private_access_spec.rb 17.5 KB
Newer Older
1 2
require 'spec_helper'

3
describe "Private Project Access", feature: true  do
4 5
  include AccessMatchers

Z.J. van de Weg's avatar
Z.J. van de Weg committed
6
  let(:project) { create(:project, :private, public_builds: false) }
7

8
  describe "Project should be private" do
9
    describe '#private?' do
10
      subject { project.private? }
11 12
      it { is_expected.to be_truthy }
    end
13 14
  end

15
  describe "GET /:project_path" do
Vinnie Okada's avatar
Vinnie Okada committed
16
    subject { namespace_project_path(project.namespace, project) }
17

18 19 20 21 22 23 24 25 26
    it { is_expected.to be_allowed_for(:admin) }
    it { is_expected.to be_allowed_for(:owner).of(project) }
    it { is_expected.to be_allowed_for(:master).of(project) }
    it { is_expected.to be_allowed_for(:developer).of(project) }
    it { is_expected.to be_allowed_for(:reporter).of(project) }
    it { is_expected.to be_allowed_for(:guest).of(project) }
    it { is_expected.to be_denied_for(:user) }
    it { is_expected.to be_denied_for(:external) }
    it { is_expected.to be_denied_for(:visitor) }
27 28 29
  end

  describe "GET /:project_path/tree/master" do
Vinnie Okada's avatar
Vinnie Okada committed
30
    subject { namespace_project_tree_path(project.namespace, project, project.repository.root_ref) }
31

32 33 34 35 36 37 38 39 40
    it { is_expected.to be_allowed_for(:admin) }
    it { is_expected.to be_allowed_for(:owner).of(project) }
    it { is_expected.to be_allowed_for(:master).of(project) }
    it { is_expected.to be_allowed_for(:developer).of(project) }
    it { is_expected.to be_allowed_for(:reporter).of(project) }
    it { is_expected.to be_denied_for(:guest).of(project) }
    it { is_expected.to be_denied_for(:user) }
    it { is_expected.to be_denied_for(:external) }
    it { is_expected.to be_denied_for(:visitor) }
41 42 43
  end

  describe "GET /:project_path/commits/master" do
Vinnie Okada's avatar
Vinnie Okada committed
44
    subject { namespace_project_commits_path(project.namespace, project, project.repository.root_ref, limit: 1) }
45

46 47 48 49 50 51 52 53 54
    it { is_expected.to be_allowed_for(:admin) }
    it { is_expected.to be_allowed_for(:owner).of(project) }
    it { is_expected.to be_allowed_for(:master).of(project) }
    it { is_expected.to be_allowed_for(:developer).of(project) }
    it { is_expected.to be_allowed_for(:reporter).of(project) }
    it { is_expected.to be_denied_for(:guest).of(project) }
    it { is_expected.to be_denied_for(:user) }
    it { is_expected.to be_denied_for(:external) }
    it { is_expected.to be_denied_for(:visitor) }
55 56 57
  end

  describe "GET /:project_path/commit/:sha" do
Vinnie Okada's avatar
Vinnie Okada committed
58
    subject { namespace_project_commit_path(project.namespace, project, project.repository.commit) }
59

60 61 62 63 64 65 66 67 68
    it { is_expected.to be_allowed_for(:admin) }
    it { is_expected.to be_allowed_for(:owner).of(project) }
    it { is_expected.to be_allowed_for(:master).of(project) }
    it { is_expected.to be_allowed_for(:developer).of(project) }
    it { is_expected.to be_allowed_for(:reporter).of(project) }
    it { is_expected.to be_denied_for(:guest).of(project) }
    it { is_expected.to be_denied_for(:user) }
    it { is_expected.to be_denied_for(:external) }
    it { is_expected.to be_denied_for(:visitor) }
69 70 71
  end

  describe "GET /:project_path/compare" do
Vinnie Okada's avatar
Vinnie Okada committed
72
    subject { namespace_project_compare_index_path(project.namespace, project) }
73

74 75 76 77 78 79 80 81 82
    it { is_expected.to be_allowed_for(:admin) }
    it { is_expected.to be_allowed_for(:owner).of(project) }
    it { is_expected.to be_allowed_for(:master).of(project) }
    it { is_expected.to be_allowed_for(:developer).of(project) }
    it { is_expected.to be_allowed_for(:reporter).of(project) }
    it { is_expected.to be_denied_for(:guest).of(project) }
    it { is_expected.to be_denied_for(:user) }
    it { is_expected.to be_denied_for(:external) }
    it { is_expected.to be_denied_for(:visitor) }
83 84
  end

