Add latest changes from gitlab-org/gitlab@14-0-stable-ee

25 files changed, 883 insertions, 18 deletions

diff --git a/app/assets/javascripts/filtered_search/available_dropdown_mappings.js b/app/assets/javascripts/filtered_search/available_dropdown_mappings.js
index 409b4ccbcfa..626a5669067 100644
--- a/app/assets/javascripts/filtered_search/available_dropdown_mappings.js
+++ b/app/assets/javascripts/filtered_search/available_dropdown_mappings.js
@@ -202,7 +202,7 @@ export default class AvailableDropdownMappings {
   getMergeRequestTargetBranchesEndpoint() {
     const endpoint = `${
       gon.relative_url_root || ''
-    }/autocomplete/merge_request_target_branches.json`;
+    }/-/autocomplete/merge_request_target_branches.json`;
 
     const params = {
       group_id: this.getGroupId(),
diff --git a/app/assets/javascripts/packages_and_registries/infrastructure_registry/components/terraform_installation.vue b/app/assets/javascripts/packages_and_registries/infrastructure_registry/components/terraform_installation.vue
index 399a3e086f1..c19ff3b4293 100644
--- a/app/assets/javascripts/packages_and_registries/infrastructure_registry/components/terraform_installation.vue
+++ b/app/assets/javascripts/packages_and_registries/infrastructure_registry/components/terraform_installation.vue
@@ -12,16 +12,16 @@ export default {
     GlSprintf,
   },
   computed: {
-    ...mapState(['packageEntity', 'terraformHelpPath', 'projectPath']),
+    ...mapState(['packageEntity', 'terraformHelpPath', 'gitlabHost', 'projectPath']),
     provisionInstructions() {
       // eslint-disable-next-line @gitlab/require-i18n-strings
       return `module "${this.packageEntity.name}" {
-  source = "${this.projectPath}/${this.packageEntity.name}"
+  source = "${this.gitlabHost}/${this.projectPath}/${this.packageEntity.name}"
   version = "${this.packageEntity.version}"
 }`;
     },
     registrySetup() {
-      return `credentials "gitlab.com" {
+      return `credentials "${this.gitlabHost}" {
   token = "<TOKEN>"
 }`;
     },
diff --git a/app/models/ci/build_metadata.rb b/app/models/ci/build_metadata.rb
index bb2dac5cd43..f009e4c6aa1 100644
--- a/app/models/ci/build_metadata.rb
+++ b/app/models/ci/build_metadata.rb
@@ -39,6 +39,7 @@ module Ci
     }
 
     ignore_column :build_id_convert_to_bigint, remove_with: '14.2', remove_after: '2021-08-22'
+    ignore_columns :id_convert_to_bigint, remove_with: '14.3', remove_after: '2021-09-22'
 
     def update_timeout_state
       timeout = timeout_with_highest_precedence
diff --git a/app/models/integrations/jira.rb b/app/models/integrations/jira.rb
index aa143cc28e1..a5aee35bada 100644
--- a/app/models/integrations/jira.rb
+++ b/app/models/integrations/jira.rb
@@ -155,7 +155,7 @@ module Integrations
     end
 
     def web_url(path = nil, **params)
-      return unless url.present?
+      return '' unless url.present?
 
       if Gitlab.com?
         params.merge!(ATLASSIAN_REFERRER_GITLAB_COM) unless Gitlab.staging?
diff --git a/app/views/projects/packages/infrastructure_registry/show.html.haml b/app/views/projects/packages/infrastructure_registry/show.html.haml
index e5701343b83..e7c77478170 100644
--- a/app/views/projects/packages/infrastructure_registry/show.html.haml
+++ b/app/views/projects/packages/infrastructure_registry/show.html.haml
@@ -10,6 +10,7 @@
       can_delete: can?(current_user, :destroy_package, @project).to_s,
       svg_path: image_path('illustrations/no-packages.svg'),
       project_name: @project.name,
-      project_path: expose_url(@project.full_path),
+      project_path: @project.root_ancestor.full_path,
+      gitlab_host: Gitlab.config.gitlab.host,
       terraform_help_path: help_page_path('user/infrastructure/index'),
       project_list_url: project_infrastructure_registry_index_path(@project)} }
diff --git a/db/migrate/20210705142714_initialize_conversion_of_ci_builds_metadata_id_to_bigint.rb b/db/migrate/20210705142714_initialize_conversion_of_ci_builds_metadata_id_to_bigint.rb
new file mode 100644
index 00000000000..ea612100e5a
--- /dev/null
+++ b/db/migrate/20210705142714_initialize_conversion_of_ci_builds_metadata_id_to_bigint.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+class InitializeConversionOfCiBuildsMetadataIdToBigint < ActiveRecord::Migration[6.1]
+  include Gitlab::Database::MigrationHelpers
+
+  TABLE = :ci_builds_metadata
+  COLUMN = :id
+
+  def up
+    initialize_conversion_of_integer_to_bigint(TABLE, COLUMN)
+  end
+
+  def down
+    revert_initialize_conversion_of_integer_to_bigint(TABLE, COLUMN)
+  end
+end
diff --git a/db/post_migrate/20210705143150_backfill_ci_builds_metadata_id_for_bigint_conversion.rb b/db/post_migrate/20210705143150_backfill_ci_builds_metadata_id_for_bigint_conversion.rb
new file mode 100644
index 00000000000..ecf9040eb46
--- /dev/null
+++ b/db/post_migrate/20210705143150_backfill_ci_builds_metadata_id_for_bigint_conversion.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+class BackfillCiBuildsMetadataIdForBigintConversion < ActiveRecord::Migration[6.1]
+  include Gitlab::Database::MigrationHelpers
+
+  TABLE = :ci_builds_metadata
+  COLUMN = :id
+
+  def up
+    backfill_conversion_of_integer_to_bigint TABLE, COLUMN, batch_size: 15000, sub_batch_size: 100
+  end
+
+  def down
+    revert_backfill_conversion_of_integer_to_bigint TABLE, COLUMN
+  end
+end
diff --git a/db/schema_migrations/20210705142714 b/db/schema_migrations/20210705142714
new file mode 100644
index 00000000000..7a64734b0e1
--- /dev/null
+++ b/db/schema_migrations/20210705142714
@@ -0,0 +1 @@
+b47570ac9018a50206f239ffdafce2e672e6888a11a51e01f6d59d62a6a929af
\ No newline at end of file
diff --git a/db/schema_migrations/20210705143150 b/db/schema_migrations/20210705143150
new file mode 100644
index 00000000000..9c91d772a41
--- /dev/null
+++ b/db/schema_migrations/20210705143150
@@ -0,0 +1 @@
+9240ebbc69525a5bc1732f5e0ee2903f2b40b8693f24fcb911e72b5ba943357e
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index 6de556b602f..64161ee7843 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -87,6 +87,15 @@ BEGIN
 END;
 $$;
 
