allow all git-upload-* commands for deploy keys

2 files changed, 37 insertions, 1 deletions

diff --git a/lib/api/internal.rb b/lib/api/internal.rb
index a602dc05418..bd28bef2ab2 100644
--- a/lib/api/internal.rb
+++ b/lib/api/internal.rb
@@ -26,7 +26,7 @@ module API
 
 
         if key.is_a? DeployKey
-          key.projects.include?(project) && git_cmd == 'git-upload-pack'
+          key.projects.include?(project) && git_cmd.starts_with?('git-upload-')
         else
           user = key.user
 
diff --git a/spec/requests/api/internal_spec.rb b/spec/requests/api/internal_spec.rb
index 5a43953d15c..028617aa08e 100644
--- a/spec/requests/api/internal_spec.rb
+++ b/spec/requests/api/internal_spec.rb
@@ -100,6 +100,32 @@ describe API::API do
         end
       end
     end
+
+    context "deploy key" do
+      let(:key) { create(:deploy_key) }
+
+      context "added to project" do
+        before do
+          key.projects << project
+        end
+
+        it do
+          archive(key, project)
+
+          response.status.should == 200
+          response.body.should == 'true'
+        end
+      end
+
+      context "not added to project" do
+        it do
+          archive(key, project)
+
+          response.status.should == 200
+          response.body.should == 'false'
+        end
+      end
+    end
   end
 
   def pull(key, project)
@@ -121,4 +147,14 @@ describe API::API do
       action: 'git-receive-pack'
     )
   end
+
+  def archive(key, project)
+    get(
+      api("/internal/allowed"),
+      ref: 'master',
+      key_id: key.id,
+      project: project.path_with_namespace,
+      action: 'git-upload-archive'
+    )
+  end
 end