Merge remote-tracking branch 'upstream/master' into 42572-release-controller

* upstream/master: (889 commits)
  SlackService - respect `notify_only_default_branch` for push events
  Clarify usage ping wording in admin area
  Update incoming emails documents
  Allow to include also descendant group labels
  Update docs on grouping CI jobs
  Support additional LabelsFinder parameters for group labels
  Extend Cluster Applications to install GitLab Runner to Kubernetes cluster
  Remove registry list webpack entry point
  Remove trailing newline that was causing an EE conflict
  Small fixes in Vuex docs
  Remove u2f webpack bundle
  Update documentation WRT to request parameters
  remove common_vue CommonsChunk config
  Fetch commit signatures from Gitaly in batches
  migrate stl_viewer to dynamic import
  migrate sketch_viewer to dynamic import
  migrate pdf_viewer to dynamic import
  migrate notebook_viewer to dynamic import
  migrate balsamiq_viewer to dynamic import
  Add some strings that were missing in gitlab.pot
  ...

25 files changed, 300 insertions, 86 deletions

diff --git a/lib/api/access_requests.rb b/lib/api/access_requests.rb
index 60ae5e6b9a2..ae13c248171 100644
--- a/lib/api/access_requests.rb
+++ b/lib/api/access_requests.rb
@@ -53,7 +53,10 @@ module API
         put ':id/access_requests/:user_id/approve' do
           source = find_source(source_type, params[:id])
 
-          member = ::Members::ApproveAccessRequestService.new(source, current_user, declared_params).execute
+          access_requester = source.requesters.find_by!(user_id: params[:user_id])
+          member = ::Members::ApproveAccessRequestService
+            .new(current_user, declared_params)
+            .execute(access_requester)
 
           status :created
           present member, with: Entities::Member
@@ -70,8 +73,7 @@ module API
           member = source.requesters.find_by!(user_id: params[:user_id])
 
           destroy_conditionally!(member) do
-            ::Members::DestroyService.new(source, current_user, params)
-              .execute(:requesters)
+            ::Members::DestroyService.new(current_user).execute(member)
           end
         end
       end
diff --git a/lib/api/api.rb b/lib/api/api.rb
index e953f3d2eca..754549f72f0 100644
--- a/lib/api/api.rb
+++ b/lib/api/api.rb
@@ -138,6 +138,7 @@ module API
     mount ::API::PagesDomains
     mount ::API::Pipelines
     mount ::API::PipelineSchedules
+    mount ::API::ProjectImport
     mount ::API::ProjectHooks
     mount ::API::Projects
     mount ::API::ProjectMilestones
diff --git a/lib/api/commits.rb b/lib/api/commits.rb
index d8fd6a6eb06..982f45425a3 100644
--- a/lib/api/commits.rb
+++ b/lib/api/commits.rb
@@ -18,25 +18,28 @@ module API
         optional :since,    type: DateTime, desc: 'Only commits after or on this date will be returned'
         optional :until,    type: DateTime, desc: 'Only commits before or on this date will be returned'
         optional :path,     type: String, desc: 'The file path'
+        optional :all,      type: Boolean, desc: 'Every commit will be returned'
         use :pagination
       end
       get ':id/repository/commits' do
         path   = params[:path]
         before = params[:until]
         after  = params[:since]
-        ref    = params[:ref_name] || user_project.try(:default_branch) || 'master'
+        ref    = params[:ref_name] || user_project.try(:default_branch) || 'master' unless params[:all]
         offset = (params[:page] - 1) * params[:per_page]
+        all    = params[:all]
 
         commits = user_project.repository.commits(ref,
                                                   path: path,
                                                   limit: params[:per_page],
                                                   offset: offset,
                                                   before: before,
-                                                  after: after)
+                                                  after: after,
+                                                  all: all)
 
