From d2601211a0c7a44666501dea82a8488b08f8faa7 Mon Sep 17 00:00:00 2001
From: Tomasz Maczukin <tomasz@maczukin.pl>
Date: Tue, 29 Dec 2015 23:12:36 +0100
Subject: Add specs for build listings in API

---
 spec/requests/api/builds_spec.rb | 52 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 spec/requests/api/builds_spec.rb

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/builds_spec.rb b/spec/requests/api/builds_spec.rb
new file mode 100644
index 00000000000..81c176c9fb0
--- /dev/null
+++ b/spec/requests/api/builds_spec.rb
@@ -0,0 +1,52 @@
+require 'spec_helper'
+
+describe API::API, api: true  do
+  include ApiHelpers
+
+  let(:user) { create(:user) }
+  let(:user2) { create(:user) }
+  let!(:project) { create(:project, creator_id: user.id) }
+  let!(:master) { create(:project_member, user: user, project: project, access_level: ProjectMember::MASTER) }
+  let!(:guest) { create(:project_member, user: user2, project: project, access_level: ProjectMember::GUEST) }
+
+  describe 'GET /projects/:id/builds ' do
+    context 'authorized user' do
+      it 'should return project builds' do
+        get api("/projects/#{project.id}/builds", user)
+
+        puts json_response
+        expect(response.status).to eq(200)
+        expect(json_response).to be_an Array
+      end
+    end
+
+    context 'unauthorized user' do
+      it 'should not return project builds' do
+        get api("/projects/#{project.id}/builds")
+
+        expect(response.status).to eq(401)
+      end
+    end
+  end
+
+  describe 'GET /projects/:id/builds/commit/:sha' do
+    context 'authorized user' do
+      it 'should return project builds for specific commit' do
+        project.ensure_ci_commit(project.repository.commit.sha)
+        get api("/projects/#{project.id}/builds/commit/#{project.ci_commits.first.sha}", user)
+
+        expect(response.status).to eq(200)
+        expect(json_response).to be_an Array
+      end
+    end
+
+    context 'unauthorized user' do
+      it 'should not return project builds' do
+        project.ensure_ci_commit(project.repository.commit.sha)
+        get api("/projects/#{project.id}/builds/commit/#{project.ci_commits.first.sha}")
+
+        expect(response.status).to eq(401)
+      end
+    end
+  end
+end
-- 
cgit v1.2.1


From 593d87ea54eec4d60cf7eeb404af82d9e015b066 Mon Sep 17 00:00:00 2001
From: Tomasz Maczukin <tomasz@maczukin.pl>
Date: Wed, 30 Dec 2015 15:12:07 +0100
Subject: Add specs for build details/traces features in builds API

---
 spec/requests/api/builds_spec.rb | 40 ++++++++++++++++++++++++++++++++++++++--
 1 file changed, 38 insertions(+), 2 deletions(-)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/builds_spec.rb b/spec/requests/api/builds_spec.rb
index 81c176c9fb0..c68ea0898b8 100644
--- a/spec/requests/api/builds_spec.rb
+++ b/spec/requests/api/builds_spec.rb
@@ -8,6 +8,9 @@ describe API::API, api: true  do
   let!(:project) { create(:project, creator_id: user.id) }
   let!(:master) { create(:project_member, user: user, project: project, access_level: ProjectMember::MASTER) }
   let!(:guest) { create(:project_member, user: user2, project: project, access_level: ProjectMember::GUEST) }
+  let(:commit) { create(:ci_commit, project: project)}
+  let(:build) { create(:ci_build, commit: commit) }
+  let(:build_with_trace) { create(:ci_build_with_trace, commit: commit) }
 
   describe 'GET /projects/:id/builds ' do
     context 'authorized user' do
@@ -32,7 +35,7 @@ describe API::API, api: true  do
   describe 'GET /projects/:id/builds/commit/:sha' do
     context 'authorized user' do
       it 'should return project builds for specific commit' do
-        project.ensure_ci_commit(project.repository.commit.sha)
+        project.ensure_ci_commit(commit.sha)
         get api("/projects/#{project.id}/builds/commit/#{project.ci_commits.first.sha}", user)
 
         expect(response.status).to eq(200)
@@ -42,11 +45,44 @@ describe API::API, api: true  do
 
     context 'unauthorized user' do
       it 'should not return project builds' do
-        project.ensure_ci_commit(project.repository.commit.sha)
+        project.ensure_ci_commit(commit.sha)
         get api("/projects/#{project.id}/builds/commit/#{project.ci_commits.first.sha}")
 
         expect(response.status).to eq(401)
       end
     end
   end
+
+  describe 'GET /projects/:id/builds/:build_id(/trace)?' do
+    context 'authorized user' do
+      it 'should return specific build data' do
+        get api("/projects/#{project.id}/builds/#{build.id}", user)
+
+        expect(response.status).to eq(200)
+        expect(json_response['name']).to eq('test')
+        expect(json_response['commit']['sha']).to eq(commit.sha)
+      end
+
+      it 'should return specific build trace' do
+        get api("/projects/#{project.id}/builds/#{build_with_trace.id}/trace", user)
+
+        expect(response.status).to eq(200)
+        expect(response.body).to eq(build_with_trace.trace)
+      end
+    end
+
+    context 'unauthorized user' do
+      it 'should not return specific build data' do
+        get api("/projects/#{project.id}/builds/#{build.id}")
+
+        expect(response.status).to eq(401)
+      end
+
+      it 'should not return specific build trace' do
+        get api("/projects/#{project.id}/builds/#{build_with_trace.id}/trace")
+
+        expect(response.status).to eq(401)
+      end
+    end
+  end
 end
-- 
cgit v1.2.1


From a17bf380cb4c90696349f268ca4a8c2fedc1f545 Mon Sep 17 00:00:00 2001
From: Tomasz Maczukin <tomasz@maczukin.pl>
Date: Wed, 30 Dec 2015 16:37:47 +0100
Subject: Add cancel/retry features to builds API

---
 spec/requests/api/builds_spec.rb | 62 +++++++++++++++++++++++++++++++++++++++-
 1 file changed, 61 insertions(+), 1 deletion(-)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/builds_spec.rb b/spec/requests/api/builds_spec.rb
index c68ea0898b8..d4af7639d4b 100644
--- a/spec/requests/api/builds_spec.rb
+++ b/spec/requests/api/builds_spec.rb
@@ -7,10 +7,11 @@ describe API::API, api: true  do
   let(:user2) { create(:user) }
   let!(:project) { create(:project, creator_id: user.id) }
   let!(:master) { create(:project_member, user: user, project: project, access_level: ProjectMember::MASTER) }
-  let!(:guest) { create(:project_member, user: user2, project: project, access_level: ProjectMember::GUEST) }
+  let!(:reporter) { create(:project_member, user: user2, project: project, access_level: ProjectMember::REPORTER) }
   let(:commit) { create(:ci_commit, project: project)}
   let(:build) { create(:ci_build, commit: commit) }
   let(:build_with_trace) { create(:ci_build_with_trace, commit: commit) }
+  let(:build_canceled) { create(:ci_build_canceled, commit: commit) }
 
   describe 'GET /projects/:id/builds ' do
     context 'authorized user' do
@@ -85,4 +86,63 @@ describe API::API, api: true  do
       end
     end
   end
+
+  describe 'GET /projects/:id/builds/:build_id/cancel' do
+    context 'authorized user' do
+      context 'user with :manage_builds persmission' do
+        it 'should cancel running or pending build' do
+          post api("/projects/#{project.id}/builds/#{build.id}/cancel", user)
+
+          expect(response.status).to eq(201)
+          expect(project.builds.first.status).to eq('canceled')
+        end
+      end
+
+      context 'user without :manage_builds permission' do
+        it 'should not cancel build' do
+          post api("/projects/#{project.id}/builds/#{build.id}/cancel", user2)
+
+          expect(response.status).to eq(403)
+        end
+      end
+    end
+
+    context 'unauthorized user' do
+      it 'should not cancel build' do
+        post api("/projects/#{project.id}/builds/#{build.id}/cancel")
+
+        expect(response.status).to eq(401)
+      end
+    end
+  end
+
+  describe 'GET /projects/:id/builds/:build_id/retry' do
+    context 'authorized user' do
+      context 'user with :manage_builds persmission' do
+        it 'should retry non-running build' do
+          post api("/projects/#{project.id}/builds/#{build_canceled.id}/retry", user)
+
+          expect(response.status).to eq(201)
+          expect(project.builds.first.status).to eq('canceled')
+          expect(json_response['status']).to eq('pending')
+        end
+      end
+
+      context 'user without :manage_builds permission' do
+        it 'should not retry build' do
+          post api("/projects/#{project.id}/builds/#{build_canceled.id}/retry", user2)
+
+          expect(response.status).to eq(403)
+        end
+      end
+    end
+
+    context 'unauthorized user' do
+      it 'should not retry build' do
+        post api("/projects/#{project.id}/builds/#{build_canceled.id}/retry")
+
+        expect(response.status).to eq(401)
+      end
+    end
+  end
 end
-- 
cgit v1.2.1


