Backport API to V3

15 files changed, 527 insertions, 25 deletions

diff --git a/spec/requests/api/project_snippets_spec.rb b/spec/requests/api/project_snippets_spec.rb
index e382d89c6ef..2c4602faf2c 100644
--- a/spec/requests/api/project_snippets_spec.rb
+++ b/spec/requests/api/project_snippets_spec.rb
@@ -212,7 +212,7 @@ describe API::ProjectSnippets, api: true do
     end
 
     it 'returns 404 for invalid snippet id' do
-      get api("/projects/#{snippet.project.id}/snippets/1234", admin)
+      get api("/projects/#{snippet.project.id}/snippets/1234/raw", admin)
 
       expect(response).to have_http_status(404)
       expect(json_response['message']).to eq('404 Snippet Not Found')
diff --git a/spec/requests/api/v3/award_emoji_spec.rb b/spec/requests/api/v3/award_emoji_spec.rb
new file mode 100644
index 00000000000..91145c8e72c
--- /dev/null
+++ b/spec/requests/api/v3/award_emoji_spec.rb
@@ -0,0 +1,74 @@
+require 'spec_helper'
+
+describe API::V3::AwardEmoji, api: true  do
+  include ApiHelpers
+
+  let(:user)            { create(:user) }
+  let!(:project)        { create(:empty_project) }
+  let(:issue)           { create(:issue, project: project) }
+  let!(:award_emoji)    { create(:award_emoji, awardable: issue, user: user) }
+  let!(:merge_request)  { create(:merge_request, source_project: project, target_project: project) }
+  let!(:downvote)       { create(:award_emoji, :downvote, awardable: merge_request, user: user) }
+  let!(:note)           { create(:note, project: project, noteable: issue) }
+
+  before { project.team << [user, :master] }
+
+  describe 'DELETE /projects/:id/awardable/:awardable_id/award_emoji/:award_id' do
+    context 'when the awardable is an Issue' do
+      it 'deletes the award' do
+        expect do
+          delete v3_api("/projects/#{project.id}/issues/#{issue.id}/award_emoji/#{award_emoji.id}", user)
+
+          expect(response).to have_http_status(200)
+        end.to change { issue.award_emoji.count }.from(1).to(0)
+      end
+
+      it 'returns a 404 error when the award emoji can not be found' do
+        delete v3_api("/projects/#{project.id}/issues/#{issue.id}/award_emoji/12345", user)
+
+        expect(response).to have_http_status(404)
+      end
+    end
+
+    context 'when the awardable is a Merge Request' do
+      it 'deletes the award' do
+        expect do
+          delete v3_api("/projects/#{project.id}/merge_requests/#{merge_request.id}/award_emoji/#{downvote.id}", user)
+
+          expect(response).to have_http_status(200)
+        end.to change { merge_request.award_emoji.count }.from(1).to(0)
+      end
+
+      it 'returns a 404 error when note id not found' do
+        delete v3_api("/projects/#{project.id}/merge_requests/#{merge_request.id}/notes/12345", user)
+
+        expect(response).to have_http_status(404)
+      end
+    end
+
+    context 'when the awardable is a Snippet' do
+      let(:snippet) { create(:project_snippet, :public, project: project) }
+      let!(:award)  { create(:award_emoji, awardable: snippet, user: user) }
+
+      it 'deletes the award' do
+        expect do
+          delete v3_api("/projects/#{project.id}/snippets/#{snippet.id}/award_emoji/#{award.id}", user)
+
+          expect(response).to have_http_status(200)
+        end.to change { snippet.award_emoji.count }.from(1).to(0)
+      end
+    end
+  end
+
+  describe 'DELETE /projects/:id/awardable/:awardable_id/award_emoji/:award_emoji_id' do
+    let!(:rocket)  { create(:award_emoji, awardable: note, name: 'rocket', user: user) }
+
+    it 'deletes the award' do
+      expect do
+        delete v3_api("/projects/#{project.id}/issues/#{issue.id}/notes/#{note.id}/award_emoji/#{rocket.id}", user)
+
+        expect(response).to have_http_status(200)
+      end.to change { note.award_emoji.count }.from(1).to(0)
+    end
+  end
+end
diff --git a/spec/requests/api/v3/boards_spec.rb b/spec/requests/api/v3/boards_spec.rb
index 8aaf3be4f87..eb95934f354 100644
--- a/spec/requests/api/v3/boards_spec.rb
+++ b/spec/requests/api/v3/boards_spec.rb
@@ -5,6 +5,7 @@ describe API::V3::Boards, api: true  do
 
