global_policy_spec.rb 5.67 KB
Newer Older
1 2
require 'spec_helper'

3
describe GlobalPolicy do
4 5
  include TermsHelper

6 7 8
  let(:current_user) { create(:user) }
  let(:user) { create(:user) }

9
  subject { described_class.new(current_user, [user]) }
10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34

  describe "reading the list of users" do
    context "for a logged in user" do
      it { is_expected.to be_allowed(:read_users_list) }
    end

    context "for an anonymous user" do
      let(:current_user) { nil }

      context "when the public level is restricted" do
        before do
          stub_application_setting(restricted_visibility_levels: [Gitlab::VisibilityLevel::PUBLIC])
        end

        it { is_expected.not_to be_allowed(:read_users_list) }
      end

      context "when the public level is not restricted" do
        before do
          stub_application_setting(restricted_visibility_levels: [])
        end

        it { is_expected.to be_allowed(:read_users_list) }
      end
    end
35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54

    context "for an admin" do
      let(:current_user) { create(:admin) }

      context "when the public level is restricted" do
        before do
          stub_application_setting(restricted_visibility_levels: [Gitlab::VisibilityLevel::PUBLIC])
        end

        it { is_expected.to be_allowed(:read_users_list) }
      end

      context "when the public level is not restricted" do
        before do
          stub_application_setting(restricted_visibility_levels: [])
        end

        it { is_expected.to be_allowed(:read_users_list) }
      end
    end
55
  end
56

57 58 59 60 61 62 63 64 65 66 67
  describe "create fork" do
    context "when user has not exceeded project limit" do
      it { is_expected.to be_allowed(:create_fork) }
    end

    context "when user has exceeded project limit" do
      let(:current_user) { create(:user, projects_limit: 0) }

      it { is_expected.not_to be_allowed(:create_fork) }
    end

68
    context "when user is a maintainer in a group" do
69 70 71 72
      let(:group) { create(:group) }
      let(:current_user) { create(:user, projects_limit: 0) }

      before do
73
        group.add_maintainer(current_user)
74 75 76 77 78 79
      end

      it { is_expected.to be_allowed(:create_fork) }
    end
  end

80 81 82 83 84 85 86 87 88 89 90 91 92
  describe 'custom attributes' do
    context 'regular user' do
      it { is_expected.not_to be_allowed(:read_custom_attribute) }
      it { is_expected.not_to be_allowed(:update_custom_attribute) }
    end

    context 'admin' do
      let(:current_user) { create(:user, :admin) }

      it { is_expected.to be_allowed(:read_custom_attribute) }
      it { is_expected.to be_allowed(:update_custom_attribute) }
    end
  end
93

94 95 96 97 98 99 100 101 102 103
  shared_examples 'access allowed when terms accepted' do |ability|
    it { is_expected.not_to be_allowed(ability) }

    it "allows #{ability} when the user accepted the terms" do
      accept_terms(current_user)

      is_expected.to be_allowed(ability)
    end
  end

104
  describe 'API access' do
105
    context 'regular user' do
106 107 108
      it { is_expected.to be_allowed(:access_api) }
    end

109
    context 'admin' do
110 111 112 113 114
      let(:current_user) { create(:admin) }

      it { is_expected.to be_allowed(:access_api) }
    end

115
    context 'anonymous' do
116 117
      let(:current_user) { nil }

118
      it { is_expected.to be_allowed(:access_api) }
119 120 121 122 123 124 125
    end

    context 'when terms are enforced' do
      before do
        enforce_terms
      end

126 127 128 129 130 131 132 133 134
      context 'regular user' do
        it_behaves_like 'access allowed when terms accepted', :access_api
      end

      context 'admin' do
        let(:current_user) { create(:admin) }

        it_behaves_like 'access allowed when terms accepted', :access_api
      end
135

136 137
      context 'anonymous' do
        let(:current_user) { nil }
138

139
        it { is_expected.to be_allowed(:access_api) }
140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157
      end
    end
  end

  describe 'git access' do
    describe 'regular user' do
      it { is_expected.to be_allowed(:access_git) }
    end

    describe 'admin' do
      let(:current_user) { create(:admin) }

      it { is_expected.to be_allowed(:access_git) }
    end

    describe 'anonymous' do
      let(:current_user) { nil }

158
      it { is_expected.to be_allowed(:access_git) }
159 160 161 162 163 164 165
    end

    context 'when terms are enforced' do
      before do
        enforce_terms
      end

166 167 168 169 170 171 172 173 174
      context 'regular user' do
        it_behaves_like 'access allowed when terms accepted', :access_git
      end

      context 'admin' do
        let(:current_user) { create(:admin) }

        it_behaves_like 'access allowed when terms accepted', :access_git
      end
175

176 177
      context 'anonymous' do
        let(:current_user) { nil }
178

179
        it { is_expected.to be_allowed(:access_git) }
180 181 182
      end
    end
  end
183

184 185 186 187 188 189 190 191 192 193 194 195
  describe 'read instance metadata' do
    context 'regular user' do
      it { is_expected.to be_allowed(:read_instance_metadata) }
    end

    context 'anonymous' do
      let(:current_user) { nil }

      it { is_expected.not_to be_allowed(:read_instance_metadata) }
    end
  end

196 197
  describe 'read instance statistics' do
    context 'regular user' do
198
      it { is_expected.to be_allowed(:read_instance_statistics) }
199 200 201 202 203 204 205 206 207 208 209 210 211

      context 'when instance statistics are set to private' do
        before do
          stub_application_setting(instance_statistics_visibility_private: true)
        end

        it { is_expected.not_to be_allowed(:read_instance_statistics) }
      end
    end

    context 'admin' do
      let(:current_user) { create(:admin) }

212
      it { is_expected.to be_allowed(:read_instance_statistics) }
213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228

      context 'when instance statistics are set to private' do
        before do
          stub_application_setting(instance_statistics_visibility_private: true)
        end

        it { is_expected.to be_allowed(:read_instance_statistics) }
      end
    end

    context 'anonymous' do
      let(:current_user) { nil }

      it { is_expected.not_to be_allowed(:read_instance_statistics) }
    end
  end
229
end