do other_project.lfs_objects << lfs_object end it 'responds with status 200' do expect(response).to have_gitlab_http_status(200) end it 'responds with links the object to the project' do expect(json_response['objects']).to be_kind_of(Array) expect(json_response['objects'].first['oid']).to eq(sample_oid) expect(json_response['objects'].first['size']).to eq(sample_size) expect(lfs_object.projects.pluck(:id)).not_to include(project.id) expect(lfs_object.projects.pluck(:id)).to include(other_project.id) expect(json_response['objects'].first['actions']['upload']['href']).to eq("#{project.http_url_to_repo}/gitlab-lfs/objects/#{sample_oid}/#{sample_size}") expect(json_response['objects'].first['actions']['upload']['header']).to eq('Authorization' => authorization) end end context 'when pushing a lfs object that does not exist' do let(:body) do { 'operation' => 'upload', 'objects' => [ { 'oid' => '91eff75a492a3ed0dfcb544d7f31326bc4014c8551849c192fd1e48d4dd2c897', 'size' => 1575078 } ] } end it 'responds with status 200' do expect(response).to have_gitlab_http_status(200) end it 'responds with upload hypermedia link' do expect(json_response['objects']).to be_kind_of(Array) expect(json_response['objects'].first['oid']).to eq("91eff75a492a3ed0dfcb544d7f31326bc4014c8551849c192fd1e48d4dd2c897") expect(json_response['objects'].first['size']).to eq(1575078) expect(json_response['objects'].first['actions']['upload']['href']).to eq("#{Gitlab.config.gitlab.url}/#{project.full_path}.git/gitlab-lfs/objects/91eff75a492a3ed0dfcb544d7f31326bc4014c8551849c192fd1e48d4dd2c897/1575078") expect(json_response['objects'].first['actions']['upload']['header']).to eq('Authorization' => authorization) end end context 'when pushing one new and one existing lfs object' do let(:body) do { 'operation' => 'upload', 'objects' => [ { 'oid' => '91eff75a492a3ed0dfcb544d7f31326bc4014c8551849c192fd1e48d4dd2c897', 'size' => 1575078 }, { 'oid' => sample_oid, 'size' => sample_size } ] } end let(:update_lfs_permissions) do project.lfs_objects << lfs_object end it 'responds with status 200' do expect(response).to have_gitlab_http_status(200) end it 'responds with upload hypermedia link for the new object' do expect(json_response['objects']).to be_kind_of(Array) expect(json_response['objects'].first['oid']).to eq("91eff75a492a3ed0dfcb544d7f31326bc4014c8551849c192fd1e48d4dd2c897") expect(json_response['objects'].first['size']).to eq(1575078) expect(json_response['objects'].first['actions']['upload']['href']).to eq("#{project.http_url_to_repo}/gitlab-lfs/objects/91eff75a492a3ed0dfcb544d7f31326bc4014c8551849c192fd1e48d4dd2c897/1575078") expect(json_response['objects'].first['actions']['upload']['header']).to eq("Authorization" => authorization) expect(json_response['objects'].last['oid']).to eq(sample_oid) expect(json_response['objects'].last['size']).to eq(sample_size) expect(json_response['objects'].last).not_to have_key('actions') end end end context 'when user does not have push access' do let(:authorization) { authorize_user } it 'responds with 403' do expect(response).to have_gitlab_http_status(403) end end context 'when build is authorized' do let(:authorization) { authorize_ci_project } context 'build has an user' do let(:user) { create(:user) } context 'tries to push to own project' do let(:build) { create(:ci_build, :running, pipeline: pipeline, user: user) } it 'responds with 403 (not 404 because project is public)' do expect(response).to have_gitlab_http_status(403) end end context 'tries to push to other project' do let(:other_project) { create(:project) } let(:pipeline) { create(:ci_empty_pipeline, project: other_project) } let(:build) { create(:ci_build, :running, pipeline: pipeline, user: user) } # I'm not sure what this tests that is different from the previous test it 'responds with 403 (not 404 because project is public)' do expect(response).to have_gitlab_http_status(403) end end end context 'does not have user' do let(:build) { create(:ci_build, :running, pipeline: pipeline) } it 'responds with 403 (not 404 because project is public)' do expect(response).to have_gitlab_http_status(403) end end end end context 'when user is not authenticated' do context 'when user has push access' do let(:update_user_permissions) do project.team << [user, :master] end it 'responds with status 401' do expect(response).to have_gitlab_http_status(401) end end context 'when user does not have push access' do it 'responds with status 401' do expect(response).to have_gitlab_http_status(401) end end end end describe 'unsupported' do let(:project) { create(:project) } let(:authorization) { authorize_user } let(:body) do { 'operation' => 'other', 'objects' => [ { 'oid' => sample_oid, 'size' => sample_size } ] } end it 'responds with status 404' do expect(response).to