Add feature tests for permissions for build artifacts read ability

features/project/builds/artifacts.feature

@@ -2,8 +2,8 @@ Feature: Project Builds Artifacts
   Background:
     Given I sign in as a user
     And I own a project
-    And CI is enabled
-    And I have recent build for my project
+    And project has CI enabled
+    And project has a recent build
   Scenario: I download build artifacts
     Given recent build has artifacts available

features/project/builds/permissions.feature

+Feature: Project Builds Permissions
+  Background:
+    Given I sign in as a user
+    And project exists in some group namespace
+    And project has CI enabled
+    And project has a recent build
+
+  Scenario: I try to download build artifacts as guest
+    Given I am member of a project with a guest role
+    And recent build has artifacts available
+    When I access artifacts download page
+    Then page status code should be 404
+
+  Scenario: I try to download build artifacts as reporter
+    Given I am member of a project with a reporter role
+    And recent build has artifacts available
+    When I access artifacts download page
+    Then download of build artifacts archive starts

features/project/builds/summary.feature

@@ -2,8 +2,8 @@ Feature: Project Builds Summary
   Background:
     Given I sign in as a user
     And I own a project
-    And CI is enabled
-    And I have recent build for my project
+    And project has CI enabled
+    And project has a recent build
   Scenario: I browse build summary page
     When I visit recent build summary page

features/steps/project/builds/artifacts.rb

@@ -8,11 +8,6 @@ class Spinach::Features::ProjectBuildsArtifacts < Spinach::FeatureSteps
     page.within('.artifacts') { click_link 'Download' }
   end
-  step 'download of build artifacts archive starts' do
-    expect(page.response_headers['Content-Type']).to eq 'application/zip'
-    expect(page.response_headers['Content-Transfer-Encoding']).to eq 'binary'
-  end
-
   step 'I click artifacts browse button' do
     page.within('.artifacts') { click_link 'Browse' }
   end

features/steps/project/builds/permissions.rb

+class Spinach::Features::ProjectBuildsPermissions < Spinach::FeatureSteps
+  include SharedAuthentication
+  include SharedProject
+  include SharedBuilds
+  include SharedPaths
+  include RepoHelpers
+end

features/steps/shared/builds.rb

 module SharedBuilds
   include Spinach::DSL
-  step 'CI is enabled' do
+  step 'project has CI enabled' do
     @project.enable_ci
   end
-  step 'I have recent build for my project' do
+  step 'project has a recent build' do
     ci_commit = create :ci_commit, project: @project, sha: sample_commit.id
     @build = create :ci_build, commit: ci_commit
   end
@@ -25,4 +25,13 @@ module SharedBuilds
     gzip = fixture_file_upload(metadata, 'application/x-gzip')
     @build.update_attributes(artifacts_metadata: gzip)
   end
+
+  step 'download of build artifacts archive starts' do
+    expect(page.response_headers['Content-Type']).to eq 'application/zip'
+    expect(page.response_headers['Content-Transfer-Encoding']).to eq 'binary'
+  end
+
+  step 'I access artifacts download page' do
+    visit download_namespace_project_build_artifacts_path(@project.namespace, @project, @build)
+  end
 end

features/steps/shared/project.rb

@@ -7,6 +7,11 @@ module SharedProject
     @project.team << [@user, :master]
   end
+  step "project exists in some group namespace" do
+    @group = create(:group, name: 'some group')
+    @project = create(:project, namespace: @group)
+  end
+
   # Create a specific project called "Shop"
   step 'I own project "Shop"' do
     @project = Project.find_by(name: "Shop")
@@ -97,6 +102,18 @@ module SharedProject
     @project ||= Project.first
   end
+  # ----------------------------------------
+  # Project permissions
+  # ----------------------------------------
+
+  step 'I am member of a project with a guest role' do
+    @project.team << [@user, Gitlab::Access::GUEST]
+  end
+
+  step 'I am member of a project with a reporter role' do
+    @project.team << [@user, Gitlab::Access::REPORTER]
+  end
+
   # ----------------------------------------
   # Visibility of archived project
   # ----------------------------------------
@@ -229,5 +246,4 @@ module SharedProject
     project ||= create(:empty_project, visibility, name: project_name, namespace: user.namespace)
     project.team << [user, :master]
   end
-
 end