chemlab 0.0.1

data/qa/service/docker_run/saml_idp.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+module QA
+  module Service
+    module DockerRun
+      class SamlIdp < Base
+        def initialize(gitlab_host, group)
+          @image = 'jamedjo/test-saml-idp'
+          @name = 'saml-idp-server'
+          @gitlab_host = gitlab_host
+          @group = group
+          super()
+        end
+
+        def idp_base_url
+          "https://#{host_name}:8443/simplesaml"
+        end
+
+        def idp_sso_url
+          "#{idp_base_url}/saml2/idp/SSOService.php"
+        end
+
+        def idp_sign_out_url
+          "#{idp_base_url}/module.php/core/authenticate.php?as=example-userpass&logout"
+        end
+
+        def idp_signed_out_url
+          "#{idp_base_url}/logout.php"
+        end
+
+        def idp_metadata_url
+          "#{idp_base_url}/saml2/idp/metadata.php"
+        end
+
+        def idp_issuer
+          idp_metadata_url
+        end
+
+        def idp_certificate_fingerprint
+          QA::Runtime::Env.simple_saml_fingerprint || '119b9e027959cdb7c662cfd075d9e2ef384e445f'
+        end
+
+        def host_name
+          return 'localhost' unless QA::Runtime::Env.running_in_ci?
+
+          super
+        end
+
+        def register!
+          command = <<~CMD.tr("\n", ' ')
+            docker run -d --rm
+            --network #{network}
+            --hostname #{host_name}
+            --name #{@name}
+            --env SIMPLESAMLPHP_SP_ENTITY_ID=#{@gitlab_host}/groups/#{@group}
+            --env SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE=#{@gitlab_host}/groups/#{@group}/-/saml/callback
+            --publish 8080:8080
+            --publish 8443:8443
+            #{@image}
+          CMD
+
+          command.gsub!("--network #{network} ", '') unless QA::Runtime::Env.running_in_ci?
+
+          shell command
+        end
+      end
+    end
+  end
+end

data/qa/service/kubernetes_cluster.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+require 'securerandom'
+require 'mkmf'
+require 'pathname'
+
+module QA
+  module Service
+    class KubernetesCluster
+      include Service::Shellout
+
+      attr_reader :api_url, :ca_certificate, :token, :rbac, :provider
+
+      def initialize(rbac: true, provider_class: QA::Service::ClusterProvider::Gcloud)
+        @rbac = rbac
+        @provider = provider_class.new(rbac: rbac)
+      end
+
+      def create!
+        validate_dependencies
+
+        @provider.validate_dependencies
+        @provider.setup
+
+        @api_url = fetch_api_url
+
+        credentials = @provider.filter_credentials(fetch_credentials)
+        @ca_certificate = Base64.decode64(credentials.dig('data', 'ca.crt'))
+        @token = Base64.decode64(credentials.dig('data', 'token'))
+
+        self
+      end
+
+      def remove!
+        @provider.teardown
+      end
+
+      def cluster_name
+        @provider.cluster_name
+      end
+
+      def to_s
+        cluster_name
+      end
+
+      private
+
+      def fetch_api_url
+        `kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}'`
+      end
+
+      def fetch_credentials
+        return global_credentials unless rbac
+
+        @provider.set_credentials(admin_user)
+        create_service_account(admin_user)
+        account_credentials
+      end
+
+      def admin_user
+        @admin_user ||= "#{@provider.cluster_name}-admin"
+      end
+
+      def create_service_account(user)
+        service_account = <<~YAML
+          ---
+          apiVersion: v1
+          kind: ServiceAccount
+          metadata:
+            name: gitlab-account
+            namespace: default
+          ---
+          kind: ClusterRoleBinding
+          apiVersion: rbac.authorization.k8s.io/v1
+          metadata:
+            name: gitlab-account-binding
+          subjects:
+          - kind: ServiceAccount
+            name: gitlab-account
+            namespace: default
+          roleRef:
+            kind: ClusterRole
+            name: cluster-admin
+            apiGroup: rbac.authorization.k8s.io
+        YAML
+
+        shell('kubectl apply -f -', stdin_data: service_account)
+      end
+
+      def account_credentials
+        secrets = JSON.parse(`kubectl get secrets -o json`)
+
+        secrets['items'].find do |item|
+          item['metadata']['annotations']['kubernetes.io/service-account.name'] == 'gitlab-account'
+        end
+      end
+
+      def global_credentials
+        JSON.parse(`kubectl get secrets -o jsonpath='{.items[0]}'`)
+      end
+
+      def validate_dependencies
+        find_executable('kubectl') || raise("You must first install `kubectl` executable to run these tests.")
+      end
+    end
+  end
+end

