diff options
Diffstat (limited to 'spec')
37 files changed, 1439 insertions, 698 deletions
diff --git a/spec/action/api_2fa_recovery.rb_spec.rb b/spec/action/api_2fa_recovery.rb_spec.rb new file mode 100644 index 0000000..70091e9 --- /dev/null +++ b/spec/action/api_2fa_recovery.rb_spec.rb @@ -0,0 +1,73 @@ +require_relative '../spec_helper' +require_relative '../../lib/action/api_2fa_recovery' + +describe Action::API2FARecovery do + let(:key_id) { '1' } + let(:actor) { Actor::Key.new(key_id) } + let(:username) { 'testuser' } + let(:discover_payload) { { 'username' => username } } + let(:api) { double(GitlabNet) } + + before do + allow(GitlabNet).to receive(:new).and_return(api) + allow(api).to receive(:discover).with(actor).and_return(discover_payload) + end + + subject do + described_class.new(actor) + end + + describe '#execute' do + context 'with an invalid repsonse' do + it 'returns nil' do + expect($stdin).to receive(:gets).and_return("meh\n") + + expect do + expect(subject.execute(nil, nil)).to be_nil + end.to output(/New recovery codes have \*not\* been generated/).to_stdout + end + end + + context 'with a negative response' do + before do + expect(subject).to receive(:continue?).and_return(false) + end + + it 'returns nil' do + expect do + expect(subject.execute(nil, nil)).to be_nil + end.to output(/New recovery codes have \*not\* been generated/).to_stdout + end + end + + + context 'with an affirmative response' do + let(:recovery_codes) { %w{ 8dfe0f433208f40b289904c6072e4a72 c33cee7fd0a73edb56e61b785e49af03 } } + + before do + expect(subject).to receive(:continue?).and_return(true) + expect(api).to receive(:two_factor_recovery_codes).with(actor).and_return(response) + end + + context 'with a unsuccessful response' do + let(:response) { { 'success' => false } } + + it 'puts error message to stdout' do + expect do + expect(subject.execute(nil, nil)).to be_falsey + end.to output(/An error occurred while trying to generate new recovery codes/).to_stdout + end + end + + context 'with a successful response' do + let(:response) { { 'success' => true, 'recovery_codes' => recovery_codes } } + + it 'puts information message including recovery codes to stdout' do + expect do + expect(subject.execute(nil, nil)).to be_truthy + end.to output(Regexp.new(recovery_codes.join("\n"))).to_stdout + end + end + end + end +end diff --git a/spec/action/base_spec.rb b/spec/action/base_spec.rb new file mode 100644 index 0000000..e986378 --- /dev/null +++ b/spec/action/base_spec.rb @@ -0,0 +1,12 @@ +require_relative '../spec_helper' +require_relative '../../lib/action/base' + +describe Action::Base do + describe '.create_from_json' do + it 'raises a NotImplementedError exeption' do + expect do + described_class.create_from_json('nomatter') + end.to raise_error(NotImplementedError) + end + end +end diff --git a/spec/action/git_lfs_authenticate_spec.rb b/spec/action/git_lfs_authenticate_spec.rb new file mode 100644 index 0000000..07e844f --- /dev/null +++ b/spec/action/git_lfs_authenticate_spec.rb @@ -0,0 +1,48 @@ +require_relative '../spec_helper' +require_relative '../../lib/action/git_lfs_authenticate' + +describe Action::GitLFSAuthenticate do + let(:key_id) { '1' } + let(:repo_name) { 'gitlab-ci.git' } + let(:actor) { Actor::Key.new(key_id) } + let(:username) { 'testuser' } + let(:discover_payload) { { 'username' => username } } + let(:api) { double(GitlabNet) } + + before do + allow(GitlabNet).to receive(:new).and_return(api) + allow(api).to receive(:discover).with(actor).and_return(discover_payload) + end + + subject do + described_class.new(actor, repo_name) + end + + describe '#execute' do + context 'when response from API is not a success' do + before do + expect(api).to receive(:lfs_authenticate).with(actor, repo_name).and_return(nil) + end + + it 'returns nil' do + expect(subject.execute(nil, nil)).to be_nil + end + end + + context 'when response from API is a success' do + let(:username) { 'testuser' } + let(:lfs_token) { '1234' } + let(:repository_http_path) { "/tmp/#{repo_name}" } + let(:gitlab_lfs_authentication) { GitlabLfsAuthentication.new(username, lfs_token, repository_http_path) } + + before do + expect(api).to receive(:lfs_authenticate).with(actor, repo_name).and_return(gitlab_lfs_authentication) + end + + it 'puts payload to stdout' do + expect($stdout).to receive(:puts).with('{"header":{"Authorization":"Basic dGVzdHVzZXI6MTIzNA=="},"href":"/tmp/gitlab-ci.git/info/lfs/"}') + expect(subject.execute(nil, nil)).to be_truthy + end + end + end +end diff --git a/spec/action/gitaly_spec.rb b/spec/action/gitaly_spec.rb new file mode 100644 index 0000000..a5f6f0b --- /dev/null +++ b/spec/action/gitaly_spec.rb @@ -0,0 +1,137 @@ +require_relative '../spec_helper' +require_relative '../../lib/action/gitaly' + +describe Action::Gitaly do + let(:git_trace_log_file_valid) { '/tmp/git_trace_performance.log' } + let(:git_trace_log_file_invalid) { "/bleep-bop#{git_trace_log_file_valid}" } + let(:git_trace_log_file_relative) { "..#{git_trace_log_file_valid}" } + let(:key_id) { '1' } + let(:key_str) { 'key-1' } + let(:key) { Actor::Key.new(key_id) } + let(:gl_repository) { 'project-1' } + let(:gl_username) { 'testuser' } + let(:git_protocol) { 'version=2' } + let(:tmp_repos_path) { File.join(ROOT_PATH, 'tmp', 'repositories') } + let(:repo_name) { 'gitlab-ci.git' } + let(:repository_path) { File.join(tmp_repos_path, repo_name) } + let(:gitaly_address) { 'unix:gitaly.socket' } + let(:gitaly_token) { '123456' } + let(:gitaly) do + { + 'repository' => { 'relative_path' => repo_name, 'storage_name' => 'default' }, + 'address' => gitaly_address, + 'token' => gitaly_token + } + end + + describe '.create_from_json' do + it 'returns an instance of Action::Gitaly' do + json = { + "gl_repository" => gl_repository, + "gl_username" => gl_username, + "repository_path" => repository_path, + "gitaly" => gitaly + } + expect(described_class.create_from_json(key_id, json)).to be_instance_of(Action::Gitaly) + end + end + + subject do + described_class.new(key, gl_repository, gl_username, git_protocol, repository_path, gitaly) + end + + describe '#execute' do + let(:args) { [ repository_path ] } + let(:base_exec_env) do + { + 'HOME' => ENV['HOME'], + 'PATH' => ENV['PATH'], + 'LD_LIBRARY_PATH' => ENV['LD_LIBRARY_PATH'], + 'LANG' => ENV['LANG'], + 'GL_ID' => key_str, + 'GL_PROTOCOL' => GitlabNet::GL_PROTOCOL, + 'GL_REPOSITORY' => gl_repository, + 'GL_USERNAME' => gl_username, + 'GITALY_TOKEN' => gitaly_token, + } + end + let(:with_trace_exec_env) do + base_exec_env.merge({ + 'GIT_TRACE' => git_trace_log_file, + 'GIT_TRACE_PACKET' => git_trace_log_file, + 'GIT_TRACE_PERFORMANCE' => git_trace_log_file + }) + end + let(:gitaly_request) do + { + 'repository' => gitaly['repository'], + 'gl_repository' => gl_repository, + 'gl_id' => key_str, + 'gl_username' => gl_username, + 'git_protocol' => git_protocol + } + end + + context 'for migrated commands' do + context 'such as git-upload-pack' do + let(:git_trace_log_file) { nil } + let(:command) { 'git-upload-pack' } + + before do + allow_any_instance_of(GitlabConfig).to receive(:git_trace_log_file).and_return(git_trace_log_file) + end + + context 'with an invalid config.git_trace_log_file' do + let(:git_trace_log_file) { git_trace_log_file_invalid } + + it 'returns true' do + expect(Kernel).to receive(:exec).with( + base_exec_env, + described_class::MIGRATED_COMMANDS[command], + gitaly_address, + JSON.dump(gitaly_request), + unsetenv_others: true, + chdir: ROOT_PATH + ).and_return(true) + + expect(subject.execute(command, args)).to be_truthy + end + end + + context 'with n relative config.git_trace_log_file' do + let(:git_trace_log_file) { git_trace_log_file_relative } + + it 'returns true' do + expect(Kernel).to receive(:exec).with( + base_exec_env, + described_class::MIGRATED_COMMANDS[command], + gitaly_address, + JSON.dump(gitaly_request), + unsetenv_others: true, + chdir: ROOT_PATH + ).and_return(true) + + expect(subject.execute(command, args)).to be_truthy + end + end + + context 'with a valid config.git_trace_log_file' do + let(:git_trace_log_file) { git_trace_log_file_valid } + + it 'returns true' do + expect(Kernel).to receive(:exec).with( + with_trace_exec_env, + described_class::MIGRATED_COMMANDS[command], + gitaly_address, + JSON.dump(gitaly_request), + unsetenv_others: true, + chdir: ROOT_PATH + ).and_return(true) + + expect(subject.execute(command, args)).to be_truthy + end + end + end + end + end +end diff --git a/spec/actor/base_spec.rb b/spec/actor/base_spec.rb new file mode 100644 index 0000000..26f899d --- /dev/null +++ b/spec/actor/base_spec.rb @@ -0,0 +1,28 @@ +require_relative '../spec_helper' +require_relative '../../lib/actor/base' + +describe Actor::Base do + describe '.identifier_key' do + it 'raises a NotImplementedError exception' do + expect do + described_class.identifier_key + end.to raise_error(NotImplementedError) + end + end + + describe '.identifier_prefix' do + it 'raises a NotImplementedError exception' do + expect do + described_class.identifier_prefix + end.to raise_error(NotImplementedError) + end + end + + describe '.id_regex' do + it 'raises a NotImplementedError exception' do + expect do + described_class.id_regex + end.to raise_error(NotImplementedError) + end + end +end diff --git a/spec/actor/key_spec.rb b/spec/actor/key_spec.rb new file mode 100644 index 0000000..e61a083 --- /dev/null +++ b/spec/actor/key_spec.rb @@ -0,0 +1,80 @@ +require_relative '../spec_helper' +require_relative '../../lib/actor/key' + +describe Actor::Key do + let(:key_id) { '1' } + let(:username) { 'testuser' } + let(:api) { double(GitlabNet) } + + let(:discover_payload) { { 'username' => username } } + let(:audit_usernames) { nil } + + before do + allow(GitlabNet).to receive(:new).and_return(api) + allow(api).to receive(:discover).with(subject).and_return(discover_payload) + end + + describe '.from' do + it 'returns an instance of Actor::Key' do + expect(described_class.from('key-1')).to be_a(Actor::Key) + end + + it 'has a key_id == 1' do + expect(described_class.from('key-1').key_id).to eq '1' + end + end + + describe '.identifier_prefix' do + it "returns 'key'" do + expect(described_class.identifier_prefix).to eql 'key' + end + end + + describe '.identifier_key' do + it "returns 'key_id'" do + expect(described_class.identifier_key).to eql 'key_id' + end + end + + subject { described_class.new(key_id, audit_usernames: audit_usernames) } + + describe '#username' do + context 'with a valid user' do + it "returns '@testuser'" do + expect(subject.username).to eql '@testuser' + end + end + + context 'without a valid user' do + let(:discover_payload) { nil } + + it "returns 'Anonymous'" do + expect(subject.username).to eql 'Anonymous' + end + end + end + + describe '#identifier' do + it "returns 'key-1'" do + expect(subject.identifier).to eql 'key-1' + end + end + + describe '#log_username' do + context 'when audit_usernames is true' do + let(:audit_usernames) { true } + + it "returns 'testuser'" do + expect(subject.log_username).to eql '@testuser' + end + end + + context 'when audit_usernames is false' do + let(:audit_usernames) { false } + + it "returns 'key with identifier key-1'" do + expect(subject.log_username).to eql 'key with identifier key-1' + end + end + end +end diff --git a/spec/actor/user_spec.rb b/spec/actor/user_spec.rb new file mode 100644 index 0000000..311fe73 --- /dev/null +++ b/spec/actor/user_spec.rb @@ -0,0 +1,62 @@ +require_relative '../spec_helper' +require_relative '../../lib/actor/user' + +describe Actor::User do + let(:user_id) { '1' } + let(:username) { 'testuser' } + let(:audit_usernames) { nil } + + describe '.from' do + it 'returns an instance of Actor::User' do + expect(described_class.from('user-1')).to be_a(Actor::User) + end + + it 'has an id == 1' do + expect(described_class.from('user-1').id).to eq '1' + end + end + + describe '.identifier_prefix' do + it "returns 'user'" do + expect(described_class.identifier_prefix).to eql 'user' + end + end + + describe '.identifier_key' do + it "returns 'user_id'" do + expect(described_class.identifier_key).to eql 'user_id' + end + end + + subject { described_class.new(user_id, audit_usernames: audit_usernames) } + + describe '#username' do + it "returns 'user-1'" do + expect(subject.username).to eql 'user-1' + end + end + + describe '#identifier' do + it "returns 'user-1'" do + expect(subject.identifier).to eql 'user-1' + end + end + + describe '#log_username' do + context 'when audit_usernames is true' do + let(:audit_usernames) { true } + + it "returns 'user-1'" do + expect(subject.log_username).to eql 'user-1' + end + end + + context 'when audit_usernames is false' do + let(:audit_usernames) { false } + + it "returns 'user with identifier user-1'" do + expect(subject.log_username).to eql 'user with identifier user-1' + end + end + end +end diff --git a/spec/actor/username_spec.rb b/spec/actor/username_spec.rb new file mode 100644 index 0000000..a02bf12 --- /dev/null +++ b/spec/actor/username_spec.rb @@ -0,0 +1,79 @@ +require_relative '../spec_helper' +require_relative '../../lib/actor/username' + +describe Actor::Username do + let(:username) { 'testuser' } + let(:api) { double(GitlabNet) } + + let(:discover_payload) { { 'username' => username } } + let(:audit_usernames) { nil } + + before do + allow(GitlabNet).to receive(:new).and_return(api) + allow(api).to receive(:discover).with(subject).and_return(discover_payload) + end + + describe '.from' do + it 'returns an instance of Actor::Username' do + expect(described_class.from("username-#{username}")).to be_a(Actor::Username) + end + + it 'has an id == 1' do + expect(described_class.from('username-1').id).to eq '1' + end + end + + describe '.identifier_prefix' do + it "returns 'user'" do + expect(described_class.identifier_prefix).to eql 'username' + end + end + + describe '.identifier_key' do + it "returns 'username'" do + expect(described_class.identifier_key).to eql 'username' + end + end + + subject { described_class.new(username, audit_usernames: audit_usernames) } + + describe '#username' do + context 'without a valid user' do + it "returns '@testuser'" do + expect(subject.username).to eql "@#{username}" + end + end + + context 'without a valid user' do + let(:discover_payload) { nil } + + it "returns 'Anonymous'" do + expect(subject.username).to eql 'Anonymous' + end + end + end + + describe '#identifier' do + it "returns 'username-testuser'" do + expect(subject.identifier).to eql 'username-testuser' + end + end + + describe '#log_username' do + context 'when audit_usernames is true' do + let(:audit_usernames) { true } + + it "returns '@testuser'" do + expect(subject.log_username).to eql "@#{username}" + end + end + + context 'when audit_usernames is false' do + let(:audit_usernames) { false } + + it "returns 'user with identifier username-testuser'" do + expect(subject.log_username).to eql "user with identifier username-#{username}" + end + end + end +end diff --git a/spec/actor_spec.rb b/spec/actor_spec.rb new file mode 100644 index 0000000..57cc718 --- /dev/null +++ b/spec/actor_spec.rb @@ -0,0 +1,34 @@ +require_relative 'spec_helper' +require_relative '../lib/actor' + +describe Actor do + describe '.new_from' do + context 'for an unsupported Actor type' do + it 'raises a NotImplementedError exception' do + expect do + described_class.new_from('unsupported-1') + end.to raise_error(Actor::UnsupportedActorError) + end + end + + context 'for a supported Actor type' do + context 'of Key' do + it 'returns an instance of Key' do + expect(described_class.new_from('key-1')).to be_a(Actor::Key) + end + end + + context 'of User' do + it 'returns an instance of User' do + expect(described_class.new_from('user-1')).to be_a(Actor::User) + end + end + + context 'of Username' do + it 'returns an instance of Username' do + expect(described_class.new_from('username-john1')).to be_a(Actor::Username) + end + end + end + end +end diff --git a/spec/gitlab_access_spec.rb b/spec/gitlab_access_spec.rb index f9717a7..73ebf2e 100644 --- a/spec/gitlab_access_spec.rb +++ b/spec/gitlab_access_spec.rb @@ -7,31 +7,27 @@ describe GitlabAccess do let(:repo_path) { File.join(repository_path, repo_name) + ".git" } let(:api) do double(GitlabNet).tap do |api| - api.stub(check_access: GitAccessStatus.new(true, - 'ok', - gl_repository: 'project-1', - gl_id: 'user-123', - gl_username: 'testuser', - repository_path: '/home/git/repositories', - gitaly: nil, - git_protocol: 'version=2')) + allow(api).to receive(:check_access).and_return( + Action::Gitaly.new( + 'key-1', + 'project-1', + 'testuser', + 'version=2', + '/home/git/repositories', + nil + ) + ) end end subject do GitlabAccess.new(nil, repo_path, 'key-123', 'wow', 'ssh').tap do |access| - access.stub(exec_cmd: :exec_called) - access.stub(api: api) + allow(access).to receive(:exec_cmd).and_return(:exec_called) + allow(access).to receive(:api).and_return(api) end end before do - GitlabConfig.any_instance.stub(repos_path: repository_path) - end - - describe :initialize do - it { subject.repo_path.should == repo_path } - it { subject.changes.should == ['wow'] } - it { subject.protocol.should == 'ssh' } + allow_any_instance_of(GitlabConfig).to receive(:repos_path).and_return(repository_path) end describe "#exec" do @@ -43,16 +39,7 @@ describe GitlabAccess do context "access is denied" do before do - api.stub(check_access: GitAccessStatus.new( - false, - 'denied', - gl_repository: nil, - gl_id: nil, - gl_username: nil, - repository_path: nil, - gitaly: nil, - git_protocol: nil - )) + allow(api).to receive(:check_access).and_raise(AccessDeniedError) end it "returns false" do @@ -62,7 +49,7 @@ describe GitlabAccess do context "API connection fails" do before do - api.stub(:check_access).and_raise(GitlabNet::ApiUnreachableError) + allow(api).to receive(:check_access).and_raise(GitlabNet::ApiUnreachableError) end it "returns false" do diff --git a/spec/gitlab_config_spec.rb b/spec/gitlab_config_spec.rb index a1c52a0..dd7e3bc 100644 --- a/spec/gitlab_config_spec.rb +++ b/spec/gitlab_config_spec.rb @@ -3,29 +3,55 @@ require_relative '../lib/gitlab_config' describe GitlabConfig do let(:config) { GitlabConfig.new } + let(:config_data) do + { + # 'user' => 'git', + # 'http_settings' => { + # 'self_signed_cert' => false + # }, + # 'log_level' => 'ERROR', + # 'audit_usernames' => true, + # 'log_format' => 'json', # Not sure on other values? + # 'git_trace_log_file' => nil + } + end + + before do + expect(YAML).to receive(:load_file).and_return(config_data) + end - describe :gitlab_url do + describe '#gitlab_url' do let(:url) { 'http://test.com' } + subject { config.gitlab_url } - before { config.send(:config)['gitlab_url'] = url } + + before { config_data['gitlab_url'] = url } it { should_not be_empty } it { should eq(url) } context 'remove trailing slashes' do - before { config.send(:config)['gitlab_url'] = url + '//' } + before { config_data['gitlab_url'] = url + '//' } it { should eq(url) } end end - describe :audit_usernames do + describe '#audit_usernames' do subject { config.audit_usernames } it("returns false by default") { should eq(false) } end - describe :log_format do + describe '#log_level' do + subject { config.log_level } + + it 'returns "INFO" by default' do + should eq('INFO') + end + end + + describe '#log_format' do subject { config.log_format } it 'returns "text" by default' do diff --git a/spec/gitlab_keys_spec.rb b/spec/gitlab_keys_spec.rb index 7011ca0..3cd6798 100644 --- a/spec/gitlab_keys_spec.rb +++ b/spec/gitlab_keys_spec.rb @@ -65,9 +65,9 @@ describe GitlabKeys do describe :initialize do let(:gitlab_keys) { build_gitlab_keys('add-key', 'key-741', 'ssh-rsa AAAAB3NzaDAxx2E') } - it { gitlab_keys.key.should == 'ssh-rsa AAAAB3NzaDAxx2E' } - it { gitlab_keys.instance_variable_get(:@command).should == 'add-key' } - it { gitlab_keys.instance_variable_get(:@key_id).should == 'key-741' } + it { expect(gitlab_keys.key).to eql 'ssh-rsa AAAAB3NzaDAxx2E' } + it { expect(gitlab_keys.instance_variable_get(:@command)).to eql 'add-key' } + it { expect(gitlab_keys.instance_variable_get(:@key_id)).to eql 'key-741' } end describe :add_key do @@ -77,7 +77,7 @@ describe GitlabKeys do create_authorized_keys_fixture gitlab_keys.send :add_key auth_line = "command=\"#{ROOT_PATH}/bin/gitlab-shell key-741\",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-rsa AAAAB3NzaDAxx2E" - File.read(tmp_authorized_keys_path).should == "existing content\n#{auth_line}\n" + expect(File.read(tmp_authorized_keys_path)).to eql "existing content\n#{auth_line}\n" end context "without file writing" do @@ -85,12 +85,12 @@ describe GitlabKeys do before { create_authorized_keys_fixture } it "should log an add-key event" do - $logger.should_receive(:info).with("Adding key", {:key_id=>"key-741", :public_key=>"ssh-rsa AAAAB3NzaDAxx2E"}) + expect($logger).to receive(:info).with("Adding key", {:key_id=>"key-741", :public_key=>"ssh-rsa AAAAB3NzaDAxx2E"}) gitlab_keys.send :add_key end it "should return true" do - gitlab_keys.send(:add_key).should be_truthy + expect(gitlab_keys.send(:add_key)).to be_truthy end end end @@ -104,7 +104,7 @@ describe GitlabKeys do create_authorized_keys_fixture gitlab_keys.send :add_key auth_line1 = 'key-741 AAAAB3NzaDAxx2E' - gitlab_keys.send(:list_keys).should == "#{auth_line1}\n" + expect(gitlab_keys.send(:list_keys)).to eql "#{auth_line1}\n" end end @@ -118,10 +118,9 @@ describe GitlabKeys do end it 'outputs the key IDs, separated by newlines' do - output = capture_stdout do + expect do gitlab_keys.send(:list_key_ids) - end - output.should match "1\n2\n3\n9000" + end.to output("1\n2\n3\n9000\n").to_stdout end end @@ -130,38 +129,38 @@ describe GitlabKeys do let(:fake_stdin) { StringIO.new("key-12\tssh-dsa ASDFASGADG\nkey-123\tssh-rsa GFDGDFSGSDFG\n", 'r') } before do create_authorized_keys_fixture - gitlab_keys.stub(stdin: fake_stdin) + allow(gitlab_keys).to receive(:stdin).and_return(fake_stdin) end it "adds lines at the end of the file" do gitlab_keys.send :batch_add_keys auth_line1 = "command=\"#{ROOT_PATH}/bin/gitlab-shell key-12\",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-dsa ASDFASGADG" auth_line2 = "command=\"#{ROOT_PATH}/bin/gitlab-shell key-123\",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-rsa GFDGDFSGSDFG" - File.read(tmp_authorized_keys_path).should == "existing content\n#{auth_line1}\n#{auth_line2}\n" + expect(File.read(tmp_authorized_keys_path)).to eql "existing content\n#{auth_line1}\n#{auth_line2}\n" end context "with invalid input" do let(:fake_stdin) { StringIO.new("key-12\tssh-dsa ASDFASGADG\nkey-123\tssh-rsa GFDGDFSGSDFG\nfoo\tbar\tbaz\n", 'r') } it "aborts" do - gitlab_keys.should_receive(:abort) + expect(gitlab_keys).to receive(:abort) gitlab_keys.send :batch_add_keys end end context "without file writing" do before do - gitlab_keys.should_receive(:open).and_yield(double(:file, puts: nil, chmod: nil)) + expect(gitlab_keys).to receive(:open).and_yield(double(:file, puts: nil, chmod: nil)) end it "should log an add-key event" do - $logger.should_receive(:info).with("Adding key", key_id: 'key-12', public_key: "ssh-dsa ASDFASGADG") - $logger.should_receive(:info).with("Adding key", key_id: 'key-123', public_key: "ssh-rsa GFDGDFSGSDFG") + expect($logger).to receive(:info).with("Adding key", key_id: 'key-12', public_key: "ssh-dsa ASDFASGADG") + expect($logger).to receive(:info).with("Adding key", key_id: 'key-123', public_key: "ssh-rsa GFDGDFSGSDFG") gitlab_keys.send :batch_add_keys end it "should return true" do - gitlab_keys.send(:batch_add_keys).should be_truthy + expect(gitlab_keys.send(:batch_add_keys)).to be_truthy end end end @@ -187,22 +186,22 @@ describe GitlabKeys do end gitlab_keys.send :rm_key erased_line = delete_line.gsub(/./, '#') - File.read(tmp_authorized_keys_path).should == "existing content\n#{erased_line}\n#{other_line}\n" + expect(File.read(tmp_authorized_keys_path)).to eql "existing content\n#{erased_line}\n#{other_line}\n" end context "without file writing" do before do - gitlab_keys.stub(:open) - gitlab_keys.stub(:lock).and_yield + allow(gitlab_keys).to receive(:open) + allow(gitlab_keys).to receive(:lock).and_yield end it "should log an rm-key event" do - $logger.should_receive(:info).with("Removing key", key_id: "key-741") + expect($logger).to receive(:info).with("Removing key", key_id: "key-741") gitlab_keys.send :rm_key end it "should return true" do - gitlab_keys.send(:rm_key).should be_truthy + expect(gitlab_keys.send(:rm_key)).to be_truthy end end @@ -219,7 +218,7 @@ describe GitlabKeys do end gitlab_keys.send :rm_key erased_line = delete_line.gsub(/./, '#') - File.read(tmp_authorized_keys_path).should == "existing content\n#{erased_line}\n#{other_line}\n" + expect(File.read(tmp_authorized_keys_path)).to eql "existing content\n#{erased_line}\n#{other_line}\n" end end end @@ -228,8 +227,8 @@ describe GitlabKeys do let(:gitlab_keys) { build_gitlab_keys('clear') } it "should return true" do - gitlab_keys.stub(:open) - gitlab_keys.send(:clear).should be_truthy + allow(gitlab_keys).to receive(:open) + expect(gitlab_keys.send(:clear)).to be_truthy end end @@ -242,7 +241,7 @@ describe GitlabKeys do end it 'returns false if opening raises an exception' do - gitlab_keys.should_receive(:open_auth_file).and_raise("imaginary error") + expect(gitlab_keys).to receive(:open_auth_file).and_raise("imaginary error") expect(gitlab_keys.exec).to eq(false) end @@ -257,51 +256,51 @@ describe GitlabKeys do describe :exec do it 'add-key arg should execute add_key method' do gitlab_keys = build_gitlab_keys('add-key') - gitlab_keys.should_receive(:add_key) + expect(gitlab_keys).to receive(:add_key) gitlab_keys.exec end it 'batch-add-keys arg should execute batch_add_keys method' do gitlab_keys = build_gitlab_keys('batch-add-keys') - gitlab_keys.should_receive(:batch_add_keys) + expect(gitlab_keys).to receive(:batch_add_keys) gitlab_keys.exec end it 'rm-key arg should execute rm_key method' do gitlab_keys = build_gitlab_keys('rm-key') - gitlab_keys.should_receive(:rm_key) + expect(gitlab_keys).to receive(:rm_key) gitlab_keys.exec end it 'clear arg should execute clear method' do gitlab_keys = build_gitlab_keys('clear') - gitlab_keys.should_receive(:clear) + expect(gitlab_keys).to receive(:clear) gitlab_keys.exec end it 'check-permissions arg should execute check_permissions method' do gitlab_keys = build_gitlab_keys('check-permissions') - gitlab_keys.should_receive(:check_permissions) + expect(gitlab_keys).to receive(:check_permissions) gitlab_keys.exec end it 'should puts message if unknown command arg' do gitlab_keys = build_gitlab_keys('change-key') - gitlab_keys.should_receive(:puts).with('not allowed') + expect(gitlab_keys).to receive(:puts).with('not allowed') gitlab_keys.exec end it 'should log a warning on unknown commands' do gitlab_keys = build_gitlab_keys('nooope') - gitlab_keys.stub(puts: nil) - $logger.should_receive(:warn).with("Attempt to execute invalid gitlab-keys command", command: '"nooope"') + allow(gitlab_keys).to receive(:puts).and_return(nil) + expect($logger).to receive(:warn).with("Attempt to execute invalid gitlab-keys command", command: '"nooope"') gitlab_keys.exec end end describe :lock do before do - GitlabKeys.any_instance.stub(lock_file: tmp_lock_file_path) + allow_any_instance_of(GitlabKeys).to receive(:lock_file).and_return(tmp_lock_file_path) end it "should raise exception if operation lasts more then timeout" do @@ -310,7 +309,7 @@ describe GitlabKeys do key.send :lock, 1 do sleep 2 end - end.to raise_error + end.to raise_error(Timeout::Error) end it "should actually lock file" do @@ -335,7 +334,7 @@ describe GitlabKeys do end thr1.join - $global.should == "foobar" + expect($global).to eql "foobar" end end @@ -353,7 +352,7 @@ describe GitlabKeys do def create_authorized_keys_fixture(existing_content: 'existing content') FileUtils.mkdir_p(File.dirname(tmp_authorized_keys_path)) open(tmp_authorized_keys_path, 'w') { |file| file.puts(existing_content) } - gitlab_keys.stub(auth_file: tmp_authorized_keys_path) + allow(gitlab_keys).to receive(:auth_file).and_return(tmp_authorized_keys_path) end def tmp_authorized_keys_path diff --git a/spec/gitlab_lfs_authentication_spec.rb b/spec/gitlab_lfs_authentication_spec.rb index 9e93a07..5516bb5 100644 --- a/spec/gitlab_lfs_authentication_spec.rb +++ b/spec/gitlab_lfs_authentication_spec.rb @@ -16,22 +16,22 @@ describe GitlabLfsAuthentication do end describe '#build_from_json' do - it { subject.username.should == 'dzaporozhets' } - it { subject.lfs_token.should == 'wsnys8Zm8Jn7zyhHTAAK' } - it { subject.repository_http_path.should == 'http://gitlab.dev/repo' } + it { expect(subject.username).to eql 'dzaporozhets' } + it { expect(subject.lfs_token).to eql 'wsnys8Zm8Jn7zyhHTAAK' } + it { expect(subject.repository_http_path).to eql 'http://gitlab.dev/repo' } end describe '#authentication_payload' do result = "{\"header\":{\"Authorization\":\"Basic ZHphcG9yb3poZXRzOndzbnlzOFptOEpuN3p5aEhUQUFL\"},\"href\":\"http://gitlab.dev/repo/info/lfs/\"}" - it { subject.authentication_payload.should eq(result) } + it { expect(subject.authentication_payload).to eq(result) } it 'should be a proper JSON' do payload = subject.authentication_payload json_payload = JSON.parse(payload) - json_payload['header']['Authorization'].should eq('Basic ZHphcG9yb3poZXRzOndzbnlzOFptOEpuN3p5aEhUQUFL') - json_payload['href'].should eq('http://gitlab.dev/repo/info/lfs/') + expect(json_payload['header']['Authorization']).to eq('Basic ZHphcG9yb3poZXRzOndzbnlzOFptOEpuN3p5aEhUQUFL') + expect(json_payload['href']).to eq('http://gitlab.dev/repo/info/lfs/') end end end diff --git a/spec/gitlab_logger_spec.rb b/spec/gitlab_logger_spec.rb index 934b6fa..31c6cff 100644 --- a/spec/gitlab_logger_spec.rb +++ b/spec/gitlab_logger_spec.rb @@ -6,7 +6,7 @@ describe :convert_log_level do subject { convert_log_level :extreme } it "converts invalid log level to Logger::INFO" do - $stderr.should_receive(:puts).at_least(:once) + expect($stderr).to receive(:puts).at_least(:once) should eq(Logger::INFO) end end diff --git a/spec/gitlab_net_spec.rb b/spec/gitlab_net_spec.rb index be2f4ba..8df6fd3 100644 --- a/spec/gitlab_net_spec.rb +++ b/spec/gitlab_net_spec.rb @@ -1,6 +1,5 @@ require_relative 'spec_helper' require_relative '../lib/gitlab_net' -require_relative '../lib/gitlab_access_status' describe GitlabNet, vcr: true do let(:gitlab_net) { described_class.new } @@ -8,57 +7,66 @@ describe GitlabNet, vcr: true do let(:base_api_endpoint) { 'http://localhost:3000/api/v4' } let(:internal_api_endpoint) { 'http://localhost:3000/api/v4/internal' } let(:project) { 'gitlab-org/gitlab-test.git' } - let(:key) { 'key-1' } - let(:key2) { 'key-2' } + + let(:actor1) { Actor.new_from('key-1') } + let(:bad_actor1) { Actor.new_from('key-777') } + let(:actor2) { Actor.new_from('user-1') } + let(:secret) { "0a3938d9d95d807e94d937af3a4fbbea\n" } before do $logger = double('logger').as_null_object - gitlab_net.stub(:base_api_endpoint).and_return(base_api_endpoint) - gitlab_net.stub(:secret_token).and_return(secret) + allow(gitlab_net).to receive(:base_api_endpoint).and_return(base_api_endpoint) + allow(gitlab_net).to receive(:secret_token).and_return(secret) end describe '#check' do it 'should return 200 code for gitlab check' do VCR.use_cassette("check-ok") do result = gitlab_net.check - result.code.should == '200' + expect(result.code).to eql('200') end end it 'adds the secret_token to request' do VCR.use_cassette("check-ok") do - Net::HTTP::Get.any_instance.should_receive(:set_form_data).with(hash_including(secret_token: secret)) + allow_any_instance_of(Net::HTTP::Get).to receive(:set_form_data).with(hash_including(secret_token: secret)) gitlab_net.check end end it "raises an exception if the connection fails" do - Net::HTTP.any_instance.stub(:request).and_raise(StandardError) - expect { gitlab_net.check }.to raise_error(GitlabNet::ApiUnreachableError) + allow_any_instance_of(Net::HTTP).to receive(:request).and_raise(StandardError) + expect do gitlab_net.check end.to raise_error(GitlabNet::ApiUnreachableError) end end describe '#discover' do - it 'should return user has based on key id' do + it 'returns user has based on key id' do VCR.use_cassette("discover-ok") do - user = gitlab_net.discover(key) - user['name'].should == 'Administrator' - user['username'].should == 'root' + user = gitlab_net.discover(actor1) + expect(user['name']).to eql 'Administrator' + expect(user['username']).to eql 'root' + end + end + + it 'returns nil if the user cannot be found' do + VCR.use_cassette("discover-not-found") do + expect(gitlab_net.discover(actor1)).to be_nil end end it 'adds the secret_token to request' do VCR.use_cassette("discover-ok") do - Net::HTTP::Get.any_instance.should_receive(:set_form_data).with(hash_including(secret_token: secret)) - gitlab_net.discover(key) + allow_any_instance_of(Net::HTTP::Get).to receive(:set_form_data).with(hash_including(secret_token: secret)) + gitlab_net.discover(actor1) end end it "raises an exception if the connection fails" do VCR.use_cassette("discover-ok") do - Net::HTTP.any_instance.stub(:request).and_raise(StandardError) - expect { gitlab_net.discover(key) }.to raise_error(GitlabNet::ApiUnreachableError) + allow_any_instance_of(Net::HTTP).to receive(:request).and_raise(StandardError) + expect(gitlab_net.discover(actor1)).to be_nil end end end @@ -67,10 +75,10 @@ describe GitlabNet, vcr: true do context 'lfs authentication succeeded' do it 'should return the correct data' do VCR.use_cassette('lfs-authenticate-ok') do - lfs_access = gitlab_net.lfs_authenticate(key, project) - lfs_access.username.should == 'root' - lfs_access.lfs_token.should == 'Hyzhyde_wLUeyUQsR3tHGTG8eNocVQm4ssioTEsBSdb6KwCSzQ' - lfs_access.repository_http_path.should == URI.join(internal_api_endpoint.sub('api/v4', ''), project).to_s + lfs_access = gitlab_net.lfs_authenticate(actor1, project) + expect(lfs_access.username).to eql 'root' + expect(lfs_access.lfs_token).to eql 'Hyzhyde_wLUeyUQsR3tHGTG8eNocVQm4ssioTEsBSdb6KwCSzQ' + expect(lfs_access.repository_http_path).to eql URI.join(internal_api_endpoint.sub('api/v4', ''), project).to_s end end end @@ -81,7 +89,7 @@ describe GitlabNet, vcr: true do it 'should return message' do VCR.use_cassette("broadcast_message-ok") do result = gitlab_net.broadcast_message - result["message"].should == "Message" + expect(result["message"]).to eql "Message" end end end @@ -90,7 +98,7 @@ describe GitlabNet, vcr: true do it 'should return nil' do VCR.use_cassette("broadcast_message-none") do result = gitlab_net.broadcast_message - result.should == {} + expect(result).to eql({}) end end end @@ -102,13 +110,13 @@ describe GitlabNet, vcr: true do let(:encoded_changes) { "123456%20789012%20refs/heads/test%0A654321%20210987%20refs/tags/tag" } it "sends the given arguments as encoded URL parameters" do - gitlab_net.should_receive(:get).with("#{internal_api_endpoint}/merge_request_urls?project=#{project}&changes=#{encoded_changes}&gl_repository=#{gl_repository}") + expect(gitlab_net).to receive(:get).with("#{internal_api_endpoint}/merge_request_urls?project=#{project}&changes=#{encoded_changes}&gl_repository=#{gl_repository}") gitlab_net.merge_request_urls(gl_repository, project, changes) end it "omits the gl_repository parameter if it's nil" do - gitlab_net.should_receive(:get).with("#{internal_api_endpoint}/merge_request_urls?project=#{project}&changes=#{encoded_changes}") + expect(gitlab_net).to receive(:get).with("#{internal_api_endpoint}/merge_request_urls?project=#{project}&changes=#{encoded_changes}") gitlab_net.merge_request_urls(nil, project, changes) end @@ -135,8 +143,7 @@ describe GitlabNet, vcr: true do subject { gitlab_net.pre_receive(gl_repository) } it 'sends the correct parameters and returns the request body parsed' do - Net::HTTP::Post.any_instance.should_receive(:set_form_data) - .with(hash_including(params)) + allow_any_instance_of(Net::HTTP::Post).to receive(:set_form_data).with(hash_including(params)) VCR.use_cassette("pre-receive") { subject } end @@ -147,9 +154,9 @@ describe GitlabNet, vcr: true do end end - it 'throws a NotFound error when pre-receive is not available' do + it 'throws a NotFoundError when pre-receive is not available' do VCR.use_cassette("pre-receive-not-found") do - expect { subject }.to raise_error(GitlabNet::NotFound) + expect do subject end.to raise_error(GitlabNet::NotFoundError) end end end @@ -158,7 +165,7 @@ describe GitlabNet, vcr: true do let(:gl_repository) { "project-1" } let(:changes) { "123456 789012 refs/heads/test\n654321 210987 refs/tags/tag" } let(:params) do - { gl_repository: gl_repository, identifier: key, changes: changes } + { gl_repository: gl_repository, identifier: actor1.identifier, changes: changes } end let(:merge_request_urls) do [{ @@ -168,11 +175,10 @@ describe GitlabNet, vcr: true do }] end - subject { gitlab_net.post_receive(gl_repository, key, changes) } + subject { gitlab_net.post_receive(gl_repository, actor1, changes) } it 'sends the correct parameters' do - Net::HTTP::Post.any_instance.should_receive(:set_form_data).with(hash_including(params)) - + allow_any_instance_of(Net::HTTP::Post).to receive(:set_form_data).with(hash_including(params)) VCR.use_cassette("post-receive") do subject @@ -187,9 +193,9 @@ describe GitlabNet, vcr: true do end end - it 'throws a NotFound error when post-receive is not