85
  describe "GET /:project_path/settings/members" do
86
    subject { namespace_project_settings_members_path(project.namespace, project) }
87

88 89 90 91 92 93 94 95 96
    it { is_expected.to be_allowed_for(:admin) }
    it { is_expected.to be_allowed_for(:owner).of(project) }
    it { is_expected.to be_allowed_for(:master).of(project) }
    it { is_expected.to be_allowed_for(:developer).of(project) }
    it { is_expected.to be_allowed_for(:reporter).of(project) }
    it { is_expected.to be_allowed_for(:guest).of(project) }
    it { is_expected.to be_denied_for(:user) }
    it { is_expected.to be_denied_for(:external) }
    it { is_expected.to be_denied_for(:visitor) }
97 98 99
  end

  describe "GET /:project_path/blob" do
Zeger-Jan van de Weg's avatar
Zeger-Jan van de Weg committed
100 101
    let(:commit) { project.repository.commit }
    subject { namespace_project_blob_path(project.namespace, project, File.join(commit.id, '.gitignore'))}
102

103 104 105 106 107 108 109 110 111
    it { is_expected.to be_allowed_for(:admin) }
    it { is_expected.to be_allowed_for(:owner).of(project) }
    it { is_expected.to be_allowed_for(:master).of(project) }
    it { is_expected.to be_allowed_for(:developer).of(project) }
    it { is_expected.to be_allowed_for(:reporter).of(project) }
    it { is_expected.to be_denied_for(:guest).of(project) }
    it { is_expected.to be_denied_for(:user) }
    it { is_expected.to be_denied_for(:external) }
    it { is_expected.to be_denied_for(:visitor) }
112 113 114
  end

  describe "GET /:project_path/edit" do
Vinnie Okada's avatar
Vinnie Okada committed
115
    subject { edit_namespace_project_path(project.namespace, project) }
116

117 118 119 120 121 122 123 124 125
    it { is_expected.to be_allowed_for(:admin) }
    it { is_expected.to be_allowed_for(:owner).of(project) }
    it { is_expected.to be_allowed_for(:master).of(project) }
    it { is_expected.to be_denied_for(:developer).of(project) }
    it { is_expected.to be_denied_for(:reporter).of(project) }
    it { is_expected.to be_denied_for(:guest).of(project) }
    it { is_expected.to be_denied_for(:user) }
    it { is_expected.to be_denied_for(:external) }
    it { is_expected.to be_denied_for(:visitor) }
126 127 128
  end

  describe "GET /:project_path/deploy_keys" do
Vinnie Okada's avatar
Vinnie Okada committed
129
    subject { namespace_project_deploy_keys_path(project.namespace, project) }
130

131 132 133 134 135 136 137 138 139
    it { is_expected.to be_allowed_for(:admin) }
    it { is_expected.to be_allowed_for(:owner).of(project) }
    it { is_expected.to be_allowed_for(:master).of(project) }
    it { is_expected.to be_denied_for(:developer).of(project) }
    it { is_expected.to be_denied_for(:reporter).of(project) }
    it { is_expected.to be_denied_for(:guest).of(project) }
    it { is_expected.to be_denied_for(:user) }
    it { is_expected.to be_denied_for(:external) }
    it { is_expected.to be_denied_for(:visitor) }
140 141 142
  end

  describe "GET /:project_path/issues" do
Vinnie Okada's avatar
Vinnie Okada committed
143
    subject { namespace_project_issues_path(project.namespace, project) }
144

145 146 147 148 149 150 151 152 153
    it { is_expected.to be_allowed_for(:admin) }
    it { is_expected.to be_allowed_for(:owner).of(project) }
    it { is_expected.to be_allowed_for(:master).of(project) }
    it { is_expected.to be_allowed_for(:developer).of(project) }
    it { is_expected.to be_allowed_for(:reporter).of(project) }
    it { is_expected.to be_allowed_for(:guest).of(project) }
    it { is_expected.to be_denied_for(:user) }
    it { is_expected.to be_denied_for(:external) }
    it { is_expected.to be_denied_for(:visitor) }
154 155
  end

156 157 158 159
  describe "GET /:project_path/issues/:id/edit" do
    let(:issue) { create(:issue, project: project) }
    subject { edit_namespace_project_issue_path(project.namespace, project, issue) }