From ea4777ff501e370a39ae30e76a955136afe3c1fa Mon Sep 17 00:00:00 2001
From: Tomasz Maczukin <tomasz@maczukin.pl>
Date: Thu, 31 Dec 2015 15:19:13 +0100
Subject: Add features for list and show details of variables in API

---
 spec/requests/api/variables_spec.rb | 75 +++++++++++++++++++++++++++++++++++++
 1 file changed, 75 insertions(+)
 create mode 100644 spec/requests/api/variables_spec.rb

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/variables_spec.rb b/spec/requests/api/variables_spec.rb
new file mode 100644
index 00000000000..8f66f5432b6
--- /dev/null
+++ b/spec/requests/api/variables_spec.rb
@@ -0,0 +1,75 @@
+require 'spec_helper'
+
+describe API::API, api: true do
+  include ApiHelpers
+
+  let(:user) { create(:user) }
+  let(:user2) { create(:user) }
+  let!(:project) { create(:project, creator_id: user.id) }
+  let!(:master) { create(:project_member, user: user, project: project, access_level: ProjectMember::MASTER) }
+  let!(:developer) { create(:project_member, user: user2, project: project, access_level: ProjectMember::DEVELOPER) }
+  let!(:variable) { create(:ci_variable, project: project) }
+
+  describe 'GET /projects/:id/variables' do
+    context 'authorized user with proper permissions' do
+      it 'should return project variables' do
+        get api("/projects/#{project.id}/variables", user)
+
+        expect(response.status).to eq(200)
+        expect(json_response).to be_a(Array)
+      end
+    end
+
+    context 'authorized user with invalid permissions' do
+      it 'should not return project variables' do
+        get api("/projects/#{project.id}/variables", user2)
+
+        expect(response.status).to eq(403)
+      end
+    end
+
+    context 'unauthorized user' do
+      it 'should not return project variables' do
+        get api("/projects/#{project.id}/variables")
+
+        expect(response.status).to eq(401)
+      end
+    end
+  end
+
+  describe 'GET /projects/:id/variables/:variable_id' do
+    context 'authorized user with proper permissions' do
+      it 'should return project variable details when ID is used as :variable_id' do
+        get api("/projects/#{project.id}/variables/1", user)
+
+        expect(response.status).to eq(200)
+        expect(json_response['key']).to eq('TEST_VARIABLE_1')
+        expect(json_response['value']).to eq('VALUE_1')
+      end
+
+      it 'should return project variable details when `key` is used as :variable_id' do
+        get api("/projects/#{project.id}/variables/TEST_VARIABLE_1", user)
+
+        expect(response.status).to eq(200)
+        expect(json_response['id']).to eq(1)
+        expect(json_response['value']).to eq('VALUE_1')
+      end
+    end
+
+    context 'authorized user with invalid permissions' do
+      it 'should not return project variable details' do
+        get api("/projects/#{project.id}/variables/1", user2)
+
+        expect(response.status).to eq(403)
+      end
+    end
+
+    context 'unauthorized user' do
+      it 'should not return project variable details' do
+        get api("/projects/#{project.id}/variables/1")
+
+        expect(response.status).to eq(401)
+      end
+    end
+  end
+end
-- 
cgit v1.2.1


From a692ce1c079703c4f3947e1d0a29547189e94d0f Mon Sep 17 00:00:00 2001
From: Tomasz Maczukin <tomasz@maczukin.pl>
Date: Thu, 31 Dec 2015 16:25:49 +0100
Subject: Add update feature for variables API

---
 spec/requests/api/variables_spec.rb | 52 +++++++++++++++++++++++++++++++------
 1 file changed, 44 insertions(+), 8 deletions(-)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/variables_spec.rb b/spec/requests/api/variables_spec.rb
index 8f66f5432b6..3f58277c4ae 100644
--- a/spec/requests/api/variables_spec.rb
+++ b/spec/requests/api/variables_spec.rb
@@ -40,25 +40,25 @@ describe API::API, api: true do
   describe 'GET /projects/:id/variables/:variable_id' do
     context 'authorized user with proper permissions' do
       it 'should return project variable details when ID is used as :variable_id' do
-        get api("/projects/#{project.id}/variables/1", user)
+        get api("/projects/#{project.id}/variables/#{variable.id}", user)
 
         expect(response.status).to eq(200)
-        expect(json_response['key']).to eq('TEST_VARIABLE_1')
-        expect(json_response['value']).to eq('VALUE_1')
+        expect(json_response['key']).to eq(variable.key)
+        expect(json_response['value']).to eq(variable.value)
       end
 
       it 'should return project variable details when `key` is used as :variable_id' do
-        get api("/projects/#{project.id}/variables/TEST_VARIABLE_1", user)
+        get api("/projects/#{project.id}/variables/#{variable.key}", user)
 
         expect(response.status).to eq(200)
-        expect(json_response['id']).to eq(1)
-        expect(json_response['value']).to eq('VALUE_1')
+        expect(json_response['id']).to eq(variable.id)
+        expect(json_response['value']).to eq(variable.value)
       end
     end
 
     context 'authorized user with invalid permissions' do
       it 'should not return project variable details' do
-        get api("/projects/#{project.id}/variables/1", user2)
+        get api("/projects/#{project.id}/variables/#{variable.id}", user2)
 
         expect(response.status).to eq(403)
       end
@@ -66,7 +66,43 @@ describe API::API, api: true do
 
     context 'unauthorized user' do
       it 'should not return project variable details' do
-        get api("/projects/#{project.id}/variables/1")
+        get api("/projects/#{project.id}/variables/#{variable.id}")
+
+        expect(response.status).to eq(401)
+      end
+    end
+  end
+
+  describe 'PUT /projects/:id/variables/:variable_id' do
+    context 'authorized user with proper permissions' do
+      it 'should update variable data' do
+        initial_variable = project.variables.first
+        key_before = initial_variable.key
+        value_before = initial_variable.value
+
+        put api("/projects/#{project.id}/variables/#{variable.id}", user), key: 'TEST_VARIABLE_1_UP', value: 'VALUE_1_UP'
+
+        updated_variable = project.variables.first
+
+        expect(response.status).to eq(200)
+        expect(key_before).to eq(variable.key)
+        expect(value_before).to eq(variable.value)
+        expect(updated_variable.key).to eq('TEST_VARIABLE_1_UP')
+        expect(updated_variable.value).to eq('VALUE_1_UP')
+      end
+    end
+
+    context 'authorized user with invalid permissions' do
+      it 'should not update variable' do
+        put api("/projects/#{project.id}/variables/#{variable.id}", user2)
+
+        expect(response.status).to eq(403)
+      end
+    end
+
+    context 'unauthorized user' do
+      it 'should not return project variable details' do
+        put api("/projects/#{project.id}/variables/#{variable.id}")
 
         expect(response.status).to eq(401)
       end
-- 
cgit v1.2.1


From 0d014feb1d216e692882976f0d70c3227eaec4ca Mon Sep 17 00:00:00 2001
From: Tomasz Maczukin <tomasz@maczukin.pl>
Date: Thu, 31 Dec 2015 16:56:03 +0100
Subject: Add delete feature to variables API