+CREATE FUNCTION trigger_542d6c2ad72e() RETURNS trigger
+    LANGUAGE plpgsql
+    AS $$
+BEGIN
+  NEW."id_convert_to_bigint" := NEW."id";
+  RETURN NEW;
+END;
+$$;
+
 CREATE FUNCTION trigger_69523443cc10() RETURNS trigger
     LANGUAGE plpgsql
     AS $$
@@ -10559,7 +10568,8 @@ CREATE TABLE ci_builds_metadata (
     environment_auto_stop_in character varying(255),
     expanded_environment_name character varying(255),
     secrets jsonb DEFAULT '{}'::jsonb NOT NULL,
-    build_id_convert_to_bigint bigint DEFAULT 0 NOT NULL
+    build_id_convert_to_bigint bigint DEFAULT 0 NOT NULL,
+    id_convert_to_bigint bigint DEFAULT 0 NOT NULL
 );
 
 CREATE SEQUENCE ci_builds_metadata_id_seq
@@ -25439,6 +25449,8 @@ CREATE TRIGGER trigger_490d204c00b3 BEFORE INSERT OR UPDATE ON ci_stages FOR EAC
 
 CREATE TRIGGER trigger_51ab7cef8934 BEFORE INSERT OR UPDATE ON ci_builds_runner_session FOR EACH ROW EXECUTE FUNCTION trigger_51ab7cef8934();
 
+CREATE TRIGGER trigger_542d6c2ad72e BEFORE INSERT OR UPDATE ON ci_builds_metadata FOR EACH ROW EXECUTE FUNCTION trigger_542d6c2ad72e();
+
 CREATE TRIGGER trigger_69523443cc10 BEFORE INSERT OR UPDATE ON events FOR EACH ROW EXECUTE FUNCTION trigger_69523443cc10();
 
 CREATE TRIGGER trigger_77f5e1d20482 BEFORE INSERT OR UPDATE ON deployments FOR EACH ROW EXECUTE FUNCTION trigger_77f5e1d20482();
diff --git a/doc/user/group/epics/epic_boards.md b/doc/user/group/epics/epic_boards.md
index c31b0c7f78a..3b653a7f3f8 100644
--- a/doc/user/group/epics/epic_boards.md
+++ b/doc/user/group/epics/epic_boards.md
@@ -19,7 +19,7 @@ labels.
 
 To view an epic board, in a group, select **Epics > Boards**.
 
-![GitLab epic board - Premium](img/epic_board_v14_0.png)
+![GitLab epic board - Premium](img/epic_board_v14_1.png)
 
 ## Create an epic board
 
@@ -99,6 +99,23 @@ To remove a list from an epic board:
 1. Select **Remove list**. A confirmation dialog appears.
 1. Select **OK**.
 
+## Create an epic from an epic board
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/233568) in GitLab 14.0.
+
+Prerequisites:
+
+- You must have at least the [Reporter role](../../permissions.md#group-members-permissions) for a group.
+- You must have [created a list](#create-a-new-list) first.
+
+To create an epic from a list in epic board:
+
+1. On the top of a list, select the **New epic** (**{plus}**) icon.
+1. Enter the new epic's title.
+1. Select **Create epic**.
+
+![Create a GitLab epic from an epic board](img/epic_board_epic_create_v14_1.png)
+
 ### Filter epics
 
 > [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/5079) in GitLab 14.0.
diff --git a/doc/user/group/epics/img/epic_board_epic_create_v14_1.png b/doc/user/group/epics/img/epic_board_epic_create_v14_1.png
new file mode 100644
index 00000000000..04017014885
--- /dev/null
+++ b/doc/user/group/epics/img/epic_board_epic_create_v14_1.png
diff --git a/doc/user/group/epics/img/epic_board_v14_0.png b/doc/user/group/epics/img/epic_board_v14_0.png
deleted file mode 100644
index e6b4e40aa05..00000000000
--- a/doc/user/group/epics/img/epic_board_v14_0.png
+++ /dev/null
diff --git a/doc/user/group/epics/img/epic_board_v14_1.png b/doc/user/group/epics/img/epic_board_v14_1.png
new file mode 100644
index 00000000000..ccf1ef9559e
--- /dev/null
+++ b/doc/user/group/epics/img/epic_board_v14_1.png
diff --git a/doc/user/group/epics/index.md b/doc/user/group/epics/index.md
index 0608ff38db1..24c78d169c4 100644
--- a/doc/user/group/epics/index.md
+++ b/doc/user/group/epics/index.md
@@ -64,6 +64,7 @@ You can also consult the [group permissions table](../../permissions.md#group-me
 ## Related topics
 
 - [Manage epics](manage_epics.md) and multi-level child epics.
+- Create workflows with [Epic Boards](epic_boards.md).
 - [Turn on notifications](../../profile/notifications.md) for about epic events.
 - [Award an emoji](../../award_emojis.md) to an epic or its comments.
 - Collaborate on an epic by posting comments in a [thread](../../discussions/index.md).
diff --git a/lib/api/group_packages.rb b/lib/api/group_packages.rb
index d9010dfd329..e396c9608cf 100644
--- a/lib/api/group_packages.rb
+++ b/lib/api/group_packages.rb
@@ -43,7 +43,7 @@ module API
           declared(params).slice(:exclude_subgroups, :order_by, :sort, :package_type, :package_name, :include_versionless, :status)
         ).execute
 