         commit_count =
-          if path || before || after
-            user_project.repository.count_commits(ref: ref, path: path, before: before, after: after)
+          if all || path || before || after
+            user_project.repository.count_commits(ref: ref, path: path, before: before, after: after, all: all)
           else
             # Cacheable commit count.
             user_project.repository.commit_count_for_ref(ref)
@@ -97,13 +100,16 @@ module API
       end
       params do
         requires :sha, type: String, desc: 'A commit sha, or the name of a branch or tag'
+        use :pagination
       end
       get ':id/repository/commits/:sha/diff', requirements: API::COMMIT_ENDPOINT_REQUIREMENTS do
         commit = user_project.commit(params[:sha])
 
         not_found! 'Commit' unless commit
 
-        present commit.raw_diffs.to_a, with: Entities::Diff
+        raw_diffs = ::Kaminari.paginate_array(commit.raw_diffs.to_a)
+
+        present paginate(raw_diffs), with: Entities::Diff
       end
 
       desc "Get a commit's comments" do
@@ -156,6 +162,27 @@ module API
         end
       end
 
+      desc 'Get all references a commit is pushed to' do
+        detail 'This feature was introduced in GitLab 10.6'
+        success Entities::BasicRef
+      end
+      params do
+        requires :sha, type: String, desc: 'A commit sha'
+        optional :type, type: String, values: %w[branch tag all], default: 'all', desc: 'Scope'
+        use :pagination
+      end
+      get ':id/repository/commits/:sha/refs', requirements: API::COMMIT_ENDPOINT_REQUIREMENTS do
+        commit = user_project.commit(params[:sha])
+        not_found!('Commit') unless commit
+
+        refs = []
+        refs.concat(user_project.repository.branch_names_contains(commit.id).map {|name| { type: 'branch', name: name }}) unless params[:type] == 'tag'
+        refs.concat(user_project.repository.tag_names_contains(commit.id).map {|name| { type: 'tag', name: name }}) unless params[:type] == 'branch'
+        refs = Kaminari.paginate_array(refs)
+
+        present paginate(refs), with: Entities::BasicRef
+      end
+
       desc 'Post comment to commit' do
         success Entities::CommitNote
       end
@@ -165,7 +192,7 @@ module API
         optional :path, type: String, desc: 'The file path'
         given :path do
           requires :line, type: Integer, desc: 'The line number'
-          requires :line_type, type: String, values: %w(new old), default: 'new', desc: 'The type of the line'
+          requires :line_type, type: String, values: %w[new old], default: 'new', desc: 'The type of the line'
         end
       end
       post ':id/repository/commits/:sha/comments', requirements: API::COMMIT_ENDPOINT_REQUIREMENTS do
diff --git a/lib/api/entities.rb b/lib/api/entities.rb
index 7838de13c56..c88fcf9472e 100644
--- a/lib/api/entities.rb
+++ b/lib/api/entities.rb
@@ -22,6 +22,7 @@ module API
       end
 
       expose :avatar_path, if: ->(user, options) { options.fetch(:only_path, false) && user.avatar_path }
+      expose :custom_attributes, using: 'API::Entities::CustomAttribute', if: :with_custom_attributes
 
       expose :web_url do |user, options|
         Gitlab::Routing.url_helpers.user_url(user)
@@ -70,7 +71,7 @@ module API
     end
 
     class ProjectHook < Hook
-      expose :project_id, :issues_events
+      expose :project_id, :issues_events, :confidential_issues_events
       expose :note_events, :pipeline_events, :wiki_page_events
       expose :job_events
     end
@@ -90,6 +91,13 @@ module API
       expose :created_at
     end
 
+    class ProjectImportStatus < ProjectIdentity
+      expose :import_status
+
+      # TODO: Use `expose_nil` once we upgrade the grape-entity gem
+      expose :import_error, if: lambda { |status, _ops| status.import_error }
+    end
+
     class BasicProjectDetails < ProjectIdentity
       include ::API::ProjectsRelationBuilder
 
@@ -109,6 +117,8 @@ module API
       expose :star_count, :forks_count
       expose :last_activity_at
 
+      expose :custom_attributes, using: 'API::Entities::CustomAttribute', if: :with_custom_attributes
+
       def self.preload_relation(projects_relation, options =  {})
         projects_relation.preload(:project_feature, :route)
                          .preload(namespace: [:route, :owner],
@@ -230,6 +240,8 @@ module API
         expose :parent_id
       end
 