---
 spec/requests/api/variables_spec.rb | 29 ++++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/variables_spec.rb b/spec/requests/api/variables_spec.rb
index 3f58277c4ae..385db2409bd 100644
--- a/spec/requests/api/variables_spec.rb
+++ b/spec/requests/api/variables_spec.rb
@@ -101,11 +101,38 @@ describe API::API, api: true do
     end
 
     context 'unauthorized user' do
-      it 'should not return project variable details' do
+      it 'should not update variable' do
         put api("/projects/#{project.id}/variables/#{variable.id}")
 
         expect(response.status).to eq(401)
       end
     end
   end
+
+  describe 'DELETE /projects/:id/variables/:variable_id' do
+    context 'authorized user with proper permissions' do
+      it 'should delete variable' do
+        expect do
+          delete api("/projects/#{project.id}/variables/#{variable.id}", user)
+        end.to change{project.variables.count}.by(-1)
+        expect(response.status).to eq(200)
+      end
+    end
+
+    context 'authorized user with invalid permissions' do
+      it 'should not delete variable' do
+        delete api("/projects/#{project.id}/variables/#{variable.id}", user2)
+
+        expect(response.status).to eq(403)
+      end
+    end
+
+    context 'unauthorized user' do
+      it 'should not delete variable' do
+        delete api("/projects/#{project.id}/variables/#{variable.id}")
+
+        expect(response.status).to eq(401)
+      end
+    end
+  end
 end
-- 
cgit v1.2.1


From c5177dd5e2171b047a695802c979cf779522ba8a Mon Sep 17 00:00:00 2001
From: Tomasz Maczukin <tomasz@maczukin.pl>
Date: Thu, 31 Dec 2015 17:03:11 +0100
Subject: Add missing 'not_found' checks in variables API

---
 spec/requests/api/variables_spec.rb | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/variables_spec.rb b/spec/requests/api/variables_spec.rb
index 385db2409bd..b35ee2d32d1 100644
--- a/spec/requests/api/variables_spec.rb
+++ b/spec/requests/api/variables_spec.rb
@@ -54,6 +54,12 @@ describe API::API, api: true do
         expect(json_response['id']).to eq(variable.id)
         expect(json_response['value']).to eq(variable.value)
       end
+
+      it 'should responde with 404 Not Found if requesting non-existing variable' do
+        get api("/projects/#{project.id}/variables/9999", user)
+
+        expect(response.status).to eq(404)
+      end
     end
 
     context 'authorized user with invalid permissions' do
@@ -90,6 +96,12 @@ describe API::API, api: true do
         expect(updated_variable.key).to eq('TEST_VARIABLE_1_UP')
         expect(updated_variable.value).to eq('VALUE_1_UP')
       end
+
+      it 'should responde with 404 Not Found if requesting non-existing variable' do
+        put api("/projects/#{project.id}/variables/9999", user)
+
+        expect(response.status).to eq(404)
+      end
     end
 
     context 'authorized user with invalid permissions' do
@@ -117,6 +129,12 @@ describe API::API, api: true do
         end.to change{project.variables.count}.by(-1)
         expect(response.status).to eq(200)
       end
+
+      it 'should responde with 404 Not Found if requesting non-existing variable' do
+        delete api("/projects/#{project.id}/variables/9999", user)
+
+        expect(response.status).to eq(404)
+      end
     end
 
     context 'authorized user with invalid permissions' do
-- 
cgit v1.2.1


From 937567b767e6d7b34dcaa1d9c83fc75464638683 Mon Sep 17 00:00:00 2001
From: Tomasz Maczukin <tomasz@maczukin.pl>
Date: Thu, 31 Dec 2015 22:30:07 +0100
Subject: Add create feature to variables API

---
 spec/requests/api/variables_spec.rb | 38 +++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/variables_spec.rb b/spec/requests/api/variables_spec.rb
index b35ee2d32d1..bf0dd77473a 100644
--- a/spec/requests/api/variables_spec.rb
+++ b/spec/requests/api/variables_spec.rb
@@ -79,6 +79,44 @@ describe API::API, api: true do
     end
   end
 
+  describe 'POST /projects/:id/variables' do
+    context 'authorized user with proper permissions' do
+      it 'should create variable' do
+        expect do
+          post api("/projects/#{project.id}/variables", user), key: 'TEST_VARIABLE_2', value: 'VALUE_2'
+        end.to change{project.variables.count}.by(1)
+
+        expect(response.status).to eq(201)
+        expect(json_response['key']).to eq('TEST_VARIABLE_2')
+        expect(json_response['value']).to eq('VALUE_2')
+      end
+
+      it 'should not allow to duplicate variable key' do
+        expect do
+          post api("/projects/#{project.id}/variables", user), key: 'TEST_VARIABLE_1', value: 'VALUE_2'
+        end.to change{project.variables.count}.by(0)
+
+        expect(response.status).to eq(400)
+      end
+    end
+
+    context 'authorized user with invalid permissions' do
+      it 'should not create variable' do
+        post api("/projects/#{project.id}/variables", user2)
+
+        expect(response.status).to eq(403)
+      end
+    end
+
+    context 'unauthorized user' do
+      it 'should not create variable' do
+        post api("/projects/#{project.id}/variables")
+
+        expect(response.status).to eq(401)
+      end
+    end
+  end
+
   describe 'PUT /projects/:id/variables/:variable_id' do
     context 'authorized user with proper permissions' do
       it 'should update variable data' do
-- 
cgit v1.2.1


From d9da81f736b770bb44c4869aef5d5c455e74ab7a Mon Sep 17 00:00:00 2001
From: Tomasz Maczukin <tomasz@maczukin.pl>
Date: Mon, 4 Jan 2016 16:38:32 +0100
Subject: Add triggers feature to API

---
 spec/requests/api/triggers_spec.rb | 45 ++++++++++++++++++++++++++++++++++----
 1 file changed, 41 insertions(+), 4 deletions(-)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/triggers_spec.rb b/spec/requests/api/triggers_spec.rb
index 314bd7ddc59..4b356108c80 100644
--- a/spec/requests/api/triggers_spec.rb
+++ b/spec/requests/api/triggers_spec.rb
@@ -3,11 +3,19 @@ require 'spec_helper'
 describe API::API do
   include ApiHelpers
 
+  let(:user) { create(:user) }
+  let(:user2) { create(:user) }
+  let!(:trigger_token) { 'secure token' }
+  let!(:trigger_token_2) { 'secure token 2' }
+  let!(:project) { create(:project, creator_id: user.id) }
+  let!(:master) { create(:project_member, user: user, project: project, access_level: ProjectMember::MASTER) }
+  let!(:developer) { create(:project_member, user: user2, project: project, access_level: ProjectMember::DEVELOPER) }
+  let!(:trigger) { create(:ci_trigger, project: project, token: trigger_token) }
+  let!(:trigger2) { create(:ci_trigger, project: project, token: trigger_token_2) }
+  let!(:trigger_request) { create(:ci_trigger_request, trigger: trigger, created_at: '2015-01-01 12:13:14') }
+
   describe 'POST /projects/:project_id/trigger' do
-    let!(:trigger_token) { 'secure token' }
-    let!(:project) { FactoryGirl.create(:project) }
-    let!(:project2) { FactoryGirl.create(:empty_project) }
-    let!(:trigger) { FactoryGirl.create(:ci_trigger, project: project, token: trigger_token) }
+    let!(:project2) { create(:empty_project) }
     let(:options) do
       {
         token: trigger_token
@@ -77,4 +85,33 @@ describe API::API do
       end
     end
   end
+
+  describe 'GET /projects/:id/triggets' do
+    context 'authenticated user with valid permissions' do
+      it 'should return list of triggers' do
+        get api("/projects/#{project.id}/triggers", user)
+
+        expect(response.status).to eq(200)
+        expect(json_response).to be_a(Array)
+        expect(json_response[0]['token']).to eq(trigger_token)
+        expect(json_response[1]['token']).to eq(trigger_token_2)
+      end
+    end
+
+    context 'authenticated user with invalid permissions' do
+      it 'should not return triggers list' do
+        get api("/projects/#{project.id}/triggers", user2)
+
+        expect(response.status).to eq(403)
+      end
+    end
+
+    context 'unauthentikated user' do
+      it 'should not return triggers list' do
+        get api("/projects/#{project.id}/triggers")
+
+        expect(response.status).to eq(401)
+      end
+    end
+  end
 end
-- 
cgit v1.2.1


From f00607431cd13a952731e36701ebc3b39e64d09b Mon Sep 17 00:00:00 2001
From: Tomasz Maczukin <tomasz@maczukin.pl>
Date: Tue, 5 Jan 2016 11:27:38 +0100
Subject: Add delete feature to triggers API