-        present paginate(packages), with: ::API::Entities::Package, user: current_user, group: true, namespace: user_group.root_ancestor
+        present paginate(packages), with: ::API::Entities::Package, user: current_user, group: true, namespace: user_group
       end
     end
   end
diff --git a/lib/api/project_packages.rb b/lib/api/project_packages.rb
index 276cbe50e42..35a68ec4e18 100644
--- a/lib/api/project_packages.rb
+++ b/lib/api/project_packages.rb
@@ -41,7 +41,7 @@ module API
           declared_params.slice(:order_by, :sort, :package_type, :package_name, :include_versionless, :status)
         ).execute
 
-        present paginate(packages), with: ::API::Entities::Package, user: current_user, namespace: user_project.root_ancestor
+        present paginate(packages), with: ::API::Entities::Package, user: current_user, namespace: user_project.namespace
       end
 
       desc 'Get a single project package' do
@@ -55,7 +55,7 @@ module API
         package = ::Packages::PackageFinder
           .new(user_project, params[:package_id]).execute
 
-        present package, with: ::API::Entities::Package, user: current_user, namespace: user_project.root_ancestor
+        present package, with: ::API::Entities::Package, user: current_user, namespace: user_project.namespace
       end
 
       desc 'Remove a package' do
diff --git a/lib/gitlab/path_regex.rb b/lib/gitlab/path_regex.rb
index 16a6c470213..4cb47ffc6d9 100644
--- a/lib/gitlab/path_regex.rb
+++ b/lib/gitlab/path_regex.rb
@@ -177,7 +177,7 @@ module Gitlab
     end
 
     def repository_route_regex
-      @repository_route_regex ||= /#{full_namespace_route_regex}|#{personal_snippet_repository_path_regex}/.freeze
+      @repository_route_regex ||= /(#{full_namespace_route_regex}|#{personal_snippet_repository_path_regex})\.*/.freeze
     end
 
     def repository_git_route_regex
@@ -185,7 +185,7 @@ module Gitlab
     end
 
     def repository_wiki_git_route_regex
-      @repository_wiki_git_route_regex ||= /#{full_namespace_route_regex}\.wiki\.git/.freeze
+      @repository_wiki_git_route_regex ||= /#{full_namespace_route_regex}\.*\.wiki\.git/.freeze
     end
 
     def full_namespace_path_regex
diff --git a/spec/frontend/packages_and_registries/infrastructure_registry/components/__snapshots__/terraform_installation_spec.js.snap b/spec/frontend/packages_and_registries/infrastructure_registry/components/__snapshots__/terraform_installation_spec.js.snap
index 427160b45e3..16d148bbea4 100644
--- a/spec/frontend/packages_and_registries/infrastructure_registry/components/__snapshots__/terraform_installation_spec.js.snap
+++ b/spec/frontend/packages_and_registries/infrastructure_registry/components/__snapshots__/terraform_installation_spec.js.snap
@@ -11,7 +11,7 @@ exports[`TerraformInstallation renders all the messages 1`] = `
   <code-instruction-stub
     copytext="Copy Terraform Command"
     instruction="module \\"Test/system-22\\" {
-  source = \\"foo/Test/system-22\\"
+  source = \\"bar.dev/foo/Test/system-22\\"
   version = \\"0.1\\"
 }"
     label="Copy and paste into your Terraform configuration, insert the variables, and run Terraform init:"
@@ -28,7 +28,7 @@ exports[`TerraformInstallation renders all the messages 1`] = `
    
   <code-instruction-stub
     copytext="Copy Terraform Setup Command"
-    instruction="credentials \\"gitlab.com\\" {
+    instruction="credentials \\"bar.dev\\" {
   token = \\"<TOKEN>\\"
 }"
     label="To authorize access to the Terraform registry:"
diff --git a/spec/frontend/packages_and_registries/infrastructure_registry/components/terraform_installation_spec.js b/spec/frontend/packages_and_registries/infrastructure_registry/components/terraform_installation_spec.js
index 7a129794d54..d527587da16 100644
--- a/spec/frontend/packages_and_registries/infrastructure_registry/components/terraform_installation_spec.js
+++ b/spec/frontend/packages_and_registries/infrastructure_registry/components/terraform_installation_spec.js
@@ -13,6 +13,7 @@ describe('TerraformInstallation', () => {
   const store = new Vuex.Store({
     state: {
       packageEntity,
+      gitlabHost: 'bar.dev',
       projectPath: 'foo',
     },
   });
@@ -42,7 +43,7 @@ describe('TerraformInstallation', () => {
     it('renders the correct command', () => {
       expect(findCodeInstructions().at(0).props('instruction')).toMatchInlineSnapshot(`
         "module \\"Test/system-22\\" {
-          source = \\"foo/Test/system-22\\"
+          source = \\"bar.dev/foo/Test/system-22\\"
           version = \\"0.1\\"
         }"
       `);
@@ -52,7 +53,7 @@ describe('TerraformInstallation', () => {
   describe('setup commands', () => {
     it('renders the correct command', () => {
       expect(findCodeInstructions().at(1).props('instruction')).toMatchInlineSnapshot(`
-        "credentials \\"gitlab.com\\" {
+        "credentials \\"bar.dev\\" {
           token = \\"<TOKEN>\\"
         }"
       `);
diff --git a/spec/lib/api/entities/package_spec.rb b/spec/lib/api/entities/package_spec.rb
new file mode 100644
index 00000000000..d63ea7833ac
--- /dev/null
+++ b/spec/lib/api/entities/package_spec.rb
@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe API::Entities::Package do
+  let(:package) { create(:generic_package) }
+
+  subject { described_class.new(package).as_json(namespace: package.project.namespace) }
+
+  it 'exposes correct attributes' do
+    expect(subject).to include(
+      :id,
+      :name,
+      :version,
+      :package_type,
+      :status,
+      :_links,
+      :created_at,
+      :tags,
+      :versions
+    )
+  end
+
+  it 'exposes correct web_path in _links' do
+    expect(subject[:_links][:web_path]).to match('/packages/')
+  end
+
+  context 'with a terraform_module' do
+    let(:package) { create(:terraform_module_package) }
+
+    it 'exposes correct web_path in _links' do
+      expect(subject[:_links][:web_path]).to match('/infrastructure_registry/')
+    end
+  end
+end
diff --git a/spec/lib/gitlab/path_regex_spec.rb b/spec/lib/gitlab/path_regex_spec.rb
index 54c866b4a6d..d343634fb92 100644
--- a/spec/lib/gitlab/path_regex_spec.rb
+++ b/spec/lib/gitlab/path_regex_spec.rb
@@ -445,6 +445,8 @@ RSpec.describe Gitlab::PathRegex do
       [
         'gitlab-org',
         'gitlab-org/gitlab-test',
+        'gitlab-org/foo.',
+        'gitlab-org/bar..',
         'gitlab-org/gitlab-test/snippets/1',
         'gitlab-org/gitlab-test/snippets/foo', # ambiguous, we allow creating a sub-group called 'snippets'
         'snippets/1'
diff --git a/spec/models/integrations/jira_spec.rb b/spec/models/integrations/jira_spec.rb
index f6310866773..23ade570383 100644
--- a/spec/models/integrations/jira_spec.rb
+++ b/spec/models/integrations/jira_spec.rb
@@ -1031,6 +1031,12 @@ RSpec.describe Integrations::Jira do
         expect(integration.web_url('subpath', bar: 'baz baz')).to eq('http://jira.test.com/path/subpath?bar=baz%20baz&foo=bar%20bar&nosso')
       end
 