available' do + it 'throws a NotFoundError when post-receive is not available' do VCR.use_cassette("post-receive-not-found") do - expect { subject }.to raise_error(GitlabNet::NotFound) + expect do subject end.to raise_error(GitlabNet::NotFoundError) end end end @@ -200,21 +206,21 @@ describe GitlabNet, vcr: true do it "should return nil when the resource is not implemented" do VCR.use_cassette("ssh-key-not-implemented") do result = gitlab_net.authorized_key("whatever") - result.should be_nil + expect(result).to be_nil end end it "should return nil when the fingerprint is not found" do VCR.use_cassette("ssh-key-not-found") do result = gitlab_net.authorized_key("whatever") - result.should be_nil + expect(result).to be_nil end end it "should return a ssh key with a valid fingerprint" do VCR.use_cassette("ssh-key-ok") do result = gitlab_net.authorized_key(ssh_key) - result.should eq({ + expect(result).to eql({ "can_push" => false, "created_at" => "2017-06-21T09:50:07.150Z", "id" => 99, @@ -228,7 +234,7 @@ describe GitlabNet, vcr: true do describe '#two_factor_recovery_codes' do it 'returns two factor recovery codes' do VCR.use_cassette('two-factor-recovery-codes') do - result = gitlab_net.two_factor_recovery_codes(key) + result = gitlab_net.two_factor_recovery_codes(actor1) expect(result['success']).to be_truthy expect(result['recovery_codes']).to eq(['f67c514de60c4953','41278385fc00c1e0']) end @@ -236,7 +242,7 @@ describe GitlabNet, vcr: true do it 'returns false when recovery codes cannot be generated' do VCR.use_cassette('two-factor-recovery-codes-fail') do - result = gitlab_net.two_factor_recovery_codes('key-777') + result = gitlab_net.two_factor_recovery_codes(bad_actor1) expect(result['success']).to be_falsey expect(result['message']).to eq('Could not find the given key') end @@ -252,7 +258,7 @@ describe GitlabNet, vcr: true do it 'sets the arguments as form parameters' do VCR.use_cassette('notify-post-receive') do - Net::HTTP::Post.any_instance.should_receive(:set_form_data).with(hash_including(params)) + allow_any_instance_of(Net::HTTP::Post).to receive(:set_form_data).with(hash_including(params)) gitlab_net.notify_post_receive(gl_repository, repo_path) end end @@ -265,92 +271,159 @@ describe GitlabNet, vcr: true do end describe '#check_access' do + context 'something is wrong with the API response' do + context 'but response is JSON parsable' do + it 'raises an UnknownError exception' do + VCR.use_cassette('failed-push') do + expect do + gitlab_net.check_access('git-receive-pack', nil, project, actor1, changes, 'ssh') + end.to raise_error(UnknownError, 'API is not accessible: An internal server error occurred') + end + end + end + + context 'but response is not JSON parsable' do + it 'raises an UnknownError exception' do + VCR.use_cassette('failed-push-unparsable') do + expect do + gitlab_net.check_access('git-receive-pack', nil, project, actor1, changes, 'ssh') + end.to raise_error(UnknownError, 'API is not accessible') + end + end + end + end + context 'ssh key with access nil, to project' do - it 'should allow pull access for host' do - VCR.use_cassette("allowed-pull") do - access = gitlab_net.check_access('git-receive-pack', nil, project, key, changes, 'ssh') - access.allowed?.should be_truthy + it 'should allow push access for host' do + VCR.use_cassette('allowed-push') do + action = gitlab_net.check_access('git-receive-pack', nil, project, actor1, changes, 'ssh') + expect(action).to be_instance_of(Action::Gitaly) end end it 'adds the secret_token to the request' do - VCR.use_cassette("allowed-pull") do - Net::HTTP::Post.any_instance.should_receive(:set_form_data).with(hash_including(secret_token: secret)) - gitlab_net.check_access('git-receive-pack', nil, project, key, changes, 'ssh') + VCR.use_cassette('allowed-pull') do + allow_any_instance_of(Net::HTTP::Post).to receive(:set_form_data).with(hash_including(secret_token: secret)) + gitlab_net.check_access('git-receive-pack', nil, project, actor1, changes, 'ssh') end end - it 'should allow push access for host' do - VCR.use_cassette("allowed-push") do - access = gitlab_net.check_access('git-upload-pack', nil, project, key, changes, 'ssh') - access.allowed?.should be_truthy + it 'should allow pull access for host' do + VCR.use_cassette("allowed-pull") do + action = gitlab_net.check_access('git-upload-pack', nil, project, actor1, changes, 'ssh') + expect(action).to be_instance_of(Action::Gitaly) end end end context 'ssh access has been disabled' do it 'should deny pull access for host' do + VCR.use_cassette('ssh-pull-disabled-old') do + expect do + gitlab_net.check_access('git-upload-pack', nil, project, actor1, changes, 'http') + end.to raise_error(AccessDeniedError, 'Git access over SSH is not allowed') + end + VCR.use_cassette('ssh-pull-disabled') do - access = gitlab_net.check_access('git-upload-pack', nil, project, key, changes, 'ssh') - access.allowed?.should be_falsey - access.message.should eq 'Git access over SSH is not allowed' + expect do + gitlab_net.check_access('git-upload-pack', nil, project, actor1, changes, 'http') + end.to raise_error(AccessDeniedError, 'Git access over SSH is not allowed') end end it 'should deny push access for host' do + VCR.use_cassette('ssh-push-disabled-old') do + expect do + gitlab_net.check_access('git-receive-pack', nil, project, actor1, changes, 'ssh') + end.to raise_error(AccessDeniedError, 'Git access over SSH is not allowed') + end + VCR.use_cassette('ssh-push-disabled') do - access = gitlab_net.check_access('git-receive-pack', nil, project, key, changes, 'ssh') - access.allowed?.should be_falsey - access.message.should eq 'Git access over SSH is not allowed' + expect do + gitlab_net.check_access('git-receive-pack', nil, project, actor1, changes, 'ssh') + end.to raise_error(AccessDeniedError, 'Git access over SSH is not allowed') end end end context 'http access has been disabled' do it 'should deny pull access for host' do + VCR.use_cassette('http-pull-disabled-old') do + expect do + gitlab_net.check_access('git-upload-pack', nil, project, actor1, changes, 'http') + end.to raise_error(AccessDeniedError, 'Pulling over HTTP is not allowed.') + end + VCR.use_cassette('http-pull-disabled') do - access = gitlab_net.check_access('git-upload-pack', nil, project, key, changes, 'http') - access.allowed?.should be_falsey - access.message.should eq 'Pulling over HTTP is not allowed.' + expect do + gitlab_net.check_access('git-upload-pack', nil, project, actor1, changes, 'http') + end.to raise_error(AccessDeniedError, 'Pulling over HTTP is not allowed.') end end it 'should deny push access for host' do - VCR.use_cassette("http-push-disabled") do - access = gitlab_net.check_access('git-receive-pack', nil, project, key, changes, 'http') - access.allowed?.should be_falsey - access.message.should eq 'Pushing over HTTP is not allowed.' + VCR.use_cassette('http-push-disabled-old') do + expect do + gitlab_net.check_access('git-receive-pack', nil, project, actor1, changes, 'http') + end.to raise_error(AccessDeniedError, 'Pushing over HTTP is not allowed.') + end + + VCR.use_cassette('http-push-disabled') do + expect do + gitlab_net.check_access('git-receive-pack', nil, project, actor1, changes, 'http') + end.to raise_error(AccessDeniedError, 'Pushing over HTTP is not allowed.') end end end context 'ssh key without access to project' do it 'should deny pull access for host' do - VCR.use_cassette("ssh-pull-project-denied") do - access = gitlab_net.check_access('git-receive-pack', nil, project, key2, changes, 'ssh') - access.allowed?.should be_falsey + VCR.use_cassette('ssh-pull-project-denied-old') do + expect do + gitlab_net.check_access('git-receive-pack', nil, project, actor2, changes, 'ssh') + end.to raise_error(AccessDeniedError, 'Git access over SSH is not allowed') + end + + VCR.use_cassette('ssh-pull-project-denied') do + expect do + gitlab_net.check_access('git-receive-pack', nil, project, actor2, changes, 'ssh') + end.to raise_error(AccessDeniedError, 'Git access over SSH is not allowed') end end it 'should deny push access for host' do - VCR.use_cassette("ssh-push-project-denied") do - access = gitlab_net.check_access('git-upload-pack', nil, project, key2, changes, 'ssh') - access.allowed?.should be_falsey + VCR.use_cassette('ssh-push-project-denied-old') do + expect do + gitlab_net.check_access('git-upload-pack', nil, project, actor2, changes, 'ssh') + end.to raise_error(AccessDeniedError, 'Git access over SSH is not allowed') + end + + VCR.use_cassette('ssh-push-project-denied') do + expect do + gitlab_net.check_access('git-upload-pack', nil, project, actor2, changes, 'ssh') + end.to raise_error(AccessDeniedError, 'Git access over SSH is not allowed') end end it 'should deny push access for host (with user)' do - VCR.use_cassette("ssh-push-project-denied-with-user") do - access = gitlab_net.check_access('git-upload-pack', nil, project, 'user-2', changes, 'ssh') - access.allowed?.should be_falsey + VCR.use_cassette('ssh-push-project-denied-with-user-old') do + expect do + gitlab_net.check_access('git-upload-pack', nil, project, actor2, changes, 'ssh') + end.to raise_error(AccessDeniedError, 'Git access over SSH is not allowed') + end + + VCR.use_cassette('ssh-push-project-denied-with-user') do + expect do + gitlab_net.check_access('git-upload-pack', nil, project, actor2, changes, 'ssh') + end.to raise_error(AccessDeniedError, 'Git access over SSH is not allowed') end end end it "raises an exception if the connection fails" do - Net::HTTP.any_instance.stub(:request).and_raise(StandardError) + allow_any_instance_of(Net::HTTP).to receive(:request).and_raise(StandardError) expect { - gitlab_net.check_access('git-upload-pack', nil, project, 'user-1', changes, 'ssh') + gitlab_net.check_access('git-upload-pack', nil, project, actor1, changes, 'ssh') }.to raise_error(GitlabNet::ApiUnreachableError) end end @@ -377,8 +450,8 @@ describe GitlabNet, vcr: true do subject { gitlab_net.send :http_client_for, URI('https://localhost/') } before do - gitlab_net.stub :cert_store - gitlab_net.send(:config).stub(:http_settings) { {'self_signed_cert' => true} } + allow(gitlab_net).to receive(:cert_store) + allow(gitlab_net.send(:config)).to receive(:http_settings).and_return({ 'self_signed_cert' => true }) end its(:verify_mode) { should eq(OpenSSL::SSL::VERIFY_NONE) } @@ -398,11 +471,11 @@ describe GitlabNet, vcr: true do subject { gitlab_net.send :http_request_for, :get, url } before do - gitlab_net.send(:config).http_settings.stub(:[]).with('user') { user } - gitlab_net.send(:config).http_settings.stub(:[]).with('password') { password } - Net::HTTP::Get.should_receive(:new).with('/', {}).and_return(get) - get.should_receive(:basic_auth).with(user, password).once - get.should_receive(:set_form_data).with(hash_including(secret_token: secret)).once + allow(gitlab_net.send(:config).http_settings).to receive(:[]).with('user').and_return(user) + allow(gitlab_net.send(:config).http_settings).to receive(:[]).with('password').and_return(password) + expect(Net::HTTP::Get).to receive(:new).with('/', {}).and_return(get) + expect(get).to receive(:basic_auth).with(user, password).once + expect(get).to receive(:set_form_data).with(hash_including(secret_token: secret)).once end it { should_not be_nil } @@ -412,11 +485,11 @@ describe GitlabNet, vcr: true do subject { gitlab_net.send :http_request_for, :get, url, params: params, headers: headers } before do - gitlab_net.send(:config).http_settings.stub(:[]).with('user') { user } - gitlab_net.send(:config).http_settings.stub(:[]).with('password') { password } - Net::HTTP::Get.should_receive(:new).with('/', headers).and_return(get) - get.should_receive(:basic_auth).with(user, password).once - get.should_receive(:set_form_data).with({ 'key1' => 'value1', secret_token: secret }).once + allow(gitlab_net.send(:config).http_settings).to receive(:[]).with('user').and_return(user) + allow(gitlab_net.send(:config).http_settings).to receive(:[]).with('password').and_return(password) + expect(Net::HTTP::Get).to receive(:new).with('/', headers).and_return(get) + expect(get).to receive(:basic_auth).with(user, password).once + expect(get).to receive(:set_form_data).with({ 'key1' => 'value1', secret_token: secret }).once end it { should_not be_nil } @@ -426,11 +499,11 @@ describe GitlabNet, vcr: true do subject { gitlab_net.send :http_request_for, :get, url, headers: headers } before do - gitlab_net.send(:config).http_settings.stub(:[]).with('user') { user } - gitlab_net.send(:config).http_settings.stub(:[]).with('password') { password } - Net::HTTP::Get.should_receive(:new).with('/', headers).and_return(get) - get.should_receive(:basic_auth).with(user, password).once - get.should_receive(:set_form_data).with(hash_including(secret_token: secret)).once + allow(gitlab_net.send(:config).http_settings).to receive(:[]).with('user').and_return(user) + allow(gitlab_net.send(:config).http_settings).to receive(:[]).with('password').and_return(password) + expect(Net::HTTP::Get).to receive(:new).with('/', headers).and_return(get) + expect(get).to receive(:basic_auth).with(user, password).once + expect(get).to receive(:set_form_data).with(hash_including(secret_token: secret)).once end it { should_not be_nil } @@ -441,12 +514,12 @@ describe GitlabNet, vcr: true do subject { gitlab_net.send :http_request_for, :get, url, options: options } before do - gitlab_net.send(:config).http_settings.stub(:[]).with('user') { user } - gitlab_net.send(:config).http_settings.stub(:[]).with('password') { password } - Net::HTTP::Get.should_receive(:new).with('/', {}).and_return(get) - get.should_receive(:basic_auth).with(user, password).once - get.should_receive(:body=).with({ 'key2' => 'value2', secret_token: secret }.to_json).once - get.should_not_receive(:set_form_data) + allow(gitlab_net.send(:config).http_settings).to receive(:[]).with('user').and_return(user) + allow(gitlab_net.send(:config).http_settings).to receive(:[]).with('password').and_return(password) + expect(Net::HTTP::Get).to receive(:new).with('/', {}).and_return(get) + expect(get).to receive(:basic_auth).with(user, password).once + expect(get).to receive(:body=).with({ 'key2' => 'value2', secret_token: secret }.to_json).once + expect(get).to_not receive(:set_form_data) end it { should_not be_nil } @@ -457,7 +530,7 @@ describe GitlabNet, vcr: true do context 'Unix socket' do it 'sets the Host header to "localhost"' do gitlab_net = described_class.new - gitlab_net.should_receive(:secret_token).and_return(secret) + expect(gitlab_net).to receive(:secret_token).and_return(secret) request = gitlab_net.send(:http_request_for, :get, URI('http+unix://%2Ffoo')) @@ -469,12 +542,12 @@ describe GitlabNet, vcr: true do describe '#cert_store' do let(:store) do double(OpenSSL::X509::Store).tap do |store| - OpenSSL::X509::Store.stub(:new) { store } + allow(OpenSSL::X509::Store).to receive(:new).and_return(store) end end before :each do - store.should_receive(:set_default_paths).once + expect(store).to receive(:set_default_paths).once end after do @@ -482,17 +555,17 @@ describe GitlabNet, vcr: true do end it "calls add_file with http_settings['ca_file']" do - gitlab_net.send(:config).http_settings.stub(:[]).with('ca_file') { 'test_file' } - gitlab_net.send(:config).http_settings.stub(:[]).with('ca_path') { nil } - store.should_receive(:add_file).with('test_file') - store.should_not_receive(:add_path) + allow(gitlab_net.send(:config).http_settings).to receive(:[]).with('ca_file').and_return('test_file') + allow(gitlab_net.send(:config).http_settings).to receive(:[]).with('ca_path').and_return(nil) + expect(store).to receive(:add_file).with('test_file') + expect(store).to_not receive(:add_path) end it "calls add_path with http_settings['ca_path']" do - gitlab_net.send(:config).http_settings.stub(:[]).with('ca_file') { nil } - gitlab_net.send(:config).http_settings.stub(:[]).with('ca_path') { 'test_path' } - store.should_not_receive(:add_file) - store.should_receive(:add_path).with('test_path') + allow(gitlab_net.send(:config).http_settings).to receive(:[]).with('ca_file').and_return(nil) + allow(gitlab_net.send(:config).http_settings).to receive(:[]).with('ca_path').and_return('test_path') + expect(store).to_not receive(:add_file) + expect(store).to receive(:add_path).with('test_path') end end end diff --git a/spec/gitlab_post_receive_spec.rb b/spec/gitlab_post_receive_spec.rb index 46e6158..c41cceb 100644 --- a/spec/gitlab_post_receive_spec.rb +++ b/spec/gitlab_post_receive_spec.rb @@ -5,13 +5,13 @@ require 'gitlab_post_receive' describe GitlabPostReceive do let(:repository_path) { "/home/git/repositories" } let(:repo_name) { 'dzaporozhets/gitlab-ci' } - let(:actor) { 'key-123' } + let(:gl_id) { 'key-123' } let(:changes) { "123456 789012 refs/heads/tést\n654321 210987 refs/tags/tag" } let(:wrongly_encoded_changes) { changes.encode("ISO-8859-1").force_encoding("UTF-8") } let(:base64_changes) { Base64.encode64(wrongly_encoded_changes) } let(:repo_path) { File.join(repository_path, repo_name) + ".git" } let(:gl_repository) { "project-1" } - let(:gitlab_post_receive) { GitlabPostReceive.new(gl_repository, repo_path, actor, wrongly_encoded_changes) } + let(:gitlab_post_receive) { GitlabPostReceive.new(gl_repository, repo_path, gl_id, wrongly_encoded_changes) } let(:broadcast_message) { "test " * 10 + "message " * 10 } let(:enqueued_at) { Time.new(2016, 6, 23, 6, 59) } let(:new_merge_request_urls) do @@ -31,7 +31,7 @@ describe GitlabPostReceive do before do $logger = double('logger').as_null_object # Global vars are bad - GitlabConfig.any_instance.stub(repos_path: repository_path) + allow_any_instance_of(GitlabConfig).to receive(:repos_path).and_return(repository_path) end describe "#exec" do @@ -63,7 +63,7 @@ describe GitlabPostReceive do context 'when contains long url string at end' do let(:broadcast_message) { "test " * 10 + "message " * 10 + "https://localhost:5000/test/a/really/long/url/that/is/in/the/broadcast/message/do-not-truncate-when-url" } - it 'doesnt truncate url' do + it 'doesnt truncate url' do expect_any_instance_of(GitlabNet).to receive(:post_receive).and_return(response) assert_broadcast_message_printed_keep_long_url_end(gitlab_post_receive) assert_new_mr_printed(gitlab_post_receive) @@ -75,7 +75,7 @@ describe GitlabPostReceive do context 'when contains long url string at start' do let(:broadcast_message) { "https://localhost:5000/test/a/really/long/url/that/is/in/the/broadcast/message/do-not-truncate-when-url " + "test " * 10 + "message " * 11} - it 'doesnt truncate url' do + it 'doesnt truncate url' do expect_any_instance_of(GitlabNet).to receive(:post_receive).and_return(response) assert_broadcast_message_printed_keep_long_url_start(gitlab_post_receive) assert_new_mr_printed(gitlab_post_receive) @@ -87,7 +87,7 @@ describe GitlabPostReceive do context 'when contains long url string in middle' do let(:broadcast_message) { "test " * 11 + "https://localhost:5000/test/a/really/long/url/that/is/in/the/broadcast/message/do-not-truncate-when-url " + "message " * 11} - it 'doesnt truncate url' do + it 'doesnt truncate url' do expect_any_instance_of(GitlabNet).to receive(:post_receive).and_return(response) assert_broadcast_message_printed_keep_long_url_middle(gitlab_post_receive) assert_new_mr_printed(gitlab_post_receive) @@ -198,7 +198,7 @@ describe GitlabPostReceive do expect(gitlab_post_receive).to receive(:puts).with( " message message message message message message message message" ).ordered - + expect(gitlab_post_receive).to receive(:puts).with( "https://localhost:5000/test/a/really/long/url/that/is/in/the/broadcast/message/do-not-truncate-when-url" ).ordered @@ -215,7 +215,7 @@ describe GitlabPostReceive do "========================================================================" ).ordered expect(gitlab_post_receive).to receive(:puts).ordered - + expect(gitlab_post_receive).to receive(:puts).with( "https://localhost:5000/test/a/really/long/url/that/is/in/the/broadcast/message/do-not-truncate-when-url" ).ordered @@ -244,7 +244,7 @@ describe GitlabPostReceive do "========================================================================" ).ordered expect(gitlab_post_receive).to receive(:puts).ordered - + expect(gitlab_post_receive).to receive(:puts).with( " test test test test test test test test test test test" ).ordered diff --git a/spec/gitlab_shell_spec.rb b/spec/gitlab_shell_spec.rb index 382cad4..c46da5d 100644 --- a/spec/gitlab_shell_spec.rb +++ b/spec/gitlab_shell_spec.rb @@ -1,6 +1,6 @@ require_relative 'spec_helper' require_relative '../lib/gitlab_shell' -require_relative '../lib/gitlab_access_status' +require_relative '../lib/action' describe GitlabShell do before do @@ -8,565 +8,208 @@ describe GitlabShell do FileUtils.mkdir_p(tmp_repos_path) end - after do - FileUtils.rm_rf(tmp_repos_path) - end - - subject do - ARGV[0] = gl_id - GitlabShell.new(gl_id).tap do |shell| - shell.stub(exec_cmd: :exec_called) - shell.stub(api: api) - end - end + after { FileUtils.rm_rf(tmp_repos_path) } - let(:gitaly_check_access) { GitAccessStatus.new( - true, - 'ok', - gl_repository: gl_repository, - gl_id: gl_id, - gl_username: gl_username, - repository_path: repo_path, - gitaly: { 'repository' => { 'relative_path' => repo_name, 'storage_name' => 'default'} , 'address' => 'unix:gitaly.socket' }, - git_protocol: git_protocol - ) - } - - let(:api) do - double(GitlabNet).tap do |api| - api.stub(discover: { 'name' => 'John Doe', 'username' => 'testuser' }) - api.stub(check_access: GitAccessStatus.new( - true, - 'ok', - gl_repository: gl_repository, - gl_id: gl_id, - gl_username: gl_username, - repository_path: repo_path, - gitaly: nil, - git_protocol: git_protocol)) - api.stub(two_factor_recovery_codes: { - 'success' => true, - 'recovery_codes' => %w[f67c514de60c4953 41278385fc00c1e0] - }) - end - end + subject { described_class.new(who) } - let(:gl_id) { "key-#{rand(100) + 100}" } - let(:ssh_cmd) { nil } + let(:who) { 'key-1' } + let(:audit_usernames) { true } + let(:actor) { Actor.new_from(who, audit_usernames: audit_usernames) } let(:tmp_repos_path) { File.join(ROOT_PATH, 'tmp', 'repositories') } - let(:repo_name) { 'gitlab-ci.git' } let(:repo_path) { File.join(tmp_repos_path, repo_name) } let(:gl_repository) { 'project-1' } - let(:gl_id) { 'user-1' } let(:gl_username) { 'testuser' } let(:git_protocol) { 'version=2' } - before do - GitlabConfig.any_instance.stub(audit_usernames: false) - end + let(:api) { double(GitlabNet) } + let(:config) { double(GitlabConfig) } - describe :initialize do - let(:ssh_cmd) { 'git-receive-pack' } + let(:gitaly_action) { Action::Gitaly.new( + actor, + gl_repository, + gl_username, + git_protocol, + repo_path, + { 'repository' => { 'relative_path' => repo_name, 'storage_name' => 'default' } , 'address' => 'unix:gitaly.socket' }) + } + let(:api_2fa_recovery_action) { Action::API2FARecovery.new(actor) } + let(:git_lfs_authenticate_action) { Action::GitLFSAuthenticate.new(actor, repo_name) } - its(:gl_id) { should == gl_id } - end + before do + allow(GitlabConfig).to receive(:new).and_return(config) + allow(config).to receive(:audit_usernames).and_return(audit_usernames) - describe :parse_cmd do - describe 'git' do - context 'w/o namespace' do - let(:ssh_args) { %w(git-upload-pack gitlab-ci.git) } + allow(Actor).to receive(:new_from).with(who, audit_usernames: audit_usernames).and_return(actor) - before do - subject.send :parse_cmd, ssh_args - end + allow(GitlabNet).to receive(:new).and_return(api) + allow(api).to receive(:discover).with(actor).and_return('username' => gl_username) + end - its(:repo_name) { should == 'gitlab-ci.git' } - its(:command) { should == 'git-upload-pack' } + describe '#exec' do + context "when we don't have a valid user" do + before do + allow(api).to receive(:discover).with(actor).and_return(nil) end - context 'namespace' do - let(:repo_name) { 'dmitriy.zaporozhets/gitlab-ci.git' } - let(:ssh_args) { %w(git-upload-pack dmitriy.zaporozhets/gitlab-ci.git) } - - before do - subject.send :parse_cmd, ssh_args - end - - its(:repo_name) { should == 'dmitriy.zaporozhets/gitlab-ci.git' } - its(:command) { should == 'git-upload-pack' } + it 'prints Welcome.. and returns true' do + expect { + expect(subject.exec(nil)).to be_truthy + }.to output("Welcome to GitLab, Anonymous!\n").to_stdout end + end - context 'with an invalid number of arguments' do - let(:ssh_args) { %w(foobar) } - - it "should raise an DisallowedCommandError" do - expect { subject.send :parse_cmd, ssh_args }.to raise_error(GitlabShell::DisallowedCommandError) + context 'when we have a valid user' do + context 'when origin_cmd is nil' do + it 'prints Welcome.. and returns true' do + expect { + expect(subject.exec(nil)).to be_truthy + }.to output("Welcome to GitLab, @testuser!