gitlabhq/spec/requests/projects_security_spec.rb

136 lines
6.3 KiB
Ruby
Raw Normal View History

2011-10-08 23:36:38 +02:00
require 'spec_helper'
describe "Projects" do
describe "GET /projects" do
2011-10-08 23:36:38 +02:00
it { projects_path.should be_allowed_for :admin }
it { projects_path.should be_allowed_for :user }
it { projects_path.should be_denied_for :visitor }
end
describe "GET /projects/new" do
2011-10-08 23:36:38 +02:00
it { projects_path.should be_allowed_for :admin }
it { projects_path.should be_allowed_for :user }
it { projects_path.should be_denied_for :visitor }
end
describe "Project" do
before do
2011-10-08 23:36:38 +02:00
@project = Factory :project
@u1 = Factory :user
@u2 = Factory :user
@u3 = Factory :user
# full access
2011-12-07 08:48:44 +01:00
@project.users_projects.create(:user => @u1, :project_access => Project::PROJECT_RWA)
2011-10-08 23:36:38 +02:00
# no access
2011-12-07 08:48:44 +01:00
@project.users_projects.create(:user => @u2, :project_access => Project::PROJECT_N)
2011-10-08 23:36:38 +02:00
# readonly
2011-12-07 08:48:44 +01:00
@project.users_projects.create(:user => @u3, :project_access => Project::PROJECT_R)
2011-10-08 23:36:38 +02:00
end
describe "GET /project_code" do
2011-10-08 23:36:38 +02:00
it { project_path(@project).should be_allowed_for @u1 }
it { project_path(@project).should be_allowed_for @u3 }
it { project_path(@project).should be_denied_for :admin }
it { project_path(@project).should be_denied_for @u2 }
it { project_path(@project).should be_denied_for :user }
it { project_path(@project).should be_denied_for :visitor }
end
2011-11-16 06:58:53 +01:00
describe "GET /project_code/master/tree" do
it { tree_project_ref_path(@project, @project.root_ref).should be_allowed_for @u1 }
it { tree_project_ref_path(@project, @project.root_ref).should be_allowed_for @u3 }
it { tree_project_ref_path(@project, @project.root_ref).should be_denied_for :admin }
it { tree_project_ref_path(@project, @project.root_ref).should be_denied_for @u2 }
it { tree_project_ref_path(@project, @project.root_ref).should be_denied_for :user }
it { tree_project_ref_path(@project, @project.root_ref).should be_denied_for :visitor }
2011-10-08 23:36:38 +02:00
end
describe "GET /project_code/commits" do
2011-10-08 23:36:38 +02:00
it { project_commits_path(@project).should be_allowed_for @u1 }
it { project_commits_path(@project).should be_allowed_for @u3 }
it { project_commits_path(@project).should be_denied_for :admin }
it { project_commits_path(@project).should be_denied_for @u2 }
it { project_commits_path(@project).should be_denied_for :user }
it { project_commits_path(@project).should be_denied_for :visitor }
end
describe "GET /project_code/commit" do
2011-11-27 16:35:49 +01:00
it { project_commit_path(@project, @project.commit.id).should be_allowed_for @u1 }
it { project_commit_path(@project, @project.commit.id).should be_allowed_for @u3 }
it { project_commit_path(@project, @project.commit.id).should be_denied_for :admin }
it { project_commit_path(@project, @project.commit.id).should be_denied_for @u2 }
it { project_commit_path(@project, @project.commit.id).should be_denied_for :user }
it { project_commit_path(@project, @project.commit.id).should be_denied_for :visitor }
2011-10-08 23:36:38 +02:00
end
describe "GET /project_code/team" do
2011-10-08 23:36:38 +02:00
it { team_project_path(@project).should be_allowed_for @u1 }
it { team_project_path(@project).should be_allowed_for @u3 }
it { team_project_path(@project).should be_denied_for :admin }
it { team_project_path(@project).should be_denied_for @u2 }
it { team_project_path(@project).should be_denied_for :user }
it { team_project_path(@project).should be_denied_for :visitor }
end
describe "GET /project_code/wall" do
2011-10-08 23:36:38 +02:00
it { wall_project_path(@project).should be_allowed_for @u1 }
it { wall_project_path(@project).should be_allowed_for @u3 }
it { wall_project_path(@project).should be_denied_for :admin }
it { wall_project_path(@project).should be_denied_for @u2 }
it { wall_project_path(@project).should be_denied_for :user }
it { wall_project_path(@project).should be_denied_for :visitor }
end
describe "GET /project_code/blob" do
before do
2011-10-17 12:39:03 +02:00
@commit = @project.commit
@path = @commit.tree.contents.select { |i| i.is_a?(Grit::Blob)}.first.name
2011-11-16 06:58:53 +01:00
@blob_path = blob_project_ref_path(@project, @commit.id, :path => @path)
2011-10-17 12:39:03 +02:00
end
it { @blob_path.should be_allowed_for @u1 }
it { @blob_path.should be_allowed_for @u3 }
it { @blob_path.should be_denied_for :admin }
it { @blob_path.should be_denied_for @u2 }
it { @blob_path.should be_denied_for :user }
it { @blob_path.should be_denied_for :visitor }
2011-10-08 23:36:38 +02:00
end
describe "GET /project_code/edit" do
2011-10-08 23:36:38 +02:00
it { edit_project_path(@project).should be_allowed_for @u1 }
it { edit_project_path(@project).should be_denied_for @u3 }
it { edit_project_path(@project).should be_denied_for :admin }
it { edit_project_path(@project).should be_denied_for @u2 }
it { edit_project_path(@project).should be_denied_for :user }
it { edit_project_path(@project).should be_denied_for :visitor }
end
describe "GET /project_code/issues" do
2011-10-08 23:36:38 +02:00
it { project_issues_path(@project).should be_allowed_for @u1 }
it { project_issues_path(@project).should be_allowed_for @u3 }
it { project_issues_path(@project).should be_denied_for :admin }
it { project_issues_path(@project).should be_denied_for @u2 }
it { project_issues_path(@project).should be_denied_for :user }
it { project_issues_path(@project).should be_denied_for :visitor }
end
2011-10-16 23:07:10 +02:00
describe "GET /project_code/snippets" do
2011-10-16 23:07:10 +02:00
it { project_snippets_path(@project).should be_allowed_for @u1 }
it { project_snippets_path(@project).should be_allowed_for @u3 }
it { project_snippets_path(@project).should be_denied_for :admin }
it { project_snippets_path(@project).should be_denied_for @u2 }
it { project_snippets_path(@project).should be_denied_for :user }
it { project_snippets_path(@project).should be_denied_for :visitor }
end
2011-11-28 19:42:32 +01:00
describe "GET /project_code/merge_requests" do
it { project_merge_requests_path(@project).should be_allowed_for @u1 }
it { project_merge_requests_path(@project).should be_allowed_for @u3 }
it { project_merge_requests_path(@project).should be_denied_for :admin }
it { project_merge_requests_path(@project).should be_denied_for @u2 }
it { project_merge_requests_path(@project).should be_denied_for :user }
it { project_merge_requests_path(@project).should be_denied_for :visitor }
end
2011-10-08 23:36:38 +02:00
end
end