have_gitlab_http_status(404) end end end describe 'when handling lfs batch request on a read-only GitLab instance' do let(:authorization) { authorize_user } let(:project) { create(:project) } let(:path) { "#{project.http_url_to_repo}/info/lfs/objects/batch" } let(:body) do { 'objects' => [{ 'oid' => sample_oid, 'size' => sample_size }] } end before do allow(Gitlab::Database).to receive(:read_only?) { true } project.team << [user, :master] enable_lfs end it 'responds with a 200 message on download' do post_lfs_json path, body.merge('operation' => 'download'), headers expect(response).to have_gitlab_http_status(200) end it 'responds with a 403 message on upload' do post_lfs_json path, body.merge('operation' => 'upload'), headers expect(response).to have_gitlab_http_status(403) expect(json_response).to include('message' => 'You cannot write to this read-only GitLab instance.') end end describe 'when pushing a lfs object' do before do enable_lfs end shared_examples 'unauthorized' do context 'and request is sent by gitlab-workhorse to authorize the request' do before do put_authorize end it 'responds with status 401' do expect(response).to have_gitlab_http_status(401) end end context 'and request is sent by gitlab-workhorse to finalize the upload' do before do put_finalize end it 'responds with status 401' do expect(response).to have_gitlab_http_status(401) end end context 'and request is sent with a malformed headers' do before do put_finalize('/etc/passwd') end it 'does not recognize it as a valid lfs command' do expect(response).to have_gitlab_http_status(401) end end end shared_examples 'forbidden' do context 'and request is sent by gitlab-workhorse to authorize the request' do before do put_authorize end it 'responds with 403' do expect(response).to have_gitlab_http_status(403) end end context 'and request is sent by gitlab-workhorse to finalize the upload' do before do put_finalize end it 'responds with 403' do expect(response).to have_gitlab_http_status(403) end end context 'and request is sent with a malformed headers' do before do put_finalize('/etc/passwd') end it 'does not recognize it as a valid lfs command' do expect(response).to have_gitlab_http_status(403) end end end describe 'to one project' do let(:project) { create(:project) } describe 'when user is authenticated' do let(:authorization) { authorize_user } describe 'when user has push access to the project' do before do project.team << [user, :developer] end context 'and the request bypassed workhorse' do it 'raises an exception' do expect { put_authorize(verified: false) }.to raise_error JWT::DecodeError end end context 'and request is sent by gitlab-workhorse to authorize the request' do before do put_authorize end it 'responds with status 200' do expect(response).to have_gitlab_http_status(200) end it 'uses the gitlab-workhorse content type' do expect(response.content_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE) end it 'responds with status 200, location of lfs store and object details' do expect(json_response['StoreLFSPath']).to eq("#{Gitlab.config.shared.path}/lfs-objects/tmp/upload") expect(json_response['LfsOid']).to eq(sample_oid) expect(json_response['LfsSize']).to eq(sample_size) end end context 'and request is sent by gitlab-workhorse to finalize the upload' do before do put_finalize end it 'responds with status 200' do expect(response).to have_gitlab_http_status(200) end it 'lfs object is linked to the project' do expect(lfs_object.projects.pluck(:id)).to include(project.id) end end context 'invalid tempfiles' do it 'rejects slashes in the tempfile name (path traversal' do put_finalize('foo/bar') expect(response).to have_gitlab_http_status(403) end it 'rejects tempfile names that do not start with the oid' do put_finalize("foo#{sample_oid}") expect(response).to have_gitlab_http_status(403) end end end describe 'and user does not have push access' do before do project.team << [user, :reporter] end it_behaves_like 'forbidden' end end context 'when build is authorized' do let(:authorization) { authorize_ci_project } context 'build has an user' do let(:user) { create(:user) } context 'tries to push to own project' do let(:build) { create(:ci_build, :running, pipeline: pipeline, user: user) } before do project.team << [user, :developer] put_authorize end it 'responds with 403 (not 404 because the build user can read the project)' do expect(response).to have_gitlab_http_status(403) end end context 'tries to push to other project' do let(:other_project) { create(:project) } let(:pipeline) { create(:ci_empty_pipeline, project: other_project) } let(:build) { create(:ci_build, :running, pipeline: pipeline, user: user) } before do put_authorize end it 'responds with 404 (do not leak non-public project existence)' do