\n").to_stdout end end - context 'with an API command' do - before do - subject.send :parse_cmd, ssh_args - end - - context 'when generating recovery codes' do - let(:ssh_args) { %w(2fa_recovery_codes) } - - it 'sets the correct command' do - expect(subject.command).to eq('2fa_recovery_codes') - end - - it 'does not set repo name' do - expect(subject.repo_name).to be_nil - end + context 'when origin_cmd is empty' do + it 'prints Welcome.. and returns true' do + expect { + expect(subject.exec('')).to be_truthy + }.to output("Welcome to GitLab, @testuser!\n").to_stdout end end end - describe 'git-lfs' do - let(:repo_name) { 'dzaporozhets/gitlab.git' } - let(:ssh_args) { %w(git-lfs-authenticate dzaporozhets/gitlab.git download) } - - before do - subject.send :parse_cmd, ssh_args + context 'when origin_cmd is invalid' do + it 'prints a message to stderr and returns false' do + expect { + expect(subject.exec("git-invalid-command #{repo_name}")).to be_falsey + }.to output("GitLab: Disallowed command\n").to_stderr end - - its(:repo_name) { should == 'dzaporozhets/gitlab.git' } - its(:command) { should == 'git-lfs-authenticate' } - its(:git_access) { should == 'git-upload-pack' } end - describe 'git-lfs old clients' do - let(:repo_name) { 'dzaporozhets/gitlab.git' } - let(:ssh_args) { %w(git-lfs-authenticate dzaporozhets/gitlab.git download long_oid) } - - before do - subject.send :parse_cmd, ssh_args + context 'when origin_cmd is valid, but incomplete' do + it 'prints a message to stderr and returns false' do + expect { + expect(subject.exec('git-upload-pack')).to be_falsey + }.to output("GitLab: Disallowed command\n").to_stderr end - - its(:repo_name) { should == 'dzaporozhets/gitlab.git' } - its(:command) { should == 'git-lfs-authenticate' } - its(:git_access) { should == 'git-upload-pack' } - end - end - - describe :exec do - let(:gitaly_message) do - JSON.dump( - 'repository' => { 'relative_path' => repo_name, 'storage_name' => 'default' }, - 'gl_repository' => gl_repository, - 'gl_id' => gl_id, - 'gl_username' => gl_username, - 'git_protocol' => git_protocol - ) - end - - before do - allow(ENV).to receive(:[]).with('GIT_PROTOCOL').and_return(git_protocol) end - shared_examples_for 'upload-pack' do |command| - let(:ssh_cmd) { "#{command} gitlab-ci.git" } - after { subject.exec(ssh_cmd) } - - it "should process the command" do - subject.should_receive(:process_cmd).with(%w(git-upload-pack gitlab-ci.git)) - end - - it "should execute the command" do - subject.should_receive(:exec_cmd).with('git-upload-pack', repo_path) - end - - it "should log the command execution" do - message = "executing git command" - user_string = "user with id #{gl_id}" - $logger.should_receive(:info).with(message, command: "git-upload-pack #{repo_path}", user: user_string) - end - - it "should use usernames if configured to do so" do - GitlabConfig.any_instance.stub(audit_usernames: true) - $logger.should_receive(:info).with("executing git command", hash_including(user: 'testuser')) - end - end - - context 'git-upload-pack' do - it_behaves_like 'upload-pack', 'git-upload-pack' - end - - context 'git upload-pack' do - it_behaves_like 'upload-pack', 'git upload-pack' - end - - context 'gitaly-upload-pack' do - let(:ssh_cmd) { "git-upload-pack gitlab-ci.git" } - before do - api.stub(check_access: gitaly_check_access) - end - after { subject.exec(ssh_cmd) } - - it "should process the command" do - subject.should_receive(:process_cmd).with(%w(git-upload-pack gitlab-ci.git)) - end - - it "should execute the command" do - subject.should_receive(:exec_cmd).with(File.join(ROOT_PATH, "bin/gitaly-upload-pack"), 'unix:gitaly.socket', gitaly_message) - end - - it "should log the command execution" do - message = "executing git command" - user_string = "user with id #{gl_id}" - $logger.should_receive(:info).with(message, command: "gitaly-upload-pack unix:gitaly.socket #{gitaly_message}", user: user_string) + context 'when origin_cmd is git-lfs-authenticate' do + context 'but incomplete' do + it 'prints a message to stderr and returns false' do + expect { + expect(subject.exec('git-lfs-authenticate')).to be_falsey + }.to output("GitLab: Disallowed command\n").to_stderr + end end - it "should use usernames if configured to do so" do - GitlabConfig.any_instance.stub(audit_usernames: true) - $logger.should_receive(:info).with("executing git command", hash_including(user: 'testuser')) + context 'but invalid' do + it 'prints a message to stderr and returns false' do + expect { + expect(subject.exec("git-lfs-authenticate #{repo_name} invalid")).to be_falsey + }.to output("GitLab: Disallowed command\n").to_stderr + end end end - context 'git-receive-pack' do - let(:ssh_cmd) { "git-receive-pack gitlab-ci.git" } - after { subject.exec(ssh_cmd) } - - it "should process the command" do - subject.should_receive(:process_cmd).with(%w(git-receive-pack gitlab-ci.git)) - end - - it "should execute the command" do - subject.should_receive(:exec_cmd).with('git-receive-pack', repo_path) - end - - it "should log the command execution" do - message = "executing git command" - user_string = "user with id #{gl_id}" - $logger.should_receive(:info).with(message, command: "git-receive-pack #{repo_path}", user: user_string) - end - end + context 'when origin_cmd is 2fa_recovery_codes' do + let(:origin_cmd) { '2fa_recovery_codes' } + let(:git_access) { '2fa_recovery_codes' } - context 'gitaly-receive-pack' do - let(:ssh_cmd) { "git-receive-pack gitlab-ci.git" } before do - api.stub(check_access: gitaly_check_access) - end - after { subject.exec(ssh_cmd) } - - it "should process the command" do - subject.should_receive(:process_cmd).with(%w(git-receive-pack gitlab-ci.git)) - end - - it "should execute the command" do - subject.should_receive(:exec_cmd).with(File.join(ROOT_PATH, "bin/gitaly-receive-pack"), 'unix:gitaly.socket', gitaly_message) - end - - it "should log the command execution" do - message = "executing git command" - user_string = "user with id #{gl_id}" - $logger.should_receive(:info).with(message, command: "gitaly-receive-pack unix:gitaly.socket #{gitaly_message}", user: user_string) - end - - it "should use usernames if configured to do so" do - GitlabConfig.any_instance.stub(audit_usernames: true) - $logger.should_receive(:info).with("executing git command", hash_including(user: 'testuser')) - end - end - - shared_examples_for 'upload-archive' do |command| - let(:ssh_cmd) { "#{command} gitlab-ci.git" } - let(:exec_cmd_params) { ['git-upload-archive', repo_path] } - let(:exec_cmd_log_params) { exec_cmd_params } - - after { subject.exec(ssh_cmd) } - - it "should process the command" do - subject.should_receive(:process_cmd).with(%w(git-upload-archive gitlab-ci.git)) - end - - it "should execute the command" do - subject.should_receive(:exec_cmd).with(*exec_cmd_params) + expect(Action::API2FARecovery).to receive(:new).with(actor).and_return(api_2fa_recovery_action) end - it "should log the command execution" do - message = "executing git command" - user_string = "user with id #{gl_id}" - $logger.should_receive(:info).with(message, command: exec_cmd_log_params.join(' '), user: user_string) - end - - it "should use usernames if configured to do so" do - GitlabConfig.any_instance.stub(audit_usernames: true) - $logger.should_receive(:info).with("executing git command", hash_including(user: 'testuser')) + it 'returns true' do + expect(api_2fa_recovery_action).to receive(:execute).with('2fa_recovery_codes', %w{ 2fa_recovery_codes }).and_return(true) + expect(subject.exec(origin_cmd)).to be_truthy end end - context 'git-upload-archive' do - it_behaves_like 'upload-archive', 'git-upload-archive' - end - - context 'git upload-archive' do - it_behaves_like 'upload-archive', 'git upload-archive' - end - - context 'gitaly-upload-archive' do + context 'when access to the repo is denied' do before do - api.stub(check_access: gitaly_check_access) + expect(api).to receive(:check_access).with('git-upload-pack', nil, repo_name, actor, '_any').and_raise(AccessDeniedError, 'Sorry, access denied') end - it_behaves_like 'upload-archive', 'git-upload-archive' do - let(:gitaly_executable) { "gitaly-upload-archive" } - let(:exec_cmd_params) do - [ - File.join(ROOT_PATH, "bin", gitaly_executable), - 'unix:gitaly.socket', - gitaly_message - ] - end - let(:exec_cmd_log_params) do - [gitaly_executable, 'unix:gitaly.socket', gitaly_message] - end + it 'prints a message to stderr and returns false' do + expect($stderr).to receive(:puts).with('GitLab: Sorry, access denied') + expect(subject.exec("git-upload-pack #{repo_name}")).to be_falsey end end - context 'arbitrary command' do - let(:ssh_cmd) { 'arbitrary command' } - after { subject.exec(ssh_cmd) } - - it "should not process the command" do - subject.should_not_receive(:process_cmd) - end - - it "should not execute the command" do - subject.should_not_receive(:exec_cmd) - end - - it "should log the attempt" do - message = 'Denied disallowed command' - user_string = "user with id #{gl_id}" - $logger.should_receive(:warn).with(message, command: 'arbitrary command', user: user_string) - end - end - - context 'no command' do - after { subject.exec(nil) } - - it "should call api.discover" do - api.should_receive(:discover).with(gl_id) - end - end - - context "failed connection" do - let(:ssh_cmd) { 'git-upload-pack gitlab-ci.git' } - + context 'when the API is unavailable' do before do - api.stub(:check_access).and_raise(GitlabNet::ApiUnreachableError) - end - after { subject.exec(ssh_cmd) } - - it "should not process the command" do - subject.should_not_receive(:process_cmd) + expect(api).to receive(:check_access).with('git-upload-pack', nil, repo_name, actor, '_any').and_raise(GitlabNet::ApiUnreachableError) end - it "should not execute the command" do - subject.should_not_receive(:exec_cmd) + it 'prints a message to stderr and returns false' do + expect($stderr).to receive(:puts).with('GitLab: Failed to authorize your Git request: internal API unreachable') + expect(subject.exec("git-upload-pack #{repo_name}")).to be_falsey end end - context 'with an API command' do + context 'when access has been verified OK' do before do - allow(subject).to receive(:continue?).and_return(true) + expect(api).to receive(:check_access).with(git_access, nil, repo_name, actor, '_any').and_return(gitaly_action) end - context 'when generating recovery codes' do - let(:ssh_cmd) { '2fa_recovery_codes' } - after do - subject.exec(ssh_cmd) - end - - it 'does not call verify_access' do - expect(subject).not_to receive(:verify_access) - end - - it 'calls the corresponding method' do - expect(subject).to receive(:api_2fa_recovery_codes) - end + context 'when origin_cmd is git-upload-pack' do + let(:origin_cmd) { 'git-upload-pack' } + let(:git_access) { 'git-upload-pack' } - it 'outputs recovery codes' do - expect($stdout).to receive(:puts) - .with(/f67c514de60c4953\n41278385fc00c1e0/) + it 'returns true' do + expect(gitaly_action).to receive(:execute).with('git-upload-pack', %W{git-upload-pack #{repo_name}}).and_return(true) + expect(subject.exec("#{origin_cmd} #{repo_name}")).to be_truthy end - context 'when the process is unsuccessful' do - it 'displays the error to the user' do - api.stub(two_factor_recovery_codes: { - 'success' => false, - 'message' => 'Could not find the given key' - }) - - expect($stdout).to receive(:puts) - .with(/Could not find the given key/) + context 'but repo path is invalid' do + it 'prints a message to stderr and returns false' do + expect(gitaly_action).to receive(:execute).with('git-upload-pack', %W{git-upload-pack #{repo_name}}).and_raise(InvalidRepositoryPathError) + expect($stderr).to receive(:puts).with('GitLab: Invalid repository path') + expect(subject.exec("#{origin_cmd} #{repo_name}")).to be_falsey end end - end - end - end - - describe :validate_access do - let(:ssh_cmd) { "git-upload-pack gitlab-ci.git" } - describe 'check access with api' do - after { subject.exec(ssh_cmd) } - - it "should call api.check_access" do - api.should_receive(:check_access).with('git-upload-pack', nil, 'gitlab-ci.git', gl_id, '_any', 'ssh') - end - - it "should disallow access and log the attempt if check_access returns false status" do - api.stub(check_access: GitAccessStatus.new( - false, - 'denied', - gl_repository: nil, - gl_id: nil, - gl_username: nil, - repository_path: nil, - gitaly: nil, - git_protocol: nil)) - message = 'Access denied' - user_string = "user with id #{gl_id}" - $logger.should_receive(:warn).with(message, command: 'git-upload-pack gitlab-ci.git', user: user_string) - end - end - - describe 'set the repository path' do - context 'with a correct path' do - before { subject.exec(ssh_cmd) } - - its(:repo_path) { should == repo_path } - end - - context "with a path that doesn't match an absolute path" do - before do - File.stub(:absolute_path) { 'y/gitlab-ci.git' } - end - - it "refuses to assign the path" do - $stderr.should_receive(:puts).with("GitLab: Invalid repository path") - expect(subject.exec(ssh_cmd)).to be_falsey + context "but we're using an old git version for Windows 2.14" do + it 'returns true' do + expect(gitaly_action).to receive(:execute).with('git-upload-pack', %W{git-upload-pack #{repo_name}}).and_return(true) + expect(subject.exec("git upload-pack #{repo_name}")).to be_truthy #NOTE: 'git upload-pack' vs. 