Add latest changes from gitlab-org/gitlab@15-9-stable-ee

12 files changed, 115 insertions, 31 deletions

diff --git a/Gemfile b/Gemfile
index 0f64f3c9b04..9e4fd6cd3e9 100644
--- a/Gemfile
+++ b/Gemfile
@@ -71,7 +71,7 @@ gem 'omniauth-oauth2-generic', '~> 0.2.2'
 gem 'omniauth-saml', '~> 2.0.0'
 gem 'omniauth-twitter', '~> 1.4'
 gem 'omniauth_crowd', '~> 2.4.0', path: 'vendor/gems/omniauth_crowd' # See vendor/gems/omniauth_crowd/README.md
-gem 'omniauth_openid_connect', '~> 0.6.0'
+gem 'omniauth_openid_connect', '~> 0.6.1'
 # Locked until Ruby 3.0 upgrade since upgrading will pull in an updated net-smtp gem.
 # See https://docs.gitlab.com/ee/development/emails.html#rationale.
 gem 'openid_connect', '= 1.3.0'
diff --git a/Gemfile.checksum b/Gemfile.checksum
index 338358973e2..8e7967a81af 100644
--- a/Gemfile.checksum
+++ b/Gemfile.checksum
@@ -401,7 +401,7 @@
 {"name":"omniauth-oauth2-generic","version":"0.2.8","platform":"ruby","checksum":"ce6e8539019d5ebf2f48867072b9f248f148bb4cbe7166dee655865abfae7613"},
 {"name":"omniauth-saml","version":"2.0.0","platform":"ruby","checksum":"02594fd6630de26a9e65a2e64223e9ad32324fa97a6c7f1f22a1553ea3dd44c7"},
 {"name":"omniauth-twitter","version":"1.4.0","platform":"ruby","checksum":"c5cc6c77cd767745ffa9ebbd5fbd694a3fa99d1d2d82a4d7def0bf3b6131b264"},
-{"name":"omniauth_openid_connect","version":"0.6.0","platform":"ruby","checksum":"b8e48ca67fdea2dff56cc161855b88707a290ae01125149dbe0f8c94e818cfd3"},
+{"name":"omniauth_openid_connect","version":"0.6.1","platform":"ruby","checksum":"5f1318f5b19b05e339ff494def060b57a503b1e3ea83c3a0ced6cc014407d423"},
 {"name":"open4","version":"1.3.4","platform":"ruby","checksum":"a1df037310624ecc1ea1d81264b11c83e96d0c3c1c6043108d37d396dcd0f4b1"},
 {"name":"openid_connect","version":"1.3.0","platform":"ruby","checksum":"a796855096850cc01140e37ea6ae9fd14f2be818b9b5bc698418063dfe228770"},
 {"name":"openssl","version":"2.2.2","platform":"ruby","checksum":"53f72382bac046c36c37049c7ec9d5597d42628d140b5cfbcd61e0226c0ca077"},
diff --git a/Gemfile.lock b/Gemfile.lock
index ca37508841b..2e548c469ce 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1025,7 +1025,7 @@ GEM
     omniauth-twitter (1.4.0)
       omniauth-oauth (~> 1.1)
       rack
-    omniauth_openid_connect (0.6.0)
+    omniauth_openid_connect (0.6.1)
       omniauth (>= 1.9, < 3)
       openid_connect (~> 1.1)
     open4 (1.3.4)
@@ -1781,7 +1781,7 @@ DEPENDENCIES
   omniauth-saml (~> 2.0.0)
   omniauth-twitter (~> 1.4)
   omniauth_crowd (~> 2.4.0)!
-  omniauth_openid_connect (~> 0.6.0)
+  omniauth_openid_connect (~> 0.6.1)
   openid_connect (= 1.3.0)
   openssl (= 2.2.2)
   org-ruby (~> 0.9.12)
diff --git a/app/assets/javascripts/ref/components/ref_selector.vue b/app/assets/javascripts/ref/components/ref_selector.vue
index 359909b8f3b..9826124912b 100644
--- a/app/assets/javascripts/ref/components/ref_selector.vue
+++ b/app/assets/javascripts/ref/components/ref_selector.vue
@@ -119,6 +119,7 @@ export default {
           'gl-inset-border-1-red-500!': !this.state,
           'gl-font-monospace': Boolean(this.selectedRef),
         },
+        'gl-mb-0',
       ];
 