   let(:user)        { create(:user) }
   let(:guest)       { create(:user) }
+  let(:non_member)  { create(:user) }
   let!(:project)    { create(:empty_project, :public, creator_id: user.id, namespace: user.namespace ) }
 
   let!(:dev_label) do
@@ -76,4 +77,37 @@ describe API::V3::Boards, api: true  do
       expect(response).to have_http_status(404)
     end
   end
+
+  describe "DELETE /projects/:id/board/lists/:list_id" do
+    let(:base_url) { "/projects/#{project.id}/boards/#{board.id}/lists" }
+
+    it "rejects a non member from deleting a list" do
+      delete v3_api("#{base_url}/#{dev_list.id}", non_member)
+
+      expect(response).to have_http_status(403)
+    end
+
+    it "rejects a user with guest role from deleting a list" do
+      delete v3_api("#{base_url}/#{dev_list.id}", guest)
+
+      expect(response).to have_http_status(403)
+    end
+
+    it "returns 404 error if list id not found" do
+      delete v3_api("#{base_url}/44444", user)
+
+      expect(response).to have_http_status(404)
+    end
+
+    context "when the user is project owner" do
+      let(:owner)     { create(:user) }
+      let(:project)   { create(:empty_project, namespace: owner.namespace) }
+
+      it "deletes the list if an admin requests it" do
+        delete v3_api("#{base_url}/#{dev_list.id}", owner)
+
+        expect(response).to have_http_status(200)
+      end
+    end
+  end
 end
diff --git a/spec/requests/api/v3/branches_spec.rb b/spec/requests/api/v3/branches_spec.rb
index a3e1581fcc5..e4cedf98e64 100644
--- a/spec/requests/api/v3/branches_spec.rb
+++ b/spec/requests/api/v3/branches_spec.rb
@@ -5,8 +5,12 @@ describe API::V3::Branches, api: true  do
   include ApiHelpers
 
   let(:user) { create(:user) }
+  let(:user2) { create(:user) }
   let!(:project) { create(:project, :repository, creator: user) }
   let!(:master) { create(:project_member, :master, user: user, project: project) }
+  let!(:guest) { create(:project_member, :guest, user: user2, project: project) }
+  let!(:branch_name) { 'feature' }
+  let!(:branch_with_dot) { CreateBranchService.new(project, user).execute("with.1.2.3", "master") }
 
   describe "GET /projects/:id/repository/branches" do
     it "returns an array of project branches" do
@@ -21,6 +25,44 @@ describe API::V3::Branches, api: true  do
     end
   end
 
+  describe "DELETE /projects/:id/repository/branches/:branch" do
+    before do
+      allow_any_instance_of(Repository).to receive(:rm_branch).and_return(true)
+    end
+
+    it "removes branch" do
+      delete v3_api("/projects/#{project.id}/repository/branches/#{branch_name}", user)
+
+      expect(response).to have_http_status(200)
+      expect(json_response['branch_name']).to eq(branch_name)
+    end
+
+    it "removes a branch with dots in the branch name" do
+      delete v3_api("/projects/#{project.id}/repository/branches/with.1.2.3", user)
+
+      expect(response).to have_http_status(200)
+      expect(json_response['branch_name']).to eq("with.1.2.3")
+    end
+
+    it 'returns 404 if branch not exists' do
+      delete v3_api("/projects/#{project.id}/repository/branches/foobar", user)
+      expect(response).to have_http_status(404)
+    end
+
+    it "removes protected branch" do
+      create(:protected_branch, project: project, name: branch_name)
+      delete v3_api("/projects/#{project.id}/repository/branches/#{branch_name}", user)
+      expect(response).to have_http_status(405)
+      expect(json_response['message']).to eq('Protected branch cant be removed')
+    end
+
+    it "does not remove HEAD branch" do
+      delete v3_api("/projects/#{project.id}/repository/branches/master", user)
+      expect(response).to have_http_status(405)
+      expect(json_response['message']).to eq('Cannot remove HEAD branch')
+    end
+  end
+
   describe "DELETE /projects/:id/repository/merged_branches" do
     before do
       allow_any_instance_of(Repository).to receive(:rm_branch).and_return(true)
@@ -33,10 +75,7 @@ describe API::V3::Branches, api: true  do
     end
 