'git-upload-pack' + end end end - end - end - - describe :exec_cmd do - let(:shell) { GitlabShell.new(gl_id) } - let(:env) do - { - 'HOME' => ENV['HOME'], - 'PATH' => ENV['PATH'], - 'LD_LIBRARY_PATH' => ENV['LD_LIBRARY_PATH'], - 'LANG' => ENV['LANG'], - 'GL_ID' => gl_id, - 'GL_PROTOCOL' => 'ssh', - 'GL_REPOSITORY' => gl_repository, - 'GL_USERNAME' => 'testuser' - } - end - let(:exec_options) { { unsetenv_others: true, chdir: ROOT_PATH } } - before do - Kernel.stub(:exec) - shell.gl_repository = gl_repository - shell.git_protocol = git_protocol - shell.instance_variable_set(:@username, gl_username) - end - - it "uses Kernel::exec method" do - Kernel.should_receive(:exec).with(env, 1, 2, exec_options).once - shell.send :exec_cmd, 1, 2 - end - - it "refuses to execute a lone non-array argument" do - expect { shell.send :exec_cmd, 1 }.to raise_error(GitlabShell::DisallowedCommandError) - end - - it "allows one argument if it is an array" do - Kernel.should_receive(:exec).with(env, [1, 2], exec_options).once - shell.send :exec_cmd, [1, 2] - end - - context "when specifying a git_tracing log file" do - let(:git_trace_log_file) { '/tmp/git_trace_performance.log' } - - before do - GitlabConfig.any_instance.stub(git_trace_log_file: git_trace_log_file) - shell - end - - it "uses GIT_TRACE_PERFORMANCE" do - expected_hash = hash_including( - 'GIT_TRACE' => git_trace_log_file, - 'GIT_TRACE_PACKET' => git_trace_log_file, - 'GIT_TRACE_PERFORMANCE' => git_trace_log_file - ) - Kernel.should_receive(:exec).with(expected_hash, [1, 2], exec_options).once - - shell.send :exec_cmd, [1, 2] - end - - context "when provides a relative path" do - let(:git_trace_log_file) { 'git_trace_performance.log' } - - it "does not uses GIT_TRACE*" do - # If we try to use it we'll show a warning to the users - expected_hash = hash_excluding( - 'GIT_TRACE', 'GIT_TRACE_PACKET', 'GIT_TRACE_PERFORMANCE' - ) - Kernel.should_receive(:exec).with(expected_hash, [1, 2], exec_options).once - - shell.send :exec_cmd, [1, 2] - end - it "writes an entry on the log" do - message = 'git trace log path must be absolute, ignoring' + context 'when origin_cmd is git-lfs-authenticate' do + let(:origin_cmd) { 'git-lfs-authenticate' } + let(:lfs_access) { double(GitlabLfsAuthentication, authentication_payload: fake_payload)} - expect($logger).to receive(:warn). - with(message, git_trace_log_file: git_trace_log_file) - - Kernel.should_receive(:exec).with(env, [1, 2], exec_options).once - shell.send :exec_cmd, [1, 2] - end - end - - context "when provides a file not writable" do before do - expect(File).to receive(:open).with(git_trace_log_file, 'a').and_raise(Errno::EACCES) + expect(Action::GitLFSAuthenticate).to receive(:new).with(actor, repo_name).and_return(git_lfs_authenticate_action) end - it "does not uses GIT_TRACE*" do - # If we try to use it we'll show a warning to the users - expected_hash = hash_excluding( - 'GIT_TRACE', 'GIT_TRACE_PACKET', 'GIT_TRACE_PERFORMANCE' - ) - Kernel.should_receive(:exec).with(expected_hash, [1, 2], exec_options).once + context 'upload' do + let(:git_access) { 'git-receive-pack' } - shell.send :exec_cmd, [1, 2] + it 'returns true' do + expect(git_lfs_authenticate_action).to receive(:execute).with('git-lfs-authenticate', %w{ git-lfs-authenticate gitlab-ci.git upload }).and_return(true) + expect(subject.exec("#{origin_cmd} #{repo_name} upload")).to be_truthy + end end - it "writes an entry on the log" do - message = 'Failed to open git trace log file' - error = 'Permission denied' + context 'download' do + let(:git_access) { 'git-upload-pack' } - expect($logger).to receive(:warn). - with(message, git_trace_log_file: git_trace_log_file, error: error) + it 'returns true' do + expect(git_lfs_authenticate_action).to receive(:execute).with('git-lfs-authenticate', %w{ git-lfs-authenticate gitlab-ci.git download }).and_return(true) + expect(subject.exec("#{origin_cmd} #{repo_name} download")).to be_truthy + end - Kernel.should_receive(:exec).with(env, [1, 2], exec_options).once - shell.send :exec_cmd, [1, 2] + context 'for old git-lfs clients' do + it 'returns true' do + expect(git_lfs_authenticate_action).to receive(:execute).with('git-lfs-authenticate', %w{ git-lfs-authenticate gitlab-ci.git download long_oid }).and_return(true) + expect(subject.exec("#{origin_cmd} #{repo_name} download long_oid")).to be_truthy + end + end end end end end - - describe :api do - let(:shell) { GitlabShell.new(gl_id) } - subject { shell.send :api } - - it { should be_a(GitlabNet) } - end end diff --git a/spec/names_helper_spec.rb b/spec/names_helper_spec.rb index f2a95e5..11383da 100644 --- a/spec/names_helper_spec.rb +++ b/spec/names_helper_spec.rb @@ -5,8 +5,8 @@ describe NamesHelper do include NamesHelper describe :extract_ref_name do - it { extract_ref_name('refs/heads/awesome-feature').should == 'awesome-feature' } - it { extract_ref_name('refs/tags/v2.2.1').should == 'v2.2.1' } - it { extract_ref_name('refs/tags/releases/v2.2.1').should == 'releases/v2.2.1' } + it { expect(extract_ref_name('refs/heads/awesome-feature')).to eql 'awesome-feature' } + it { expect(extract_ref_name('refs/tags/v2.2.1')).to eql 'v2.2.1' } + it { expect(extract_ref_name('refs/tags/releases/v2.2.1')).to eql 'releases/v2.2.1' } end end diff --git a/spec/vcr_cassettes/allowed-pull.yml b/spec/vcr_cassettes/allowed-pull.yml index 1636fd5..0b22d7a 100644 --- a/spec/vcr_cassettes/allowed-pull.yml +++ b/spec/vcr_cassettes/allowed-pull.yml @@ -5,7 +5,7 @@ http_interactions: uri: http://localhost:3000/api/v4/internal/allowed body: encoding: US-ASCII - string: action=git-receive-pack&changes=0000000000000000000000000000000000000000+92d0970eefd7acb6d548878925ce2208cfe2d2ec+refs%2Fheads%2Fbranch4&gl_repository&project=gitlab-org%2Fgitlab-test.git&protocol=ssh&env=%7B%7D&key_id=1&secret_token=0a3938d9d95d807e94d937af3a4fbbea%0A + string: action=git-upload-pack&changes=0000000000000000000000000000000000000000+92d0970eefd7acb6d548878925ce2208cfe2d2ec+refs%2Fheads%2Fbranch4&gl_repository&project=gitlab-org%2Fgitlab-test.git&protocol=ssh&env=%7B%7D&key_id=1&secret_token=0a3938d9d95d807e94d937af3a4fbbea%0A headers: Accept-Encoding: - gzip;q=1.0,deflate;q=0.6,identity;q=0.3 diff --git a/spec/vcr_cassettes/allowed-push.yml b/spec/vcr_cassettes/allowed-push.yml index b073476..bea28bb 100644 --- a/spec/vcr_cassettes/allowed-push.yml +++ b/spec/vcr_cassettes/allowed-push.yml @@ -5,7 +5,7 @@ http_interactions: uri: http://localhost:3000/api/v4/internal/allowed body: encoding: US-ASCII - string: action=git-upload-pack&changes=0000000000000000000000000000000000000000+92d0970eefd7acb6d548878925ce2208cfe2d2ec+refs%2Fheads%2Fbranch4&gl_repository&project=gitlab-org%2Fgitlab-test.git&protocol=ssh&env=%7B%7D&key_id=1&secret_token=0a3938d9d95d807e94d937af3a4fbbea%0A + string: action=git-receive-pack&changes=0000000000000000000000000000000000000000+92d0970eefd7acb6d548878925ce2208cfe2d2ec+refs%2Fheads%2Fbranch4&gl_repository&project=gitlab-org%2Fgitlab-test.git&protocol=ssh&env=%7B%7D&key_id=1&secret_token=0a3938d9d95d807e94d937af3a4fbbea%0A headers: Accept-Encoding: - gzip;q=1.0,deflate;q=0.6,identity;q=0.3 diff --git a/spec/vcr_cassettes/discover-not-found.yml b/spec/vcr_cassettes/discover-not-found.yml new file mode 100644 index 0000000..db03b02 --- /dev/null +++ b/spec/vcr_cassettes/discover-not-found.yml @@ -0,0 +1,46 @@ +--- +http_interactions: +- request: + method: get + uri: http://localhost:3000/api/v4/internal/discover?key_id=1 + body: + encoding: US-ASCII + string: secret_token=0a3938d9d95d807e94d937af3a4fbbea%0A + headers: + Accept-Encoding: + - gzip;q=1.0,deflate;q=0.6,identity;q=0.3 + Accept: + - "*/*" + User-Agent: + - Ruby + Content-Type: + - application/x-www-form-urlencoded + response: + status: + code: 404 + message: Not Found + headers: + Cache-Control: + - max-age=0, private, must-revalidate + Content-Length: + - '42' + Content-Type: + - application/json + Date: + - Wed, 21 Jun 2017 10:44:49 GMT + Etag: + - W/"63b4ab301951bea83c4fc398eba8e307" + Vary: + - Origin + X-Frame-Options: + - SAMEORIGIN + X-Request-Id: + - dc11b8d4-1972-417b-8305-2c35c849405c + X-Runtime: + - '0.230170' + body: + encoding: UTF-8 + string: '{"message":"404 Not found"}' + http_version: + recorded_at: Wed, 21 Jun 2017 10:44:49 GMT +recorded_with: VCR 2.4.0 diff --git a/spec/vcr_cassettes/failed-push-unparsable.yml b/spec/vcr_cassettes/failed-push-unparsable.yml new file mode 100644 index 0000000..fbc09ec --- /dev/null +++ b/spec/vcr_cassettes/failed-push-unparsable.yml @@ -0,0 +1,46 @@ +--- +http_interactions: +- request: + method: post + uri: http://localhost:3000/api/v4/internal/allowed + body: + encoding: US-ASCII + string: action=git-upload-pack&changes=0000000000000000000000000000000000000000+92d0970eefd7acb6d548878925ce2208cfe2d2ec+refs%2Fheads%2Fbranch4&gl_repository&project=gitlab-org%2Fgitlab-test.git&protocol=ssh&env=%7B%7D&key_id=1&secret_token=0a3938d9d95d807e94d937af3a4fbbea%0A + headers: + Accept-Encoding: + - gzip;q=1.0,deflate;q=0.6,identity;q=0.3 + Accept: + - "*/*" + User-Agent: + - Ruby + Content-Type: + - application/x-www-form-urlencoded + response: + status: + code: 500 + message: Internal Server Error + headers: + Cache-Control: + - max-age=0, private, must-revalidate + Content-Length: + - '155' + Content-Type: + - application/json + Date: + - Wed, 21 Jun 2017 10:44:52 GMT + Etag: + - W/"45654cae433b5a9c5fbba1d45d382e52" + Vary: + - Origin + X-Frame-Options: + - SAMEORIGIN + X-Request-Id: + - 67ab4954-19e6-42ce-aae6-55c8ae5a365e + X-Runtime: + - '0.230871' + body: + encoding: UTF-8 + string: '""' + http_version: + recorded_at: Wed, 21 Jun 2017 10:44:52 GMT +recorded_with: VCR 2.4.0 diff --git a/spec/vcr_cassettes/failed-push.yml b/spec/vcr_cassettes/failed-push.yml new file mode 100644 index 0000000..334aabd --- /dev/null +++ b/spec/vcr_cassettes/failed-push.yml @@ -0,0 +1,46 @@ +--- +http_interactions: +- request: + method: post + uri: http://localhost:3000/api/v4/internal/allowed + body: + encoding: US-ASCII + string: action=git-upload-pack&changes=0000000000000000000000000000000000000000+92d0970eefd7acb6d548878925ce2208cfe2d2ec+refs%2Fheads%2Fbranch4&gl_repository&project=gitlab-org%2Fgitlab-test.git&protocol=ssh&env=%7B%7D&key_id=1&secret_token=0a3938d9d95d807e94d937af3a4fbbea%0A + headers: + Accept-Encoding: + - gzip;q=1.0,deflate;q=0.6,identity;q=0.3 + Accept: + - "*/*" + User-Agent: + - Ruby + Content-Type: + - application/x-www-form-urlencoded + response: + status: + code: 500 + message: Internal Server Error + headers: + Cache-Control: + - max-age=0, private, must-revalidate + Content-Length: + - '155' + Content-Type: + - application/json + Date: + - Wed, 21 Jun 2017 10:44:52 GMT + Etag: + - W/"45654cae433b5a9c5fbba1d45d382e52" + Vary: + - Origin + X-Frame-Options: + - SAMEORIGIN + X-Request-Id: + - 67ab4954-19e6-42ce-aae6-55c8ae5a365e + X-Runtime: + - '0.230871' + body: + encoding: UTF-8 + string: '{"status":false,"message":"An internal server error occurred"}' + http_version: + recorded_at: Wed, 21 Jun 2017 10:44:52 GMT +recorded_with: VCR 2.4.0 diff --git a/spec/vcr_cassettes/http-pull-disabled-old.yml b/spec/vcr_cassettes/http-pull-disabled-old.yml new file mode 100644 index 0000000..23ef3e5 --- /dev/null +++ b/spec/vcr_cassettes/http-pull-disabled-old.yml @@ -0,0 +1,46 @@ +--- +http_interactions: +- request: + method: post + uri: http://localhost:3000/api/v4/internal/allowed + body: + encoding: US-ASCII + string: action=git-upload-pack&changes=0000000000000000000000000000000000000000+92d0970eefd7acb6d548878925ce2208cfe2d2ec+refs%2Fheads%2Fbranch4&gl_repository&project=gitlab-org%2Fgitlab-test.git&protocol=http&env=%7B%7D&key_id=1&secret_token=0a3938d9d95d807e94d937af3a4fbbea%0A + headers: + Accept-Encoding: + - gzip;q=1.0,deflate;q=0.6,identity;q=0.3 + Accept: + - "*/*" + User-Agent: + - Ruby + Content-Type: + - application/x-www-form-urlencoded + response: + status: + code: 200 + message: OK + headers: + Cache-Control: + - max-age=0, private, must-revalidate + Content-Length: + - '62' + Content-Type: + - application/json + Date: + - Wed, 21 Jun 2017 10:32:01 GMT + Etag: + - W/"71e09fcf8a60a03cd1acc22806386ead" + Vary: + - Origin + X-Frame-Options: + - SAMEORIGIN + X-Request-Id: + - 70bdecc9-0078-4a4b-aa6b-cac1b2578886 + X-Runtime: + - '0.324202' + body: + encoding: UTF-8 + string: '{"status":false,"message":"Pulling over HTTP is not allowed."