+      expose :custom_attributes, using: 'API::Entities::CustomAttribute', if: :with_custom_attributes
+
       expose :statistics, if: :statistics do
         with_options format_with: -> (value) { value.to_i } do
           expose :storage_size
@@ -274,6 +286,11 @@ module API
       expose :stats, using: Entities::CommitStats, if: :stats
       expose :status
       expose :last_pipeline, using: 'API::Entities::PipelineBasic'
+      expose :project_id
+    end
+
+    class BasicRef < Grape::Entity
+      expose :type, :name
     end
 
     class Branch < Grape::Entity
@@ -1137,6 +1154,10 @@ module API
       expose :domain
       expose :url
       expose :project_id
+      expose :verified?, as: :verified
+      expose :verification_code, as: :verification_code
+      expose :enabled_until
+
       expose :certificate,
         as: :certificate_expiration,
         if: ->(pages_domain, _) { pages_domain.certificate? },
@@ -1148,6 +1169,10 @@ module API
     class PagesDomain < Grape::Entity
       expose :domain
       expose :url
+      expose :verified?, as: :verified
+      expose :verification_code, as: :verification_code
+      expose :enabled_until
+
       expose :certificate,
         if: ->(pages_domain, _) { pages_domain.certificate? },
         using: PagesDomainCertificate do |pages_domain|
@@ -1172,6 +1197,7 @@ module API
       expose :id
       expose :ref
       expose :startline
+      expose :project_id
     end
   end
 end
diff --git a/lib/api/groups.rb b/lib/api/groups.rb
index b81f07a1770..4a4df1b8b9e 100644
--- a/lib/api/groups.rb
+++ b/lib/api/groups.rb
@@ -1,6 +1,7 @@
 module API
   class Groups < Grape::API
     include PaginationParams
+    include Helpers::CustomAttributes
 
     before { authenticate_non_get! }
 
@@ -67,6 +68,8 @@ module API
         }
 
         groups = groups.with_statistics if options[:statistics]
+        groups, options = with_custom_attributes(groups, options)
+
         present paginate(groups), options
       end
     end
@@ -79,6 +82,7 @@ module API
       end
       params do
         use :group_list_params
+        use :with_custom_attributes
       end
       get do
         groups = find_groups(params)
@@ -142,9 +146,20 @@ module API
       desc 'Get a single group, with containing projects.' do
         success Entities::GroupDetail
       end
+      params do
+        use :with_custom_attributes
+      end
       get ":id" do
         group = find_group!(params[:id])
-        present group, with: Entities::GroupDetail, current_user: current_user
+
+        options = {
+          with: Entities::GroupDetail,
+          current_user: current_user
+        }
+
+        group, options = with_custom_attributes(group, options)
+
+        present group, options
       end
 
       desc 'Remove a group.'
@@ -175,12 +190,19 @@ module API
         optional :starred, type: Boolean, default: false, desc: 'Limit by starred status'
 
         use :pagination
+        use :with_custom_attributes
       end
       get ":id/projects" do
         projects = find_group_projects(params)
-        entity = params[:simple] ? Entities::BasicProjectDetails : Entities::Project
 
-        present entity.prepare_relation(projects), with: entity, current_user: current_user
+        options = {
+          with: params[:simple] ? Entities::BasicProjectDetails : Entities::Project,
+          current_user: current_user
+        }
+
+        projects, options = with_custom_attributes(projects, options)
+
+        present options[:with].prepare_relation(projects), options
       end
 
       desc 'Get a list of subgroups in this group.' do
@@ -188,6 +210,7 @@ module API
       end
       params do
         use :group_list_params
+        use :with_custom_attributes
       end
       get ":id/subgroups" do
         groups = find_groups(params)
diff --git a/lib/api/helpers.rb b/lib/api/helpers.rb
index 6134ad2bfc7..e4fca77ab5d 100644
--- a/lib/api/helpers.rb
+++ b/lib/api/helpers.rb
@@ -172,7 +172,7 @@ module API
 
