Merge branch 'mk-validate-username-change-with-container-registry-tags' into 'master'

Prevent user from changing username with container registry tags

Closes #35451

See merge request !13356

3 files changed, 23 insertions, 0 deletions

diff --git a/app/models/user.rb b/app/models/user.rb
index 8b593951352..7f5ef25374a 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -142,6 +142,8 @@ class User < ActiveRecord::Base
     uniqueness: { case_sensitive: false }
 
   validate :namespace_uniq, if: :username_changed?
+  validate :namespace_move_dir_allowed, if: :username_changed?
+
   validate :avatar_type, if: ->(user) { user.avatar.present? && user.avatar_changed? }
   validate :unique_email, if: :email_changed?
   validate :owns_notification_email, if: :notification_email_changed?
@@ -480,6 +482,12 @@ class User < ActiveRecord::Base
     end
   end
 
+  def namespace_move_dir_allowed
+    if namespace&.any_project_has_container_registry_tags?
+      errors.add(:username, 'cannot be changed if a personal project has container registry tags.')
+    end
+  end
+
   def avatar_type
     unless avatar.image?
       errors.add :avatar, "only images allowed"
diff --git a/changelogs/unreleased/mk-validate-username-change-with-container-registry-tags.yml b/changelogs/unreleased/mk-validate-username-change-with-container-registry-tags.yml
new file mode 100644
index 00000000000..425d5231e14
--- /dev/null
+++ b/changelogs/unreleased/mk-validate-username-change-with-container-registry-tags.yml
@@ -0,0 +1,4 @@
+---
+title: Add missing validation error for username change with container registry tags
+merge_request: 13356
+author:
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index 61670e71921..e7eff387439 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -116,6 +116,17 @@ describe User, models: true do
       it 'validates uniqueness' do
         expect(subject).to validate_uniqueness_of(:username).case_insensitive
       end
+
+      context 'when username is changed' do
+        let(:user) { build_stubbed(:user, username: 'old_path', namespace: build_stubbed(:namespace)) }
+
+        it 'validates move_dir is allowed for the namespace' do
+          expect(user.namespace).to receive(:any_project_has_container_registry_tags?).and_return(true)
+          user.username = 'new_path'
+          expect(user).to be_invalid
+          expect(user.errors.messages[:username].first).to match('cannot be changed if a personal project has container registry tags')
+        end
+      end
     end
 
     it { is_expected.to validate_presence_of(:projects_limit) }