data/qa/service/omnibus.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module QA
+  module Service
+    class Omnibus
+      include Scenario::Actable
+      include Service::Shellout
+
+      def initialize(container)
+        @name = container
+      end
+
+      def gitlab_ctl(command, input: nil)
+        docker_exec("gitlab-ctl #{command}", input: input)
+      end
+
+      def docker_exec(command, input: nil)
+        command = "#{input} | #{command}" if input
+        shell "docker exec #{@name} bash -c '#{command}'"
+      end
+    end
+  end
+end

data/qa/service/shellout.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require 'open3'
+
+module QA
+  module Service
+    module Shellout
+      CommandError = Class.new(StandardError)
+
+      module_function
+
+      ##
+      # TODO, make it possible to use generic QA framework classes
+      # as a library - gitlab-org/gitlab-qa#94
+      #
+      def shell(command, stdin_data: nil)
+        puts "Executing `#{command}`"
+
+        Open3.popen2e(*command) do |stdin, out, wait|
+          stdin.puts(stdin_data) if stdin_data
+          stdin.close if stdin_data
+          out.each_char { |char| print char }
+
+          if wait.value.exited? && wait.value.exitstatus.nonzero?
+            raise CommandError, "Command `#{command}` failed!"
+          end
+        end
+      end
+    end
+  end
+end

data/qa/specs/features/api/1_manage/rate_limits_spec.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module QA
+  context 'Manage with IP rate limits', :requires_admin do
+    describe 'Users API' do
+      let(:api_client) { Runtime::API::Client.new(:gitlab, ip_limits: true) }
+      let(:request) { Runtime::API::Request.new(api_client, '/users') }
+
+      it 'GET /users' do
+        5.times do
+          get request.url
+          expect_status(200)
+        end
+      end
+    end
+  end
+end

data/qa/specs/features/api/1_manage/users_spec.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module QA
+  context 'Manage' do
+    describe 'Users API' do
+      before(:context) do
+        @api_client = Runtime::API::Client.new(:gitlab)
+      end
+
+      let(:request) { Runtime::API::Request.new(@api_client, '/users') }
+
+      it 'GET /users' do
+        get request.url
+
+        expect_status(200)
+      end
+
+      it 'GET /users/:username with a valid username' do
+        get request.url, { params: { username: Runtime::User.username } }
+
+        expect_status(200)
+        expect(json_body).to contain_exactly(
+          a_hash_including(username: Runtime::User.username)
+        )
+      end
+
+      it 'GET /users/:username with an invalid username' do
+        get request.url, { params: { username: SecureRandom.hex(10) } }
+
+        expect_status(200)
+        expect(json_body).to eq([])
+      end
+    end
+  end
+end

data/qa/specs/features/api/2_plan/closes_issue_via_pushing_a_commit_spec.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module QA
+  context 'Plan' do
+    include Support::Api
+
+    describe 'Issue' do
+      let(:issue) do
+        Resource::Issue.fabricate_via_api!
+      end
+
+      let(:issue_id) { issue.api_response[:iid] }
+
+      let(:api_client) { Runtime::API::Client.new(:gitlab) }
+
+      before do
+        # Initial commit should be pushed because
+        # the very first commit to the project doesn't close the issue
+        # https://gitlab.com/gitlab-org/gitlab-foss/issues/38965
+        push_commit('Initial commit')
+      end
+
+      it 'closes via pushing a commit' do
+        push_commit("Closes ##{issue_id}", false)
+
+        Support::Retrier.retry_until(max_duration: 10, sleep_interval: 1) do
+          issue_closed?
+        end
+      end
+
+      private
+
+      def push_commit(commit_message, new_branch = true)
+        Resource::Repository::ProjectPush.fabricate! do |push|
+          push.commit_message = commit_message
+          push.new_branch = new_branch
+          push.file_content = commit_message
+          push.project = issue.project
+        end
+      end
+
+      def issue_closed?
+        response = get Runtime::API::Request.new(api_client, "/projects/#{issue.project.id}/issues/#{issue_id}").url
+        parse_body(response)[:state] == 'closed'
+      end
+    end
+  end
+end

