Port #save_multiple to Groups::VariablesController

app/controllers/groups/variables_controller.rb

@@ -31,6 +31,16 @@ module Groups
       end
     end
 
+    def save_multiple
+      respond_to do |format|
+        format.json do
+          return head :ok if @group.update(variables_params)
+
+          head :bad_request
+        end
+      end
+    end
+
     def destroy
       if variable.destroy
         redirect_to group_settings_ci_cd_path(group),
@@ -49,8 +59,12 @@ module Groups
       params.require(:variable).permit(*variable_params_attributes)
     end
 
+    def variables_params
+      params.permit(variables_attributes: [*variable_params_attributes])
+    end
+
     def variable_params_attributes
-      %i[key value protected]
+      %i[id key value protected _destroy]
     end
 
     def variable

app/models/group.rb

@@ -31,6 +31,8 @@ class Group < Namespace
 
   has_many :uploads, as: :model, dependent: :destroy # rubocop:disable Cop/ActiveRecordDependent
 
+  accepts_nested_attributes_for :variables, allow_destroy: true
+
   validate :visibility_level_allowed_by_projects
   validate :visibility_level_allowed_by_sub_groups
   validate :visibility_level_allowed_by_parent

config/routes/group.rb

@@ -27,7 +27,11 @@ constraints(GroupUrlConstrainer.new) do
       resource :ci_cd, only: [:show], controller: 'ci_cd'
     end
 
-    resources :variables, only: [:index, :show, :update, :create, :destroy]
+    resources :variables, only: [:index, :show, :update, :create, :destroy] do
+      collection do
+        post :save_multiple
+      end
+    end
 
     resources :children, only: [:index]
 

spec/controllers/groups/variables_controller_spec.rb

@@ -29,13 +29,9 @@ describe Groups::VariablesController do
   end
 
   describe 'POST #update' do
-    let(:variable) { create(:ci_group_variable) }
+    let!(:variable) { create(:ci_group_variable, group: group) }
 
     context 'updating a variable with valid characters' do
-      before do
-        group.variables << variable
-      end
-
       it 'shows a success flash message' do
         post :update, group_id: group,
                       id: variable.id, variable: { key: variable.key, value: 'two' }
@@ -53,4 +49,77 @@ describe Groups::VariablesController do
       end
     end
   end
+
+  describe 'POST #save_multiple' do
+    let!(:variable) { create(:ci_group_variable, group: group) }
+
+    context 'with invalid new variable parameters' do
+      subject do
+        post :save_multiple,
+          group_id: group,
+          variables_attributes: [{ id: variable.id, key: variable.key, value: 'other_value' },
+                                 { key: '..?', value: 'dummy_value' }],
+          format: :json
+      end
+
+      it 'does not update the existing variable' do
+        expect { subject }.not_to change { variable.reload.value }
+      end
+
+      it 'does not create the new variable' do
+        expect { subject }.not_to change { group.variables.count }
+      end
+
+      it 'returns a bad request response' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:bad_request)
+      end
+    end
+
+    context 'with valid new variable parameters' do
+      subject do
+        post :save_multiple,
+          group_id: group,
+          variables_attributes: [{ id: variable.id, key: variable.key, value: 'other_value' },
+                                 { key: 'new_key', value: 'dummy_value' }],
+          format: :json
+      end
+
+      it 'updates the existing variable' do
+        expect { subject }.to change { variable.reload.value }.to('other_value')
+      end
+
+      it 'creates the new variable' do
+        expect { subject }.to change { group.variables.count }.by(1)
+      end
+
+      it 'returns a successful response' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+    end
+
+    context 'with a deleted variable' do
+      subject do
+        post :save_multiple,
+          group_id: group,
+          variables_attributes: [{ id: variable.id, key: variable.key,
+                                   value: variable.value, _destroy: 'true' }],
+          format: :json
+      end
+
+      it 'destroys the variable' do
+        expect { subject }.to change { group.variables.count }.by(-1)
+        expect { variable.reload }.to raise_error ActiveRecord::RecordNotFound
+      end
+
+      it 'returns a successful response' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+    end
+  end
 end