     it 'returns a 403 error if guest' do
-      user_b = create :user
-      create(:project_member, :guest, user: user_b, project: project)
-
-      delete v3_api("/projects/#{project.id}/repository/merged_branches", user_b)
+      delete v3_api("/projects/#{project.id}/repository/merged_branches", user2)
 
       expect(response).to have_http_status(403)
     end
diff --git a/spec/requests/api/v3/broadcast_messages_spec.rb b/spec/requests/api/v3/broadcast_messages_spec.rb
new file mode 100644
index 00000000000..06556401a29
--- /dev/null
+++ b/spec/requests/api/v3/broadcast_messages_spec.rb
@@ -0,0 +1,34 @@
+require 'spec_helper'
+
+describe API::V3::BroadcastMessages, api: true do
+  include ApiHelpers
+
+  let(:user)  { create(:user) }
+  let(:admin) { create(:admin) }
+
+  describe 'DELETE /broadcast_messages/:id' do
+    let!(:message) { create(:broadcast_message) }
+
+    it 'returns a 401 for anonymous users' do
+      delete v3_api("/broadcast_messages/#{message.id}"),
+        attributes_for(:broadcast_message)
+
+      expect(response).to have_http_status(401)
+    end
+
+    it 'returns a 403 for users' do
+      delete v3_api("/broadcast_messages/#{message.id}", user),
+        attributes_for(:broadcast_message)
+
+      expect(response).to have_http_status(403)
+    end
+
+    it 'deletes the broadcast message for admins' do
+      expect do
+        delete v3_api("/broadcast_messages/#{message.id}", admin)
+
+        expect(response).to have_http_status(200)
+      end.to change { BroadcastMessage.count }.by(-1)
+    end
+  end
+end
diff --git a/spec/requests/api/v3/environments_spec.rb b/spec/requests/api/v3/environments_spec.rb
new file mode 100644
index 00000000000..1ac666ab240
--- /dev/null
+++ b/spec/requests/api/v3/environments_spec.rb
@@ -0,0 +1,39 @@
+require 'spec_helper'
+
+describe API::V3::Environments, api: true  do
+  include ApiHelpers
+
+  let(:user)          { create(:user) }
+  let(:non_member)    { create(:user) }
+  let(:project)       { create(:empty_project, :private, namespace: user.namespace) }
+  let!(:environment)  { create(:environment, project: project) }
+
+  before do
+    project.team << [user, :master]
+  end
+
+  describe 'DELETE /projects/:id/environments/:environment_id' do
+    context 'as a master' do
+      it 'returns a 200 for an existing environment' do
+        delete v3_api("/projects/#{project.id}/environments/#{environment.id}", user)
+
+        expect(response).to have_http_status(200)
+      end
+
+      it 'returns a 404 for non existing id' do
+        delete v3_api("/projects/#{project.id}/environments/12345", user)
+
+        expect(response).to have_http_status(404)
+        expect(json_response['message']).to eq('404 Not found')
+      end
+    end
+
+    context 'a non member' do
+      it 'rejects the request' do
+        delete v3_api("/projects/#{project.id}/environments/#{environment.id}", non_member)
+
+        expect(response).to have_http_status(404)
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/v3/files_spec.rb b/spec/requests/api/v3/files_spec.rb
index 52fd908af7d..93637053626 100644
--- a/spec/requests/api/v3/files_spec.rb
+++ b/spec/requests/api/v3/files_spec.rb
@@ -2,17 +2,6 @@ require 'spec_helper'
 