+      it 'returns an empty string if URL is not set' do
+        integration.url = nil
+
+        expect(integration.web_url).to eq('')
+      end
+
       it 'includes Atlassian referrer for gitlab.com' do
         allow(Gitlab).to receive(:com?).and_return(true)
 
@@ -1048,16 +1054,40 @@ RSpec.describe Integrations::Jira do
       end
     end
 
+    describe '#project_url' do
+      it 'returns the correct URL' do
+        expect(integration.project_url).to eq('http://jira.test.com/path')
+      end
+
+      it 'returns an empty string if URL is not set' do
+        integration.url = nil
+
+        expect(integration.project_url).to eq('')
+      end
+    end
+
     describe '#issues_url' do
       it 'returns the correct URL' do
         expect(integration.issues_url).to eq('http://jira.test.com/path/browse/:id')
       end
+
+      it 'returns an empty string if URL is not set' do
+        integration.url = nil
+
+        expect(integration.issues_url).to eq('')
+      end
     end
 
     describe '#new_issue_url' do
       it 'returns the correct URL' do
         expect(integration.new_issue_url).to eq('http://jira.test.com/path/secure/CreateIssue!default.jspa')
       end
+
+      it 'returns an empty string if URL is not set' do
+        integration.url = nil
+
+        expect(integration.new_issue_url).to eq('')
+      end
     end
   end
 
diff --git a/spec/requests/api/project_packages_spec.rb b/spec/requests/api/project_packages_spec.rb
index 5886f293f41..9b7538547f6 100644
--- a/spec/requests/api/project_packages_spec.rb
+++ b/spec/requests/api/project_packages_spec.rb
@@ -3,8 +3,9 @@
 require 'spec_helper'
 
 RSpec.describe API::ProjectPackages do
-  let(:user) { create(:user) }
   let_it_be(:project) { create(:project, :public) }
+
+  let(:user) { create(:user) }
   let!(:package1) { create(:npm_package, project: project, version: '3.1.0', name: "@#{project.root_namespace.path}/foo1") }
   let(:package_url) { "/projects/#{project.id}/packages/#{package1.id}" }
   let!(:package2) { create(:nuget_package, project: project, version: '2.0.4') }
@@ -71,6 +72,20 @@ RSpec.describe API::ProjectPackages do
             expect(json_response).to include(a_hash_including('_links' => a_hash_including('web_path' => include('infrastructure_registry'))))
           end
         end
+
+        context 'in nested group' do
+          let_it_be(:nested_project) { create(:project, :public, :in_subgroup) }
+          let_it_be(:nested_terraform_module_package) { create(:terraform_module_package, project: nested_project) }
+
+          let(:params) { { package_type: :terraform_module } }
+          let(:url) { "/projects/#{nested_project.id}/packages" }
+
+          it 'returns the nested terraform module package with the correct web_path' do
+            subject
+
+            expect(json_response).to include(a_hash_including('_links' => a_hash_including('web_path' => include(nested_project.namespace.full_path))))
+          end
+        end
       end
 