---
 spec/requests/api/triggers_spec.rb | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/triggers_spec.rb b/spec/requests/api/triggers_spec.rb
index 4b356108c80..4e073a55d9c 100644
--- a/spec/requests/api/triggers_spec.rb
+++ b/spec/requests/api/triggers_spec.rb
@@ -114,4 +114,37 @@ describe API::API do
       end
     end
   end
+
+  describe 'DELETE /projects/:id/triggets/:trigger_id' do
+    context 'authenticated user with valid permissions' do
+      it 'should delete trigger' do
+        expect do
+          delete api("/projects/#{project.id}/triggers/#{trigger.id}", user)
+        end.to change{project.triggers.count}.by(-1)
+        expect(response.status).to eq(200)
+      end
+
+      it 'should responde with 404 Not Found if requesting non-existing trigger' do
+        delete api("/projects/#{project.id}/triggers/9999", user)
+
+        expect(response.status).to eq(404)
+      end
+    end
+
+    context 'authenticated user with invalid permissions' do
+      it 'should not delete trigger' do
+        delete api("/projects/#{project.id}/triggers/#{trigger.id}", user2)
+
+        expect(response.status).to eq(403)
+      end
+    end
+
+    context 'unauthentikated user' do
+      it 'should not delete trigger' do
+        delete api("/projects/#{project.id}/triggers/#{trigger.id}")
+
+        expect(response.status).to eq(401)
+      end
+    end
+  end
 end
-- 
cgit v1.2.1


From 49c8bf4e9b510be51859dcc301cb46b29b750cb0 Mon Sep 17 00:00:00 2001
From: Tomasz Maczukin <tomasz@maczukin.pl>
Date: Tue, 5 Jan 2016 11:44:10 +0100
Subject: Add create feature to triggers API

---
 spec/requests/api/triggers_spec.rb | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/triggers_spec.rb b/spec/requests/api/triggers_spec.rb
index 4e073a55d9c..316c2ae958d 100644
--- a/spec/requests/api/triggers_spec.rb
+++ b/spec/requests/api/triggers_spec.rb
@@ -115,6 +115,35 @@ describe API::API do
     end
   end
 
+  describe 'POST /projects/:id/triggets' do
+    context 'authenticated user with valid permissions' do
+      it 'should create trigger' do
+        expect do
+          post api("/projects/#{project.id}/triggers", user)
+        end.to change{project.triggers.count}.by(1)
+
+        expect(response.status).to eq(201)
+        expect(json_response).to be_a(Hash)
+      end
+    end
+
+    context 'authenticated user with invalid permissions' do
+      it 'should not create trigger' do
+        post api("/projects/#{project.id}/triggers", user2)
+
+        expect(response.status).to eq(403)
+      end
+    end
+
+    context 'unauthentikated user' do
+      it 'should not create trigger' do
+        post api("/projects/#{project.id}/triggers")
+
+        expect(response.status).to eq(401)
+      end
+    end
+  end
+
   describe 'DELETE /projects/:id/triggets/:trigger_id' do
     context 'authenticated user with valid permissions' do
       it 'should delete trigger' do
-- 
cgit v1.2.1


From 8675664655c4e0f1e043afa88ff1fd75ae5a6a9e Mon Sep 17 00:00:00 2001
From: Tomasz Maczukin <tomasz@maczukin.pl>
Date: Tue, 5 Jan 2016 12:25:16 +0100
Subject: Get show details feature to triggers API

---
 spec/requests/api/triggers_spec.rb | 56 ++++++++++++++++++++++++++++++++++----
 1 file changed, 51 insertions(+), 5 deletions(-)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/triggers_spec.rb b/spec/requests/api/triggers_spec.rb
index 316c2ae958d..c1c2bb04b29 100644
--- a/spec/requests/api/triggers_spec.rb
+++ b/spec/requests/api/triggers_spec.rb
@@ -5,8 +5,8 @@ describe API::API do
 
   let(:user) { create(:user) }
   let(:user2) { create(:user) }
-  let!(:trigger_token) { 'secure token' }
-  let!(:trigger_token_2) { 'secure token 2' }
+  let!(:trigger_token) { 'secure_token' }
+  let!(:trigger_token_2) { 'secure_token_2' }
   let!(:project) { create(:project, creator_id: user.id) }
   let!(:master) { create(:project_member, user: user, project: project, access_level: ProjectMember::MASTER) }
   let!(:developer) { create(:project_member, user: user2, project: project, access_level: ProjectMember::DEVELOPER) }
@@ -86,7 +86,7 @@ describe API::API do
     end
   end
 
-  describe 'GET /projects/:id/triggets' do
+  describe 'GET /projects/:id/triggers' do
     context 'authenticated user with valid permissions' do
       it 'should return list of triggers' do
         get api("/projects/#{project.id}/triggers", user)
@@ -115,7 +115,53 @@ describe API::API do
     end
   end
 
-  describe 'POST /projects/:id/triggets' do
+  describe 'GET /projects/:id/triggers/:triggers_id' do
+    context 'authenticated user with valid permissions' do
+      context 'ID is used as :trigger_id' do
+        it 'should return trigger details' do
+          get api("/projects/#{project.id}/triggers/#{trigger.id}", user)
+
+          expect(response.status).to eq(200)
+          expect(json_response).to be_a(Hash)
+          expect(json_response['token']).to eq(trigger_token)
+        end
+      end
+
+      context '`token` is used as :trigger_id' do
+        it 'should return trigger details' do
+          get api("/projects/#{project.id}/triggers/#{trigger.token}", user)
+
+          expect(response.status).to eq(200)
+          expect(json_response).to be_a(Hash)
+          expect(json_response['id']).to eq(trigger.id)
+        end
+      end
+
+      it 'should responde with 404 Not Found if requesting non-existing trigger' do
+        get api("/projects/#{project.id}/triggers/9999", user)
+
+        expect(response.status).to eq(404)
+      end
+    end
+
+    context 'authenticated user with invalid permissions' do
+      it 'should not return triggers list' do
+        get api("/projects/#{project.id}/triggers/#{trigger.id}", user2)
+
+        expect(response.status).to eq(403)
+      end
+    end
+
+    context 'unauthentikated user' do
+      it 'should not return triggers list' do
+        get api("/projects/#{project.id}/triggers/#{trigger.id}")
+
+        expect(response.status).to eq(401)
+      end
+    end
+  end
+
+  describe 'POST /projects/:id/triggers' do
     context 'authenticated user with valid permissions' do
       it 'should create trigger' do
         expect do
@@ -144,7 +190,7 @@ describe API::API do
     end
   end
 
-  describe 'DELETE /projects/:id/triggets/:trigger_id' do
+  describe 'DELETE /projects/:id/triggers/:trigger_id' do
     context 'authenticated user with valid permissions' do
       it 'should delete trigger' do
         expect do
-- 
cgit v1.2.1


From b60c146267dfa8dc1c170426e1817c6b2a168d1a Mon Sep 17 00:00:00 2001
From: Tomasz Maczukin <tomasz@maczukin.pl>
Date: Thu, 7 Jan 2016 13:49:38 +0100
Subject: Change :variable_id to :key as resource ID in API

---
 spec/requests/api/variables_spec.rb | 42 +++++++++++++------------------------
 1 file changed, 15 insertions(+), 27 deletions(-)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/variables_spec.rb b/spec/requests/api/variables_spec.rb
index bf0dd77473a..214d7d5a0cc 100644
--- a/spec/requests/api/variables_spec.rb
+++ b/spec/requests/api/variables_spec.rb
@@ -37,26 +37,17 @@ describe API::API, api: true do
     end
   end
 
-  describe 'GET /projects/:id/variables/:variable_id' do
+  describe 'GET /projects/:id/variables/:key' do
     context 'authorized user with proper permissions' do
-      it 'should return project variable details when ID is used as :variable_id' do
-        get api("/projects/#{project.id}/variables/#{variable.id}", user)
-
-        expect(response.status).to eq(200)
-        expect(json_response['key']).to eq(variable.key)
-        expect(json_response['value']).to eq(variable.value)
-      end
-
-      it 'should return project variable details when `key` is used as :variable_id' do
+      it 'should return project variable details' do
         get api("/projects/#{project.id}/variables/#{variable.key}", user)
 
         expect(response.status).to eq(200)
-        expect(json_response['id']).to eq(variable.id)
         expect(json_response['value']).to eq(variable.value)
       end
 
       it 'should responde with 404 Not Found if requesting non-existing variable' do
-        get api("/projects/#{project.id}/variables/9999", user)
+        get api("/projects/#{project.id}/variables/non_existing_variable", user)
 
         expect(response.status).to eq(404)
       end
@@ -64,7 +55,7 @@ describe API::API, api: true do
 
     context 'authorized user with invalid permissions' do
       it 'should not return project variable details' do
-        get api("/projects/#{project.id}/variables/#{variable.id}", user2)
+        get api("/projects/#{project.id}/variables/#{variable.key}", user2)
 
         expect(response.status).to eq(403)
       end
@@ -72,7 +63,7 @@ describe API::API, api: true do
 
     context 'unauthorized user' do
       it 'should not return project variable details' do
-        get api("/projects/#{project.id}/variables/#{variable.id}")
+        get api("/projects/#{project.id}/variables/#{variable.key}")
 
         expect(response.status).to eq(401)
       end
@@ -117,26 +108,23 @@ describe API::API, api: true do
     end
   end
 