data/qa/specs/features/api/3_create/repository/files_spec.rb

@@ -0,0 +1,106 @@
+# frozen_string_literal: true
+
+require 'securerandom'
+
+module QA
+  describe 'API basics' do
+    before(:context) do
+      @api_client = Runtime::API::Client.new(:gitlab)
+    end
+
+    let(:project_name) { "api-basics-#{SecureRandom.hex(8)}" }
+    let(:sanitized_project_path) { CGI.escape("#{Runtime::User.username}/#{project_name}") }
+
+    it 'user creates a project with a file and deletes them afterwards' do
+      create_project_request = Runtime::API::Request.new(@api_client, '/projects')
+      post create_project_request.url, path: project_name, name: project_name
+
+      expect_status(201)
+      expect(json_body).to match(
+        a_hash_including(name: project_name, path: project_name)
+      )
+
+      create_file_request = Runtime::API::Request.new(@api_client, "/projects/#{sanitized_project_path}/repository/files/README.md")
+      post create_file_request.url, branch: 'master', content: 'Hello world', commit_message: 'Add README.md'
+
+      expect_status(201)
+      expect(json_body).to match(
+        a_hash_including(branch: 'master', file_path: 'README.md')
+      )
+
+      get_file_request = Runtime::API::Request.new(@api_client, "/projects/#{sanitized_project_path}/repository/files/README.md", ref: 'master')
+      get get_file_request.url
+
+      expect_status(200)
+      expect(json_body).to match(
+        a_hash_including(
+          ref: 'master',
+          file_path: 'README.md', file_name: 'README.md',
+          encoding: 'base64', content: 'SGVsbG8gd29ybGQ='
+        )
+      )
+
+      delete_file_request = Runtime::API::Request.new(@api_client, "/projects/#{sanitized_project_path}/repository/files/README.md", branch: 'master', commit_message: 'Remove README.md')
+      delete delete_file_request.url
+
+      expect_status(204)
+
+      get_tree_request = Runtime::API::Request.new(@api_client, "/projects/#{sanitized_project_path}/repository/tree")
+      get get_tree_request.url
+
+      expect_status(200)
+      expect(json_body).to eq([])
+
+      delete_project_request = Runtime::API::Request.new(@api_client, "/projects/#{sanitized_project_path}")
+      delete delete_project_request.url
+
+      expect_status(202)
+      expect(json_body).to match(
+        a_hash_including(message: '202 Accepted')
+      )
+    end
+
+    describe 'raw file access' do
+      let(:svg_file) do
+        <<-SVG
+          <?xml version="1.0" standalone="no"?>
+          <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+
+          <svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
+            <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
+            <script type="text/javascript">
+               alert("surprise");
+            </script>
+          </svg>
+        SVG
+      end
+
+      it 'sets no-cache headers as expected' do
+        create_project_request = Runtime::API::Request.new(@api_client, '/projects')
+        post create_project_request.url, path: project_name, name: project_name
+
+        create_file_request = Runtime::API::Request.new(@api_client, "/projects/#{sanitized_project_path}/repository/files/test.svg")
+        post create_file_request.url, branch: 'master', content: svg_file, commit_message: 'Add test.svg'
+
+        get_file_request = Runtime::API::Request.new(@api_client, "/projects/#{sanitized_project_path}/repository/files/test.svg/raw", ref: 'master')
+
+        3.times do
+          response = get get_file_request.url
+
+          # Subsequent responses aren't cached, so headers should match from
+          #   request to request, especially a 200 response rather than a 304
+          #   (indicating a cached response.) Further, :content_disposition
+          #   should include `attachment` for all responses.
+          #
+          expect(response.headers[:cache_control]).to include("no-store")
+          expect(response.headers[:cache_control]).to include("no-cache")
+          expect(response.headers[:pragma]).to eq("no-cache")
+          expect(response.headers[:expires]).to eq("Fri, 01 Jan 1990 00:00:00 GMT")
+          expect(response.headers[:content_disposition]).to include("attachment")
+          expect(response.headers[:content_disposition]).not_to include("inline")
+          expect(response.headers[:content_type]).to include("image/svg+xml")
+        end
+      end
+    end
+  end
+end