       context 'project is private' do
diff --git a/spec/requests/git_http_spec.rb b/spec/requests/git_http_spec.rb
index ec55810b4ad..40005596c3e 100644
--- a/spec/requests/git_http_spec.rb
+++ b/spec/requests/git_http_spec.rb
@@ -966,6 +966,722 @@ RSpec.describe 'Git HTTP requests' do
         end
       end
     end
+
+    context "when the project path ends with a dot" do
+      let(:path) { "#{project.full_path}.git" }
+
+      context "when the project is public" do
+        let(:project) { create(:project, :repository, :public, path: 'foo.') }
+
+        it_behaves_like 'pushes require Basic HTTP Authentication'
+
+        context 'when not authenticated' do
+          let(:env) { {} }
+
+          it_behaves_like 'pulls are allowed'
+        end
+
+        context "when authenticated" do
+          let(:env) { { user: user.username, password: user.password } }
+
+          context 'as a developer on the team' do
+            before do
+              project.add_developer(user)
+            end
+
+            it_behaves_like 'pulls are allowed'
+            it_behaves_like 'pushes are allowed'
+
+            context 'but git-receive-pack over HTTP is disabled in config' do
+              before do
+                allow(Gitlab.config.gitlab_shell).to receive(:receive_pack).and_return(false)
+              end
+
+              it 'rejects pushes with 403 Forbidden' do
+                upload(path, **env) do |response|
+                  expect(response).to have_gitlab_http_status(:forbidden)
+                  expect(response.body).to eq(git_access_error(:receive_pack_disabled_over_http))
+                end
+              end
+            end
+
+            context 'but git-upload-pack over HTTP is disabled in config' do
+              it "rejects pushes with 403 Forbidden" do
+                allow(Gitlab.config.gitlab_shell).to receive(:upload_pack).and_return(false)
+
+                download(path, **env) do |response|
+                  expect(response).to have_gitlab_http_status(:forbidden)
+                  expect(response.body).to eq(git_access_error(:upload_pack_disabled_over_http))
+                end
+              end
+            end
+
+            context 'but the service parameter is missing' do
+              it 'rejects clones with 403 Forbidden' do
+                get("/#{path}/info/refs", headers: auth_env(*env.values_at(:user, :password), nil))
+
+                expect(response).to have_gitlab_http_status(:forbidden)
+              end
+            end
+          end
+
+          context 'and not a member of the team' do
+            it_behaves_like 'pulls are allowed'
+
+            it 'rejects pushes with 403 Forbidden' do
+              upload(path, **env) do |response|
+                expect(response).to have_gitlab_http_status(:forbidden)
+                expect(response.body).to eq('You are not allowed to push code to this project.')
+              end
+            end
+
+            context 'when merge requests are open that allow maintainer access' do
+              let(:canonical_project) { create(:project, :public, :repository) }
+              let(:project) { fork_project(canonical_project, nil, repository: true) }
+
+              before do
+                canonical_project.add_maintainer(user)
+                create(:merge_request,
+                       source_project: project,
+                       target_project:  canonical_project,
+                       source_branch: 'fixes',
+                       allow_collaboration: true)
+              end
+
+              it_behaves_like 'pushes are allowed'
+            end
+
+            context 'but the service parameter is missing' do
+              it 'rejects clones with 401 Unauthorized' do
+                get("/#{path}/info/refs")
+
+                expect(response).to have_gitlab_http_status(:unauthorized)
+              end
+            end
+          end
+        end
+
+        context 'when the request is not from gitlab-workhorse' do
+          it 'raises an exception' do
+            expect do
+              get("/#{project.full_path}.git/info/refs?service=git-upload-pack")
+            end.to raise_error(JWT::DecodeError)
+          end
+        end
+
+        context 'when the repo is public' do
+          context 'but the repo is disabled' do
+            let(:project) { create(:project, :public, :repository, :repository_disabled) }
+            let(:path) { "#{project.full_path}.git" }
+            let(:env) { {} }
+
+            it_behaves_like 'pulls require Basic HTTP Authentication'
+            it_behaves_like 'pushes require Basic HTTP Authentication'
+            it_behaves_like 'operations are not allowed with expired password'
+          end
+
+          context 'but the repo is enabled' do
+            let(:project) { create(:project, :public, :repository, :repository_enabled) }
+            let(:path) { "#{project.full_path}.git" }
+            let(:env) { {} }
+
+            it_behaves_like 'pulls are allowed'
+          end
+
+          context 'but only project members are allowed' do
+            let(:project) { create(:project, :public, :repository, :repository_private) }
+
+            it_behaves_like 'pulls require Basic HTTP Authentication'
+            it_behaves_like 'pushes require Basic HTTP Authentication'
+            it_behaves_like 'operations are not allowed with expired password'
+          end
+        end
+
+        context 'and the user requests a redirected path' do
+          let!(:redirect) { project.route.create_redirect('foo/bar') }
+          let(:path) { "#{redirect.path}.git" }
+
+          it 'downloads get status 200 for redirects' do
+            clone_get(path)
+
+            expect(response).to have_gitlab_http_status(:ok)
+          end
+        end
+      end
+
+      context "when the project is private" do
+        let(:project) { create(:project, :repository, :private, path: 'foo.') }
+
+        it_behaves_like 'pulls require Basic HTTP Authentication'
+        it_behaves_like 'pushes require Basic HTTP Authentication'
+        it_behaves_like 'operations are not allowed with expired password'
+
+        context "when username and password are provided" do
+          let(:env) { { user: user.username, password: 'nope' } }
+
+          context "when authentication fails" do
+            context "when the user is IP banned" do
+              before do
+                stub_rack_attack_setting(enabled: true, ip_whitelist: [])
+              end
+
+              it "responds with status 403" do
+                expect(Rack::Attack::Allow2Ban).to receive(:banned?).and_return(true)
+                expect(Gitlab::AuthLogger).to receive(:error).with({
+                  message: 'Rack_Attack',
+                  env: :blocklist,
+                  remote_ip: '127.0.0.1',
+                  request_method: 'GET',
+                  path: "/#{path}/info/refs?service=git-upload-pack"
+                })
+
+                clone_get(path, **env)
+
+                expect(response).to have_gitlab_http_status(:forbidden)
+              end
+            end
+          end
+
+          context "when authentication succeeds" do
+            let(:env) { { user: user.username, password: user.password } }
+
+            context "when the user has access to the project" do
+              before do
+                project.add_maintainer(user)
+              end
+
+              context "when the user is blocked" do
+                it "rejects pulls with 401 Unauthorized" do
