Merge branch 'docker-registry' into docker-registry-view

10 files changed, 92 insertions, 63 deletions

diff --git a/app/services/create_branch_service.rb b/app/services/create_branch_service.rb
index 707c2f7ff85..9f4481a8153 100644
--- a/app/services/create_branch_service.rb
+++ b/app/services/create_branch_service.rb
@@ -43,9 +43,4 @@ class CreateBranchService < BaseService
     out[:branch] = branch
     out
   end
-
-  def build_push_data(project, user, branch)
-    Gitlab::PushDataBuilder.
-      build(project, user, Gitlab::Git::BLANK_SHA, branch.target, "#{Gitlab::Git::BRANCH_REF_PREFIX}#{branch.name}", [])
-  end
 end
diff --git a/app/services/create_tag_service.rb b/app/services/create_tag_service.rb
index 55985380d31..91ed0e354d0 100644
--- a/app/services/create_tag_service.rb
+++ b/app/services/create_tag_service.rb
@@ -1,50 +1,30 @@
 require_relative 'base_service'
 
 class CreateTagService < BaseService
-  def execute(tag_name, ref, message, release_description = nil)
+  def execute(tag_name, target, message, release_description = nil)
     valid_tag = Gitlab::GitRefValidator.validate(tag_name)
-    if valid_tag == false
-      return error('Tag name invalid')
-    end
+    return error('Tag name invalid') unless valid_tag
 
     repository = project.repository
-    existing_tag = repository.find_tag(tag_name)
-    if existing_tag
-      return error('Tag already exists')
-    end
-
     message.strip! if message
 
-    repository.add_tag(tag_name, ref, message)
-    new_tag = repository.find_tag(tag_name)
+    new_tag = nil
+    begin
+      new_tag = repository.add_tag(current_user, tag_name, target, message)
+    rescue Rugged::TagError
+      return error("Tag #{tag_name} already exists")
+    rescue GitHooksService::PreReceiveError
+      return error('Tag creation was rejected by Git hook')
+    end
 
     if new_tag
-      push_data = create_push_data(project, current_user, new_tag)
-      EventCreateService.new.push(project, current_user, push_data)
-      project.execute_hooks(push_data.dup, :tag_push_hooks)
-      project.execute_services(push_data.dup, :tag_push_hooks)
-      CreateCommitBuildsService.new.execute(project, current_user, push_data)
-
       if release_description
         CreateReleaseService.new(@project, @current_user).
           execute(tag_name, release_description)
       end
-
-      success(new_tag)
+      success.merge(tag: new_tag)
     else
-      error('Invalid reference name')
+      error("Target #{target} is invalid")
     end
   end
-
-  def success(branch)
-    out = super()
-    out[:tag] = branch
-    out
-  end
-
-  def create_push_data(project, user, tag)
-    commits = [project.commit(tag.target)].compact
-    Gitlab::PushDataBuilder.
-      build(project, user, Gitlab::Git::BLANK_SHA, tag.target, "#{Gitlab::Git::TAG_REF_PREFIX}#{tag.name}", commits, tag.message)
-  end
 end
diff --git a/app/services/git_push_service.rb b/app/services/git_push_service.rb
index b7af80055bf..66136b62617 100644
--- a/app/services/git_push_service.rb
+++ b/app/services/git_push_service.rb
@@ -17,6 +17,7 @@ class GitPushService < BaseService
   #  6. Checks if the project's main language has changed
   #
   def execute
+    @project.repository.after_create if @project.empty_repo?
     @project.repository.after_push_commit(branch_name, params[:newrev])
 
     if push_remove_branch?
diff --git a/app/services/git_tag_push_service.rb b/app/services/git_tag_push_service.rb
index 64271d8bc5c..7410442609d 100644
--- a/app/services/git_tag_push_service.rb
+++ b/app/services/git_tag_push_service.rb
@@ -2,6 +2,7 @@ class GitTagPushService < BaseService
   attr_accessor :push_data
 
   def execute
+    project.repository.after_create if project.empty_repo?
     project.repository.before_push_tag
 