     def find_project_snippet(id)
       finder_params = { project: user_project }
-      SnippetsFinder.new(current_user, finder_params).execute.find(id)
+      SnippetsFinder.new(current_user, finder_params).find(id)
     end
 
     def find_merge_request_with_access(iid, access_level = :read_merge_request)
diff --git a/lib/api/helpers/custom_attributes.rb b/lib/api/helpers/custom_attributes.rb
new file mode 100644
index 00000000000..70e4eda95f8
--- /dev/null
+++ b/lib/api/helpers/custom_attributes.rb
@@ -0,0 +1,28 @@
+module API
+  module Helpers
+    module CustomAttributes
+      extend ActiveSupport::Concern
+
+      included do
+        helpers do
+          params :with_custom_attributes do
+            optional :with_custom_attributes, type: Boolean, default: false, desc: 'Include custom attributes in the response'
+          end
+
+          def with_custom_attributes(collection_or_resource, options = {})
+            options = options.merge(
+              with_custom_attributes: params[:with_custom_attributes] &&
+                can?(current_user, :read_custom_attribute)
+            )
+
+            if options[:with_custom_attributes] && collection_or_resource.is_a?(ActiveRecord::Relation)
+              collection_or_resource = collection_or_resource.includes(:custom_attributes)
+            end
+
+            [collection_or_resource, options]
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/api/helpers/runner.rb b/lib/api/helpers/runner.rb
index fbe30192a16..35ac0b4cbca 100644
--- a/lib/api/helpers/runner.rb
+++ b/lib/api/helpers/runner.rb
@@ -9,16 +9,22 @@ module API
                                                                   Gitlab::CurrentSettings.runners_registration_token)
       end
 
-      def get_runner_version_from_params
-        return unless params['info'].present?
+      def authenticate_runner!
+        forbidden! unless current_runner
 
-        attributes_for_keys(%w(name version revision platform architecture), params['info'])
+        current_runner
+          .update_cached_info(get_runner_details_from_request)
       end
 
-      def authenticate_runner!
-        forbidden! unless current_runner
+      def get_runner_details_from_request
+        return get_runner_ip unless params['info'].present?
+
+        attributes_for_keys(%w(name version revision platform architecture), params['info'])
+          .merge(get_runner_ip)
+      end
 
-        current_runner.update_cached_info(get_runner_version_from_params)
+      def get_runner_ip
+        { ip_address: request.ip }
       end
 
       def current_runner
diff --git a/lib/api/internal.rb b/lib/api/internal.rb
index 9285fb90cdc..b3660e4a1d0 100644
--- a/lib/api/internal.rb
+++ b/lib/api/internal.rb
@@ -13,7 +13,7 @@ module API
       #   key_id - ssh key id for Git over SSH
       #   user_id - user id for Git over HTTP
       #   protocol - Git access protocol being used, e.g. HTTP or SSH
-      #   project - project path with namespace
+      #   project - project full_path (not path on disk)
       #   action - git action (git-upload-pack or git-receive-pack)
       #   changes - changes as "oldrev newrev ref", see Gitlab::ChangesList
       post "/allowed" do
diff --git a/lib/api/members.rb b/lib/api/members.rb
index bc1de37284a..8b12986d09e 100644
--- a/lib/api/members.rb
+++ b/lib/api/members.rb
@@ -81,12 +81,16 @@ module API
           source = find_source(source_type, params.delete(:id))
           authorize_admin_source!(source_type, source)
 
-          member = source.members.find_by!(user_id: params.delete(:user_id))
+          member = source.members.find_by!(user_id: params[:user_id])
+          updated_member =
+            ::Members::UpdateService
+              .new(current_user, declared_params(include_missing: false))
+              .execute(member)
 
-          if member.update_attributes(declared_params(include_missing: false))
-            present member, with: Entities::Member
+          if updated_member.valid?
+            present updated_member, with: Entities::Member
           else
-            render_validation_error!(member)
+            render_validation_error!(updated_member)
           end
         end
 