+                  user.block
+                  project.add_maintainer(user)
+
+                  download(path, **env) do |response|
+                    expect(response).to have_gitlab_http_status(:unauthorized)
+                  end
+                end
+
+                it "rejects pulls with 401 Unauthorized for unknown projects (no project existence information leak)" do
+                  user.block
+
+                  download('doesnt/exist.git', **env) do |response|
+                    expect(response).to have_gitlab_http_status(:unauthorized)
+                  end
+                end
+              end
+
+              context "when the user isn't blocked" do
+                before do
+                  stub_rack_attack_setting(enabled: true, bantime: 1.minute, findtime: 5.minutes, maxretry: 2, ip_whitelist: [])
+                end
+
+                it "resets the IP in Rack Attack on download" do
+                  expect(Rack::Attack::Allow2Ban).to receive(:reset).twice
+
+                  download(path, **env) do
+                    expect(response).to have_gitlab_http_status(:ok)
+                    expect(response.media_type).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE)
+                  end
+                end
+
+                it "resets the IP in Rack Attack on upload" do
+                  expect(Rack::Attack::Allow2Ban).to receive(:reset).twice
+
+                  upload(path, **env) do
+                    expect(response).to have_gitlab_http_status(:ok)
+                    expect(response.media_type).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE)
+                  end
+                end
+
+                it 'updates the user last activity', :clean_gitlab_redis_shared_state do
+                  expect(user.last_activity_on).to be_nil
+
+                  download(path, **env) do |response|
+                    expect(user.reload.last_activity_on).to eql(Date.today)
+                  end
+                end
+              end
+
+              context "when an oauth token is provided" do
+                before do
+                  application = Doorkeeper::Application.create!(name: "MyApp", redirect_uri: "https://app.com", owner: user)
+                  @token = Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id, scopes: "api")
+                end
+
+                let(:path) { "#{project.full_path}.git" }
+                let(:env) { { user: 'oauth2', password: @token.token } }
+
+                it_behaves_like 'pulls are allowed'
+                it_behaves_like 'pushes are allowed'
+
+                context "when password is expired" do
+                  it "responds to downloads with status 401 unauthorized" do
+                    user.update!(password_expires_at: 2.days.ago)
+
+                    download(path, **env) do |response|
+                      expect(response).to have_gitlab_http_status(:unauthorized)
+                    end
+                  end
+                end
+              end
+
+              context 'when user has 2FA enabled' do
+                let(:user) { create(:user, :two_factor) }
+                let(:access_token) { create(:personal_access_token, user: user) }
+                let(:path) { "#{project.full_path}.git" }
+
+                before do
+                  project.add_maintainer(user)
+                end
+
+                context 'when username and password are provided' do
+                  it 'rejects pulls with personal access token error message' do
+                    download(path, user: user.username, password: user.password) do |response|
+                      expect(response).to have_gitlab_http_status(:unauthorized)
+                      expect(response.body).to include('You must use a personal access token with \'read_repository\' or \'write_repository\' scope for Git over HTTP')
+                    end
+                  end
+
+                  it 'rejects the push attempt with personal access token error message' do
+                    upload(path, user: user.username, password: user.password) do |response|
+                      expect(response).to have_gitlab_http_status(:unauthorized)
+                      expect(response.body).to include('You must use a personal access token with \'read_repository\' or \'write_repository\' scope for Git over HTTP')
+                    end
+                  end
+                end
+
+                context 'when username and personal access token are provided' do
+                  let(:env) { { user: user.username, password: access_token.token } }
+
+                  it_behaves_like 'pulls are allowed'
+                  it_behaves_like 'pushes are allowed'
+
+                  it 'rejects the push attempt for read_repository scope' do
+                    read_access_token = create(:personal_access_token, user: user, scopes: [:read_repository])
+
+                    upload(path, user: user.username, password: read_access_token.token) do |response|
+                      expect(response).to have_gitlab_http_status(:forbidden)
+                      expect(response.body).to include('You are not allowed to upload code')
+                    end
+                  end
+
+                  it 'accepts the push attempt for write_repository scope' do
+                    write_access_token = create(:personal_access_token, user: user, scopes: [:write_repository])
+
+                    upload(path, user: user.username, password: write_access_token.token) do |response|
+                      expect(response).to have_gitlab_http_status(:ok)
+                    end
+                  end
+
+                  it 'accepts the pull attempt for read_repository scope' do
+                    read_access_token = create(:personal_access_token, user: user, scopes: [:read_repository])
+
+                    download(path, user: user.username, password: read_access_token.token) do |response|
+                      expect(response).to have_gitlab_http_status(:ok)
+                    end
+                  end
+
+                  it 'accepts the pull attempt for api scope' do
+                    read_access_token = create(:personal_access_token, user: user, scopes: [:api])
+
+                    download(path, user: user.username, password: read_access_token.token) do |response|
+                      expect(response).to have_gitlab_http_status(:ok)
+                    end
+                  end
+
+                  it 'accepts the push attempt for api scope' do
+                    write_access_token = create(:personal_access_token, user: user, scopes: [:api])
+
+                    upload(path, user: user.username, password: write_access_token.token) do |response|
+                      expect(response).to have_gitlab_http_status(:ok)
+                    end
+                  end
+
+                  context "when password is expired" do
+                    it "responds to uploads with status 401 unauthorized" do
+                      user.update!(password_expires_at: 2.days.ago)
+
+                      write_access_token = create(:personal_access_token, user: user, scopes: [:write_repository])
+
+                      upload(path, user: user.username, password: write_access_token.token) do |response|
+                        expect(response).to have_gitlab_http_status(:unauthorized)
+                      end
+                    end
+                  end
+                end
+              end
+
+              context 'when internal auth is disabled' do