       if (Array.isArray(this.toggleButtonClass)) {
diff --git a/app/helpers/broadcast_messages_helper.rb b/app/helpers/broadcast_messages_helper.rb
index 01d28ed3221..1c5a601de25 100644
--- a/app/helpers/broadcast_messages_helper.rb
+++ b/app/helpers/broadcast_messages_helper.rb
@@ -62,6 +62,23 @@ module BroadcastMessagesHelper
     end.join(', ')
   end
 
+  def admin_broadcast_messages_data(broadcast_messages)
+    broadcast_messages.map do |message|
+      {
+        id: message.id,
+        status: broadcast_message_status(message),
+        preview: broadcast_message(message, preview: true),
+        starts_at: message.starts_at.iso8601,
+        ends_at: message.ends_at.iso8601,
+        target_roles: target_access_levels_display(message.target_access_levels),
+        target_path: message.target_path,
+        type: message.broadcast_type.capitalize,
+        edit_path: edit_admin_broadcast_message_path(message),
+        delete_path: "#{admin_broadcast_message_path(message)}.js"
+      }
+    end.to_json
+  end
+
   private
 
   def current_user_access_level_for_project_or_group
diff --git a/app/models/user_synced_attributes_metadata.rb b/app/models/user_synced_attributes_metadata.rb
index 4cceffda19e..4cd0e3fb828 100644
--- a/app/models/user_synced_attributes_metadata.rb
+++ b/app/models/user_synced_attributes_metadata.rb
@@ -27,15 +27,11 @@ class UserSyncedAttributesMetadata < ApplicationRecord
 
   class << self
     def syncable_attributes
-      return SYNCABLE_ATTRIBUTES if sync_name?
-
-      SYNCABLE_ATTRIBUTES - %i[name]
-    end
-
-    private
-
-    def sync_name?
-      Gitlab.config.ldap.sync_name
+      if Gitlab.config.ldap.enabled && !Gitlab.config.ldap.sync_name
+        SYNCABLE_ATTRIBUTES - %i[name]
+      else
+        SYNCABLE_ATTRIBUTES
+      end
     end
   end
 
