Merge branch 'master' into collapsable-pipeline-settingscollapsable-pipeline-settings

* master: (260 commits)
  Enable auto-retry in GitLab CI/CD pipeline
  Clean up new navigation templates
  Wait for gitaly to boot during tests
  Update 'Visibility of pipelines'
  refactored code
  Fix note resolution specs
  Add author and MR to changelog
  Tidy up projects API specs
  Resolve outdated diff discussions on push
  Fix migration
  change collapse to resolve and comments to discussions
  add unit tests for new collapse_outdated_diff_comments toggle
  Add functionality to collapse outdated diff comments regardless of discussion resolution
  refactor code based on feedback
  fix spec failures
  Use flexbox for prometheus graph row grouping instead of bootstrap classes
  Fix wrong API status codes
  small refactor
  Hide admin link from default search results for non-admins
  Make search dropdowns consistent
  ...

1 files changed, 326 insertions, 0 deletions

diff --git a/spec/requests/api/users_spec.rb b/spec/requests/api/users_spec.rb
index 5fef4437997..37cb95a16e3 100644
--- a/spec/requests/api/users_spec.rb
+++ b/spec/requests/api/users_spec.rb
@@ -4,6 +4,7 @@ describe API::Users do
   let(:user)  { create(:user) }
   let(:admin) { create(:admin) }
   let(:key) { create(:key, user: user) }
+  let(:gpg_key) { create(:gpg_key, user: user) }
   let(:email) { create(:email, user: user) }
   let(:omniauth_user) { create(:omniauth_user) }
   let(:ldap_user) { create(:omniauth_user, provider: 'ldapmain') }
@@ -753,6 +754,164 @@ describe API::Users do
     end
   end
 