 describe API::V3::Files, api: true  do
   include ApiHelpers
-  let(:user) { create(:user) }
-  let!(:project) { create(:project, :repository, namespace: user.namespace ) }
-  let(:guest) { create(:user) { |u| project.add_guest(u) } }
-  let(:file_path) { 'files/ruby/popen.rb' }
-  let(:params) do
-    {
-      file_path: file_path,
-      ref: 'master'
-    }
-  end
-  let(:author_email) { FFaker::Internet.email }
 
   # I have to remove periods from the end of the name
   # This happened when the user's name had a suffix (i.e. "Sr.")
@@ -26,6 +15,18 @@ describe API::V3::Files, api: true  do
   # ...
   # Author: Foo Sr <foo@example.com>
   # ...
+
+  let(:user) { create(:user) }
+  let!(:project) { create(:project, :repository, namespace: user.namespace ) }
+  let(:guest) { create(:user) { |u| project.add_guest(u) } }
+  let(:file_path) { 'files/ruby/popen.rb' }
+  let(:params) do
+    {
+      file_path: file_path,
+      ref: 'master'
+    }
+  end
+  let(:author_email) { FFaker::Internet.email }
   let(:author_name) { FFaker::Name.name.chomp("\.") }
 
   before { project.team << [user, :developer] }
diff --git a/spec/requests/api/v3/labels_spec.rb b/spec/requests/api/v3/labels_spec.rb
index f44403374e9..dfac357d37c 100644
--- a/spec/requests/api/v3/labels_spec.rb
+++ b/spec/requests/api/v3/labels_spec.rb
@@ -149,4 +149,23 @@ describe API::V3::Labels, api: true  do
       end
     end
   end
+
+  describe 'DELETE /projects/:id/labels' do
+    it 'returns 200 for existing label' do
+      delete v3_api("/projects/#{project.id}/labels", user), name: 'label1'
+
+      expect(response).to have_http_status(200)
+    end
+
+    it 'returns 404 for non existing label' do
+      delete v3_api("/projects/#{project.id}/labels", user), name: 'label2'
+      expect(response).to have_http_status(404)
+      expect(json_response['message']).to eq('404 Label Not Found')
+    end
+
+    it 'returns 400 for wrong parameters' do
+      delete v3_api("/projects/#{project.id}/labels", user)
+      expect(response).to have_http_status(400)
+    end
+  end
 end
diff --git a/spec/requests/api/v3/members_spec.rb b/spec/requests/api/v3/members_spec.rb
index 28c3ca03960..13814ed10c3 100644
--- a/spec/requests/api/v3/members_spec.rb
+++ b/spec/requests/api/v3/members_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe API::Members, api: true  do
+describe API::V3::Members, api: true  do
   include ApiHelpers
 
   let(:master) { create(:user) }
diff --git a/spec/requests/api/v3/notes_spec.rb b/spec/requests/api/v3/notes_spec.rb
index b51cb3055d5..b8f0260c6a2 100644
--- a/spec/requests/api/v3/notes_spec.rb
+++ b/spec/requests/api/v3/notes_spec.rb
@@ -2,6 +2,7 @@ require 'spec_helper'
 
 describe API::V3::Notes, api: true  do
   include ApiHelpers
+
   let(:user) { create(:user) }
   let!(:project) { create(:empty_project, :public, namespace: user.namespace) }
   let!(:issue) { create(:issue, project: project, author: user) }
@@ -373,12 +374,12 @@ describe API::V3::Notes, api: true  do
     context 'when noteable is an Issue' do
       it 'deletes a note' do
         delete v3_api("/projects/#{project.id}/issues/#{issue.id}/"\
-                   "notes/#{issue_note.id}", user)
+                      "notes/#{issue_note.id}", user)
 
         expect(response).to have_http_status(200)
         # Check if note is really deleted
         delete v3_api("/projects/#{project.id}/issues/#{issue.id}/"\
-                   "notes/#{issue_note.id}", user)
+                      "notes/#{issue_note.id}", user)
         expect(response).to have_http_status(404)
       end
 