expect(response).to have_gitlab_http_status(404) end end end context 'does not have user' do let(:build) { create(:ci_build, :running, pipeline: pipeline) } before do put_authorize end it 'responds with 404 (do not leak non-public project existence)' do expect(response).to have_gitlab_http_status(404) end end end context 'for unauthenticated' do it_behaves_like 'unauthorized' end end describe 'to a forked project' do let(:upstream_project) { create(:project, :public) } let(:project_owner) { create(:user) } let(:project) { fork_project(upstream_project, project_owner) } describe 'when user is authenticated' do let(:authorization) { authorize_user } describe 'when user has push access to the project' do before do project.team << [user, :developer] end context 'and request is sent by gitlab-workhorse to authorize the request' do before do put_authorize end it 'responds with status 200' do expect(response).to have_gitlab_http_status(200) end it 'with location of lfs store and object details' do expect(json_response['StoreLFSPath']).to eq("#{Gitlab.config.shared.path}/lfs-objects/tmp/upload") expect(json_response['LfsOid']).to eq(sample_oid) expect(json_response['LfsSize']).to eq(sample_size) end end context 'and request is sent by gitlab-workhorse to finalize the upload' do before do put_finalize end it 'responds with status 200' do expect(response).to have_gitlab_http_status(200) end it 'lfs object is linked to the source project' do expect(lfs_object.projects.pluck(:id)).to include(upstream_project.id) end end end describe 'and user does not have push access' do it_behaves_like 'forbidden' end end context 'when build is authorized' do let(:authorization) { authorize_ci_project } before do put_authorize end context 'build has an user' do let(:user) { create(:user) } context 'tries to push to own project' do let(:build) { create(:ci_build, :running, pipeline: pipeline, user: user) } it 'responds with 403 (not 404 because project is public)' do expect(response).to have_gitlab_http_status(403) end end context 'tries to push to other project' do let(:other_project) { create(:project) } let(:pipeline) { create(:ci_empty_pipeline, project: other_project) } let(:build) { create(:ci_build, :running, pipeline: pipeline, user: user) } # I'm not sure what this tests that is different from the previous test it 'responds with 403 (not 404 because project is public)' do expect(response).to have_gitlab_http_status(403) end end end context 'does not have user' do let(:build) { create(:ci_build, :running, pipeline: pipeline) } it 'responds with 403 (not 404 because project is public)' do expect(response).to have_gitlab_http_status(403) end end end context 'for unauthenticated' do it_behaves_like 'unauthorized' end describe 'and second project not related to fork or a source project' do let(:second_project) { create(:project) } let(:authorization) { authorize_user } before do second_project.team << [user, :master] upstream_project.lfs_objects << lfs_object end context 'when pushing the same lfs object to the second project' do before do put "#{second_project.http_url_to_repo}/gitlab-lfs/objects/#{sample_oid}/#{sample_size}", nil, headers.merge('X-Gitlab-Lfs-Tmp' => lfs_tmp_file).compact end it 'responds with status 200' do expect(response).to have_gitlab_http_status(200) end it 'links the lfs object to the project' do expect(lfs_object.projects.pluck(:id)).to include(second_project.id, upstream_project.id) end end end end def put_authorize(verified: true) authorize_headers = headers authorize_headers.merge!(workhorse_internal_api_request_header) if verified put "#{project.http_url_to_repo}/gitlab-lfs/objects/#{sample_oid}/#{sample_size}/authorize", nil, authorize_headers end def put_finalize(lfs_tmp = lfs_tmp_file) put "#{project.http_url_to_repo}/gitlab-lfs/objects/#{sample_oid}/#{sample_size}", nil, headers.merge('X-Gitlab-Lfs-Tmp' => lfs_tmp).compact end def lfs_tmp_file "#{sample_oid}012345678" end end def enable_lfs allow(Gitlab.config.lfs).to receive(:enabled).and_return(true) end def authorize_ci_project ActionController::HttpAuthentication::Basic.encode_credentials('gitlab-ci-token', build.token) end def authorize_user ActionController::HttpAuthentication::Basic.encode_credentials(user.username, user.password) end def authorize_deploy_key ActionController::HttpAuthentication::Basic.encode_credentials("lfs+deploy-key-#{key.id}", Gitlab::LfsToken.new(key).token) end def authorize_user_key ActionController::HttpAuthentication::Basic.encode_credentials(user.username, Gitlab::LfsToken.new(user).token) end def post_lfs_json(url, body = nil, headers = nil) post(url, body.try(:to_json), (headers || {}).merge('Content-Type' => 'application/vnd.git-lfs+json')) end def json_response @json_response ||= JSON.parse(response.body) end end