+  describe 'POST /users/:id/keys' do
+    before do
+      admin
+    end
+
+    it 'does not create invalid GPG key' do
+      post api("/users/#{user.id}/gpg_keys", admin)
+
+      expect(response).to have_http_status(400)
+      expect(json_response['error']).to eq('key is missing')
+    end
+
+    it 'creates GPG key' do
+      key_attrs = attributes_for :gpg_key
+      expect do
+        post api("/users/#{user.id}/gpg_keys", admin), key_attrs
+
+        expect(response).to have_http_status(201)
+      end.to change { user.gpg_keys.count }.by(1)
+    end
+
+    it 'returns 400 for invalid ID' do
+      post api('/users/999999/gpg_keys', admin)
+
+      expect(response).to have_http_status(400)
+    end
+  end
+
+  describe 'GET /user/:id/gpg_keys' do
+    before do
+      admin
+    end
+
+    context 'when unauthenticated' do
+      it 'returns authentication error' do
+        get api("/users/#{user.id}/gpg_keys")
+
+        expect(response).to have_http_status(401)
+      end
+    end
+
+    context 'when authenticated' do
+      it 'returns 404 for non-existing user' do
+        get api('/users/999999/gpg_keys', admin)
+
+        expect(response).to have_http_status(404)
+        expect(json_response['message']).to eq('404 User Not Found')
+      end
+
+      it 'returns 404 error if key not foud' do
+        delete api("/users/#{user.id}/gpg_keys/42", admin)
+
+        expect(response).to have_http_status(404)
+        expect(json_response['message']).to eq('404 GPG Key Not Found')
+      end
+
+      it 'returns array of GPG keys' do
+        user.gpg_keys << gpg_key
+        user.save
+
+        get api("/users/#{user.id}/gpg_keys", admin)
+
+        expect(response).to have_http_status(200)
+        expect(response).to include_pagination_headers
+        expect(json_response).to be_an Array
+        expect(json_response.first['key']).to eq(gpg_key.key)
+      end
+    end
+  end
+
+  describe 'DELETE /user/:id/gpg_keys/:key_id' do
+    before do
+      admin
+    end
+
+    context 'when unauthenticated' do
+      it 'returns authentication error' do
+        delete api("/users/#{user.id}/keys/42")
+
+        expect(response).to have_http_status(401)
+      end
+    end
+
+    context 'when authenticated' do
+      it 'deletes existing key' do
+        user.gpg_keys << gpg_key
+        user.save
+
+        expect do
+          delete api("/users/#{user.id}/gpg_keys/#{gpg_key.id}", admin)
+
+          expect(response).to have_http_status(204)
+        end.to change { user.gpg_keys.count }.by(-1)
+      end
+
+      it 'returns 404 error if user not found' do
+        user.keys << key
+        user.save
+
+        delete api("/users/999999/gpg_keys/#{gpg_key.id}", admin)
+
+        expect(response).to have_http_status(404)
+        expect(json_response['message']).to eq('404 User Not Found')
+      end
+
+      it 'returns 404 error if key not foud' do
+        delete api("/users/#{user.id}/gpg_keys/42", admin)
+
+        expect(response).to have_http_status(404)
+        expect(json_response['message']).to eq('404 GPG Key Not Found')
+      end
+    end
+  end
+
+  describe 'POST /user/:id/gpg_keys/:key_id/revoke' do
+    before do
+      admin
+    end
+
+    context 'when unauthenticated' do
+      it 'returns authentication error' do
+        post api("/users/#{user.id}/gpg_keys/42/revoke")
+
+        expect(response).to have_http_status(401)
+      end
+    end
+
+    context 'when authenticated' do
+      it 'revokes existing key' do
+        user.gpg_keys << gpg_key
+        user.save
+
+        expect do
+          post api("/users/#{user.id}/gpg_keys/#{gpg_key.id}/revoke", admin)
+
+          expect(response).to have_http_status(:accepted)
+        end.to change { user.gpg_keys.count }.by(-1)
+      end
+
+      it 'returns 404 error if user not found' do
+        user.gpg_keys << gpg_key
+        user.save
+
+        post api("/users/999999/gpg_keys/#{gpg_key.id}/revoke", admin)
+
+        expect(response).to have_http_status(404)
+        expect(json_response['message']).to eq('404 User Not Found')
+      end
+
+      it 'returns 404 error if key not foud' do
+        post api("/users/#{user.id}/gpg_keys/42/revoke", admin)
+
+        expect(response).to have_http_status(404)
+        expect(json_response['message']).to eq('404 GPG Key Not Found')
+      end
+    end
+  end
+
   describe "POST /users/:id/emails" do
     before do
       admin
@@ -1153,6 +1312,173 @@ describe API::Users do
     end
   end
 