-  describe 'PUT /projects/:id/variables/:variable_id' do
+  describe 'PUT /projects/:id/variables/:key' do
     context 'authorized user with proper permissions' do
       it 'should update variable data' do
         initial_variable = project.variables.first
-        key_before = initial_variable.key
         value_before = initial_variable.value
 
-        put api("/projects/#{project.id}/variables/#{variable.id}", user), key: 'TEST_VARIABLE_1_UP', value: 'VALUE_1_UP'
+        put api("/projects/#{project.id}/variables/#{variable.key}", user), value: 'VALUE_1_UP'
 
         updated_variable = project.variables.first
 
         expect(response.status).to eq(200)
-        expect(key_before).to eq(variable.key)
         expect(value_before).to eq(variable.value)
-        expect(updated_variable.key).to eq('TEST_VARIABLE_1_UP')
         expect(updated_variable.value).to eq('VALUE_1_UP')
       end
 
       it 'should responde with 404 Not Found if requesting non-existing variable' do
-        put api("/projects/#{project.id}/variables/9999", user)
+        put api("/projects/#{project.id}/variables/non_existing_variable", user)
 
         expect(response.status).to eq(404)
       end
@@ -144,7 +132,7 @@ describe API::API, api: true do
 
     context 'authorized user with invalid permissions' do
       it 'should not update variable' do
-        put api("/projects/#{project.id}/variables/#{variable.id}", user2)
+        put api("/projects/#{project.id}/variables/#{variable.key}", user2)
 
         expect(response.status).to eq(403)
       end
@@ -152,24 +140,24 @@ describe API::API, api: true do
 
     context 'unauthorized user' do
       it 'should not update variable' do
-        put api("/projects/#{project.id}/variables/#{variable.id}")
+        put api("/projects/#{project.id}/variables/#{variable.key}")
 
         expect(response.status).to eq(401)
       end
     end
   end
 
-  describe 'DELETE /projects/:id/variables/:variable_id' do
+  describe 'DELETE /projects/:id/variables/:key' do
     context 'authorized user with proper permissions' do
       it 'should delete variable' do
         expect do
-          delete api("/projects/#{project.id}/variables/#{variable.id}", user)
+          delete api("/projects/#{project.id}/variables/#{variable.key}", user)
         end.to change{project.variables.count}.by(-1)
         expect(response.status).to eq(200)
       end
 
       it 'should responde with 404 Not Found if requesting non-existing variable' do
-        delete api("/projects/#{project.id}/variables/9999", user)
+        delete api("/projects/#{project.id}/variables/non_existing_variable", user)
 
         expect(response.status).to eq(404)
       end
@@ -177,7 +165,7 @@ describe API::API, api: true do
 
     context 'authorized user with invalid permissions' do
       it 'should not delete variable' do
-        delete api("/projects/#{project.id}/variables/#{variable.id}", user2)
+        delete api("/projects/#{project.id}/variables/#{variable.key}", user2)
 
         expect(response.status).to eq(403)
       end
@@ -185,7 +173,7 @@ describe API::API, api: true do
 
     context 'unauthorized user' do
       it 'should not delete variable' do
-        delete api("/projects/#{project.id}/variables/#{variable.id}")
+        delete api("/projects/#{project.id}/variables/#{variable.key}")
 
         expect(response.status).to eq(401)
       end
-- 
cgit v1.2.1


From e0ec69d919cb44194e76034f2324ec0d4f5f1df6 Mon Sep 17 00:00:00 2001
From: Tomasz Maczukin <tomasz@maczukin.pl>
Date: Thu, 7 Jan 2016 18:48:33 +0100
Subject: Change 'trigger_id' to 'token' as resource ID in triggers API

---
 spec/requests/api/triggers_spec.rb | 42 +++++++++++++-------------------------
 1 file changed, 14 insertions(+), 28 deletions(-)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/triggers_spec.rb b/spec/requests/api/triggers_spec.rb
index c1c2bb04b29..e8d89426ec0 100644
--- a/spec/requests/api/triggers_spec.rb
+++ b/spec/requests/api/triggers_spec.rb
@@ -93,8 +93,7 @@ describe API::API do
 
         expect(response.status).to eq(200)
         expect(json_response).to be_a(Array)
-        expect(json_response[0]['token']).to eq(trigger_token)
-        expect(json_response[1]['token']).to eq(trigger_token_2)
+        expect(json_response[0]).to have_key('token')
       end
     end
 
@@ -115,30 +114,17 @@ describe API::API do
     end
   end
 
-  describe 'GET /projects/:id/triggers/:triggers_id' do
+  describe 'GET /projects/:id/triggers/:token' do
     context 'authenticated user with valid permissions' do
-      context 'ID is used as :trigger_id' do
-        it 'should return trigger details' do
-          get api("/projects/#{project.id}/triggers/#{trigger.id}", user)
+      it 'should return trigger details' do
+        get api("/projects/#{project.id}/triggers/#{trigger.token}", user)
 
-          expect(response.status).to eq(200)
-          expect(json_response).to be_a(Hash)
-          expect(json_response['token']).to eq(trigger_token)
-        end
-      end
-
-      context '`token` is used as :trigger_id' do
-        it 'should return trigger details' do
-          get api("/projects/#{project.id}/triggers/#{trigger.token}", user)
-
-          expect(response.status).to eq(200)
-          expect(json_response).to be_a(Hash)
-          expect(json_response['id']).to eq(trigger.id)
-        end
+        expect(response.status).to eq(200)
+        expect(json_response).to be_a(Hash)
       end
 
       it 'should responde with 404 Not Found if requesting non-existing trigger' do
-        get api("/projects/#{project.id}/triggers/9999", user)
+        get api("/projects/#{project.id}/triggers/abcdef012345", user)
 
         expect(response.status).to eq(404)
       end
@@ -146,7 +132,7 @@ describe API::API do
 
     context 'authenticated user with invalid permissions' do
       it 'should not return triggers list' do
-        get api("/projects/#{project.id}/triggers/#{trigger.id}", user2)
+        get api("/projects/#{project.id}/triggers/#{trigger.token}", user2)
 
         expect(response.status).to eq(403)
       end
@@ -154,7 +140,7 @@ describe API::API do
 
     context 'unauthentikated user' do
       it 'should not return triggers list' do
-        get api("/projects/#{project.id}/triggers/#{trigger.id}")
+        get api("/projects/#{project.id}/triggers/#{trigger.token}")
 
         expect(response.status).to eq(401)
       end
@@ -190,17 +176,17 @@ describe API::API do
     end
   end
 
-  describe 'DELETE /projects/:id/triggers/:trigger_id' do
+  describe 'DELETE /projects/:id/triggers/:token' do
     context 'authenticated user with valid permissions' do
       it 'should delete trigger' do
         expect do
-          delete api("/projects/#{project.id}/triggers/#{trigger.id}", user)
+          delete api("/projects/#{project.id}/triggers/#{trigger.token}", user)
         end.to change{project.triggers.count}.by(-1)
         expect(response.status).to eq(200)
       end
 
       it 'should responde with 404 Not Found if requesting non-existing trigger' do
-        delete api("/projects/#{project.id}/triggers/9999", user)
+        delete api("/projects/#{project.id}/triggers/abcdef012345", user)
 
         expect(response.status).to eq(404)
       end
@@ -208,7 +194,7 @@ describe API::API do
 
     context 'authenticated user with invalid permissions' do
       it 'should not delete trigger' do
-        delete api("/projects/#{project.id}/triggers/#{trigger.id}", user2)
+        delete api("/projects/#{project.id}/triggers/#{trigger.token}", user2)
 
         expect(response.status).to eq(403)
       end
@@ -216,7 +202,7 @@ describe API::API do
 
     context 'unauthentikated user' do
       it 'should not delete trigger' do
-        delete api("/projects/#{project.id}/triggers/#{trigger.id}")
+        delete api("/projects/#{project.id}/triggers/#{trigger.token}")
 
         expect(response.status).to eq(401)
       end
-- 
cgit v1.2.1


From 549a2fa7873366b52e9ba3caa849073b7b958b73 Mon Sep 17 00:00:00 2001
From: Tomasz Maczukin <tomasz@maczukin.pl>
Date: Fri, 8 Jan 2016 14:01:31 +0100
Subject: Modify builds scope filtering in builds API