@@ -99,7 +103,7 @@ module API
           member = source.members.find_by!(user_id: params[:user_id])
 
           destroy_conditionally!(member) do
-            ::Members::DestroyService.new(source, current_user, declared_params).execute
+            ::Members::DestroyService.new(current_user).execute(member)
           end
         end
       end
diff --git a/lib/api/merge_requests.rb b/lib/api/merge_requests.rb
index 719afa09295..4ffd4895c7e 100644
--- a/lib/api/merge_requests.rb
+++ b/lib/api/merge_requests.rb
@@ -48,6 +48,8 @@ module API
         optional :scope, type: String, values: %w[created-by-me assigned-to-me all],
                          desc: 'Return merge requests for the given scope: `created-by-me`, `assigned-to-me` or `all`'
         optional :my_reaction_emoji, type: String, desc: 'Return issues reacted by the authenticated user by the given emoji'
+        optional :source_branch, type: String, desc: 'Return merge requests with the given source branch'
+        optional :target_branch, type: String, desc: 'Return merge requests with the given target branch'
         optional :search, type: String, desc: 'Search merge requests for text present in the title or description'
         use :pagination
       end
diff --git a/lib/api/pages_domains.rb b/lib/api/pages_domains.rb
index d7b613a717e..ba33993d852 100644
--- a/lib/api/pages_domains.rb
+++ b/lib/api/pages_domains.rb
@@ -2,6 +2,8 @@ module API
   class PagesDomains < Grape::API
     include PaginationParams
 
+    PAGES_DOMAINS_ENDPOINT_REQUIREMENTS = API::PROJECT_ENDPOINT_REQUIREMENTS.merge(domain: API::NO_SLASH_URL_PART_REGEX)
+
     before do
       authenticate!
     end
@@ -48,7 +50,7 @@ module API
     params do
       requires :id, type: String, desc: 'The ID of a project'
     end
-    resource :projects, requirements: { id: %r{[^/]+} } do
+    resource :projects, requirements: API::PROJECT_ENDPOINT_REQUIREMENTS do
       before do
         require_pages_enabled!
       end
@@ -71,7 +73,7 @@ module API
       params do
         requires :domain, type: String, desc: 'The domain'
       end
-      get ":id/pages/domains/:domain", requirements: { domain: %r{[^/]+} } do
+      get ":id/pages/domains/:domain", requirements: PAGES_DOMAINS_ENDPOINT_REQUIREMENTS do
         authorize! :read_pages, user_project
 
         present pages_domain, with: Entities::PagesDomain
@@ -105,7 +107,7 @@ module API
         optional :certificate, allow_blank: false, types: [File, String], desc: 'The certificate'
         optional :key, allow_blank: false, types: [File, String], desc: 'The key'
       end
-      put ":id/pages/domains/:domain", requirements: { domain: %r{[^/]+} } do
+      put ":id/pages/domains/:domain", requirements: PAGES_DOMAINS_ENDPOINT_REQUIREMENTS do
         authorize! :update_pages, user_project
 
         pages_domain_params = declared(params, include_parent_namespaces: false)
@@ -126,7 +128,7 @@ module API
       params do
         requires :domain, type: String, desc: 'The domain'
       end
-      delete ":id/pages/domains/:domain", requirements: { domain: %r{[^/]+} } do
+      delete ":id/pages/domains/:domain", requirements: PAGES_DOMAINS_ENDPOINT_REQUIREMENTS do
         authorize! :update_pages, user_project
 