@@ -392,18 +393,18 @@ describe API::V3::Notes, api: true  do
     context 'when noteable is a Snippet' do
       it 'deletes a note' do
         delete v3_api("/projects/#{project.id}/snippets/#{snippet.id}/"\
-                   "notes/#{snippet_note.id}", user)
+                      "notes/#{snippet_note.id}", user)
 
         expect(response).to have_http_status(200)
         # Check if note is really deleted
         delete v3_api("/projects/#{project.id}/snippets/#{snippet.id}/"\
-                   "notes/#{snippet_note.id}", user)
+                      "notes/#{snippet_note.id}", user)
         expect(response).to have_http_status(404)
       end
 
       it 'returns a 404 error when note id not found' do
         delete v3_api("/projects/#{project.id}/snippets/#{snippet.id}/"\
-                   "notes/12345", user)
+                      "notes/12345", user)
 
         expect(response).to have_http_status(404)
       end
@@ -412,18 +413,18 @@ describe API::V3::Notes, api: true  do
     context 'when noteable is a Merge Request' do
       it 'deletes a note' do
         delete v3_api("/projects/#{project.id}/merge_requests/"\
-                   "#{merge_request.id}/notes/#{merge_request_note.id}", user)
+                      "#{merge_request.id}/notes/#{merge_request_note.id}", user)
 
         expect(response).to have_http_status(200)
         # Check if note is really deleted
         delete v3_api("/projects/#{project.id}/merge_requests/"\
-                   "#{merge_request.id}/notes/#{merge_request_note.id}", user)
+                      "#{merge_request.id}/notes/#{merge_request_note.id}", user)
         expect(response).to have_http_status(404)
       end
 
       it 'returns a 404 error when note id not found' do
         delete v3_api("/projects/#{project.id}/merge_requests/"\
-                   "#{merge_request.id}/notes/12345", user)
+                      "#{merge_request.id}/notes/12345", user)
 
