1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
|
# frozen_string_literal: true
require 'spec_helper'
RSpec.describe Import::GitlabGroupsController do
include WorkhorseHelpers
let(:import_path) { "#{Dir.tmpdir}/gitlab_groups_controller_spec" }
let(:workhorse_token) { JWT.encode({ 'iss' => 'gitlab-workhorse' }, Gitlab::Workhorse.secret, 'HS256') }
let(:workhorse_headers) do
{ 'GitLab-Workhorse' => '1.0', Gitlab::Workhorse::INTERNAL_API_REQUEST_HEADER => workhorse_token }
end
before do
allow_next_instance_of(Gitlab::ImportExport) do |import_export|
expect(import_export).to receive(:storage_path).and_return(import_path)
end
allow(Gitlab::ApplicationRateLimiter).to receive(:throttled?).and_return(false)
stub_uploads_object_storage(ImportExportUploader)
end
after do
FileUtils.rm_rf(import_path, secure: true)
end
describe 'POST create' do
subject(:import_request) { upload_archive(file_upload, workhorse_headers, request_params) }
let_it_be(:user) { create(:user) }
let(:file) { File.join('spec', %w[fixtures group_export.tar.gz]) }
let(:file_upload) { fixture_file_upload(file) }
before do
login_as(user)
end
def upload_archive(file, headers = {}, params = {})
workhorse_finalize(
import_gitlab_group_path,
method: :post,
file_key: :file,
params: params.merge(file: file),
headers: headers,
send_rewritten_field: true
)
end
context 'when importing without a parent group' do
let(:request_params) { { path: 'test-group-import', name: 'test-group-import' } }
it 'successfully creates the group' do
expect { import_request }.to change { Group.count }.by 1
group = Group.find_by(name: 'test-group-import')
expect(response).to have_gitlab_http_status(:found)
expect(response).to redirect_to(group_path(group))
expect(flash[:notice]).to include('is being imported')
end
it 'imports the group data', :sidekiq_inline do
allow(GroupImportWorker).to receive(:perform_async).and_call_original
import_request
group = Group.find_by(name: 'test-group-import')
expect(GroupImportWorker).to have_received(:perform_async).with(user.id, group.id)
expect(group.description).to eq 'A voluptate non sequi temporibus quam at.'
expect(group.visibility_level).to eq Gitlab::VisibilityLevel::PRIVATE
end
end
context 'when importing to a parent group' do
let(:request_params) { { path: 'test-group-import', name: 'test-group-import', parent_id: parent_group.id } }
let(:parent_group) { create(:group) }
before do
parent_group.add_owner(user)
end
it 'creates a new group under the parent' do
expect { import_request }
.to change { parent_group.children.reload.size }.by 1
expect(response).to have_gitlab_http_status(:found)
end
shared_examples 'is created with the parent visibility level' do |visibility_level|
before do
parent_group.update!(visibility_level: visibility_level)
end
it "imports a #{Gitlab::VisibilityLevel.level_name(visibility_level)} group" do
import_request
group = parent_group.children.find_by(name: 'test-group-import')
expect(group.visibility_level).to eq visibility_level
end
end
[
Gitlab::VisibilityLevel::PUBLIC,
Gitlab::VisibilityLevel::INTERNAL,
Gitlab::VisibilityLevel::PRIVATE
].each do |visibility_level|
context "when the parent is #{Gitlab::VisibilityLevel.level_name(visibility_level)}" do
include_examples 'is created with the parent visibility level', visibility_level
end
end
end
context 'when supplied invalid params' do
subject(:import_request) do
upload_archive(
file_upload,
workhorse_headers,
{ path: '', name: '' }
)
end
it 'responds with an error' do
expect { import_request }.not_to change { Group.count }
expect(flash[:alert])
.to include('Group could not be imported', "Name can't be blank", 'Group URL is too short')
end
end
context 'when the user is not authorized to create groups' do
let(:request_params) { { path: 'test-group-import', name: 'test-group-import' } }
let(:user) { create(:user, can_create_group: false) }
it 'returns an error' do
expect { import_request }.not_to change { Group.count }
expect(flash[:alert]).to eq 'Group could not be imported: You don’t have permission to create groups.'
end
end
context 'when the requests exceed the rate limit' do
let(:request_params) { { path: 'test-group-import', name: 'test-group-import' } }
before do
allow(Gitlab::ApplicationRateLimiter).to receive(:throttled?).and_return(true)
end
it 'throttles the requests' do
import_request
expect(response).to have_gitlab_http_status(:found)
expect(flash[:alert]).to eq 'This endpoint has been requested too many times. Try again later.'
end
end
context 'when group import FF is disabled' do
let(:request_params) { { path: 'test-group-import', name: 'test-group-import' } }
before do
stub_feature_flags(group_import_export: false)
end
it 'returns an error' do
expect { import_request }.not_to change { Group.count }
expect(response).to have_gitlab_http_status(:not_found)
end
end
context 'when the parent group is invalid' do
let(:request_params) { { path: 'test-group-import', name: 'test-group-import', parent_id: -1 } }
it 'does not create a new group' do
expect { import_request }.not_to change { Group.count }
expect(response).to have_gitlab_http_status(:not_found)
end
end
context 'when the user is not an owner of the parent group' do
let(:request_params) { { path: 'test-group-import', name: 'test-group-import', parent_id: parent_group.id } }
let(:parent_group) { create(:group) }
it 'returns an error' do
expect { import_request }.not_to change { parent_group.children.reload.count }
expect(flash[:alert]).to include "You don’t have permission to create a subgroup in this group"
end
end
end
describe 'POST authorize' do
let_it_be(:user) { create(:user) }
before do
login_as(user)
end
context 'when using a workhorse header' do
subject(:authorize_request) { post authorize_import_gitlab_group_path, headers: workhorse_headers }
it 'authorizes the request' do
authorize_request
expect(response).to have_gitlab_http_status :ok
expect(response.media_type).to eq Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE
expect(json_response['TempPath']).to eq ImportExportUploader.workhorse_local_upload_path
end
end
context 'when the request bypasses gitlab-workhorse' do
subject(:authorize_request) { post authorize_import_gitlab_group_path }
it 'rejects the request' do
expect { authorize_request }.to raise_error(JWT::DecodeError)
end
end
context 'when direct upload is enabled' do
subject(:authorize_request) { post authorize_import_gitlab_group_path, headers: workhorse_headers }
before do
stub_uploads_object_storage(ImportExportUploader, enabled: true, direct_upload: true)
end
it 'accepts the request and stores the files' do
authorize_request
expect(response).to have_gitlab_http_status :ok
expect(response.media_type).to eq Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE
expect(json_response).not_to have_key 'TempPath'
expect(json_response['RemoteObject'].keys)
.to include('ID', 'GetURL', 'StoreURL', 'DeleteURL', 'MultipartUpload')
end
end
context 'when direct upload is disabled' do
subject(:authorize_request) { post authorize_import_gitlab_group_path, headers: workhorse_headers }
before do
stub_uploads_object_storage(ImportExportUploader, enabled: true, direct_upload: false)
end
it 'handles the local file' do
authorize_request
expect(response).to have_gitlab_http_status :ok
expect(response.media_type).to eq Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE
expect(json_response['TempPath']).to eq ImportExportUploader.workhorse_local_upload_path
expect(json_response['RemoteObject']).to be_nil
end
end
end
end
|