Stop empty external auth classification labels overriding default labels

Most of the project templates bundled with GitLab have an empty string
set for `external_authorization_classification_label` in their
`project.json`. When imported this overrides the default label set on
the instance, causing the label to appear empty.

This change sets empty labels to nil during import, allowing the
default label to override it and be applied to the project.

3 files changed, 32 insertions, 1 deletions

diff --git a/changelogs/unreleased/use_default_external_auth_label_empty.yml b/changelogs/unreleased/use_default_external_auth_label_empty.yml
new file mode 100644
index 00000000000..9c1039b0875
--- /dev/null
+++ b/changelogs/unreleased/use_default_external_auth_label_empty.yml
@@ -0,0 +1,6 @@
+---
+title: Prevent empty external authorization classification labels from overriding
+  the default label
+merge_request: 32517
+author: Will Chandler
+type: fixed
diff --git a/lib/gitlab/import_export/project_tree_restorer.rb b/lib/gitlab/import_export/project_tree_restorer.rb
index 91fe4e5d074..685cf53f27f 100644
--- a/lib/gitlab/import_export/project_tree_restorer.rb
+++ b/lib/gitlab/import_export/project_tree_restorer.rb
@@ -107,7 +107,7 @@ module Gitlab
 
       def project_params
         @project_params ||= begin
-          attrs = json_params.merge(override_params).merge(visibility_level)
+          attrs = json_params.merge(override_params).merge(visibility_level, external_label)
 
           # Cleaning all imported and overridden params
           Gitlab::ImportExport::AttributeCleaner.clean(relation_hash: attrs,
@@ -135,6 +135,13 @@ module Gitlab
         { 'visibility_level' => level }
       end
 
+      def external_label
+        label = override_params['external_authorization_classification_label'].presence ||
+          json_params['external_authorization_classification_label'].presence
+
+        { 'external_authorization_classification_label' => label }
+      end
+
       # Given a relation hash containing one or more models and its relationships,
       # loops through each model and each object from a model type and
       # and assigns its correspondent attributes hash from +tree_hash+
diff --git a/spec/lib/gitlab/import_export/project_tree_restorer_spec.rb b/spec/lib/gitlab/import_export/project_tree_restorer_spec.rb
index 0aef4887c75..87be7857e67 100644
--- a/spec/lib/gitlab/import_export/project_tree_restorer_spec.rb
+++ b/spec/lib/gitlab/import_export/project_tree_restorer_spec.rb
@@ -512,6 +512,24 @@ describe Gitlab::ImportExport::ProjectTreeRestorer do
         expect(Milestone.find_by_title('Group-level milestone').iid).to eq(2)
       end
     end
+
+    context 'with external authorization classification labels' do
+      it 'converts empty external classification authorization labels to nil' do
+        project.create_import_data(data: { override_params: { external_authorization_classification_label: "" } })
+
+        restored_project_json
+
+        expect(project.external_authorization_classification_label).to be_nil
+      end
+
+      it 'preserves valid external classification authorization labels' do
+        project.create_import_data(data: { override_params: { external_authorization_classification_label: "foobar" } })
+
+        restored_project_json
+
+        expect(project.external_authorization_classification_label).to eq("foobar")
+      end
+    end
   end
 
   describe '#restored_project' do