Add latest changes from gitlab-org/gitlab@master

7 files changed, 229 insertions, 66 deletions

diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 46245286820..62208d838c1 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -33,10 +33,8 @@ class UsersController < ApplicationController
       end
 
       format.json do
-        # In 13.8, this endpoint will be removed:
-        # https://gitlab.com/gitlab-org/gitlab/-/issues/289972
-        load_events
-        pager_json("events/_events", @events.count, events: @events)
+        msg = "This endpoint is deprecated. Use %s instead." % user_activity_path
+        render json: { message: msg }, status: :not_found
       end
     end
   end
diff --git a/app/finders/concerns/packages/finder_helper.rb b/app/finders/concerns/packages/finder_helper.rb
new file mode 100644
index 00000000000..524e7aa7ff9
--- /dev/null
+++ b/app/finders/concerns/packages/finder_helper.rb
@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module Packages
+  module FinderHelper
+    extend ActiveSupport::Concern
+
+    private
+
+    def packages_visible_to_user(user, within_group:)
+      return ::Packages::Package.none unless within_group
+      return ::Packages::Package.none unless Ability.allowed?(user, :read_package, within_group)
+
+      projects = projects_visible_to_reporters(user, within_group.self_and_descendants.select(:id))
+      ::Packages::Package.for_projects(projects.select(:id))
+    end
+
+    def projects_visible_to_user(user, within_group:)
+      return ::Project.none unless within_group
+      return ::Project.none unless Ability.allowed?(user, :read_package, within_group)
+
+      projects_visible_to_reporters(user, within_group.self_and_descendants.select(:id))
+    end
+
+    def projects_visible_to_reporters(user, namespace_ids)
+      ::Project.in_namespace(namespace_ids)
+               .public_or_visible_to_user(user, ::Gitlab::Access::REPORTER)
+    end
+  end
+end
diff --git a/app/finders/packages/nuget/package_finder.rb b/app/finders/packages/nuget/package_finder.rb
index e6fb6712d47..8f585f045a1 100644
--- a/app/finders/packages/nuget/package_finder.rb
+++ b/app/finders/packages/nuget/package_finder.rb
@@ -1,11 +1,15 @@
 # frozen_string_literal: true
+
 module Packages
   module Nuget
     class PackageFinder
+      include ::Packages::FinderHelper
+
       MAX_PACKAGES_COUNT = 50
 
-      def initialize(project, package_name:, package_version: nil, limit: MAX_PACKAGES_COUNT)
-        @project = project
+      def initialize(current_user, project_or_group, package_name:, package_version: nil, limit: MAX_PACKAGES_COUNT)
+        @current_user = current_user
+        @project_or_group = project_or_group
         @package_name = package_name
         @package_version = package_version
         @limit = limit
@@ -17,15 +21,32 @@ module Packages
 
       private
 
+      def base
+        if project?
+          @project_or_group.packages
+        elsif group?
+          packages_visible_to_user(@current_user, within_group: @project_or_group)
+        else
+          ::Packages::Package.none
+        end
+      end
+
       def packages
-        result = @project.packages
-                         .nuget
-                         .has_version
-                         .processed
-                         .with_name_like(@package_name)
+        result = base.nuget
+                     .has_version
+                     .processed
+                     .with_name_like(@package_name)
         result = result.with_version(@package_version) if @package_version.present?
         result
       end
+
+      def project?
+        @project_or_group.is_a?(::Project)
+      end
+
+      def group?
+        @project_or_group.is_a?(::Group)
+      end
     end
   end
 end
diff --git a/app/presenters/packages/nuget/service_index_presenter.rb b/app/presenters/packages/nuget/service_index_presenter.rb
index ed00b36b362..0bbdb0f9043 100644
--- a/app/presenters/packages/nuget/service_index_presenter.rb
+++ b/app/presenters/packages/nuget/service_index_presenter.rb
@@ -21,8 +21,11 @@ module Packages
 
       VERSION = '3.0.0'.freeze
 
-      def initialize(project)
-        @project = project
+      PROJECT_LEVEL_SERVICES = %i[download publish].freeze
+      GROUP_LEVEL_SERVICES = %i[search metadata].freeze
+
+      def initialize(project_or_group)
+        @project_or_group = project_or_group
       end
 
       def version
@@ -30,16 +33,21 @@ module Packages
       end
 
       def resources
-        [
-          build_service(:download),
-          build_service(:search),
-          build_service(:publish),
-          build_service(:metadata)
-        ].flatten
+        available_services.map { |service| build_service(service) }
+                          .flatten
       end
 
       private
 
+      def available_services
+        case scope
+        when :group
+          GROUP_LEVEL_SERVICES
+        when :project
+          (GROUP_LEVEL_SERVICES + PROJECT_LEVEL_SERVICES).flatten
+        end
+      end
+
       def build_service(service_type)
         url = build_service_url(service_type)
         comment = SERVICE_COMMENTS[service_type]
@@ -50,36 +58,72 @@ module Packages
       end
 