}' + http_version: + recorded_at: Wed, 21 Jun 2017 10:32:01 GMT +recorded_with: VCR 2.4.0 diff --git a/spec/vcr_cassettes/http-pull-disabled.yml b/spec/vcr_cassettes/http-pull-disabled.yml index 23ef3e5..34cf634 100644 --- a/spec/vcr_cassettes/http-pull-disabled.yml +++ b/spec/vcr_cassettes/http-pull-disabled.yml @@ -17,8 +17,8 @@ http_interactions: - application/x-www-form-urlencoded response: status: - code: 200 - message: OK + code: 401 + message: Unauthorized headers: Cache-Control: - max-age=0, private, must-revalidate diff --git a/spec/vcr_cassettes/http-push-disabled-old.yml b/spec/vcr_cassettes/http-push-disabled-old.yml new file mode 100644 index 0000000..676e5b8 --- /dev/null +++ b/spec/vcr_cassettes/http-push-disabled-old.yml @@ -0,0 +1,46 @@ +--- +http_interactions: +- request: + method: post + uri: http://localhost:3000/api/v4/internal/allowed + body: + encoding: US-ASCII + string: action=git-receive-pack&changes=0000000000000000000000000000000000000000+92d0970eefd7acb6d548878925ce2208cfe2d2ec+refs%2Fheads%2Fbranch4&gl_repository&project=gitlab-org%2Fgitlab-test.git&protocol=http&env=%7B%7D&key_id=1&secret_token=0a3938d9d95d807e94d937af3a4fbbea%0A + headers: + Accept-Encoding: + - gzip;q=1.0,deflate;q=0.6,identity;q=0.3 + Accept: + - "*/*" + User-Agent: + - Ruby + Content-Type: + - application/x-www-form-urlencoded + response: + status: + code: 200 + message: OK + headers: + Cache-Control: + - max-age=0, private, must-revalidate + Content-Length: + - '62' + Content-Type: + - application/json + Date: + - Wed, 21 Jun 2017 10:32:01 GMT + Etag: + - W/"7f14e23ac07cc8b0a53c567fcf9432fd" + Vary: + - Origin + X-Frame-Options: + - SAMEORIGIN + X-Request-Id: + - 573f3584-87c6-41cb-a5bf-5e7ee76d4250 + X-Runtime: + - '0.266135' + body: + encoding: UTF-8 + string: '{"status":false,"message":"Pushing over HTTP is not allowed."}' + http_version: + recorded_at: Wed, 21 Jun 2017 10:32:01 GMT +recorded_with: VCR 2.4.0 diff --git a/spec/vcr_cassettes/http-push-disabled.yml b/spec/vcr_cassettes/http-push-disabled.yml index 676e5b8..e7e185e 100644 --- a/spec/vcr_cassettes/http-push-disabled.yml +++ b/spec/vcr_cassettes/http-push-disabled.yml @@ -17,8 +17,8 @@ http_interactions: - application/x-www-form-urlencoded response: status: - code: 200 - message: OK + code: 401 + message: Unauthorized headers: Cache-Control: - max-age=0, private, must-revalidate diff --git a/spec/vcr_cassettes/ssh-pull-disabled-old.yml b/spec/vcr_cassettes/ssh-pull-disabled-old.yml new file mode 100644 index 0000000..55ce261 --- /dev/null +++ b/spec/vcr_cassettes/ssh-pull-disabled-old.yml @@ -0,0 +1,46 @@ +--- +http_interactions: +- request: + method: post + uri: http://localhost:3000/api/v4/internal/allowed + body: + encoding: US-ASCII + string: action=git-upload-pack&changes=0000000000000000000000000000000000000000+92d0970eefd7acb6d548878925ce2208cfe2d2ec+refs%2Fheads%2Fbranch4&gl_repository&project=gitlab-org%2Fgitlab-test.git&protocol=ssh&env=%7B%7D&key_id=1&secret_token=0a3938d9d95d807e94d937af3a4fbbea%0A + headers: + Accept-Encoding: + - gzip;q=1.0,deflate;q=0.6,identity;q=0.3 + Accept: + - "*/*" + User-Agent: + - Ruby + Content-Type: + - application/x-www-form-urlencoded + response: + status: + code: 200 + message: OK + headers: + Cache-Control: + - max-age=0, private, must-revalidate + Content-Length: + - '63' + Content-Type: + - application/json + Date: + - Wed, 21 Jun 2017 12:23:57 GMT + Etag: + - W/"76a32010244f80700d5e1ba8a55d094c" + Vary: + - Origin + X-Frame-Options: + - SAMEORIGIN + X-Request-Id: + - 096ae253-c6fe-4360-b4d4-48f4b5435ca6 + X-Runtime: + - '6.377187' + body: + encoding: UTF-8 + string: '{"status":false,"message":"Git access over SSH is not allowed"}' + http_version: + recorded_at: Wed, 21 Jun 2017 12:23:57 GMT +recorded_with: VCR 2.4.0 diff --git a/spec/vcr_cassettes/ssh-pull-disabled.yml b/spec/vcr_cassettes/ssh-pull-disabled.yml index 55ce261..92fc36a 100644 --- a/spec/vcr_cassettes/ssh-pull-disabled.yml +++ b/spec/vcr_cassettes/ssh-pull-disabled.yml @@ -17,8 +17,8 @@ http_interactions: - application/x-www-form-urlencoded response: status: - code: 200 - message: OK + code: 401 + message: Unauthorized headers: Cache-Control: - max-age=0, private, must-revalidate diff --git a/spec/vcr_cassettes/ssh-pull-project-denied-old.yml b/spec/vcr_cassettes/ssh-pull-project-denied-old.yml new file mode 100644 index 0000000..c16e608 --- /dev/null +++ b/spec/vcr_cassettes/ssh-pull-project-denied-old.yml @@ -0,0 +1,46 @@ +--- +http_interactions: +- request: + method: post + uri: http://localhost:3000/api/v4/internal/allowed + body: + encoding: US-ASCII + string: action=git-receive-pack&changes=0000000000000000000000000000000000000000+92d0970eefd7acb6d548878925ce2208cfe2d2ec+refs%2Fheads%2Fbranch4&gl_repository&project=gitlab-org%2Fgitlab-test.git&protocol=ssh&env=%7B%7D&key_id=2&secret_token=0a3938d9d95d807e94d937af3a4fbbea%0A + headers: + Accept-Encoding: + - gzip;q=1.0,deflate;q=0.6,identity;q=0.3 + Accept: + - "*/*" + User-Agent: + - Ruby + Content-Type: + - application/x-www-form-urlencoded + response: + status: + code: 200 + message: OK + headers: + Cache-Control: + - max-age=0, private, must-revalidate + Content-Length: + - '63' + Content-Type: + - application/json + Date: + - Wed, 21 Jun 2017 12:24:04 GMT + Etag: + - W/"76a32010244f80700d5e1ba8a55d094c" + Vary: + - Origin + X-Frame-Options: + - SAMEORIGIN + X-Request-Id: + - c843a5a3-fc08-46eb-aa45-caceae515638 + X-Runtime: + - '7.359835' + body: + encoding: UTF-8 + string: '{"status":false,"message":"Git access over SSH is not allowed"}' + http_version: + recorded_at: Wed, 21 Jun 2017 12:24:04 GMT +recorded_with: VCR 2.4.0 diff --git a/spec/vcr_cassettes/ssh-pull-project-denied.yml b/spec/vcr_cassettes/ssh-pull-project-denied.yml index c16e608..61a71db 100644 --- a/spec/vcr_cassettes/ssh-pull-project-denied.yml +++ b/spec/vcr_cassettes/ssh-pull-project-denied.yml @@ -17,8 +17,8 @@ http_interactions: - application/x-www-form-urlencoded response: status: - code: 200 - message: OK + code: 401 + message: Unauthorized headers: Cache-Control: - max-age=0, private, must-revalidate diff --git a/spec/vcr_cassettes/ssh-push-disabled-old.yml b/spec/vcr_cassettes/ssh-push-disabled-old.yml new file mode 100644 index 0000000..c061791 --- /dev/null +++ b/spec/vcr_cassettes/ssh-push-disabled-old.yml @@ -0,0 +1,46 @@ +--- +http_interactions: +- request: + method: post + uri: http://localhost:3000/api/v4/internal/allowed + body: + encoding: US-ASCII + string: action=git-receive-pack&changes=0000000000000000000000000000000000000000+92d0970eefd7acb6d548878925ce2208cfe2d2ec+refs%2Fheads%2Fbranch4&gl_repository&project=gitlab-org%2Fgitlab-test.git&protocol=ssh&env=%7B%7D&key_id=1&secret_token=0a3938d9d95d807e94d937af3a4fbbea%0A + headers: + Accept-Encoding: + - gzip;q=1.0,deflate;q=0.6,identity;q=0.3 + Accept: + - "*/*" + User-Agent: + - Ruby + Content-Type: + - application/x-www-form-urlencoded + response: + status: + code: 200 + message: OK + headers: + Cache-Control: + - max-age=0, private, must-revalidate + Content-Length: + - '63' + Content-Type: + - application/json + Date: + - Wed, 21 Jun 2017 12:23:57 GMT + Etag: + - W/"76a32010244f80700d5e1ba8a55d094c" + Vary: + - Origin + X-Frame-Options: + - SAMEORIGIN + X-Request-Id: + - 93620e06-fda9-4be5-855e-300f5d62fa3c + X-Runtime: + - '0.207159' + body: + encoding: UTF-8 + string: '{"status":false,"message":"Git access over SSH is not allowed"}' + http_version: + recorded_at: Wed, 21 Jun 2017 12:23:57 GMT +recorded_with: VCR 2.4.0 diff --git a/spec/vcr_cassettes/ssh-push-disabled.yml b/spec/vcr_cassettes/ssh-push-disabled.yml index c061791..5ca2642 100644 --- a/spec/vcr_cassettes/ssh-push-disabled.yml +++ b/spec/vcr_cassettes/ssh-push-disabled.yml @@ -17,8 +17,8 @@ http_interactions: - application/x-www-form-urlencoded response: status: - code: 200 - message: OK + code: 401 + message: Unauthorized headers: Cache-Control: - max-age=0, private, must-revalidate diff --git a/spec/vcr_cassettes/ssh-push-project-denied-old.yml b/spec/vcr_cassettes/ssh-push-project-denied-old.yml new file mode 100644 index 0000000..5107d15 --- /dev/null +++ b/spec/vcr_cassettes/ssh-push-project-denied-old.yml @@ -0,0 +1,46 @@ +--- +http_interactions: +- request: + method: post + uri: http://localhost:3000/api/v4/internal/allowed + body: + encoding: US-ASCII + string: action=git-upload-pack&changes=0000000000000000000000000000000000000000+92d0970eefd7acb6d548878925ce2208cfe2d2ec+refs%2Fheads%2Fbranch4&gl_repository&project=gitlab-org%2Fgitlab-test.git&protocol=ssh&env=%7B%7D&key_id=2&secret_token=0a3938d9d95d807e94d937af3a4fbbea%0A + headers: + Accept-Encoding: + - gzip;q=1.0,deflate;q=0.6,identity;q=0.3 + Accept: + - "*/*" + User-Agent: + - Ruby + Content-Type: + - application/x-www-form-urlencoded + response: + status: + code: 200 + message: OK + headers: + Cache-Control: + - max-age=0, private, must-revalidate + Content-Length: + - '63' + Content-Type: + - application/json + Date: + - Wed, 21 Jun 2017 12:24:04 GMT + Etag: + - W/"76a32010244f80700d5e1ba8a55d094c" + Vary: + - Origin + X-Frame-Options: + - SAMEORIGIN + X-Request-Id: + - 8ce54f29-9ed0-46e5-aedb-37edaa3d52da + X-Runtime: + - '0.228256' + body: + encoding: UTF-8 + string: '{"status":false,"message":"Git access over SSH is not allowed"}' + http_version: + recorded_at: Wed, 21 Jun 2017 12:24:04 GMT +recorded_with: VCR 2.4.0 diff --git a/spec/vcr_cassettes/ssh-push-project-denied-with-user-old.yml b/spec/vcr_cassettes/ssh-push-project-denied-with-user-old.yml new file mode 100644 index 0000000..b461b5b --- /dev/null +++ b/spec/vcr_cassettes/ssh-push-project-denied-with-user-old.yml @@ -0,0 +1,46 @@ +--- +http_interactions: +- request: + method: post + uri: http://localhost:3000/api/v4/internal/allowed + body: + encoding: US-ASCII + string: action=git-upload-pack&changes=0000000000000000000000000000000000000000+92d0970eefd7acb6d548878925ce2208cfe2d2ec+refs%2Fheads%2Fbranch4&gl_repository&project=gitlab-org%2Fgitlab-test.git&protocol=ssh&env=%7B%7D&user_id=2&secret_token=0a3938d9d95d807e94d937af3a4fbbea%0A + headers: + Accept-Encoding: + - gzip;q=1.0,deflate;q=0.6,identity;q=0.3 + Accept: + - "*/*" + User-Agent: + - Ruby + Content-Type: + - application/x-www-form-urlencoded + response: + status: + code: 200 + message: OK + headers: + Cache-Control: + - max-age=0, private, must-revalidate + Content-Length: + - '63' + Content-Type: + - application/json + Date: + - Wed, 21 Jun 2017 12:24:05 GMT + Etag: + - W/"76a32010244f80700d5e1ba8a55d094c" + Vary: + - Origin + X-Frame-Options: + - SAMEORIGIN + X-Request-Id: + - 3b242d73-d860-48ac-8fef-80e2d0d3daca + X-Runtime: + - '0.342469' + body: + encoding: UTF-8 + string: '{"status":false,"message":"Git access over SSH is not allowed"}' + http_version: + recorded_at: Wed, 21 Jun 2017 12:24:05 GMT +recorded_with: VCR 2.4.0 diff --git a/spec/vcr_cassettes/ssh-push-project-denied-with-user.yml b/spec/vcr_cassettes/ssh-push-project-denied-with-user.yml index b461b5b..01be21b 100644 --- a/spec/vcr_cassettes/ssh-push-project-denied-with-user.yml +++ b/spec/vcr_cassettes/ssh-push-project-denied-with-user.yml @@ -17,8 +17,8 @@ http_interactions: - application/x-www-form-urlencoded response: status: - code: 200 - message: OK + code: 401 + message: Unauthorized headers: Cache-Control: - max-age=0, private, must-revalidate diff --git a/spec/vcr_cassettes/ssh-push-project-denied.yml b/spec/vcr_cassettes/ssh-push-project-denied.yml index 5107d15..b23dd8d 100644 --- a/spec/vcr_cassettes/ssh-push-project-denied.yml +++ b/spec/vcr_cassettes/ssh-push-project-denied.yml @@ -17,8 +17,8 @@ http_interactions: - application/x-www-form-urlencoded response: status: - code: 200 - message: OK + code: 401 + message: Unauthorized headers: Cache-Control: - max-age=0, private, must-revalidate |