     @push_data = build_push_data
diff --git a/app/services/issues/move_service.rb b/app/services/issues/move_service.rb
index 82e7090f1ea..e61628086f0 100644
--- a/app/services/issues/move_service.rb
+++ b/app/services/issues/move_service.rb
@@ -41,14 +41,25 @@ module Issues
     private
 
     def create_new_issue
-      new_params = { id: nil, iid: nil, label_ids: [], milestone: nil,
+      new_params = { id: nil, iid: nil, label_ids: cloneable_label_ids,
+                     milestone_id: cloneable_milestone_id,
                      project: @new_project, author: @old_issue.author,
                      description: rewrite_content(@old_issue.description) }
 
-      new_params = @old_issue.serializable_hash.merge(new_params)
+      new_params = @old_issue.serializable_hash.symbolize_keys.merge(new_params)
       CreateService.new(@new_project, @current_user, new_params).execute
     end
 
+    def cloneable_label_ids
+      @new_project.labels
+        .where(title: @old_issue.labels.pluck(:title)).pluck(:id)
+    end
+
+    def cloneable_milestone_id
+      @new_project.milestones
+        .find_by(title: @old_issue.milestone.try(:title)).try(:id)
+    end
+
     def rewrite_notes
       @old_issue.notes.find_each do |note|
         new_note = note.dup
diff --git a/app/services/jwt/docker_authentication_service.rb b/app/services/jwt/container_registry_authentication_service.rb
index 16d77193a1e..88af4f8361b 100644
--- a/app/services/jwt/docker_authentication_service.rb
+++ b/app/services/jwt/container_registry_authentication_service.rb
@@ -1,11 +1,13 @@
 module Jwt
-  class DockerAuthenticationService < BaseService
+  class ContainerRegistryAuthenticationService < BaseService
     def execute
       if params[:offline_token]
         return error('forbidden', 403) unless current_user
       end
 
-      { token: token.encoded }
+      return error('forbidden', 401) if scopes.empty?
+
+      { token: authorized_token(scopes).encoded }
     end
 
     def self.full_access_token(*names)
@@ -21,7 +23,7 @@ module Jwt
 
     private
 
-    def token
+    def authorized_token(access)
       token = ::Jwt::RSAToken.new(registry.key)
       token.issuer = registry.issuer
       token.audience = params[:service]
@@ -30,11 +32,13 @@ module Jwt
       token
     end
 
-    def access
+    def scopes
       return unless params[:scope]
 
-      scope = process_scope(params[:scope])
-      [scope].compact
+      @scopes ||= begin
+        scope = process_scope(params[:scope])
+        [scope].compact
+      end
     end
 
     def process_scope(scope)
@@ -48,22 +52,22 @@ module Jwt
     end
 
     def process_repository_access(type, name, actions)
-      current_project = Project.find_with_namespace(name)
-      return unless current_project
+      requested_project = Project.find_with_namespace(name)
+      return unless requested_project
 
       actions = actions.select do |action|
-        can_access?(current_project, action)
+        can_access?(requested_project, action)
       end
 
-      { type: type, name: name, actions: actions } if actions
+      { type: type, name: name, actions: actions } if actions.present?
     end
 
-    def can_access?(current_project, action)
-      case action
+    def can_access?(requested_project, requested_action)
+      case requested_action
       when 'pull'
-        current_project == project || can?(current_user, :download_code, current_project)
+        requested_project.public? || requested_project == project || can?(current_user, :read_container_registry, requested_project)
       when 'push'
-        current_project == project || can?(current_user, :push_code, current_project)
+        requested_project == project || can?(current_user, :create_container_registry, requested_project)
       else
         false
       end
diff --git a/app/services/merge_requests/build_service.rb b/app/services/merge_requests/build_service.rb
index fa34753c4fd..cd4230aa5e4 100644
--- a/app/services/merge_requests/build_service.rb
+++ b/app/services/merge_requests/build_service.rb
@@ -7,6 +7,9 @@ module MergeRequests
       merge_request.can_be_created = false
       merge_request.compare_commits = []
       merge_request.source_project = project unless merge_request.source_project
+
+      merge_request.target_project = nil unless can?(current_user, :read_project, merge_request.target_project)
+
       merge_request.target_project ||= (project.forked_from_project || project)
       merge_request.target_branch ||= merge_request.target_project.default_branch
 
