spec/support/shared_examples/graphql/mutations/security/ci_configuration_shared_examples.rb


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120

# frozen_string_literal: true

require 'spec_helper'

RSpec.shared_examples_for 'graphql mutations security ci configuration' do
  let_it_be(:project) { create(:project, :public, :repository) }
  let_it_be(:user) { create(:user) }

  let(:branch) do
    "set-secret-config"
  end

  let(:success_path) do
    "http://127.0.0.1:3000/root/demo-historic-secrets/-/merge_requests/new?"
  end

  let(:service_response) do
    ServiceResponse.success(payload: { branch: branch, success_path: success_path })
  end

  let(:error) { "An error occurred!" }

  let(:service_error_response) do
    ServiceResponse.error(message: error)
  end

  specify { expect(described_class).to require_graphql_authorizations(:push_code) }

  describe '#resolve' do
    let(:result) { subject }

    it 'generates an error if the resource is not accessible to the user' do
      expect_graphql_error_to_be_created(Gitlab::Graphql::Errors::ResourceNotAvailable) do
        subject
      end
    end

    context 'when user does not have enough permissions' do
      before do
        project.add_guest(user)
      end

      it 'generates an error' do
        expect_graphql_error_to_be_created(Gitlab::Graphql::Errors::ResourceNotAvailable) do
          subject
        end
      end
    end

    context 'when user is a maintainer of a different project' do
      before do
        create(:project_empty_repo).add_maintainer(user)
      end

      it 'generates an error' do
        expect_graphql_error_to_be_created(Gitlab::Graphql::Errors::ResourceNotAvailable) do
          subject
        end
      end
    end

    context 'when the user does not have permission to create a new branch' do
      let(:error_message) { 'You are not allowed to create protected branches on this project.' }

      before do
        project.add_developer(user)

        allow_next_instance_of(::Files::MultiService) do |multi_service|
          allow(multi_service).to receive(:execute).and_raise(Gitlab::Git::PreReceiveError.new("GitLab: #{error_message}"))
        end
      end

      it 'returns an array of errors' do
        expect(result).to match(
          branch: be_nil,
          success_path: be_nil,
          errors: match_array([error_message])
        )
      end
    end

    context 'when the user can create a merge request' do
      before do
        project.add_developer(user)
      end

      context 'when service successfully generates a path to create a new merge request' do
        before do
          allow_next_instance_of(service) do |service|
            allow(service).to receive(:execute).and_return(service_response)
          end
        end

        it 'returns a success path' do
          expect(result).to match(
            branch: branch,
            success_path: success_path,
            errors: []
          )
        end
      end

      context 'when service can not generate any path to create a new merge request' do
        before do
          allow_next_instance_of(service) do |service|
            allow(service).to receive(:execute).and_return(service_error_response)
          end
        end

        it 'returns an array of errors' do
          expect(result).to match(
            branch: be_nil,
            success_path: be_nil,
            errors: match_array([error])
          )
        end
      end
    end
  end
end