Bob -> Sara : HelloBob -> Sara : HelloBob -> Sara : HelloBob -> Sara : HelloCaption with bold and italic
HTML diff --git a/spec/models/ability_spec.rb b/spec/models/ability_spec.rb index 3bf6140a4e2..35732df0420 100644 --- a/spec/models/ability_spec.rb +++ b/spec/models/ability_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' -RSpec.describe Ability do +RSpec.describe Ability, feature_category: :system_access do describe '#policy_for' do subject(:policy) { described_class.policy_for(user, subject, **options) } @@ -476,6 +476,89 @@ RSpec.describe Ability do end end + describe '.allowed?' do + let_it_be(:group) { create(:group, :private) } + let_it_be(:user) { create(:user) } + let_it_be(:delegated_user) { create(:user) } + let(:request_store_key) { format(::Gitlab::Auth::Identity::COMPOSITE_IDENTITY_KEY_FORMAT, user.id) } + + subject { described_class.allowed?(user, :read_group, group) } + + context 'with composite identity', :request_store do + before do + ::Gitlab::SafeRequestStore[request_store_key] = delegated_user + allow(user).to receive(:has_composite_identity?).and_return(true) + end + + context 'when both users are members' do + before_all do + group.add_developer(delegated_user) + group.add_developer(user) + end + + it 'returns true' do + expect(subject).to be_truthy + end + + context 'when delegating user is not set in RequestStore' do + before do + ::Gitlab::SafeRequestStore.delete(request_store_key) + end + + it 'raises an exception' do + expect { subject }.to raise_exception(::Gitlab::Auth::Identity::MissingCompositeIdentityError) + end + end + end + + context 'when only delegating user is a member' do + before_all do + group.add_developer(user) + end + + it 'returns false' do + expect(subject).to be_falsey + end + + context 'with disabled composite_identity feature flag' do + before do + stub_feature_flags(composite_identity: false) + end + + it 'returns true' do + expect(subject).to be_truthy + end + end + + context 'with unenforced composite identity' do + before do + allow(user).to receive(:has_composite_identity?).and_return(false) + end + + it 'returns true' do + expect(subject).to be_truthy + end + end + end + + context 'when only delegated user is a member' do + before_all do + group.add_developer(delegated_user) + end + + it 'returns false' do + expect(subject).to be_falsey + end + end + + context 'when neither user is a member' do + it 'returns false' do + expect(subject).to be_falsey + end + end + end + end + describe 'forgetting', :request_store do it 'allows us to discard specific values from the DeclarativePolicy cache' do user_a = build_stubbed(:user) diff --git a/spec/models/notification_recipient_spec.rb b/spec/models/notification_recipient_spec.rb index 9a4b3a878eb..f80ec0cad33 100644 --- a/spec/models/notification_recipient_spec.rb +++ b/spec/models/notification_recipient_spec.rb @@ -14,6 +14,16 @@ RSpec.describe NotificationRecipient, feature_category: :team_planning do describe '#notifiable?' do let(:recipient) { described_class.new(user, :mention, target: target, project: project) } + context 'when user has a composite identity' do + before do + allow(recipient).to receive(:has_composite_identity?).and_return(true) + end + + it 'returns false' do + expect(recipient.notifiable?).to eq false + end + end + context 'when emails are disabled' do it 'returns false if group disabled' do expect(project.namespace).to receive(:emails_enabled?).and_return(false) diff --git a/spec/models/oauth_access_token_spec.rb b/spec/models/oauth_access_token_spec.rb index c61f80b76d7..f30e7b78833 100644 --- a/spec/models/oauth_access_token_spec.rb +++ b/spec/models/oauth_access_token_spec.rb @@ -77,4 +77,66 @@ RSpec.describe OauthAccessToken, feature_category: :system_access do end end end + + describe '#scope_user' do + let_it_be(:user) { create(:user) } + let_it_be_with_refind(:oauth_access_token) { create(:oauth_access_token) } + let(:user_id) { user.id } + + before do + allow(oauth_access_token).to receive(:scopes).and_return(scopes) + end + + context 'when scopes match expected format' do + context 'when scopes only include the composite scope' do + let(:scopes) { "user:#{user_id}" } + + it 'returns the user' do + expect(oauth_access_token.scope_user).to eq user + end + end + + context 'when scopes include another scope before composite scope' do + let(:scopes) { "other:scope user:#{user_id}" } + + it 'returns the user' do + expect(oauth_access_token.scope_user).to eq user + end + end + + context "when scopes include another scope after composite scope" do + let(:scopes) { "user:#{user_id} other:scope" } + + it 'returns the user' do + expect(oauth_access_token.scope_user).to eq user + end + end + + context 'when scopes include another scope before and after composite scope' do + let(:scopes) { "api user:#{user_id} read_api" } + + it 'returns the user' do + expect(oauth_access_token.scope_user).to eq user + end + end + end + + context 'when scopes do not match composite scope format' do + where(:scopes) do + [ + "user:#{non_existing_record_id}", + 'user:not_a_number', + 'some:other:scope', + nil, + "" + ] + end + + with_them do + it 'returns false' do + expect(oauth_access_token.scope_user).to be_nil + end + end + end + end end diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb index f893783eff5..550dbf60117 100644 --- a/spec/models/user_spec.rb +++ b/spec/models/user_spec.rb @@ -8828,6 +8828,12 @@ RSpec.describe User, feature_category: :user_profile do end end + describe '#has_composite_identity?' do + it 'is false' do + expect(build(:user).has_composite_identity?).to be false + end + end + describe 'color_mode_id' do context 'when theme_id is 11' do let(:user) { build(:user, theme_id: 11) } diff --git a/spec/requests/api/doorkeeper_access_spec.rb b/spec/requests/api/doorkeeper_access_spec.rb index 110aadea561..35066ecf4dc 100644 --- a/spec/requests/api/doorkeeper_access_spec.rb +++ b/spec/requests/api/doorkeeper_access_spec.rb @@ -8,6 +8,44 @@ RSpec.describe 'doorkeeper access', feature_category: :system_access do let!(:application) { Doorkeeper::Application.create!(name: "MyApp", redirect_uri: "https://app.com", owner: user) } let!(:token) { Doorkeeper::AccessToken.create! application_id: application.id, resource_owner_id: user.id, scopes: "api", organization_id: organization.id } + describe 'access token with composite identity scope', :request_store do + let!(:scopes) { "user:#{scope_user.id} api" } + let!