         status 204
diff --git a/lib/api/project_hooks.rb b/lib/api/project_hooks.rb
index 86066e2b58f..f82241058e5 100644
--- a/lib/api/project_hooks.rb
+++ b/lib/api/project_hooks.rb
@@ -10,6 +10,7 @@ module API
         requires :url, type: String, desc: "The URL to send the request to"
         optional :push_events, type: Boolean, desc: "Trigger hook on push events"
         optional :issues_events, type: Boolean, desc: "Trigger hook on issues events"
+        optional :confidential_issues_events, type: Boolean, desc: "Trigger hook on confidential issues events"
         optional :merge_requests_events, type: Boolean, desc: "Trigger hook on merge request events"
         optional :tag_push_events, type: Boolean, desc: "Trigger hook on tag push events"
         optional :note_events, type: Boolean, desc: "Trigger hook on note(comment) events"
diff --git a/lib/api/project_import.rb b/lib/api/project_import.rb
new file mode 100644
index 00000000000..a509c1f32c1
--- /dev/null
+++ b/lib/api/project_import.rb
@@ -0,0 +1,69 @@
+module API
+  class ProjectImport < Grape::API
+    include PaginationParams
+
+    helpers do
+      def import_params
+        declared_params(include_missing: false)
+      end
+
+      def file_is_valid?
+        import_params[:file] && import_params[:file]['tempfile'].respond_to?(:read)
+      end
+
+      def validate_file!
+        render_api_error!('The file is invalid', 400) unless file_is_valid?
+      end
+    end
+
+    before do
+      forbidden! unless Gitlab::CurrentSettings.import_sources.include?('gitlab_project')
+    end
+
+    resource :projects, requirements: API::PROJECT_ENDPOINT_REQUIREMENTS do
+      params do
+        requires :path, type: String, desc: 'The new project path and name'
+        requires :file, type: File, desc: 'The project export file to be imported'
+        optional :namespace, type: String, desc: "The ID or name of the namespace that the project will be imported into. Defaults to the current user's namespace."
+      end
+      desc 'Create a new project import' do
+        detail 'This feature was introduced in GitLab 10.6.'
+        success Entities::ProjectImportStatus
+      end
+      post 'import' do
+        validate_file!
+
+        Gitlab::QueryLimiting.whitelist('https://gitlab.com/gitlab-org/gitlab-ce/issues/42437')
+
+        namespace = if import_params[:namespace]
+                      find_namespace!(import_params[:namespace])
+                    else
+                      current_user.namespace
+                    end
+
+        project_params = {
+            path: import_params[:path],
+            namespace_id: namespace.id,
+            file: import_params[:file]['tempfile']
+        }
+
+        project = ::Projects::GitlabProjectsImportService.new(current_user, project_params).execute
+
+        render_api_error!(project.errors.full_messages&.first, 400) unless project.saved?
+
+        present project, with: Entities::ProjectImportStatus
+      end
+
+      params do
+        requires :id, type: String, desc: 'The ID of a project'
+      end
+      desc 'Get a project export status' do
+        detail 'This feature was introduced in GitLab 10.6.'
+        success Entities::ProjectImportStatus
+      end
+      get ':id/import' do
+        present user_project, with: Entities::ProjectImportStatus
+      end
+    end
+  end
+end
diff --git a/lib/api/projects.rb b/lib/api/projects.rb
index 5b481121a10..b552b0e0c5d 100644
--- a/lib/api/projects.rb
+++ b/lib/api/projects.rb
@@ -3,6 +3,7 @@ require_dependency 'declarative_policy'
 module API
   class Projects < Grape::API
     include PaginationParams
+    include Helpers::CustomAttributes
 
     before { authenticate_non_get! }
 
@@ -80,6 +81,7 @@ module API
         projects = projects.with_merge_requests_enabled if params[:with_merge_requests_enabled]
         projects = projects.with_statistics if params[:statistics]
         projects = paginate(projects)
+        projects, options = with_custom_attributes(projects, options)
 
         if current_user
           project_members = current_user.project_members.preload(:source, user: [notification_settings: :source])
@@ -107,6 +109,7 @@ module API
         requires :user_id, type: String, desc: 'The ID or username of the user'
         use :collection_params
         use :statistics_params
+        use :with_custom_attributes
       end
       get ":user_id/projects" do
         user = find_user(params[:user_id])
@@ -127,6 +130,7 @@ module API
       params do
         use :collection_params
         use :statistics_params
+        use :with_custom_attributes
       end
       get do
         present_projects load_projects
@@ -196,11 +200,19 @@ module API
       end
       params do
         use :statistics_params
+        use :with_custom_attributes
       end
       get ":id" do
-        entity = current_user ? Entities::ProjectWithAccess : Entities::BasicProjectDetails
-        present user_project, with: entity, current_user: current_user,
-                              user_can_admin_project: can?(current_user, :admin_project, user_project), statistics: params[:statistics]
+        options = {
+          with: current_user ? Entities::ProjectWithAccess : Entities::BasicProjectDetails,
+          current_user: current_user,
+          user_can_admin_project: can?(current_user, :admin_project, user_project),
+          statistics: params[:statistics]
+        }
+
+        project, options = with_custom_attributes(user_project, options)
+
+        present project, options
       end
 