       def build_service_url(service_type)
-        base_path = api_v4_projects_packages_nuget_path(id: @project.id)
-
         full_path = case service_type
                     when :download
-                      api_v4_projects_packages_nuget_download_package_name_package_version_package_filename_path(
-                        {
-                          id: @project.id,
-                          package_name: nil,
-                          package_version: nil,
-                          package_filename: nil
-                        },
-                        true
-                      )
+                      download_service_url
                     when :search
-                      "#{base_path}/query"
+                      search_service_url
                     when :metadata
-                      api_v4_projects_packages_nuget_metadata_package_name_package_version_path(
-                        {
-                          id: @project.id,
-                          package_name: nil,
-                          package_version: nil
-                        },
-                        true
-                      )
+                      metadata_service_url
                     when :publish
-                      base_path
+                      publish_service_url
                     end
 
         expose_url(full_path)
       end
+
+      def scope
+        return :project if @project_or_group.is_a?(::Project)
+        return :group if @project_or_group.is_a?(::Group)
+      end
+
+      def download_service_url
+        params = {
+          id: @project_or_group.id,
+          package_name: nil,
+          package_version: nil,
+          package_filename: nil
+        }
+
+        api_v4_projects_packages_nuget_download_package_name_package_version_package_filename_path(
+          params,
+          true
+        )
+      end
+
+      def metadata_service_url
+        params = {
+          id: @project_or_group.id,
+          package_name: nil,
+          package_version: nil
+        }
+
+        case scope
+        when :group
+          api_v4_groups_packages_nuget_metadata_package_name_package_version_path(
+            params,
+            true
+          )
+        when :project
+          api_v4_projects_packages_nuget_metadata_package_name_package_version_path(
+            params,
+            true
+          )
+        end
+      end
+
+      def search_service_url
+        case scope
+        when :group
+          api_v4_groups_packages_nuget_query_path(id: @project_or_group.id)
+        when :project
+          api_v4_projects_packages_nuget_query_path(id: @project_or_group.id)
+        end
+      end
+
+      def publish_service_url
+        api_v4_projects_packages_nuget_path(id: @project_or_group.id)
+      end
     end
   end
 end
diff --git a/app/services/members/create_service.rb b/app/services/members/create_service.rb
index 3588cda180f..5fcf2d711b0 100644
--- a/app/services/members/create_service.rb
+++ b/app/services/members/create_service.rb
@@ -54,7 +54,8 @@ module Members
     end
 
     def enqueue_onboarding_progress_action(source)
-      Namespaces::OnboardingUserAddedWorker.perform_async(source.id)
+      namespace_id = source.is_a?(Project) ? source.namespace_id : source.id
+      Namespaces::OnboardingUserAddedWorker.perform_async(namespace_id)
     end
   end
 end
diff --git a/app/services/merge_requests/update_service.rb b/app/services/merge_requests/update_service.rb
index 826a48fdcf9..1d0ab403f12 100644
--- a/app/services/merge_requests/update_service.rb
+++ b/app/services/merge_requests/update_service.rb
@@ -126,9 +126,23 @@ module MergeRequests
     override :handle_quick_actions
     def handle_quick_actions(merge_request)
       super
+
+      # Ensure this parameter does not get used as an attribute
+      rebase = params.delete(:rebase)
+
+      if rebase
+        rebase_from_quick_action(merge_request)
+        # Ignore "/merge" if "/rebase" is used to avoid an unexpected race
+        params.delete(:merge)
+      end
+
       merge_from_quick_action(merge_request) if params[:merge]
     end
 
+    def rebase_from_quick_action(merge_request)
+      merge_request.rebase_async(current_user.id)
+    end
+
     def merge_from_quick_action(merge_request)
       last_diff_sha = params.delete(:merge)
 
diff --git a/app/services/packages/nuget/search_service.rb b/app/services/packages/nuget/search_service.rb
index b95aa30bec1..de2a4890ef9 100644
--- a/app/services/packages/nuget/search_service.rb
+++ b/app/services/packages/nuget/search_service.rb
@@ -3,6 +3,7 @@
 module Packages
   module Nuget
     class SearchService < BaseService
+      include ::Packages::FinderHelper
       include Gitlab::Utils::StrongMemoize
       include ActiveRecord::ConnectionAdapters::Quoting
 
@@ -16,8 +17,11 @@ module Packages
         padding: 0
       }.freeze
 
-      def initialize(project, search_term, options = {})
-        @project = project
+      RESULT = Struct.new(:results, :total_count, keyword_init: true).freeze
+
+      def initialize(current_user, project_or_group, search_term, options = {})
+        @current_user = current_user
+        @project_or_group = project_or_group
         @search_term = search_term
         @options = DEFAULT_OPTIONS.merge(options)
 