+  describe 'GET /user/gpg_keys' do
+    context 'when unauthenticated' do
+      it 'returns authentication error' do
+        get api('/user/gpg_keys')
+
+        expect(response).to have_http_status(401)
+      end
+    end
+
+    context 'when authenticated' do
+      it 'returns array of GPG keys' do
+        user.gpg_keys << gpg_key
+        user.save
+
+        get api('/user/gpg_keys', user)
+
+        expect(response).to have_http_status(200)
+        expect(response).to include_pagination_headers
+        expect(json_response).to be_an Array
+        expect(json_response.first['key']).to eq(gpg_key.key)
+      end
+
+      context 'scopes' do
+        let(:path) { '/user/gpg_keys' }
+        let(:api_call) { method(:api) }
+
+        include_examples 'allows the "read_user" scope'
+      end
+    end
+  end
+
+  describe 'GET /user/gpg_keys/:key_id' do
+    it 'returns a single key' do
+      user.gpg_keys << gpg_key
+      user.save
+
+      get api("/user/gpg_keys/#{gpg_key.id}", user)
+
+      expect(response).to have_http_status(200)
+      expect(json_response['key']).to eq(gpg_key.key)
+    end
+
+    it 'returns 404 Not Found within invalid ID' do
+      get api('/user/gpg_keys/42', user)
+
+      expect(response).to have_http_status(404)
+      expect(json_response['message']).to eq('404 GPG Key Not Found')
+    end
+
+    it "returns 404 error if admin accesses user's GPG key" do
+      user.gpg_keys << gpg_key
+      user.save
+
+      get api("/user/gpg_keys/#{gpg_key.id}", admin)
+
+      expect(response).to have_http_status(404)
+      expect(json_response['message']).to eq('404 GPG Key Not Found')
+    end
+
+    it 'returns 404 for invalid ID' do
+      get api('/users/gpg_keys/ASDF', admin)
+
+      expect(response).to have_http_status(404)
+    end
+
+    context 'scopes' do
+      let(:path) { "/user/gpg_keys/#{gpg_key.id}" }
+      let(:api_call) { method(:api) }
+
+      include_examples 'allows the "read_user" scope'
+    end
+  end
+
+  describe 'POST /user/gpg_keys' do
+    it 'creates a GPG key' do
+      key_attrs = attributes_for :gpg_key
+      expect do
+        post api('/user/gpg_keys', user), key_attrs
+
+        expect(response).to have_http_status(201)
+      end.to change { user.gpg_keys.count }.by(1)
+    end
+
+    it 'returns a 401 error if unauthorized' do
+      post api('/user/gpg_keys'), key: 'some key'
+
+      expect(response).to have_http_status(401)
+    end
+
+    it 'does not create GPG key without key' do
+      post api('/user/gpg_keys', user)
+
+      expect(response).to have_http_status(400)
+      expect(json_response['error']).to eq('key is missing')
+    end
+  end
+
+  describe 'POST /user/gpg_keys/:key_id/revoke' do
+    it 'revokes existing GPG key' do
+      user.gpg_keys << gpg_key
+      user.save
+
+      expect do
+        post api("/user/gpg_keys/#{gpg_key.id}/revoke", user)
+
+        expect(response).to have_http_status(:accepted)
+      end.to change { user.gpg_keys.count}.by(-1)
+    end
+
+    it 'returns 404 if key ID not found' do
+      post api('/user/gpg_keys/42/revoke', user)
+
+      expect(response).to have_http_status(404)
+      expect(json_response['message']).to eq('404 GPG Key Not Found')
+    end
+
+    it 'returns 401 error if unauthorized' do
+      user.gpg_keys << gpg_key
+      user.save
+
+      post api("/user/gpg_keys/#{gpg_key.id}/revoke")
+
+      expect(response).to have_http_status(401)
+    end
+
+    it 'returns a 404 for invalid ID' do
+      post api('/users/gpg_keys/ASDF/revoke', admin)
+
+      expect(response).to have_http_status(404)
+    end
+  end
+
+  describe 'DELETE /user/gpg_keys/:key_id' do
+    it 'deletes existing GPG key' do
+      user.gpg_keys << gpg_key
+      user.save
+
+      expect do
+        delete api("/user/gpg_keys/#{gpg_key.id}", user)
+
+        expect(response).to have_http_status(204)
+      end.to change { user.gpg_keys.count}.by(-1)
+    end
+
+    it 'returns 404 if key ID not found' do
+      delete api('/user/gpg_keys/42', user)
+
+      expect(response).to have_http_status(404)
+      expect(json_response['message']).to eq('404 GPG Key Not Found')
+    end
+
+    it 'returns 401 error if unauthorized' do
+      user.gpg_keys << gpg_key
+      user.save
+
+      delete api("/user/gpg_keys/#{gpg_key.id}")
+
+      expect(response).to have_http_status(401)
+    end
+
+    it 'returns a 404 for invalid ID' do
+      delete api('/users/gpg_keys/ASDF', admin)
+
+      expect(response).to have_http_status(404)
+    end
+  end
+
   describe "GET /user/emails" do
     context "when unauthenticated" do
       it "returns authentication error" do