       desc 'Fork new project for the current user or provided namespace.' do
@@ -242,6 +254,7 @@ module API
       end
       params do
         use :collection_params
+        use :with_custom_attributes
       end
       get ':id/forks' do
         forks = ForkProjectsFinder.new(user_project, params: project_finder_params, current_user: current_user).execute
@@ -258,6 +271,7 @@ module API
           [
             :jobs_enabled,
             :resolve_outdated_diff_discussions,
+            :ci_config_path,
             :container_registry_enabled,
             :default_branch,
             :description,
diff --git a/lib/api/runner.rb b/lib/api/runner.rb
index 5469cba69a6..91cdc564002 100644
--- a/lib/api/runner.rb
+++ b/lib/api/runner.rb
@@ -16,7 +16,8 @@ module API
         optional :tag_list, type: Array[String], desc: %q(List of Runner's tags)
       end
       post '/' do
-        attributes = attributes_for_keys [:description, :locked, :run_untagged, :tag_list]
+        attributes = attributes_for_keys([:description, :locked, :run_untagged, :tag_list])
+          .merge(get_runner_details_from_request)
 
         runner =
           if runner_registration_token_valid?
@@ -30,7 +31,6 @@ module API
         return forbidden! unless runner
 
         if runner.id
-          runner.update(get_runner_version_from_params)
           present runner, with: Entities::RunnerRegistrationDetails
         else
           not_found!
diff --git a/lib/api/search.rb b/lib/api/search.rb
index 9f08fd96a3b..3556ad98c52 100644
--- a/lib/api/search.rb
+++ b/lib/api/search.rb
@@ -11,7 +11,7 @@ module API
         projects: Entities::BasicProjectDetails,
         milestones: Entities::Milestone,
         notes: Entities::Note,
-        commits: Entities::Commit,
+        commits: Entities::CommitDetail,
         blobs: Entities::Blob,
         wiki_blobs: Entities::Blob,
         snippet_titles: Entities::Snippet,
@@ -35,7 +35,7 @@ module API
       def process_results(results)
         case params[:scope]
         when 'wiki_blobs'
-          paginate(results).map { |blob| Gitlab::ProjectSearchResults.parse_search_result(blob) }
+          paginate(results).map { |blob| Gitlab::ProjectSearchResults.parse_search_result(blob, user_project) }
         when 'blobs'
           paginate(results).map { |blob| blob[1] }
         else
@@ -85,9 +85,7 @@ module API
         use :pagination
       end
       get ':id/-/search' do
-        find_group!(params[:id])
-
-        present search(group_id: params[:id]), with: entity
+        present search(group_id: user_group.id), with: entity
       end
     end
 
@@ -106,9 +104,7 @@ module API
         use :pagination
       end
       get ':id/-/search' do
-        find_project!(params[:id])
-
-        present search(project_id: params[:id]), with: entity
+        present search(project_id: user_project.id), with: entity
       end
     end
   end
diff --git a/lib/api/services.rb b/lib/api/services.rb
index 51e33e2c686..6c97659166d 100644
--- a/lib/api/services.rb
+++ b/lib/api/services.rb
@@ -1,6 +1,7 @@
+# frozen_string_literal: true
 module API
   class Services < Grape::API
-    chat_notification_settings = [
+    CHAT_NOTIFICATION_SETTINGS = [
       {
         required: true,
         name: :webhook,
@@ -19,9 +20,9 @@ module API
         type: String,
         desc: 'The default chat channel'
       }
-    ]
+    ].freeze
 