160 161 162 163 164 165 166 167 168
    it { is_expected.to be_allowed_for(:admin) }
    it { is_expected.to be_allowed_for(:owner).of(project) }
    it { is_expected.to be_allowed_for(:master).of(project) }
    it { is_expected.to be_allowed_for(:developer).of(project) }
    it { is_expected.to be_allowed_for(:reporter).of(project) }
    it { is_expected.to be_denied_for(:guest).of(project) }
    it { is_expected.to be_denied_for(:user) }
    it { is_expected.to be_denied_for(:external) }
    it { is_expected.to be_denied_for(:visitor) }
169 170
  end

171
  describe "GET /:project_path/snippets" do
Vinnie Okada's avatar
Vinnie Okada committed
172
    subject { namespace_project_snippets_path(project.namespace, project) }
173

174 175 176 177 178 179 180 181 182
    it { is_expected.to be_allowed_for(:admin) }
    it { is_expected.to be_allowed_for(:owner).of(project) }
    it { is_expected.to be_allowed_for(:master).of(project) }
    it { is_expected.to be_allowed_for(:developer).of(project) }
    it { is_expected.to be_allowed_for(:reporter).of(project) }
    it { is_expected.to be_allowed_for(:guest).of(project) }
    it { is_expected.to be_denied_for(:user) }
    it { is_expected.to be_denied_for(:external) }
    it { is_expected.to be_denied_for(:visitor) }
183 184 185
  end

  describe "GET /:project_path/merge_requests" do
Vinnie Okada's avatar
Vinnie Okada committed
186
    subject { namespace_project_merge_requests_path(project.namespace, project) }
187

188 189 190 191 192 193 194 195 196
    it { is_expected.to be_allowed_for(:admin) }
    it { is_expected.to be_allowed_for(:owner).of(project) }
    it { is_expected.to be_allowed_for(:master).of(project) }
    it { is_expected.to be_allowed_for(:developer).of(project) }
    it { is_expected.to be_allowed_for(:reporter).of(project) }
    it { is_expected.to be_denied_for(:guest).of(project) }
    it { is_expected.to be_denied_for(:user) }
    it { is_expected.to be_denied_for(:external) }
    it { is_expected.to be_denied_for(:visitor) }
197 198 199
  end

  describe "GET /:project_path/branches" do
Vinnie Okada's avatar
Vinnie Okada committed
200
    subject { namespace_project_branches_path(project.namespace, project) }
201 202 203

    before do
      # Speed increase
204
      allow_any_instance_of(Project).to receive(:branches).and_return([])
205 206
    end

207 208 209 210 211 212 213 214 215
    it { is_expected.to be_allowed_for(:admin) }
    it { is_expected.to be_allowed_for(:owner).of(project) }
    it { is_expected.to be_allowed_for(:master).of(project) }
    it { is_expected.to be_allowed_for(:developer).of(project) }
    it { is_expected.to be_allowed_for(:reporter).of(project) }
    it { is_expected.to be_denied_for(:guest).of(project) }
    it { is_expected.to be_denied_for(:user) }
    it { is_expected.to be_denied_for(:external) }
    it { is_expected.to be_denied_for(:visitor) }
216 217 218
  end

  describe "GET /:project_path/tags" do
Vinnie Okada's avatar
Vinnie Okada committed
219
    subject { namespace_project_tags_path(project.namespace, project) }
220 221 222

    before do
      # Speed increase
223
      allow_any_instance_of(Project).to receive(:tags).and_return([])
224 225
    end

226 227 228 229 230 231 232 233 234
    it { is_expected.to be_allowed_for(:admin) }
    it { is_expected.to be_allowed_for(:owner).of(project) }
    it { is_expected.to be_allowed_for(:master).of(project) }
    it { is_expected.to be_allowed_for(:developer).of(project) }
    it { is_expected.to be_allowed_for(:reporter).of(project) }
    it { is_expected.to be_denied_for(:guest).of(project) }
    it { is_expected.to be_denied_for(:user) }
    it { is_expected.to be_denied_for(:external) }
    it { is_expected.to be_denied_for(:visitor) }
235 236
  end

237 238
  describe "GET /:project_path/namespace/hooks" do
    subject { namespace_project_settings_integrations_path(project.namespace, project) }
239

240 241 242 243 244 245 246 247 248
    it { is_expected.to be_allowed_for(:admin) }
    it { is_expected.to be_allowed_for(:owner).of(project) }
    it { is_expected.to be_allowed_for(:master).of(project) }
    it { is_expected.to be_denied_for(:developer).of(project) }
    it { is_expected.to be_denied_for(:reporter).of(project) }
    it { is_expected.to be_denied_for(:guest).of(project) }
    it { is_expected.to be_denied_for(:user) }
    it { is_expected.to be_denied_for(:external) }
    it { is_expected.to be_denied_for(:visitor) }
249
  end
Kamil Trzcinski's avatar
Kamil Trzcinski committed
250 251 252 253

  describe "GET /:project_path/pipelines" do
    subject { namespace_project_pipelines_path(project.namespace, project) }