---
 spec/requests/api/builds_spec.rb | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/builds_spec.rb b/spec/requests/api/builds_spec.rb
index d4af7639d4b..a953eb2fac2 100644
--- a/spec/requests/api/builds_spec.rb
+++ b/spec/requests/api/builds_spec.rb
@@ -18,7 +18,20 @@ describe API::API, api: true  do
       it 'should return project builds' do
         get api("/projects/#{project.id}/builds", user)
 
-        puts json_response
+        expect(response.status).to eq(200)
+        expect(json_response).to be_an Array
+      end
+
+      it 'should filter project with one scope element' do
+        get api("/projects/#{project.id}/builds?scope=pending", user)
+
+        expect(response.status).to eq(200)
+        expect(json_response).to be_an Array
+      end
+
+      it 'should filter project with array of scope elements' do
+        get api("/projects/#{project.id}/builds?scope[0]=pending&scope[1]=running", user)
+
         expect(response.status).to eq(200)
         expect(json_response).to be_an Array
       end
-- 
cgit v1.2.1


From 6e7db8e23e169bcbf0847ece27b9e44e00ae572b Mon Sep 17 00:00:00 2001
From: Gabriel Mazetto <gabriel@gitlab.com>
Date: Wed, 30 Dec 2015 16:52:02 -0200
Subject: Prevent ldap_blocked users from being blocked/unblocked by the API

---
 spec/requests/api/users_spec.rb | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/users_spec.rb b/spec/requests/api/users_spec.rb
index 4f278551d07..b82c5c7685f 100644
--- a/spec/requests/api/users_spec.rb
+++ b/spec/requests/api/users_spec.rb
@@ -8,6 +8,8 @@ describe API::API, api: true  do
   let(:key)   { create(:key, user: user) }
   let(:email)   { create(:email, user: user) }
   let(:omniauth_user) { create(:omniauth_user) }
+  let(:ldap_user) { create(:omniauth_user, provider: 'ldapmain') }
+  let(:ldap_blocked_user) { create(:omniauth_user, provider: 'ldapmain', state: 'ldap_blocked') }
 
   describe "GET /users" do
     context "when unauthenticated" do
@@ -783,6 +785,12 @@ describe API::API, api: true  do
       expect(user.reload.state).to eq('blocked')
     end
 
+    it 'should not re-block ldap blocked users' do
+      put api("/users/#{ldap_blocked_user.id}/block", admin)
+      expect(response.status).to eq(403)
+      expect(ldap_blocked_user.reload.state).to eq('ldap_blocked')
+    end
+
     it 'should not be available for non admin users' do
       put api("/users/#{user.id}/block", user)
       expect(response.status).to eq(403)
@@ -797,7 +805,9 @@ describe API::API, api: true  do
   end
 
   describe 'PUT /user/:id/unblock' do
+    let(:blocked_user)  { create(:user, state: 'blocked') }
     before { admin }
+
     it 'should unblock existing user' do
       put api("/users/#{user.id}/unblock", admin)
       expect(response.status).to eq(200)
@@ -805,12 +815,15 @@ describe API::API, api: true  do
     end
 
     it 'should unblock a blocked user' do
-      put api("/users/#{user.id}/block", admin)
-      expect(response.status).to eq(200)
-      expect(user.reload.state).to eq('blocked')
-      put api("/users/#{user.id}/unblock", admin)
+      put api("/users/#{blocked_user.id}/unblock", admin)
       expect(response.status).to eq(200)
-      expect(user.reload.state).to eq('active')
+      expect(blocked_user.reload.state).to eq('active')
+    end
+
+    it 'should not unblock ldap blocked users' do
+      put api("/users/#{ldap_blocked_user.id}/unblock", admin)
+      expect(response.status).to eq(403)
+      expect(ldap_blocked_user.reload.state).to eq('ldap_blocked')
     end
 
     it 'should not be available for non admin users' do
-- 
cgit v1.2.1


From 1eb7b5ee8d5afeeea74ccbd5627e5a235dffe9fd Mon Sep 17 00:00:00 2001
From: Tomasz Maczukin <tomasz@maczukin.pl>
Date: Fri, 8 Jan 2016 22:57:42 +0100
Subject: Modify entities for builds API

---
 spec/requests/api/builds_spec.rb | 1 -
 1 file changed, 1 deletion(-)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/builds_spec.rb b/spec/requests/api/builds_spec.rb
index a953eb2fac2..1e58e18fad9 100644
--- a/spec/requests/api/builds_spec.rb
+++ b/spec/requests/api/builds_spec.rb
@@ -74,7 +74,6 @@ describe API::API, api: true  do
 
         expect(response.status).to eq(200)
         expect(json_response['name']).to eq('test')
-        expect(json_response['commit']['sha']).to eq(commit.sha)
       end
 
       it 'should return specific build trace' do
-- 
cgit v1.2.1


From d54bff2a770c1030056866a47097aee9937390ef Mon Sep 17 00:00:00 2001
From: Tomasz Maczukin <tomasz@maczukin.pl>
Date: Fri, 8 Jan 2016 23:04:44 +0100
Subject: Change test access level from MASTER to DEVELOPER

This should help us detect potential regressions in the future.
---
 spec/requests/api/builds_spec.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/builds_spec.rb b/spec/requests/api/builds_spec.rb
index 1e58e18fad9..b6a1154cf76 100644
--- a/spec/requests/api/builds_spec.rb
+++ b/spec/requests/api/builds_spec.rb
@@ -6,7 +6,7 @@ describe API::API, api: true  do
   let(:user) { create(:user) }
   let(:user2) { create(:user) }
   let!(:project) { create(:project, creator_id: user.id) }
-  let!(:master) { create(:project_member, user: user, project: project, access_level: ProjectMember::MASTER) }
+  let!(:developer) { create(:project_member, user: user, project: project, access_level: ProjectMember::DEVELOPER) }
   let!(:reporter) { create(:project_member, user: user2, project: project, access_level: ProjectMember::REPORTER) }
   let(:commit) { create(:ci_commit, project: project)}
   let(:build) { create(:ci_build, commit: commit) }
-- 
cgit v1.2.1


From 4eb27d7c72d57015c7551a00e34a54cefc2d3db9 Mon Sep 17 00:00:00 2001
From: Tomasz Maczukin <tomasz@maczukin.pl>
Date: Fri, 8 Jan 2016 23:33:45 +0100
Subject: Add some modifications to builds API and specs

---
 spec/requests/api/builds_spec.rb | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/builds_spec.rb b/spec/requests/api/builds_spec.rb
index b6a1154cf76..799558d1bdd 100644
--- a/spec/requests/api/builds_spec.rb
+++ b/spec/requests/api/builds_spec.rb
@@ -50,7 +50,7 @@ describe API::API, api: true  do
     context 'authorized user' do
       it 'should return project builds for specific commit' do
         project.ensure_ci_commit(commit.sha)
-        get api("/projects/#{project.id}/builds/commit/#{project.ci_commits.first.sha}", user)
+        get api("/projects/#{project.id}/builds/commit/#{commit.sha}", user)
 
         expect(response.status).to eq(200)
         expect(json_response).to be_an Array
@@ -60,7 +60,7 @@ describe API::API, api: true  do
     context 'unauthorized user' do
       it 'should not return project builds' do
         project.ensure_ci_commit(commit.sha)
-        get api("/projects/#{project.id}/builds/commit/#{project.ci_commits.first.sha}")
+        get api("/projects/#{project.id}/builds/commit/#{commit.sha}")
 
         expect(response.status).to eq(401)
       end
@@ -99,7 +99,7 @@ describe API::API, api: true  do
     end
   end
 
-  describe 'GET /projects/:id/builds/:build_id/cancel' do
+  describe 'POST /projects/:id/builds/:build_id/cancel' do
     context 'authorized user' do
       context 'user with :manage_builds persmission' do
         it 'should cancel running or pending build' do
@@ -128,7 +128,7 @@ describe API::API, api: true  do
     end
   end
 