         expect(response).to have_http_status(404)
       end
diff --git a/spec/requests/api/v3/runners_spec.rb b/spec/requests/api/v3/runners_spec.rb
new file mode 100644
index 00000000000..ca335ce9cf0
--- /dev/null
+++ b/spec/requests/api/v3/runners_spec.rb
@@ -0,0 +1,154 @@
+require 'spec_helper'
+
+describe API::V3::Runners, api: true  do
+  include ApiHelpers
+
+  let(:admin) { create(:user, :admin) }
+  let(:user) { create(:user) }
+  let(:user2) { create(:user) }
+
+  let(:project) { create(:empty_project, creator_id: user.id) }
+  let(:project2) { create(:empty_project, creator_id: user.id) }
+
+  let!(:shared_runner) { create(:ci_runner, :shared) }
+  let!(:unused_specific_runner) { create(:ci_runner) }
+
+  let!(:specific_runner) do
+    create(:ci_runner).tap do |runner|
+      create(:ci_runner_project, runner: runner, project: project)
+    end
+  end
+
+  let!(:two_projects_runner) do
+    create(:ci_runner).tap do |runner|
+      create(:ci_runner_project, runner: runner, project: project)
+      create(:ci_runner_project, runner: runner, project: project2)
+    end
+  end
+
+  before do
+    # Set project access for users
+    create(:project_member, :master, user: user, project: project)
+    create(:project_member, :reporter, user: user2, project: project)
+  end
+
+  describe 'DELETE /runners/:id' do
+    context 'admin user' do
+      context 'when runner is shared' do
+        it 'deletes runner' do
+          expect do
+            delete v3_api("/runners/#{shared_runner.id}", admin)
+
+            expect(response).to have_http_status(200)
+          end.to change{ Ci::Runner.shared.count }.by(-1)
+        end
+      end
+
+      context 'when runner is not shared' do
+        it 'deletes unused runner' do
+          expect do
+            delete v3_api("/runners/#{unused_specific_runner.id}", admin)
+
+            expect(response).to have_http_status(200)
+          end.to change{ Ci::Runner.specific.count }.by(-1)
+        end
+
+        it 'deletes used runner' do
+          expect do
+            delete v3_api("/runners/#{specific_runner.id}", admin)
+
+            expect(response).to have_http_status(200)
+          end.to change{ Ci::Runner.specific.count }.by(-1)
+        end
+      end
+
+      it 'returns 404 if runner does not exists' do
+        delete v3_api('/runners/9999', admin)
+
+        expect(response).to have_http_status(404)
+      end
+    end
+
+    context 'authorized user' do
+      context 'when runner is shared' do
+        it 'does not delete runner' do
+          delete v3_api("/runners/#{shared_runner.id}", user)
+          expect(response).to have_http_status(403)
+        end
+      end
+
+      context 'when runner is not shared' do
+        it 'does not delete runner without access to it' do
+          delete v3_api("/runners/#{specific_runner.id}", user2)
+          expect(response).to have_http_status(403)
+        end
+
+        it 'does not delete runner with more than one associated project' do
+          delete v3_api("/runners/#{two_projects_runner.id}", user)
+          expect(response).to have_http_status(403)
+        end
+
+        it 'deletes runner for one owned project' do
+          expect do
+            delete v3_api("/runners/#{specific_runner.id}", user)
+
+            expect(response).to have_http_status(200)
+          end.to change{ Ci::Runner.specific.count }.by(-1)
+        end
+      end
+    end
+
+    context 'unauthorized user' do
+      it 'does not delete runner' do
+        delete v3_api("/runners/#{specific_runner.id}")
+
+        expect(response).to have_http_status(401)
+      end
+    end
+  end
+
+  describe 'DELETE /projects/:id/runners/:runner_id' do
+    context 'authorized user' do
+      context 'when runner have more than one associated projects' do
+        it "disables project's runner" do
+          expect do
+            delete v3_api("/projects/#{project.id}/runners/#{two_projects_runner.id}", user)
+
+            expect(response).to have_http_status(200)
+          end.to change{ project.runners.count }.by(-1)
+        end
+      end
+
+      context 'when runner have one associated projects' do
+        it "does not disable project's runner" do
+          expect do
+            delete v3_api("/projects/#{project.id}/runners/#{specific_runner.id}", user)
+          end.to change{ project.runners.count }.by(0)
+          expect(response).to have_http_status(403)
+        end
+      end
+
+      it 'returns 404 is runner is not found' do
+        delete v3_api("/projects/#{project.id}/runners/9999", user)
+
+        expect(response).to have_http_status(404)
+      end
+    end
+
+    context 'authorized user without permissions' do
+      it "does not disable project's runner" do
+        delete v3_api("/projects/#{project.id}/runners/#{specific_runner.id}", user2)
