gitlabhq/spec/requests/security/project_access_spec.rb

244 lines
7.5 KiB
Ruby
Raw Normal View History

2011-10-08 23:36:38 +02:00
require 'spec_helper'
describe "Application access" do
describe "GET /" do
it { root_path.should be_allowed_for :admin }
it { root_path.should be_allowed_for :user }
it { root_path.should be_denied_for :visitor }
2011-10-08 23:36:38 +02:00
end
describe "GET /projects/new" do
it { new_project_path.should be_allowed_for :admin }
it { new_project_path.should be_allowed_for :user }
it { new_project_path.should be_denied_for :visitor }
2011-10-08 23:36:38 +02:00
end
describe "Project" do
2012-09-26 19:22:30 +02:00
let(:project) { create(:project) }
let(:master) { create(:user) }
let(:guest) { create(:user) }
let(:reporter) { create(:user) }
before do
2011-10-08 23:36:38 +02:00
# full access
2013-01-04 23:43:32 +01:00
project.team << [master, :master]
2012-09-26 19:22:30 +02:00
2011-10-08 23:36:38 +02:00
# readonly
2013-01-04 23:43:32 +01:00
project.team << [reporter, :reporter]
2011-10-08 23:36:38 +02:00
end
describe "GET /project_code" do
2012-09-26 19:22:30 +02:00
subject { project_path(project) }
it { should be_allowed_for master }
it { should be_allowed_for reporter }
it { should be_denied_for :admin }
it { should be_denied_for guest }
it { should be_denied_for :user }
it { should be_denied_for :visitor }
end
describe "GET /project_code/tree/master" do
2013-01-04 23:49:43 +01:00
subject { project_tree_path(project, project.repository.root_ref) }
2012-08-25 19:43:55 +02:00
2012-09-26 19:22:30 +02:00
it { should be_allowed_for master }
it { should be_allowed_for reporter }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :admin }
2012-09-26 19:22:30 +02:00
it { should be_denied_for guest }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :user }
it { should be_denied_for :visitor }
2011-10-08 23:36:38 +02:00
end
2012-09-26 19:22:30 +02:00
describe "GET /project_code/commits/master" do
2013-01-04 23:49:43 +01:00
subject { project_commits_path(project, project.repository.root_ref, limit: 1) }
2012-08-25 19:43:55 +02:00
2012-09-26 19:22:30 +02:00
it { should be_allowed_for master }
it { should be_allowed_for reporter }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :admin }
2012-09-26 19:22:30 +02:00
it { should be_denied_for guest }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :user }
it { should be_denied_for :visitor }
2011-10-08 23:36:38 +02:00
end
2012-09-26 19:22:30 +02:00
describe "GET /project_code/commit/:sha" do
2013-01-04 23:43:32 +01:00
subject { project_commit_path(project, project.repository.commit) }
2012-08-25 19:43:55 +02:00
2012-09-26 19:22:30 +02:00
it { should be_allowed_for master }
it { should be_allowed_for reporter }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :admin }
2012-09-26 19:22:30 +02:00
it { should be_denied_for guest }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :user }
it { should be_denied_for :visitor }
2011-10-08 23:36:38 +02:00
end
2012-09-26 19:22:30 +02:00
describe "GET /project_code/compare" do
subject { project_compare_index_path(project) }
2012-08-25 19:43:55 +02:00
2012-09-26 19:22:30 +02:00
it { should be_allowed_for master }
it { should be_allowed_for reporter }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :admin }
2012-09-26 19:22:30 +02:00
it { should be_denied_for guest }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :user }
it { should be_denied_for :visitor }
2011-10-08 23:36:38 +02:00
end
describe "GET /project_code/team" do
2012-09-26 19:22:30 +02:00
subject { project_team_index_path(project) }
2012-08-25 19:43:55 +02:00
2012-09-26 19:22:30 +02:00
it { should be_allowed_for master }
it { should be_allowed_for reporter }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :admin }
2012-09-26 19:22:30 +02:00
it { should be_denied_for guest }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :user }
it { should be_denied_for :visitor }
2011-10-08 23:36:38 +02:00
end
describe "GET /project_code/wall" do
2012-09-26 19:22:30 +02:00
subject { wall_project_path(project) }
2012-08-25 19:43:55 +02:00
2012-09-26 19:22:30 +02:00
it { should be_allowed_for master }
it { should be_allowed_for reporter }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :admin }
2012-09-26 19:22:30 +02:00
it { should be_denied_for guest }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :user }
it { should be_denied_for :visitor }
2011-10-08 23:36:38 +02:00
end
describe "GET /project_code/blob" do
before do
2013-01-04 23:43:32 +01:00
commit = project.repository.commit
2012-08-25 19:43:55 +02:00
path = commit.tree.contents.select { |i| i.is_a?(Grit::Blob)}.first.name
2012-09-26 19:22:30 +02:00
@blob_path = project_blob_path(project, File.join(commit.id, path))
2011-10-17 12:39:03 +02:00
end
2012-09-26 19:22:30 +02:00
it { @blob_path.should be_allowed_for master }
it { @blob_path.should be_allowed_for reporter }
2011-10-17 12:39:03 +02:00
it { @blob_path.should be_denied_for :admin }
2012-09-26 19:22:30 +02:00
it { @blob_path.should be_denied_for guest }
2011-10-17 12:39:03 +02:00
it { @blob_path.should be_denied_for :user }
it { @blob_path.should be_denied_for :visitor }