-  describe 'GET /projects/:id/builds/:build_id/retry' do
+  describe 'POST /projects/:id/builds/:build_id/retry' do
     context 'authorized user' do
       context 'user with :manage_builds persmission' do
         it 'should retry non-running build' do
-- 
cgit v1.2.1


From 96bbc145f31ad029e080ad8903445d81d6c31968 Mon Sep 17 00:00:00 2001
From: Tomasz Maczukin <tomasz@maczukin.pl>
Date: Mon, 11 Jan 2016 10:20:45 +0100
Subject: Change commit builds URL in builds API

---
 spec/requests/api/builds_spec.rb | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/builds_spec.rb b/spec/requests/api/builds_spec.rb
index 799558d1bdd..587fb74750d 100644
--- a/spec/requests/api/builds_spec.rb
+++ b/spec/requests/api/builds_spec.rb
@@ -46,11 +46,11 @@ describe API::API, api: true  do
     end
   end
 
-  describe 'GET /projects/:id/builds/commit/:sha' do
+  describe 'GET /projects/:id/repository/commits/:sha/builds' do
     context 'authorized user' do
       it 'should return project builds for specific commit' do
         project.ensure_ci_commit(commit.sha)
-        get api("/projects/#{project.id}/builds/commit/#{commit.sha}", user)
+        get api("/projects/#{project.id}/repository/commits/#{commit.sha}/builds", user)
 
         expect(response.status).to eq(200)
         expect(json_response).to be_an Array
@@ -60,7 +60,7 @@ describe API::API, api: true  do
     context 'unauthorized user' do
       it 'should not return project builds' do
         project.ensure_ci_commit(commit.sha)
-        get api("/projects/#{project.id}/builds/commit/#{commit.sha}")
+        get api("/projects/#{project.id}/repository/commits/#{commit.sha}/builds")
 
         expect(response.status).to eq(401)
       end
-- 
cgit v1.2.1


From d44653da1f74c2c15fe7ec3f8aa9b16563ffebd6 Mon Sep 17 00:00:00 2001
From: Tomasz Maczukin <tomasz@maczukin.pl>
Date: Wed, 13 Jan 2016 12:16:27 +0100
Subject: Add some fixes after review

---
 spec/requests/api/triggers_spec.rb | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/triggers_spec.rb b/spec/requests/api/triggers_spec.rb
index e8d89426ec0..2a86b60bc4d 100644
--- a/spec/requests/api/triggers_spec.rb
+++ b/spec/requests/api/triggers_spec.rb
@@ -105,7 +105,7 @@ describe API::API do
       end
     end
 
-    context 'unauthentikated user' do
+    context 'unauthenticated user' do
       it 'should not return triggers list' do
         get api("/projects/#{project.id}/triggers")
 
@@ -123,7 +123,7 @@ describe API::API do
         expect(json_response).to be_a(Hash)
       end
 
-      it 'should responde with 404 Not Found if requesting non-existing trigger' do
+      it 'should respond with 404 Not Found if requesting non-existing trigger' do
         get api("/projects/#{project.id}/triggers/abcdef012345", user)
 
         expect(response.status).to eq(404)
@@ -138,7 +138,7 @@ describe API::API do
       end
     end
 
-    context 'unauthentikated user' do
+    context 'unauthenticated user' do
       it 'should not return triggers list' do
         get api("/projects/#{project.id}/triggers/#{trigger.token}")
 
@@ -167,7 +167,7 @@ describe API::API do
       end
     end
 
-    context 'unauthentikated user' do
+    context 'unauthenticated user' do
       it 'should not create trigger' do
         post api("/projects/#{project.id}/triggers")
 
@@ -185,7 +185,7 @@ describe API::API do
         expect(response.status).to eq(200)
       end
 
-      it 'should responde with 404 Not Found if requesting non-existing trigger' do
+      it 'should respond with 404 Not Found if requesting non-existing trigger' do
         delete api("/projects/#{project.id}/triggers/abcdef012345", user)
 
         expect(response.status).to eq(404)
@@ -200,7 +200,7 @@ describe API::API do
       end
     end
 
-    context 'unauthentikated user' do
+    context 'unauthenticated user' do
       it 'should not delete trigger' do
         delete api("/projects/#{project.id}/triggers/#{trigger.token}")
 
-- 
cgit v1.2.1


From 97338496188add9ec8d192c7e78f6a6040befffa Mon Sep 17 00:00:00 2001
From: Tomasz Maczukin <tomasz@maczukin.pl>
Date: Wed, 13 Jan 2016 15:17:59 +0100
Subject: Add some fixes after review

---
 spec/requests/api/builds_spec.rb | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/builds_spec.rb b/spec/requests/api/builds_spec.rb
index 587fb74750d..4bf3d2681dc 100644
--- a/spec/requests/api/builds_spec.rb
+++ b/spec/requests/api/builds_spec.rb
@@ -35,6 +35,12 @@ describe API::API, api: true  do
         expect(response.status).to eq(200)
         expect(json_response).to be_an Array
       end
+
+      it 'should respond 400 when scope contains invalid state' do
+        get api("/projects/#{project.id}/builds?scope[0]=pending&scope[1]=unknown_status", user)
+
+        expect(response.status).to eq(400)
+      end
     end
 
     context 'unauthorized user' do
-- 
cgit v1.2.1


From 990bd06c04bebe6319968aa619990bf4cb60483c Mon Sep 17 00:00:00 2001
From: Tomasz Maczukin <tomasz@maczukin.pl>
Date: Wed, 13 Jan 2016 16:05:49 +0100
Subject: Change :ci_build_canceled factory to :canceled trait

---
 spec/requests/api/builds_spec.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/builds_spec.rb b/spec/requests/api/builds_spec.rb
index 4bf3d2681dc..e5567d42500 100644
--- a/spec/requests/api/builds_spec.rb
+++ b/spec/requests/api/builds_spec.rb
@@ -11,7 +11,7 @@ describe API::API, api: true  do
   let(:commit) { create(:ci_commit, project: project)}
   let(:build) { create(:ci_build, commit: commit) }
   let(:build_with_trace) { create(:ci_build_with_trace, commit: commit) }
-  let(:build_canceled) { create(:ci_build_canceled, commit: commit) }
+  let(:build_canceled) { create(:ci_build, :canceled, commit: commit) }
 
   describe 'GET /projects/:id/builds ' do
     context 'authorized user' do
-- 
cgit v1.2.1


From 13032b713d0943c2b7e2f2a3b886ef06be8e88ef Mon Sep 17 00:00:00 2001
From: Tomasz Maczukin <tomasz@maczukin.pl>
Date: Wed, 13 Jan 2016 18:30:49 +0100
Subject: Add seperated 'describe' block for build trace specs

---
 spec/requests/api/builds_spec.rb | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/builds_spec.rb b/spec/requests/api/builds_spec.rb
index e5567d42500..8c9f5a382b7 100644
--- a/spec/requests/api/builds_spec.rb
+++ b/spec/requests/api/builds_spec.rb
@@ -73,7 +73,7 @@ describe API::API, api: true  do
     end
   end
 
-  describe 'GET /projects/:id/builds/:build_id(/trace)?' do
+  describe 'GET /projects/:id/builds/:build_id' do
     context 'authorized user' do
       it 'should return specific build data' do
         get api("/projects/#{project.id}/builds/#{build.id}", user)
@@ -81,7 +81,19 @@ describe API::API, api: true  do
         expect(response.status).to eq(200)
         expect(json_response['name']).to eq('test')
       end
+    end
+
+    context 'unauthorized user' do
+      it 'should not return specific build data' do
+        get api("/projects/#{project.id}/builds/#{build.id}")
 
+        expect(response.status).to eq(401)
+      end
+    end
+  end
+
+  describe 'GET /projects/:id/builds/:build_id/trace' do
+    context 'authorized user' do
       it 'should return specific build trace' do
         get api("/projects/#{project.id}/builds/#{build_with_trace.id}/trace", user)
 
@@ -91,12 +103,6 @@ describe API::API, api: true  do
     end
 
     context 'unauthorized user' do
-      it 'should not return specific build data' do
-        get api("/projects/#{project.id}/builds/#{build.id}")
-
-        expect(response.status).to eq(401)
-      end
-
       it 'should not return specific build trace' do
         get api("/projects/#{project.id}/builds/#{build_with_trace.id}/trace")
 