+
+        expect(response).to have_http_status(403)
+      end
+    end
+
+    context 'unauthorized user' do
+      it "does not disable project's runner" do
+        delete v3_api("/projects/#{project.id}/runners/#{specific_runner.id}")
+
+        expect(response).to have_http_status(401)
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/v3/services_spec.rb b/spec/requests/api/v3/services_spec.rb
new file mode 100644
index 00000000000..7e8c8753d02
--- /dev/null
+++ b/spec/requests/api/v3/services_spec.rb
@@ -0,0 +1,22 @@
+require "spec_helper"
+
+describe API::V3::Services, api: true  do
+  include ApiHelpers
+
+  let(:user) { create(:user) }
+  let(:project) { create(:empty_project, creator_id: user.id, namespace: user.namespace) }
+
+  Service.available_services_names.each do |service|
+    describe "DELETE /projects/:id/services/#{service.dasherize}" do
+      include_context service
+
+      it "deletes #{service}" do
+        delete v3_api("/projects/#{project.id}/services/#{dashed_service}", user)
+
+        expect(response).to have_http_status(200)
+        project.send(service_method).reload
+        expect(project.send(service_method).activated?).to be_falsey
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/v3/system_hooks_spec.rb b/spec/requests/api/v3/system_hooks_spec.rb
index da58efb6ebf..91038977c82 100644
--- a/spec/requests/api/v3/system_hooks_spec.rb
+++ b/spec/requests/api/v3/system_hooks_spec.rb
@@ -38,4 +38,20 @@ describe API::V3::SystemHooks, api: true  do
       end
     end
   end
+
+  describe "DELETE /hooks/:id" do
+    it "deletes a hook" do
+      expect do
+        delete v3_api("/hooks/#{hook.id}", admin)
+
+        expect(response).to have_http_status(200)
+      end.to change { SystemHook.count }.by(-1)
+    end
+
+    it 'returns 404 if the system hook does not exist' do
+      delete v3_api('/hooks/12345', admin)
+
+      expect(response).to have_http_status(404)
+    end
+  end
 end
diff --git a/spec/requests/api/v3/tags_spec.rb b/spec/requests/api/v3/tags_spec.rb
index 6722789d928..6870cfd2668 100644
--- a/spec/requests/api/v3/tags_spec.rb
+++ b/spec/requests/api/v3/tags_spec.rb
@@ -64,4 +64,26 @@ describe API::V3::Tags, api: true  do
       end
     end
   end
+
+  describe 'DELETE /projects/:id/repository/tags/:tag_name' do
+    let(:tag_name) { project.repository.tag_names.sort.reverse.first }
+
+    before do
+      allow_any_instance_of(Repository).to receive(:rm_tag).and_return(true)
+    end
+
+    context 'delete tag' do
+      it 'deletes an existing tag' do
+        delete v3_api("/projects/#{project.id}/repository/tags/#{tag_name}", user)
+
+        expect(response).to have_http_status(200)
+        expect(json_response['tag_name']).to eq(tag_name)
+      end
+
+      it 'raises 404 if the tag does not exist' do
+        delete v3_api("/projects/#{project.id}/repository/tags/foobar", user)
+        expect(response).to have_http_status(404)
+      end
+    end
+  end
 end
diff --git a/spec/requests/api/v3/triggers_spec.rb b/spec/requests/api/v3/triggers_spec.rb
new file mode 100644
index 00000000000..721ce4a361b
--- /dev/null
+++ b/spec/requests/api/v3/triggers_spec.rb
@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe API::V3::Triggers do
+  include ApiHelpers
+
+  let(:user) { create(:user) }
+  let(:user2) { create(:user) }
+  let!(:trigger_token) { 'secure_token' }
+  let!(:project) { create(:project, :repository, creator: user) }
+  let!(:master) { create(:project_member, :master, user: user, project: project) }
+  let!(:developer) { create(:project_member, :developer, user: user2, project: project) }
+  let!(:trigger) { create(:ci_trigger, project: project, token: trigger_token) }
+
+  describe 'DELETE /projects/:id/triggers/:token' do
+    context 'authenticated user with valid permissions' do
+      it 'deletes trigger' do
+        expect do
+          delete v3_api("/projects/#{project.id}/triggers/#{trigger.token}", user)
+
+          expect(response).to have_http_status(200)
+        end.to change{project.triggers.count}.by(-1)
+      end
+
+      it 'responds with 404 Not Found if requesting non-existing trigger' do
+        delete v3_api("/projects/#{project.id}/triggers/abcdef012345", user)
+
+        expect(response).to have_http_status(404)
+      end
+    end
+
+    context 'authenticated user with invalid permissions' do
+      it 'does not delete trigger' do
+        delete v3_api("/projects/#{project.id}/triggers/#{trigger.token}", user2)
+
+        expect(response).to have_http_status(403)
+      end
+    end
+
+    context 'unauthenticated user' do
+      it 'does not delete trigger' do
+        delete v3_api("/projects/#{project.id}/triggers/#{trigger.token}")
+
+        expect(response).to have_http_status(401)
+      end
+    end
+  end
+end