diff --git a/app/views/admin/broadcast_messages/index.html.haml b/app/views/admin/broadcast_messages/index.html.haml
index 2fb59570231..010cc493ddf 100644
--- a/app/views/admin/broadcast_messages/index.html.haml
+++ b/app/views/admin/broadcast_messages/index.html.haml
@@ -10,16 +10,4 @@
   page: params[:page] || 1,
   target_access_level_options: target_access_level_options.to_json,
   messages_count: @broadcast_messages.total_count,
-  messages: @broadcast_messages.map { |message| {
-    id: message.id,
-    status: broadcast_message_status(message),
-    preview: broadcast_message(message, preview: true),
-    starts_at: message.starts_at.to_s,
-    ends_at: message.ends_at.to_s,
-    target_roles: target_access_levels_display(message.target_access_levels),
-    target_path: message.target_path,
-    type: message.broadcast_type.capitalize,
-    edit_path: edit_admin_broadcast_message_path(message),
-    delete_path: admin_broadcast_message_path(message) + '.js'
-  } }.to_json
-} }
+  messages: admin_broadcast_messages_data(@broadcast_messages) } }
diff --git a/data/deprecations/15-9-legacy-praefect-configuration.yml b/data/deprecations/15-9-legacy-praefect-configuration.yml
new file mode 100644
index 00000000000..666a6d4f56a
--- /dev/null
+++ b/data/deprecations/15-9-legacy-praefect-configuration.yml
@@ -0,0 +1,34 @@
+#
+# REQUIRED FIELDS
+#
+- title: "Legacy Praefect configuration method"
+  announcement_milestone: "15.9"
+  removal_milestone: "16.0"
+  breaking_change: true
+  reporter: mjwood
+  stage: Systems
+  issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/390291
+  body: |
+    Previously, Praefect configuration keys were scattered throughout the configuration file. Now, these are in a single configuration structure that matches
+    Praefect configuration so the previous configuration method is deprecated.
+
+    The single configuration structure available from GitLab 15.9, though backwards compatibility is maintained. Once removed, Praefect must be configured using the single
+    configuration structure. You should update the configuration of Praefect at your earliest convenience. See
+    [GitLab 15.9 upgrade information](https://docs.gitlab.com/ee/update/#1590).
+
+    This change brings Praefect configuration in Omnibus GitLab in line with the configuration structure of Praefect. Previously, the hierarchies and configuration keys
+    didn't match. The change improves consistency between Omnibus GitLab and source installs and enables us to provide better documentation and tooling for both.
+#
+# OPTIONAL END OF SUPPORT FIELDS
+#
+# If an End of Support period applies, the announcement should be shared with GitLab Support
+# in the `#spt_managers` channel in Slack, and mention `@gitlab-com/support` in this MR.
+#
+  end_of_support_milestone:  # (optional) Use "XX.YY" format. The milestone when support for this feature will end.
+  #
+  # OTHER OPTIONAL FIELDS
+  #
+  tiers:  # (optional - may be required in the future) An array of tiers that the feature is available in currently.  e.g., [Free, Silver, Gold, Core, Premium, Ultimate]
+  documentation_url: https://docs.gitlab.com/ee/administration/gitaly/praefect.html # (optional) This is a link to the current documentation page
+  image_url:  # (optional) This is a link to a thumbnail image depicting the feature
+  video_url:  # (optional) Use the youtube thumbnail URL with the structure of https://img.youtube.com/vi/UNIQUEID/hqdefault.jpg
diff --git a/doc/update/deprecations.md b/doc/update/deprecations.md
index f212316fa16..ff2a018cd23 100644
--- a/doc/update/deprecations.md
+++ b/doc/update/deprecations.md
@@ -256,6 +256,28 @@ To be prepared for this change, you should do the following before GitLab 16.0:
 
 <div class="deprecation removal-160 breaking-change">
 
+### Legacy Praefect configuration method
+
+Planned removal: GitLab <span class="removal-milestone">16.0</span> <span class="removal-date"></span>
+
+WARNING:
+This is a [breaking change](https://docs.gitlab.com/ee/development/deprecation_guidelines/).
+Review the details carefully before upgrading.
+
+Previously, Praefect configuration keys were scattered throughout the configuration file. Now, these are in a single configuration structure that matches
+Praefect configuration so the previous configuration method is deprecated.
+
+The single configuration structure available from GitLab 15.9, though backwards compatibility is maintained. Once removed, Praefect must be configured using the single
+configuration structure. You should update the configuration of Praefect at your earliest convenience. See
+[GitLab 15.9 upgrade information](https://docs.gitlab.com/ee/update/#1590).
+
+This change brings Praefect configuration in Omnibus GitLab in line with the configuration structure of Praefect. Previously, the hierarchies and configuration keys
+didn't match. The change improves consistency between Omnibus GitLab and source installs and enables us to provide better documentation and tooling for both.
+
+</div>
+
+<div class="deprecation removal-160 breaking-change">
+
 ### Legacy URLs replaced or removed
 
 Planned removal: GitLab <span class="removal-milestone">16.0</span> <span class="removal-date"></span>
diff --git a/doc/user/group/import/index.md b/doc/user/group/import/index.md
index 7f8bb95f4d5..eb32856ff79 100644
--- a/doc/user/group/import/index.md
+++ b/doc/user/group/import/index.md
@@ -58,6 +58,12 @@ We invite you to leave your feedback about migrating by direct transfer in
 If you want to move groups instead of copying groups, you can [transfer groups](../manage.md#transfer-a-group) if the
 groups are in the same GitLab instance. Transferring groups is a faster and more complete option.
 