(:scoped_token) { OauthAccessToken.create! application_id: application.id, user: user, scopes: scopes, organization_id: organization.id } + + let(:scope_user) { create(:user) } + let(:group) { create(:group, :private) } + let(:user) do + user = create(:user) + allow(user).to receive(:has_composite_identity?).and_return(true) + user + end + + context 'when user one has a composite identity token scoped to user two' do + before do + group.add_developer(user) # scoped user doesn't have access + allow(OauthAccessToken).to receive(:by_token).and_return(scoped_token) # this is required for the has_composite_identity? stub to work + end + + it 'restricts user access permissions' do + get api("/groups/#{group.id}"), params: { access_token: scoped_token.plaintext_token } + + expect(response).to have_gitlab_http_status(:not_found) + end + + context 'when both users have access to a resource' do + before do + group.add_developer(scope_user) + end + + it 'allows access' do + get api("/groups/#{group.id}"), params: { access_token: token.plaintext_token } + + expect(response).to have_gitlab_http_status(:ok) + end + end + end + end + describe "unauthenticated" do it "returns authentication success" do get api("/user"), params: { access_token: token.plaintext_token } diff --git a/spec/requests/api/virtual_registries/packages/maven_registries_spec.rb b/spec/requests/api/virtual_registries/packages/maven_registries_spec.rb index f8b0d4630b2..2bd66d24160 100644 --- a/spec/requests/api/virtual_registries/packages/maven_registries_spec.rb +++ b/spec/requests/api/virtual_registries/packages/maven_registries_spec.rb @@ -214,7 +214,7 @@ RSpec.describe API::VirtualRegistries::Packages::Maven, :aggregate_failures, fea group.add_maintainer(user) end - it 'returns a bad request beacuse it is not a top level group' do + it 'returns a bad request because it is not a top level group' do api_request expect(response).to have_gitlab_http_status(:bad_request) diff --git a/spec/services/ci/runners/set_runner_associated_projects_service_spec.rb b/spec/services/ci/runners/set_runner_associated_projects_service_spec.rb index 78096132f1d..c038f6af26a 100644 --- a/spec/services/ci/runners/set_runner_associated_projects_service_spec.rb +++ b/spec/services/ci/runners/set_runner_associated_projects_service_spec.rb @@ -211,8 +211,7 @@ RSpec.describe ::Ci::Runners::SetRunnerAssociatedProjectsService, '#execute', fe let(:new_projects) { [project3, project4] } let(:owner_project) { new_projects.first } - it 'assigns associated projects and returns success response', - quarantine: 'https://gitlab.com/gitlab-org/gitlab/-/issues/481411' do + it 'assigns associated projects and returns success response' do expect(execute).to be_success runner.reload diff --git a/spec/support/helpers/test_env.rb b/spec/support/helpers/test_env.rb index 38ffe2bfec8..5340d2c5ba6 100644 --- a/spec/support/helpers/test_env.rb +++ b/spec/support/helpers/test_env.rb @@ -535,6 +535,8 @@ module TestEnv end def component_ahead_of_target?(component_folder, expected_version) + return false unless Dir.exist?(File.join(component_folder, '.git')) + # The HEAD of the component_folder will be used as heuristic for the version # of the binaries, allowing to use Git to determine if HEAD is later than # the expected version. Note: Git considers HEAD to be an anchestor of HEAD. @@ -556,6 +558,8 @@ module TestEnv return false unless Dir.exist?(component_folder) + return false unless Dir.exist?