Skip to content

Ensure user is project member in create package service tests

Gerardo Navarro requested to merge gitlab-community/gitlab:323970-test-ensure-user-is-project-member-in-create-package-service-tests into master

What does this MR do and why?

This MR wants to correct the user used in the test cases for the Npm::CreatePackageService. Currently, the user defined in the test cases is not a member of the project and can create new packages. This is unexpected and because we do not want non-member users to create packages for this project.

As far as I have seen, I do not see any security issues because the user and its project membership are authorized in API::NpmProjectPackages, see https://gitlab.com/gitlab-community/gitlab/-/blob/810d3a92ab59bff03411d3f4512628671d6d866e/lib/api/npm_project_packages.rb#L75 . However IMO, it might make sense to fix the test user in order to use more realistic test data.

Note: The services tests for other package formats are also using a non-member as a test user. If desired, I am also happy to extend these changes also to the other service tests.

🛠 with ❤ at Siemens

Screenshots or screen recordings

Only changes in the test cases.

How to set up and validate locally

  1. Execute test case
bundle exec rspec spec/services/packages/npm/create_package_service_spec.rb

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #323970

Edited by Gerardo Navarro

Merge request reports