@@ -38,21 +41,45 @@ module MergeRequests
         merge_request.can_be_created = false
       end
 
+      set_title_and_description(merge_request)
+    end
+
+    private
+
+    # When your branch name starts with an iid followed by a dash this pattern will be
+    # interpreted as the user wants to close that issue on this project.
+    #
+    # For example:
+    # - Issue 112 exists, title: Emoji don't show up in commit title
+    # - Source branch is: 112-fix-mep-mep
+    #
+    # Will lead to:
+    # - Appending `Closes #112` to the description
+    # - Setting the title as 'Resolves "Emoji don't show up in commit title"' if there is
+    #   more than one commit in the MR
+    #
+    def set_title_and_description(merge_request)
+      if match = merge_request.source_branch.match(/\A(\d+)-/)
+        iid = match[1]
+      end
+
       commits = merge_request.compare_commits
       if commits && commits.count == 1
         commit = commits.first
         merge_request.title       = commit.title
         merge_request.description ||= commit.description.try(:strip)
+      elsif iid && (issue = merge_request.target_project.get_issue(iid)) && !issue.try(:confidential?)
+        case issue
+        when Issue
+          merge_request.title = "Resolve \"#{issue.title}\""
+        when ExternalIssue
+          merge_request.title = "Resolve #{issue.title}"
+        end
       else
         merge_request.title = merge_request.source_branch.titleize.humanize
       end
 
-      # When your branch name starts with an iid followed by a dash this pattern will
-      # be interpreted as the use wants to close that issue on this project
-      # Pattern example: 112-fix-mep-mep
-      # Will lead to appending `Closes #112` to the description
-      if match = merge_request.source_branch.match(/\A(\d+)-/)
-        iid = match[1]
+      if iid
         closes_issue = "Closes ##{iid}"
 
         if merge_request.description.present?
diff --git a/app/services/notes/create_service.rb b/app/services/notes/create_service.rb
index 2bb312bb252..01586994813 100644
--- a/app/services/notes/create_service.rb
+++ b/app/services/notes/create_service.rb
@@ -5,6 +5,8 @@ module Notes
       note.author = current_user
       note.system = false
 
+      return unless valid_project?(note)
+
       if note.save
         # Finish the harder work in the background
         NewNoteWorker.perform_in(2.seconds, note.id, params)
@@ -13,5 +15,14 @@ module Notes
 
       note
     end
+
+    private
+
+    def valid_project?(note)
+      return false unless project
+      return true if note.for_commit?
+
+      note.noteable.try(:project) == project
+    end
   end
 end
diff --git a/app/services/projects/destroy_service.rb b/app/services/projects/destroy_service.rb
index 70bfc1fd533..a8b31f95c4c 100644
--- a/app/services/projects/destroy_service.rb
+++ b/app/services/projects/destroy_service.rb
@@ -7,9 +7,7 @@ module Projects
     DELETED_FLAG = '+deleted'
 
     def pending_delete!
-      project.update_attribute(:pending_delete, true)
-
-      ProjectDestroyWorker.perform_in(1.minute, project.id, current_user.id, params)
+      project.schedule_delete!(current_user.id, params)
     end
 
     def execute
diff --git a/app/services/wiki_pages/create_service.rb b/app/services/wiki_pages/create_service.rb
index 988c663b9d0..24a817c06c9 100644
--- a/app/services/wiki_pages/create_service.rb
+++ b/app/services/wiki_pages/create_service.rb
@@ -1,7 +1,8 @@
 module WikiPages
   class CreateService < WikiPages::BaseService
     def execute
-      page = WikiPage.new(@project.wiki)
+      project_wiki = ProjectWiki.new(@project, current_user)
+      page = WikiPage.new(project_wiki)
 
       if page.create(@params)
         execute_hooks(page, 'create')