(File.join(component_folder, '.git')) + sha, exit_status = Gitlab::Popen.popen(%W[#{Gitlab.config.git.bin_path} rev-parse HEAD], component_folder) return false if exit_status != 0 diff --git a/spec/support/matchers/markdown_matchers.rb b/spec/support/matchers/markdown_matchers.rb index c0ebcc5c474..4a205ae6bf6 100644 --- a/spec/support/matchers/markdown_matchers.rb +++ b/spec/support/matchers/markdown_matchers.rb @@ -299,7 +299,7 @@ module MarkdownMatchers end end - # PLantumlFilter + # PlantumlFilter matcher :parse_plantuml do set_default_markdown_messages diff --git a/yarn.lock b/yarn.lock index 6aa39f7535d..21157df828c 100644 --- a/yarn.lock +++ b/yarn.lock @@ -2502,76 +2502,63 @@ resolved "https://registry.yarnpkg.com/@rtsao/scc/-/scc-1.1.0.tgz#927dd2fae9bc3361403ac2c7a00c32ddce9ad7e8" integrity sha512-zt6OdqaDoOnJ1ZYsCYGt9YmWzDXl4vQdKTyJev62gFhRGKdx7mcT54V9KIjg+d2wi9EXsPvAPKe7i7WjfVWB8g== -"@sentry-internal/browser-utils@8.38.0": - version "8.38.0" - resolved "https://registry.yarnpkg.com/@sentry-internal/browser-utils/-/browser-utils-8.38.0.tgz#d7f6d398778906efb0c017e63d3c59d3203dfa7d" - integrity sha512-5QMVcssrAcmjKT0NdFYcX0b0wwZovGAZ9L2GajErXtHkBenjI2sgR2+5J7n+QZGuk2SC1qhGmT1O9i3p3UEwew== +"@sentry-internal/browser-utils@8.41.0": + version "8.41.0" + resolved "https://registry.yarnpkg.com/@sentry-internal/browser-utils/-/browser-utils-8.41.0.tgz#9dc30a8c88aa6e1e542e5acae29ceabd1b377cc4" + integrity sha512-nU7Bn3jEUmf1QXRUT3j2ewUBlFJpe9vnAnjqpeVPDWTsVI52BwVNcJHuE37PrGs66OZ1ZkGMfKnQk43oCAa+oQ== dependencies: - "@sentry/core" "8.38.0" - "@sentry/types" "8.38.0" - "@sentry/utils" "8.38.0" + "@sentry/core" "8.41.0" + "@sentry/types" "8.41.0" -"@sentry-internal/feedback@8.38.0": - version "8.38.0" - resolved "https://registry.yarnpkg.com/@sentry-internal/feedback/-/feedback-8.38.0.tgz#726661a01f7ff40b93c8ee05c985fd0436a1c033" - integrity sha512-AW5HCCAlc3T1jcSuNhbFVNO1CHyJ5g5tsGKEP4VKgu+D1Gg2kZ5S2eFatLBUP/BD5JYb1A7p6XPuzYp1XfMq0A== +"@sentry-internal/feedback@8.41.0": + version "8.41.0" + resolved "https://registry.yarnpkg.com/@sentry-internal/feedback/-/feedback-8.41.0.tgz#9c3c95e6f7738a0d00fcb89061c284baef313ba2" + integrity sha512-bw+BrSNw8abOnu/IpD8YSbYubXkkT8jyNS7TM4e4UPZMuXcbtia7/r5d7kAiUfKv/sV5PNMlZLOk+EYJeLTANg== dependencies: - "@sentry/core" "8.38.0" - "@sentry/types" "8.38.0" - "@sentry/utils" "8.38.0" + "@sentry/core" "8.41.0" + "@sentry/types" "8.41.0" -"@sentry-internal/replay-canvas@8.38.0": - version "8.38.0" - resolved "https://registry.yarnpkg.com/@sentry-internal/replay-canvas/-/replay-canvas-8.38.0.tgz#26e9bc937dab73e1a26d57dc1015b7ff1f2d76c5" - integrity sha512-OxmlWzK9J8mRM+KxdSnQ5xuxq+p7TiBzTz70FT3HltxmeugvDkyp6803UcFqHOPHR35OYeVLOalym+FmvNn9kw== +"@sentry-internal/replay-canvas@8.41.0": + version "8.41.0" + resolved "https://registry.yarnpkg.com/@sentry-internal/replay-canvas/-/replay-canvas-8.41.0.tgz#9da984adc54fcd8ebe07cbbc13132fa78396dd01" + integrity sha512-lpgOBHWr1ZNxidD72A2pfoUMjIpwonOPYoQZWAHr86Oa3eIVQOyfklZlHW+gKPFl2/IEl9Lbtcke0JiDp3dkIQ== dependencies: - "@sentry-internal/replay" "8.38.0" - "@sentry/core" "8.38.0" - "@sentry/types" "8.38.0" - "@sentry/utils" "8.38.0" + "@sentry-internal/replay" "8.41.0" + "@sentry/core" "8.41.0" + "@sentry/types" "8.41.0" -"@sentry-internal/replay@8.38.0": - version "8.38.0" - resolved "https://registry.yarnpkg.com/@sentry-internal/replay/-/replay-8.38.0.tgz#9a9b945a3c066f5610a363774e3c99420c3f4fce" - integrity sha512-mQPShKnIab7oKwkwrRxP/D8fZYHSkDY+cvqORzgi+wAwgnunytJQjz9g6Ww2lJu98rHEkr5SH4V4rs6PZYZmnQ== +"@sentry-internal/replay@8.41.0": + version "8.41.0" + resolved "https://registry.yarnpkg.com/@sentry-internal/replay/-/replay-8.41.0.tgz#b1112a52a0cf1727589ad4d42a8fac9f98f6d733" + integrity sha512-ByXEY7JI95y4Qr9fS3d28l9uuVU5Qa0HgL+xDmYElNx7CXz3Q9hFN6ibgUeC3h8BO5pDULxWNgAppl7FRY8N5w== dependencies: - "@sentry-internal/browser-utils" "8.38.0" - "@sentry/core" "8.38.0" - "@sentry/types" "8.38.0" - "@sentry/utils" "8.38.0" + "@sentry-internal/browser-utils" "8.41.0" + "@sentry/core" "8.41.0" + "@sentry/types" "8.41.0" -"@sentry/browser@8.38.0": - version "8.38.0" - resolved "https://registry.yarnpkg.com/@sentry/browser/-/browser-8.38.0.tgz#c562accdc2bbe0b0074d98bfe7ff460e39ce3109" - integrity sha512-AZR+b0EteNZEGv6JSdBD22S9VhQ7nrljKsSnzxobBULf3BpwmhmCzTbDrqWszKDAIDYmL+yQJIR2glxbknneWQ== +"@sentry/browser@8.41.0": + version "8.41.0" + resolved "https://registry.yarnpkg.com/@sentry/browser/-/browser-8.41.0.tgz#f594012e6377a92db72127ef39aee812efe3a3b7" + integrity sha512-FfAU55eYwW2lG4M3dEw2472RvHrD5YWSfHCZvuRf/4skX38kFvKghZQ+epL+CVHTzvIRHOrbj8qQK6YLTGl9ew== dependencies: - "@sentry-internal/browser-utils" "8.38.0" - "@sentry-internal/feedback" "8.38.0" - "@sentry-internal/replay" "8.38.0" - "@sentry-internal/replay-canvas" "8.38.0" - "@sentry/core" "8.38.0" - "@sentry/types" "8.38.0" - "@sentry/utils" "8.38.0" + "@sentry-internal/browser-utils" "8.41.0" + "@sentry-internal/feedback" "8.41.0" + "@sentry-internal/replay" "8.41.0" + "@sentry-internal/replay-canvas" "8.41.0" + "@sentry/core" "8.41.0" + "@sentry/types" "8.41.0" -"@sentry/core@8.38.0": - version "8.38.0" - resolved "https://registry.yarnpkg.com/@sentry/core/-/core-8.38.0.tgz#5d1b74770c79e489e786018a3e514cddeb777bcb" - integrity sha512-sGD+5TEHU9G7X7zpyaoJxpOtwjTjvOd1f/MKBrWW2vf9UbYK+GUJrOzLhMoSWp/pHSYgvObkJkDb/HwieQjvhQ== +"@sentry/core@8.41.0": + version "8.41.0" + resolved "https://registry.yarnpkg.com/@sentry/core/-/core-8.41.0.tgz#e8a25cacd25fe4358f3179e85f3c2697427fe5a6" + integrity sha512-3v7u3t4LozCA5SpZY4yqUN2U3jSrkXNoLgz6L2SUUiydyCuSwXZIFEwpLJfgQyidpNDifeQbBI5E1O910XkPsA== dependencies: - "@sentry/types" "8.38.0" - "@sentry/utils" "8.38.0" + "@sentry/types" "8.41.0" -"@sentry/types@8.38.0": - version "8.38.0" - resolved "https://registry.yarnpkg.com/@sentry/types/-/types-8.38.0.tgz#9c48734a8b4055bfd553a0141efec78e9680ed09" - integrity sha512-fP5H9ZX01W4Z/EYctk3mkSHi7d06cLcX2/UWqwdWbyPWI+pL2QpUPICeO/C+8SnmYx//wFj3qWDhyPCh1PdFAA== - -"@sentry/utils@8.38.0": - version "8.38.0" - resolved "https://registry.yarnpkg.com/@sentry/utils/-/utils-8.38.0.tgz#2f91ca7d044f6e17b993c866ca02a981c4c1bc25" - integrity sha512-3X7MgIKIx+2q5Al7QkhaRB4wV6DvzYsaeIwdqKUzGLuRjXmNgJrLoU87TAwQRmZ6Wr3IoEpThZZMNrzYPXxArw== - dependencies: - "@sentry/types" "8.38.0" +"@sentry/types@8.41.0": + version "8.41.0" + resolved "https://registry.yarnpkg.com/@sentry/types/-/types-8.41.0.tgz#db40c93bcedad26569c5dfe10a4b31253c349a10" + integrity sha512-eqdnGr9k9H++b9CjVUoTNUVahPVWeNnMy0YGkqS5+cjWWC+x43p56202oidGFmWo6702ub/xwUNH6M5PC4kq6A== "@sinclair/typebox@^0.27.8": version "0.27.8"