#465: Update specs for Projects::Git::TreesController

app/controllers/projects/base_controller.rb

@@ -12,7 +12,8 @@ class Projects::BaseController < ApplicationController
   end
 
   def find_project
-    @project = Project.find_by_owner_and_name! params[:name_with_owner] if params[:name_with_owner].present?
+    return if params[:name_with_owner].blank?
+    authorize @project = Project.find_by_owner_and_name!(params[:name_with_owner]), :show?
   end
 
   def init_statistics

app/controllers/projects/git/trees_controller.rb

@@ -60,13 +60,13 @@ class Projects::Git::TreesController < Projects::Git::BaseController
   end
 
   def create
-    authorize @project
+    authorize @project, :write?
     status = @project.create_branch(params[:new_ref], params[:from_ref], current_user) ? 200 : 422
     render nothing: true, status: status
   end
 
   def destroy
-    authorize @project
+    authorize @project, :write?
     status = @branch && @project.delete_branch(@branch, current_user) ? 200 : 422
     render nothing: true, status: status
   end

spec/controllers/projects/git/git_trees_controller_spec.rb

@@ -14,18 +14,18 @@ describe Projects::Git::TreesController, type: :controller do
     [:tags, :branches].each do |action|
       it "should be able to perform #{action} action with anonymous acccess", anonymous_access: true do
         get action, @params.merge(treeish: 'master')
-        response.should be_success
+        expect(response).to be_success
       end
 
       it "should not be able to perform #{action} action without anonymous acccess", anonymous_access: false do
         get action, @params.merge(treeish: 'master')
-        response.should_not be_success
+        expect(response).to_not be_success
       end
     end
 
     it "should be able to perform archive action with anonymous acccess", anonymous_access: true do
       get :archive, @params.merge(format: 'tar.gz')
-      response.should be_success
+      expect(response).to be_success
     end
 
     it "should not be able to perform archive action without anonymous acccess", anonymous_access: false do
@@ -35,17 +35,17 @@ describe Projects::Git::TreesController, type: :controller do
 
     it 'should not be able to perform destroy action' do
       delete :destroy, @params.merge(treeish: 'master')
-      response.should_not be_success
+      expect(response).to_not be_success
     end
 
     it 'should not be able to perform restore_branch action' do
       put :restore_branch, @params.merge(treeish: 'master')
-      response.should_not be_success
+      expect(response).to_not be_success
     end
 
     it 'should not be able to perform create action' do
       post :create, @params.merge(treeish: '', from_ref: 'master', new_ref: 'master-1')
-      response.should_not be_success
+      expect(response).to_not be_success
     end
 
   end
@@ -67,28 +67,28 @@ describe Projects::Git::TreesController, type: :controller do
 
     it 'should be able to perform archive action' do
       get :archive, @params.merge(format: 'tar.gz')
-      response.should be_success
+      expect(response).to be_success
     end
 
     it 'should not be able to perform destroy action' do
       delete :destroy, @params.merge(treeish: 'master')
-      response.should_not be_success
+      expect(response).to_not be_success
     end
 
     it 'should not be able to perform restore_branch action' do
       put :restore_branch, @params.merge(treeish: 'master')
-      response.should_not be_success
+      expect(response).to_not be_success
     end
 
     it 'should not be able to perform create action' do
       post :create, @params.merge(treeish: '', from_ref: 'master', new_ref: 'master-1')
-      response.should_not be_success
+      expect(response).to_not be_success
     end
 
     [:tags, :branches].each do |action|
       it "should be able to perform #{action} action" do
         get action, @params.merge(treeish: 'master')
-        response.should be_success
+        expect(response).to be_success
       end
     end
   end
@@ -102,22 +102,22 @@ describe Projects::Git::TreesController, type: :controller do
 
     it 'should be able to perform destroy action' do
       delete :destroy, @params.merge(treeish: 'conflicts')
-      response.should be_success
+      expect(response).to be_success
     end
 
     it 'should not be able to perform destroy action for master branch' do
       delete :destroy, @params.merge(treeish: 'master')
-      response.should_not be_success
+      expect(response).to_not be_success
     end
 
     it 'should be able to perform restore_branch action' do
       put :restore_branch, @params.merge(treeish: 'master-1', sha: 'master')
-      response.should be_success
+      expect(response).to be_success
     end
 
     it 'should be able to perform create action' do
       post :create, @params.merge(treeish: '', from_ref: 'master', new_ref: 'master-1')
-      response.should be_success
+      expect(response).to be_success
     end
   end