Merge branch '11613-routable_actions-sso-master-failure' into 'master'

Resolve "routable_actions SSO master failure"

Closes #11613

See merge request gitlab-org/gitlab-ee!12736

ee/spec/controllers/concerns/ee/routable_actions/sso_enforcement_redirect_spec.rb

@@ -6,6 +6,7 @@ describe EE::RoutableActions::SsoEnforcementRedirect do
   let(:saml_provider) { create(:saml_provider, enforced_sso: true) }
   let(:root_group) { saml_provider.group }
   let(:nested_group) { create(:group, :private, parent: root_group) }
+  let(:project) { create(:project, :private, group: root_group) }
   let(:nested_project) { create(:project, :private, group: nested_group) }
 
   describe '#should_redirect_to_group_saml_sso?' do
@@ -26,58 +27,86 @@ describe EE::RoutableActions::SsoEnforcementRedirect do
       expect(subject.should_redirect_to_group_saml_sso?(double, double)).to eq(false)
     end
 
-    context 'with a project' do
-      subject { described_class.new(nested_project) }
-
+    shared_examples 'a routable with SSO enforcement redirect' do
       it 'is false when a new sso session is not needed' do
-        allow_any_instance_of(ProjectPolicy).to receive(:needs_new_sso_session?).and_return(false)
+        expect_next_instance_of(BasePolicy) do |policy|
+          expect(policy).to receive(:needs_new_sso_session?).and_return(false)
+        end
 
         expect(subject.should_redirect_to_group_saml_sso?(user, request)).to eq false
       end
 
       it 'is true when a new sso session is needed' do
-        allow_any_instance_of(ProjectPolicy).to receive(:needs_new_sso_session?).and_return(true)
+        expect_next_instance_of(BasePolicy) do |policy|
+          expect(policy).to receive(:needs_new_sso_session?).and_return(true)
+        end
 
         expect(subject.should_redirect_to_group_saml_sso?(user, request)).to eq true
       end
+    end
+
+    context 'with a project' do
+      subject { described_class.new(project) }
+
+      it_behaves_like 'a routable with SSO enforcement redirect'
+    end
 
-      context 'in a personal namespace' do
+    context 'with a nested project' do
+      subject { described_class.new(nested_project) }
+
+      it_behaves_like 'a routable with SSO enforcement redirect'
+    end
+
+    context 'with a project in a personal namespace' do
       subject { described_class.new(create(:project)) }
 
       it 'returns false' do
         expect(subject.should_redirect_to_group_saml_sso?(user, double)).to eq false
       end
     end
-    end
 
     context 'with a group' do
+      subject { described_class.new(root_group) }
+
+      it_behaves_like 'a routable with SSO enforcement redirect'
+    end
+
+    context 'with a nested group' do
       subject { described_class.new(nested_group) }
 
-      it 'is false when a new sso session is not needed' do
-        allow_any_instance_of(GroupPolicy).to receive(:needs_new_sso_session?).and_return(false)
+      it_behaves_like 'a routable with SSO enforcement redirect'
+    end
+  end
 
-        expect(subject.should_redirect_to_group_saml_sso?(user, request)).to eq false
+  describe '#sso_redirect_url' do
+    shared_examples 'a routable SSO url' do
+      it 'returns the SSO url for the root group' do
+        expect(subject.sso_redirect_url).to match(/groups\/#{root_group.to_param}\/-\/saml\/sso\?token=/)
+      end
     end
 
-      it 'is true when a new sso session is needed' do
-        allow_any_instance_of(GroupPolicy).to receive(:needs_new_sso_session?).and_return(true)
+    context 'with a group' do
+      subject { described_class.new(root_group) }
 
-        expect(subject.should_redirect_to_group_saml_sso?(user, request)).to eq true
-      end
+      it_behaves_like 'a routable SSO url'
     end
+
+    context 'with a nested group', :nested_groups do
+      subject { described_class.new(nested_group) }
+
+      it_behaves_like 'a routable SSO url'
     end
 
-  describe '#sso_redirect_url' do
-    it 'returns the SSO url for a group' do
-      subject = described_class.new(nested_group)
+    context 'with a project' do
+      subject { described_class.new(project) }
 
-      expect(subject.sso_redirect_url).to match(/groups\/#{root_group.to_param}\/-\/saml\/sso\?token=/)
+      it_behaves_like 'a routable SSO url'
     end
 
-    it "returns the SSO url for a project's root group" do
-      subject = described_class.new(nested_project)
+    context 'with a nested project', :nested_groups do
+      subject { described_class.new(nested_project) }
 
-      expect(subject.sso_redirect_url).to match(/groups\/#{root_group.to_param}\/-\/saml\/sso\?token=/)
+      it_behaves_like 'a routable SSO url'
     end
   end
 end

ee/spec/controllers/concerns/routable_actions_spec.rb

@@ -53,6 +53,12 @@ describe RoutableActions do
       end
 
       describe 'for a group' do
+        let(:routable) { root_group }
+
+        include_examples 'sso redirects'
+      end
+
+      describe 'for a nested group', :nested_groups do
         let(:routable) { create(:group, :private, parent: root_group) }
 
         include_examples 'sso redirects'
@@ -63,6 +69,12 @@ describe RoutableActions do
 
         include_examples 'sso redirects'
       end
+
+      describe 'for a nested project', :nested_groups do
+        let(:routable) { create(:project, :private, group: create(:group, :private, parent: root_group)) }
+
+        include_examples 'sso redirects'
+      end
     end
   end
 end