+                before do
+                  allow_any_instance_of(ApplicationSetting).to receive(:password_authentication_enabled_for_git?) { false }
+                end
+
+                it 'rejects pulls with personal access token error message' do
+                  download(path, user: 'foo', password: 'bar') do |response|
+                    expect(response).to have_gitlab_http_status(:unauthorized)
+                    expect(response.body).to include('You must use a personal access token with \'read_repository\' or \'write_repository\' scope for Git over HTTP')
+                  end
+                end
+
+                it 'rejects pushes with personal access token error message' do
+                  upload(path, user: 'foo', password: 'bar') do |response|
+                    expect(response).to have_gitlab_http_status(:unauthorized)
+                    expect(response.body).to include('You must use a personal access token with \'read_repository\' or \'write_repository\' scope for Git over HTTP')
+                  end
+                end
+
+                context 'when LDAP is configured' do
+                  before do
+                    allow(Gitlab::Auth::Ldap::Config).to receive(:enabled?).and_return(true)
+                    allow_any_instance_of(Gitlab::Auth::Ldap::Authentication)
+                      .to receive(:login).and_return(nil)
+                  end
+
+                  it 'does not display the personal access token error message' do
+                    upload(path, user: 'foo', password: 'bar') do |response|
+                      expect(response).to have_gitlab_http_status(:unauthorized)
+                      expect(response.body).not_to include('You must use a personal access token with \'read_repository\' or \'write_repository\' scope for Git over HTTP')
+                    end
+                  end
+                end
+              end
+
+              context "when blank password attempts follow a valid login" do
+                def attempt_login(include_password)
+                  password = include_password ? user.password : ""
+                  clone_get path, user: user.username, password: password
+                  response.status
+                end
+
+                include_context 'rack attack cache store'
+
+                it "repeated attempts followed by successful attempt" do
+                  options = Gitlab.config.rack_attack.git_basic_auth
+                  maxretry = options[:maxretry]
+                  ip = '1.2.3.4'
+
+                  allow_any_instance_of(ActionDispatch::Request).to receive(:ip).and_return(ip)
+                  Rack::Attack::Allow2Ban.reset(ip, options)
+
+                  maxretry.times.each do
+                    expect(attempt_login(false)).to eq(401)
+                  end
+
+                  expect(attempt_login(true)).to eq(200)
+                  expect(Rack::Attack::Allow2Ban.banned?(ip)).to be_falsey
+                end
+              end
+
+              context 'and the user requests a redirected path' do
+                let!(:redirect) { project.route.create_redirect('foo/bar') }
+                let(:path) { "#{redirect.path}.git" }
+                let(:project_moved_message) do
+                  <<-MSG.strip_heredoc
+                    Project '#{redirect.path}' was moved to '#{project.full_path}'.
+
+                    Please update your Git remote:
+
+                      git remote set-url origin #{project.http_url_to_repo}.
+                  MSG
+                end
+
+                it 'downloads get status 200' do
+                  clone_get(path, **env)
+
+                  expect(response).to have_gitlab_http_status(:ok)
+                end
+
+                it 'uploads get status 404 with "project was moved" message' do
+                  upload(path, **env) do |response|
+                    expect(response).to have_gitlab_http_status(:ok)
+                  end
+                end
+              end
+            end
+
+            context "when the user doesn't have access to the project" do
+              it "pulls get status 404" do
+                download(path, user: user.username, password: user.password) do |response|
+                  expect(response).to have_gitlab_http_status(:not_found)
+                end
+              end
+
+              it "uploads get status 404" do
+                upload(path, user: user.username, password: user.password) do |response|
+                  expect(response).to have_gitlab_http_status(:not_found)
+                end
+              end
+            end
+          end
+        end
+
+        context "when a gitlab ci token is provided" do
+          let(:project) { create(:project, :repository) }
+          let(:build) { create(:ci_build, :running) }
+          let(:other_project) { create(:project, :repository) }
+
+          before do
+            build.update!(project: project) # can't associate it on factory create
+          end
+
+          context 'when build created by system is authenticated' do
+            let(:path) { "#{project.full_path}.git" }
+            let(:env) { { user: 'gitlab-ci-token', password: build.token } }
+
+            it_behaves_like 'pulls are allowed'
+
+            # A non-401 here is not an information leak since the system is
+            # "authenticated" as CI using the correct token. It does not have
+            # push access, so pushes should be rejected as forbidden, and giving
+            # a reason is fine.
+            #
+            # We know for sure it is not an information leak since pulls using
+            # the build token must be allowed.
+            it "rejects pushes with 403 Forbidden" do
+              push_get(path, **env)
+
+              expect(response).to have_gitlab_http_status(:forbidden)
+              expect(response.body).to eq(git_access_error(:auth_upload))
+            end
+
+            # We are "authenticated" as CI using a valid token here. But we are
+            # not authorized to see any other project, so return "not found".
+            it "rejects pulls for other project with 404 Not Found" do
+              clone_get("#{other_project.full_path}.git", **env)
+
+              expect(response).to have_gitlab_http_status(:not_found)
+              expect(response.body).to eq(git_access_error(:project_not_found))
+            end
+          end
+
+          context 'and build created by' do
+            before do
+              build.update!(user: user)
+              project.add_reporter(user)
+            end
+
+            shared_examples 'can download code only' do
+              let(:path) { "#{project.full_path}.git" }
+              let(:env) { { user: 'gitlab-ci-token', password: build.token } }
+
+              it_behaves_like 'pulls are allowed'
+
+              context 'when the repo does not exist' do
+                let(:project) { create(:project) }
+
+                it 'rejects pulls with 404 Not Found' do
+                  clone_get(path, **env)
+
+                  expect(response).to have_gitlab_http_status(:not_found)
+                  expect(response.body).to eq(git_access_error(:no_repo))
+                end
+              end
+
+              it 'rejects pushes with 403 Forbidden' do
+                push_get(path, **env)
+
+                expect(response).to have_gitlab_http_status(:forbidden)
+                expect(response.body).to eq(git_access_error(:auth_upload))
+              end