+### Rate limit
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/386452) in GitLab 15.9.
+
+Each user can perform up to six migrations per minute.
+
 ### Visibility rules
 
 After migration:
diff --git a/spec/helpers/broadcast_messages_helper_spec.rb b/spec/helpers/broadcast_messages_helper_spec.rb
index d4021a2eb59..e0bdb09f257 100644
--- a/spec/helpers/broadcast_messages_helper_spec.rb
+++ b/spec/helpers/broadcast_messages_helper_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe BroadcastMessagesHelper do
+RSpec.describe BroadcastMessagesHelper, feature_category: :onboarding do
   include Gitlab::Routing.url_helpers
 
   let_it_be(:user) { create(:user) }
@@ -68,7 +68,7 @@ RSpec.describe BroadcastMessagesHelper do
     end
   end
 
-  describe 'current_broadcast_notification_message' do
+  describe '#current_broadcast_notification_message' do
     subject { helper.current_broadcast_notification_message }
 
     context 'with available broadcast notification messages' do
@@ -97,7 +97,7 @@ RSpec.describe BroadcastMessagesHelper do
     end
   end
 
-  describe 'current_broadcast_banner_messages' do
+  describe '#current_broadcast_banner_messages' do
     describe 'user access level targeted messages' do
       let_it_be(:message) { create(:broadcast_message, broadcast_type: 'banner', starts_at: Time.now, target_access_levels: [Gitlab::Access::DEVELOPER]) }
 
@@ -107,7 +107,7 @@ RSpec.describe BroadcastMessagesHelper do
     end
   end
 
-  describe 'broadcast_message' do
+  describe '#broadcast_message' do
     let(:current_broadcast_message) { BroadcastMessage.new(message: 'Current Message') }
 
     it 'returns nil when no current message' do
@@ -119,7 +119,7 @@ RSpec.describe BroadcastMessagesHelper do
     end
   end
 
-  describe 'broadcast_message_status' do
+  describe '#broadcast_message_status' do
     it 'returns Active' do
       message = build(:broadcast_message)
 
@@ -138,4 +138,23 @@ RSpec.describe BroadcastMessagesHelper do
       expect(helper.broadcast_message_status(message)).to eq 'Pending'
     end
   end
+
+  describe '#admin_broadcast_messages_data' do
+    let(:starts_at) { 1.day.ago }
+    let(:ends_at) { 1.day.from_now }
+    let(:message) { build(:broadcast_message, id: non_existing_record_id, starts_at: starts_at, ends_at: ends_at) }
+
+    subject(:single_broadcast_message) { Gitlab::Json.parse(admin_broadcast_messages_data([message])).first }
+
+    it 'returns the expected messages data attributes' do
+      keys = %w[id status preview starts_at ends_at target_roles target_path type edit_path delete_path]
+
+      expect(single_broadcast_message.keys).to match(keys)
+    end
+
+    it 'has the correct iso formatted date', time_travel_to: '2020-01-01 00:00:00 +0000' do
+      expect(single_broadcast_message['starts_at']).to eq('2019-12-31T00:00:00Z')
+      expect(single_broadcast_message['ends_at']).to eq('2020-01-02T00:00:00Z')
+    end
+  end
 end
diff --git a/spec/lib/gitlab/auth/o_auth/user_spec.rb b/spec/lib/gitlab/auth/o_auth/user_spec.rb
index a5cbad74829..04fbbff3559 100644
--- a/spec/lib/gitlab/auth/o_auth/user_spec.rb
+++ b/spec/lib/gitlab/auth/o_auth/user_spec.rb
@@ -420,6 +420,7 @@ RSpec.describe Gitlab::Auth::OAuth::User, feature_category: :authentication_and_
             context "and LDAP user has an account already" do
               context 'when sync_name is disabled' do
                 before do
+                  allow(Gitlab.config.ldap).to receive(:enabled).and_return(true)
                   allow(Gitlab.config.ldap).to receive(:sync_name).and_return(false)
                 end