2011-10-08 23:36:38 +02:00
end
describe "GET /project_code/edit" do
2012-09-26 19:22:30 +02:00
subject { edit_project_path(project) }
2012-08-25 19:43:55 +02:00
2012-09-26 19:22:30 +02:00
it { should be_allowed_for master }
it { should be_denied_for reporter }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :admin }
2012-09-26 19:22:30 +02:00
it { should be_denied_for guest }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :user }
it { should be_denied_for :visitor }
2011-10-08 23:36:38 +02:00
end
2011-12-29 23:33:26 +01:00
describe "GET /project_code/deploy_keys" do
2012-09-26 19:22:30 +02:00
subject { project_deploy_keys_path(project) }
2012-08-25 19:43:55 +02:00
2012-09-26 19:22:30 +02:00
it { should be_allowed_for master }
it { should be_denied_for reporter }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :admin }
2012-09-26 19:22:30 +02:00
it { should be_denied_for guest }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :user }
it { should be_denied_for :visitor }
2011-12-29 23:33:26 +01:00
end
describe "GET /project_code/issues" do
2012-09-26 19:22:30 +02:00
subject { project_issues_path(project) }
2012-08-25 19:43:55 +02:00
2012-09-26 19:22:30 +02:00
it { should be_allowed_for master }
it { should be_allowed_for reporter }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :admin }
2012-09-26 19:22:30 +02:00
it { should be_denied_for guest }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :user }
it { should be_denied_for :visitor }
2011-10-08 23:36:38 +02:00
end
2011-10-16 23:07:10 +02:00
describe "GET /project_code/snippets" do
2012-09-26 19:22:30 +02:00
subject { project_snippets_path(project) }
2012-08-25 19:43:55 +02:00
2012-09-26 19:22:30 +02:00
it { should be_allowed_for master }
it { should be_allowed_for reporter }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :admin }
2012-09-26 19:22:30 +02:00
it { should be_denied_for guest }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :user }
it { should be_denied_for :visitor }
2011-10-16 23:07:10 +02:00
end
2011-11-28 19:42:32 +01:00
describe "GET /project_code/merge_requests" do
2012-09-26 19:22:30 +02:00
subject { project_merge_requests_path(project) }
2012-08-25 19:43:55 +02:00
2012-09-26 19:22:30 +02:00
it { should be_allowed_for master }
it { should be_allowed_for reporter }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :admin }
2012-09-26 19:22:30 +02:00
it { should be_denied_for guest }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :user }
it { should be_denied_for :visitor }
2011-11-28 19:42:32 +01:00
end
describe "GET /project_code/repository" do
2012-09-26 19:22:30 +02:00
subject { project_repository_path(project) }
2012-08-25 19:43:55 +02:00
2012-09-26 19:22:30 +02:00
it { should be_allowed_for master }
it { should be_allowed_for reporter }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :admin }
2012-09-26 19:22:30 +02:00
it { should be_denied_for guest }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :user }
it { should be_denied_for :visitor }
end
describe "GET /project_code/repository/branches" do
2012-09-26 19:22:30 +02:00
subject { branches_project_repository_path(project) }
2012-08-25 19:43:55 +02:00
2012-09-26 19:43:42 +02:00
before do
# Speed increase
Project.any_instance.stub(:branches).and_return([])
end
2012-09-26 19:22:30 +02:00
it { should be_allowed_for master }
it { should be_allowed_for reporter }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :admin }
2012-09-26 19:22:30 +02:00
it { should be_denied_for guest }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :user }
it { should be_denied_for :visitor }
end
describe "GET /project_code/repository/tags" do
2012-09-26 19:22:30 +02:00
subject { tags_project_repository_path(project) }
2012-08-25 19:43:55 +02:00
2012-09-26 19:43:42 +02:00
before do
# Speed increase
Project.any_instance.stub(:tags).and_return([])
end
2012-09-26 19:22:30 +02:00
it { should be_allowed_for master }
it { should be_allowed_for reporter }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :admin }
2012-09-26 19:22:30 +02:00
it { should be_denied_for guest }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :user }
it { should be_denied_for :visitor }
end
describe "GET /project_code/hooks" do
2012-09-26 19:22:30 +02:00
subject { project_hooks_path(project) }
2012-08-25 19:43:55 +02:00
2012-09-26 19:22:30 +02:00
it { should be_allowed_for master }
it { should be_allowed_for reporter }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :admin }
2012-09-26 19:22:30 +02:00
it { should be_denied_for guest }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :user }
it { should be_denied_for :visitor }
end
describe "GET /project_code/files" do
2012-09-26 19:22:30 +02:00
subject { files_project_path(project) }
2012-08-25 19:43:55 +02:00
2012-09-26 19:22:30 +02:00
it { should be_allowed_for master }
it { should be_allowed_for reporter }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :admin }
2012-09-26 19:22:30 +02:00
it { should be_denied_for guest }
2012-08-25 19:43:55 +02:00
it { should be_denied_for :user }
it { should be_denied_for :visitor }
end
2011-10-08 23:36:38 +02:00
end
end