@@ -26,8 +30,8 @@ module Packages
       end
 
       def execute
-        OpenStruct.new(
-          total_count: package_names.total_count,
+        RESULT.new(
+          total_count: non_paginated_matching_package_names.count,
           results: search_packages
         )
       end
@@ -39,52 +43,104 @@ module Packages
         # See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/24182#technical-notes
         # and https://docs.microsoft.com/en-us/nuget/api/search-query-service-resource
         subquery_name = :partition_subquery
-        arel_table = Arel::Table.new(:partition_subquery)
+        arel_table = Arel::Table.new(subquery_name)
         column_names = Packages::Package.column_names.map do |cn|
           "#{subquery_name}.#{quote_column_name(cn)}"
         end
 
         # rubocop: disable CodeReuse/ActiveRecord
-        pkgs = Packages::Package.select(column_names.join(','))
-                                .from(package_names_partition, subquery_name)
-                                .where(arel_table[:row_number].lteq(MAX_VERSIONS_PER_PACKAGE))
+        pkgs = Packages::Package
+        pkgs = pkgs.with(project_ids_cte.to_arel) if use_project_ids_cte?
+        pkgs = pkgs.select(column_names.join(','))
+                   .from(package_names_partition, subquery_name)
+                   .where(arel_table[:row_number].lteq(MAX_VERSIONS_PER_PACKAGE))
 
         return pkgs if include_prerelease_versions?
 
         # we can't use pkgs.without_version_like since we have a custom from
         pkgs.where.not(arel_table[:version].matches(PRE_RELEASE_VERSION_MATCHING_TERM))
+        # rubocop: enable CodeReuse/ActiveRecord
       end
 
       def package_names_partition
+        # rubocop: disable CodeReuse/ActiveRecord
         table_name = quote_table_name(Packages::Package.table_name)
         name_column = "#{table_name}.#{quote_column_name('name')}"
         created_at_column = "#{table_name}.#{quote_column_name('created_at')}"
         select_sql = "ROW_NUMBER() OVER (PARTITION BY #{name_column} ORDER BY #{created_at_column} DESC) AS row_number, #{table_name}.*"
 
-        @project.packages
-                .select(select_sql)
-                .nuget
-                .has_version
-                .without_nuget_temporary_name
-                .with_name(package_names)
+        nuget_packages.select(select_sql)
+                      .with_name(paginated_matching_package_names)
+                      .where(project_id: project_ids)
+        # rubocop: enable CodeReuse/ActiveRecord
       end
 
-      def package_names
-        strong_memoize(:package_names) do
-          pkgs = @project.packages
-                         .nuget
-                         .has_version
-                         .without_nuget_temporary_name
-                         .order_name
-                         .select_distinct_name
+      def paginated_matching_package_names
+        pkgs = base_matching_package_names
+        pkgs.page(0) # we're using a padding
+            .per(per_page)
+            .padding(padding)
+      end
+
+      def non_paginated_matching_package_names
+        # rubocop: disable CodeReuse/ActiveRecord
+        pkgs = base_matching_package_names
+        pkgs = pkgs.with(project_ids_cte.to_arel) if use_project_ids_cte?
+        pkgs
+        # rubocop: enable CodeReuse/ActiveRecord
+      end
+
+      def base_matching_package_names
+        strong_memoize(:base_matching_package_names) do
+          # rubocop: disable CodeReuse/ActiveRecord
+          pkgs = nuget_packages.order_name
+                               .select_distinct_name
+                               .where(project_id: project_ids)
           pkgs = pkgs.without_version_like(PRE_RELEASE_VERSION_MATCHING_TERM) unless include_prerelease_versions?
           pkgs = pkgs.search_by_name(@search_term) if @search_term.present?
-          pkgs.page(0) # we're using a padding
-              .per(per_page)
-              .padding(padding)
+          pkgs
+          # rubocop: enable CodeReuse/ActiveRecord
         end
       end
 
+      def nuget_packages
+        Packages::Package.nuget
+                         .has_version
+                         .without_nuget_temporary_name
+      end
+
+      def project_ids_cte
+        return unless use_project_ids_cte?
+
+        strong_memoize(:project_ids_cte) do
+          query = projects_visible_to_user(@current_user, within_group: @project_or_group)
+          Gitlab::SQL::CTE.new(:project_ids, query.select(:id))
+        end
+      end
+
+      def project_ids
+        return @project_or_group.id if project?
+
+        if use_project_ids_cte?
+          # rubocop: disable CodeReuse/ActiveRecord
+          Project.select(:id)
+                 .from(project_ids_cte.table)
+          # rubocop: enable CodeReuse/ActiveRecord
+        end
+      end
+
+      def use_project_ids_cte?
+        group?
+      end
+
+      def project?
+        @project_or_group.is_a?(::Project)
+      end
+
+      def group?
+        @project_or_group.is_a?(::Group)
+      end
+
       def include_prerelease_versions?
         @options[:include_prerelease_versions]
       end