254 255 256 257 258 259 260 261 262
    it { is_expected.to be_allowed_for(:admin) }
    it { is_expected.to be_allowed_for(:owner).of(project) }
    it { is_expected.to be_allowed_for(:master).of(project) }
    it { is_expected.to be_allowed_for(:developer).of(project) }
    it { is_expected.to be_allowed_for(:reporter).of(project) }
    it { is_expected.to be_denied_for(:guest).of(project) }
    it { is_expected.to be_denied_for(:user) }
    it { is_expected.to be_denied_for(:external) }
    it { is_expected.to be_denied_for(:visitor) }
263 264 265

    context 'when public builds is enabled' do
      before do
Z.J. van de Weg's avatar
Z.J. van de Weg committed
266
        project.update(public_builds: true)
267 268
      end

Z.J. van de Weg's avatar
Z.J. van de Weg committed
269 270 271 272 273
      it { is_expected.to be_allowed_for(:guest).of(project) }
    end

    context 'when public buils are disabled' do
      it { is_expected.to be_denied_for(:guest).of(project) }
274
    end
Kamil Trzcinski's avatar
Kamil Trzcinski committed
275 276 277 278 279 280
  end

  describe "GET /:project_path/pipelines/:id" do
    let(:pipeline) { create(:ci_pipeline, project: project) }
    subject { namespace_project_pipeline_path(project.namespace, project, pipeline) }

281 282 283 284 285 286 287 288 289
    it { is_expected.to be_allowed_for(:admin) }
    it { is_expected.to be_allowed_for(:owner).of(project) }
    it { is_expected.to be_allowed_for(:master).of(project) }
    it { is_expected.to be_allowed_for(:developer).of(project) }
    it { is_expected.to be_allowed_for(:reporter).of(project) }
    it { is_expected.to be_denied_for(:guest).of(project) }
    it { is_expected.to be_denied_for(:user) }
    it { is_expected.to be_denied_for(:external) }
    it { is_expected.to be_denied_for(:visitor) }
290 291 292

    context 'when public builds is enabled' do
      before do
Z.J. van de Weg's avatar
Z.J. van de Weg committed
293
        project.update(public_builds: true)
294 295
      end

Z.J. van de Weg's avatar
Z.J. van de Weg committed
296 297 298 299 300
      it { is_expected.to be_allowed_for(:guest).of(project) }
    end

    context 'when public buils are disabled' do
      it { is_expected.to be_denied_for(:guest).of(project) }
301
    end
Kamil Trzcinski's avatar
Kamil Trzcinski committed
302 303 304 305 306
  end

  describe "GET /:project_path/builds" do
    subject { namespace_project_builds_path(project.namespace, project) }

307 308 309 310 311 312 313 314 315
    it { is_expected.to be_allowed_for(:admin) }
    it { is_expected.to be_allowed_for(:owner).of(project) }
    it { is_expected.to be_allowed_for(:master).of(project) }
    it { is_expected.to be_allowed_for(:developer).of(project) }
    it { is_expected.to be_allowed_for(:reporter).of(project) }
    it { is_expected.to be_denied_for(:guest).of(project) }
    it { is_expected.to be_denied_for(:user) }
    it { is_expected.to be_denied_for(:external) }
    it { is_expected.to be_denied_for(:visitor) }
316 317 318

    context 'when public builds is enabled' do
      before do
Z.J. van de Weg's avatar
Z.J. van de Weg committed
319
        project.update(public_builds: true)
320 321
      end

Z.J. van de Weg's avatar
Z.J. van de Weg committed
322 323 324 325 326
      it { is_expected.to be_allowed_for(:guest).of(project) }
    end

    context 'when public buils are disabled' do
      it { is_expected.to be_denied_for(:guest).of(project) }
327
    end
Kamil Trzcinski's avatar
Kamil Trzcinski committed
328 329 330 331 332 333 334
  end

  describe "GET /:project_path/builds/:id" do
    let(:pipeline) { create(:ci_pipeline, project: project) }
    let(:build) { create(:ci_build, pipeline: pipeline) }
    subject { namespace_project_build_path(project.namespace, project, build.id) }