+            end
+
+            context 'administrator' do
+              let(:user) { create(:admin) }
+
+              context 'when admin mode is enabled', :enable_admin_mode do
+                it_behaves_like 'can download code only'
+
+                it 'downloads from other project get status 404' do
+                  clone_get "#{other_project.full_path}.git", user: 'gitlab-ci-token', password: build.token
+
+                  expect(response).to have_gitlab_http_status(:not_found)
+                end
+              end
+
+              context 'when admin mode is disabled' do
+                it_behaves_like 'can download code only'
+
+                it 'downloads from other project get status 404' do
+                  clone_get "#{other_project.full_path}.git", user: 'gitlab-ci-token', password: build.token
+
+                  expect(response).to have_gitlab_http_status(:not_found)
+                end
+              end
+            end
+
+            context 'regular user' do
+              let(:user) { create(:user) }
+
+              it_behaves_like 'can download code only'
+
+              it 'downloads from other project get status 404' do
+                clone_get "#{other_project.full_path}.git", user: 'gitlab-ci-token', password: build.token
+
+                expect(response).to have_gitlab_http_status(:not_found)
+              end
+
+              context 'when users password is expired' do
+                it 'rejects pulls with 401 unauthorized' do
+                  user.update!(password_expires_at: 2.days.ago)
+
+                  download(path, user: 'gitlab-ci-token', password: build.token) do |response|
+                    expect(response).to have_gitlab_http_status(:unauthorized)
+                  end
+                end
+              end
+            end
+          end
+        end
+      end
+
+      it_behaves_like 'project path without .git suffix' do
+        let(:repository_path) { create(:project, :repository, :public, path: 'project.').full_path }
+      end
+
+      context "retrieving an info/refs file" do
+        let(:project) { create(:project, :repository, :public, path: 'project.') }
+
+        context "when the file exists" do
+          before do
+            # Provide a dummy file in its place
+            allow_any_instance_of(Repository).to receive(:blob_at).and_call_original
+            allow_any_instance_of(Repository).to receive(:blob_at).with('b83d6e391c22777fca1ed3012fce84f633d7fed0', 'info/refs') do
+              Blob.decorate(Gitlab::Git::Blob.find(project.repository, 'master', 'bar/branch-test.txt'), project)
+            end
+
+            get "/#{project.full_path}/-/blob/master/info/refs"
+          end
+
+          it "returns the file" do
+            expect(response).to have_gitlab_http_status(:ok)
+          end
+        end
+
+        context "when the file does not exist" do
+          before do
+            get "/#{project.full_path}/-/blob/master/info/refs"
+          end
+
+          it "redirects" do
+            expect(response).to have_gitlab_http_status(:found)
+          end
+        end
+      end
+    end
+
+    context "when the Wiki path ends with a dot" do
+      let(:wiki) { ProjectWiki.new(project) }
+      let(:path) { "/#{wiki.repository.full_path}.git" }
+
+      context "when the project is public" do
+        let(:project) { create(:project, :wiki_repo, :public, :wiki_enabled, path: 'foo.') }
+
+        it_behaves_like 'pushes require Basic HTTP Authentication'
+
+        context 'when unauthenticated' do
+          let(:env) { {} }
+
+          it_behaves_like 'pulls are allowed'
+
+          it "responds to pulls with the wiki's repo" do
+            download(path) do |response|
+              json_body = ActiveSupport::JSON.decode(response.body)
+
+              expect(json_body['Repository']['relative_path']).to eq(wiki.repository.relative_path)
+            end
+          end
+        end
+
+        context 'when authenticated' do
+          let(:env) { { user: user.username, password: user.password } }
+
+          context 'and as a developer on the team' do
+            before do
+              project.add_developer(user)
+            end
+
+            context 'but the repo is disabled' do
+              let(:project) { create(:project, :wiki_repo, :public, :repository_disabled, :wiki_enabled, path: 'foo.') }
+
+              it_behaves_like 'pulls are allowed'
+              it_behaves_like 'pushes are allowed'
+            end
+          end
+
+          context 'and not on the team' do
+            it_behaves_like 'pulls are allowed'
+
+            it 'rejects pushes with 403 Forbidden' do
+              upload(path, **env) do |response|
+                expect(response).to have_gitlab_http_status(:forbidden)
+                expect(response.body).to eq(git_access_wiki_error(:write_to_wiki))
+              end
+            end
+          end
+        end
+      end
+
+      context "when the project is private" do
+        let(:project) { create(:project, :wiki_repo, :private, :wiki_enabled, path: 'foo.') }
+
+        it_behaves_like 'pulls require Basic HTTP Authentication'
+        it_behaves_like 'pushes require Basic HTTP Authentication'
+        it_behaves_like 'operations are not allowed with expired password'
+
+        context 'when authenticated' do
+          context 'and as a developer on the team' do
+            before do
+              project.add_developer(user)
+            end
+
+            context 'when user is using credentials with special characters' do
+              context 'with password with special characters' do
+                before do
+                  user.update!(password: 'RKszEwéC5kFnû∆f243fycGu§Gh9ftDj!U')
+                end
+
+                it 'allows clones' do
+                  download(path, user: user.username, password: user.password) do |response|
+                    expect(response).to have_gitlab_http_status(:ok)
+                  end
+                end
+              end
+            end
+
+            context 'but the repo is disabled' do
+              let(:project) { create(:project, :wiki_repo, :private, :repository_disabled, :wiki_enabled, path: 'foo.') }
+
+              it 'allows clones' do
+                download(path, user: user.username, password: user.password) do |response|
+                  expect(response).to have_gitlab_http_status(:ok)
+                end
+              end
+
+              it 'pushes are allowed' do
+                upload(path, user: user.username, password: user.password) do |response|
+                  expect(response).to have_gitlab_http_status(:ok)
+                end
+              end
+            end
+          end
+
+          context 'and not on the team' do
+            it 'rejects clones with 404 Not Found' do
+              download(path, user: user.username, password: user.password) do |response|
+                expect(response).to have_gitlab_http_status(:not_found)
+                expect(response.body).to eq(git_access_wiki_error(:not_found))
+              end
+            end
+
+            it 'rejects pushes with 404 Not Found' do
+              upload(path, user: user.username, password: user.password) do |response|
+                expect(response).to have_gitlab_http_status(:not_found)
+                expect(response.body).to eq(git_access_wiki_error(:not_found))
+              end
+            end
+          end
+        end
+      end
+    end
   end
 
   describe "User with LDAP identity" do