-- 
cgit v1.2.1


From 0c10aee59677e2dadfef6538a74fe1e28fcdd37e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9my=20Coutable?= <remy@rymai.me>
Date: Wed, 13 Jan 2016 19:42:36 +0100
Subject: Ensure the API doesn't return notes that the current user shouldn't
 see

---
 spec/requests/api/notes_spec.rb | 51 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/notes_spec.rb b/spec/requests/api/notes_spec.rb
index 8b177af4689..565805d870c 100644
--- a/spec/requests/api/notes_spec.rb
+++ b/spec/requests/api/notes_spec.rb
@@ -10,6 +10,24 @@ describe API::API, api: true  do
   let!(:issue_note) { create(:note, noteable: issue, project: project, author: user) }
   let!(:merge_request_note) { create(:note, noteable: merge_request, project: project, author: user) }
   let!(:snippet_note) { create(:note, noteable: snippet, project: project, author: user) }
+
+  # For testing the cross-reference of a private issue in a public issue
+  let(:private_user)    { create(:user) }
+  let(:private_project) {
+    create(:project, namespace: private_user.namespace).
+    tap { |p| p.team << [private_user, :master] }
+  }
+  let(:private_issue)   { create(:issue, project: private_project) }
+  let(:ext_proj)  { create(:project, :public) }
+  let(:ext_issue) { create(:issue, project: ext_proj) }
+
+  let!(:cross_reference_note) {
+    create :note,
+    noteable: ext_issue, project: ext_proj,
+    note: "mentioned in issue #{private_issue.to_reference(ext_proj)}",
+    system: true
+  }
+
   before { project.team << [user, :reporter] }
 
   describe "GET /projects/:id/noteable/:noteable_id/notes" do
@@ -25,6 +43,24 @@ describe API::API, api: true  do
         get api("/projects/#{project.id}/issues/123/notes", user)
         expect(response.status).to eq(404)
       end
+
+      context "that references a private issue" do
+        it "should return an empty array" do
+          get api("/projects/#{ext_proj.id}/issues/#{ext_issue.id}/notes", user)
+          expect(response.status).to eq(200)
+          expect(json_response).to be_an Array
+          expect(json_response).to be_empty
+        end
+
+        context "and current user can view the note" do
+          it "should return an empty array" do
+            get api("/projects/#{ext_proj.id}/issues/#{ext_issue.id}/notes", private_user)
+            expect(response.status).to eq(200)
+            expect(json_response).to be_an Array
+            expect(json_response.first['body']).to eq(cross_reference_note.note)
+          end
+        end
+      end
     end
 
     context "when noteable is a Snippet" do
@@ -68,6 +104,21 @@ describe API::API, api: true  do
         get api("/projects/#{project.id}/issues/#{issue.id}/notes/123", user)
         expect(response.status).to eq(404)
       end
+
+      context "that references a private issue" do
+        it "should return a 404 error" do
+          get api("/projects/#{ext_proj.id}/issues/#{ext_issue.id}/notes/#{cross_reference_note.id}", user)
+          expect(response.status).to eq(404)
+        end
+
+        context "and current user can view the note" do
+          it "should return an issue note by id" do
+            get api("/projects/#{ext_proj.id}/issues/#{ext_issue.id}/notes/#{cross_reference_note.id}", private_user)
+            expect(response.status).to eq(200)
+            expect(json_response['body']).to eq(cross_reference_note.note)
+          end
+        end
+      end
     end
 
     context "when noteable is a Snippet" do
-- 
cgit v1.2.1


From 3b7f34281e4d1c4ca626578ddc9a1b9eda7e7538 Mon Sep 17 00:00:00 2001
From: Tomasz Maczukin <tomasz@maczukin.pl>
Date: Wed, 13 Jan 2016 19:57:23 +0100
Subject: Modify :ci_variable factory

---
 spec/requests/api/variables_spec.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/variables_spec.rb b/spec/requests/api/variables_spec.rb
index 214d7d5a0cc..9744729ba0c 100644
--- a/spec/requests/api/variables_spec.rb
+++ b/spec/requests/api/variables_spec.rb
@@ -46,7 +46,7 @@ describe API::API, api: true do
         expect(json_response['value']).to eq(variable.value)
       end
 
-      it 'should responde with 404 Not Found if requesting non-existing variable' do
+      it 'should respond with 404 Not Found if requesting non-existing variable' do
         get api("/projects/#{project.id}/variables/non_existing_variable", user)
 
         expect(response.status).to eq(404)
@@ -84,7 +84,7 @@ describe API::API, api: true do
 
       it 'should not allow to duplicate variable key' do
         expect do
-          post api("/projects/#{project.id}/variables", user), key: 'TEST_VARIABLE_1', value: 'VALUE_2'
+          post api("/projects/#{project.id}/variables", user), key: variable.key, value: 'VALUE_2'
         end.to change{project.variables.count}.by(0)
 
         expect(response.status).to eq(400)
-- 
cgit v1.2.1


From e918493f55eb27cdb779f0bc2d8cbbace8b69aa9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9my=20Coutable?= <remy@rymai.me>
Date: Thu, 14 Jan 2016 10:04:48 +0100
Subject: Fix specs and rubocop warnings

---
 spec/requests/api/notes_spec.rb | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/notes_spec.rb b/spec/requests/api/notes_spec.rb
index 565805d870c..d8bbd107269 100644
--- a/spec/requests/api/notes_spec.rb
+++ b/spec/requests/api/notes_spec.rb
@@ -13,20 +13,21 @@ describe API::API, api: true  do
 
   # For testing the cross-reference of a private issue in a public issue
   let(:private_user)    { create(:user) }
-  let(:private_project) {
+  let(:private_project) do
     create(:project, namespace: private_user.namespace).
     tap { |p| p.team << [private_user, :master] }
-  }
-  let(:private_issue)   { create(:issue, project: private_project) }
+  end
+  let(:private_issue)    { create(:issue, project: private_project) }
+
   let(:ext_proj)  { create(:project, :public) }
   let(:ext_issue) { create(:issue, project: ext_proj) }
 
-  let!(:cross_reference_note) {
+  let!(:cross_reference_note) do
     create :note,
     noteable: ext_issue, project: ext_proj,
     note: "mentioned in issue #{private_issue.to_reference(ext_proj)}",
     system: true
-  }
+  end
 
   before { project.team << [user, :reporter] }
 
-- 
cgit v1.2.1


From 3183092ca94b14d6e61f5e8ba51069554646baf8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A9my=20Coutable?= <remy@rymai.me>
Date: Thu, 14 Jan 2016 12:08:44 +0100
Subject: Add pagination headers to already paginated API resources

---
 spec/requests/api/commit_status_spec.rb | 6 +++++-
 spec/requests/api/notes_spec.rb         | 4 ++++
 2 files changed, 9 insertions(+), 1 deletion(-)

(limited to 'spec/requests/api')

diff --git a/spec/requests/api/commit_status_spec.rb b/spec/requests/api/commit_status_spec.rb
index a28607bd240..21482fc1070 100644
--- a/spec/requests/api/commit_status_spec.rb
+++ b/spec/requests/api/commit_status_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe API::API, api: true do
+describe API::CommitStatus, api: true do
   include ApiHelpers
   let(:user) { create(:user) }
   let(:user2) { create(:user) }
@@ -12,6 +12,10 @@ describe API::API, api: true do
   let(:commit_status) { create(:commit_status, commit: ci_commit) }
 
   describe "GET /projects/:id/repository/commits/:sha/statuses" do
+    it_behaves_like 'a paginated resources' do
+      let(:request) { get api("/projects/#{project.id}/repository/commits/#{commit.id}/statuses", user) }
+    end
+
     context "reporter user" do
       let(:statuses_id) { json_response.map { |status| status['id'] } }
 
diff --git a/spec/requests/api/notes_spec.rb b/spec/requests/api/notes_spec.rb
index d8bbd107269..39f9a06fe1b 100644
--- a/spec/requests/api/notes_spec.rb
+++ b/spec/requests/api/notes_spec.rb
@@ -32,6 +32,10 @@ describe API::API, api: true  do
   before { project.team << [user, :reporter] }
 
   describe "GET /projects/:id/noteable/:noteable_id/notes" do
+    it_behaves_like 'a paginated resources' do
+      let(:request) { get api("/projects/#{project.id}/issues/#{issue.id}/notes", user) }
+    end
+
     context "when noteable is an Issue" do
       it "should return an array of issue notes" do
         get api("/projects/#{project.id}/issues/#{issue.id}/notes", user)
-- 
cgit v1.2.1