335 336 337 338 339 340 341 342 343
    it { is_expected.to be_allowed_for(:admin) }
    it { is_expected.to be_allowed_for(:owner).of(project) }
    it { is_expected.to be_allowed_for(:master).of(project) }
    it { is_expected.to be_allowed_for(:developer).of(project) }
    it { is_expected.to be_allowed_for(:reporter).of(project) }
    it { is_expected.to be_denied_for(:guest).of(project) }
    it { is_expected.to be_denied_for(:user) }
    it { is_expected.to be_denied_for(:external) }
    it { is_expected.to be_denied_for(:visitor) }
344 345

    context 'when public builds is enabled' do
Z.J. van de Weg's avatar
Z.J. van de Weg committed
346 347 348 349 350
      before do
        project.update(public_builds: true)
      end

      it { is_expected.to be_allowed_for(:guest).of(project) }
351 352 353 354 355 356 357 358
    end

    context 'when public buils are disabled' do
      before do
        project.public_builds = false
        project.save
      end

Z.J. van de Weg's avatar
Z.J. van de Weg committed
359
      it { is_expected.to be_denied_for(:guest).of(project) }
360
    end
Kamil Trzcinski's avatar
Kamil Trzcinski committed
361 362 363 364 365
  end

  describe "GET /:project_path/environments" do
    subject { namespace_project_environments_path(project.namespace, project) }

366 367 368 369 370 371 372 373 374
    it { is_expected.to be_allowed_for(:admin) }
    it { is_expected.to be_allowed_for(:owner).of(project) }
    it { is_expected.to be_allowed_for(:master).of(project) }
    it { is_expected.to be_allowed_for(:developer).of(project) }
    it { is_expected.to be_allowed_for(:reporter).of(project) }
    it { is_expected.to be_denied_for(:guest).of(project) }
    it { is_expected.to be_denied_for(:user) }
    it { is_expected.to be_denied_for(:external) }
    it { is_expected.to be_denied_for(:visitor) }
Kamil Trzcinski's avatar
Kamil Trzcinski committed
375 376 377 378 379 380
  end

  describe "GET /:project_path/environments/:id" do
    let(:environment) { create(:environment, project: project) }
    subject { namespace_project_environment_path(project.namespace, project, environment) }

381 382 383 384 385 386 387 388 389
    it { is_expected.to be_allowed_for(:admin) }
    it { is_expected.to be_allowed_for(:owner).of(project) }
    it { is_expected.to be_allowed_for(:master).of(project) }
    it { is_expected.to be_allowed_for(:developer).of(project) }
    it { is_expected.to be_allowed_for(:reporter).of(project) }
    it { is_expected.to be_denied_for(:guest).of(project) }
    it { is_expected.to be_denied_for(:user) }
    it { is_expected.to be_denied_for(:external) }
    it { is_expected.to be_denied_for(:visitor) }
Kamil Trzcinski's avatar
Kamil Trzcinski committed
390 391 392 393 394
  end

  describe "GET /:project_path/environments/new" do
    subject { new_namespace_project_environment_path(project.namespace, project) }

395 396 397 398 399 400 401 402 403
    it { is_expected.to be_allowed_for(:admin) }
    it { is_expected.to be_allowed_for(:owner).of(project) }
    it { is_expected.to be_allowed_for(:master).of(project) }
    it { is_expected.to be_allowed_for(:developer).of(project) }
    it { is_expected.to be_denied_for(:reporter).of(project) }
    it { is_expected.to be_denied_for(:guest).of(project) }
    it { is_expected.to be_denied_for(:user) }
    it { is_expected.to be_denied_for(:external) }
    it { is_expected.to be_denied_for(:visitor) }
Kamil Trzcinski's avatar
Kamil Trzcinski committed
404
  end
405 406 407 408 409 410 411 412 413

  describe "GET /:project_path/container_registry" do
    before do
      stub_container_registry_tags('latest')
      stub_container_registry_config(enabled: true)
    end

    subject { namespace_project_container_registry_index_path(project.namespace, project) }

414 415 416 417 418 419 420 421 422
    it { is_expected.to be_allowed_for(:admin) }
    it { is_expected.to be_allowed_for(:owner).of(project) }
    it { is_expected.to be_allowed_for(:master).of(project) }
    it { is_expected.to be_allowed_for(:developer).of(project) }
    it { is_expected.to be_allowed_for(:reporter).of(project) }
    it { is_expected.to be_denied_for(:guest).of(project) }
    it { is_expected.to be_denied_for(:user) }
    it { is_expected.to be_denied_for(:external) }
    it { is_expected.to be_denied_for(:visitor) }
423
  end
424
end