-    chat_notification_flags = [
+    CHAT_NOTIFICATION_FLAGS = [
       {
         required: false,
         name: :notify_only_broken_pipelines,
@@ -34,9 +35,9 @@ module API
         type: Boolean,
         desc: 'Send notifications only for the default branch'
       }
-    ]
+    ].freeze
 
-    chat_notification_channels = [
+    CHAT_NOTIFICATION_CHANNELS = [
       {
         required: false,
         name: :push_channel,
@@ -85,9 +86,9 @@ module API
         type: String,
         desc: 'The name of the channel to receive wiki_page_events notifications'
       }
-    ]
+    ].freeze
 
-    chat_notification_events = [
+    CHAT_NOTIFICATION_EVENTS = [
       {
         required: false,
         name: :push_events,
@@ -136,7 +137,7 @@ module API
         type: Boolean,
         desc: 'Enable notifications for wiki_page_events'
       }
-    ]
+    ].freeze
 
     services = {
       'asana' => [
@@ -627,10 +628,10 @@ module API
         }
       ],
       'slack' => [
-        chat_notification_settings,
-        chat_notification_flags,
-        chat_notification_channels,
-        chat_notification_events
+        CHAT_NOTIFICATION_SETTINGS,
+        CHAT_NOTIFICATION_FLAGS,
+        CHAT_NOTIFICATION_CHANNELS,
+        CHAT_NOTIFICATION_EVENTS
       ].flatten,
       'microsoft-teams' => [
         {
@@ -641,10 +642,10 @@ module API
         }
       ],
       'mattermost' => [
-        chat_notification_settings,
-        chat_notification_flags,
-        chat_notification_channels,
-        chat_notification_events
+        CHAT_NOTIFICATION_SETTINGS,
+        CHAT_NOTIFICATION_FLAGS,
+        CHAT_NOTIFICATION_CHANNELS,
+        CHAT_NOTIFICATION_EVENTS
       ].flatten,
       'teamcity' => [
         {
@@ -724,7 +725,22 @@ module API
       ]
     end
 
-    trigger_services = {
+    SERVICES = services.freeze
+    SERVICE_CLASSES = service_classes.freeze
+
+    SERVICE_CLASSES.each do |service|
+      event_names = service.try(:event_names) || next
+      event_names.each do |event_name|
+        SERVICES[service.to_param.tr("_", "-")] << {
+          required: false,
+          name: event_name.to_sym,
+          type: String,
+          desc: ServicesHelper.service_event_description(event_name)
+        }
+      end
+    end
+
+    TRIGGER_SERVICES = {
       'mattermost-slash-commands' => [
         {
           name: :token,
@@ -756,22 +772,9 @@ module API
         end
       end
 
-      services.each do |service_slug, settings|
+      SERVICES.each do |service_slug, settings|
         desc "Set #{service_slug} service for project"
         params do
-          service_classes.each do |service|
-            event_names = service.try(:event_names) || next
-            event_names.each do |event_name|
-              services[service.to_param.tr("_", "-")] << {
-                required: false,
-                name: event_name.to_sym,
-                type: String,
-                desc: ServicesHelper.service_event_description(event_name)
-              }
-            end
-          end
-          services.freeze
-
           settings.each do |setting|
             if setting[:required]
               requires setting[:name], type: setting[:type], desc: setting[:desc]
@@ -794,7 +797,7 @@ module API
 
       desc "Delete a service for project"
       params do
-        requires :service_slug, type: String, values: services.keys, desc: 'The name of the service'
+        requires :service_slug, type: String, values: SERVICES.keys, desc: 'The name of the service'
       end
       delete ":id/services/:service_slug" do
         service = user_project.find_or_initialize_service(params[:service_slug].underscore)
@@ -814,7 +817,7 @@ module API
         success Entities::ProjectService
       end
       params do
-        requires :service_slug, type: String, values: services.keys, desc: 'The name of the service'
+        requires :service_slug, type: String, values: SERVICES.keys, desc: 'The name of the service'
       end
       get ":id/services/:service_slug" do
         service = user_project.find_or_initialize_service(params[:service_slug].underscore)
@@ -822,7 +825,7 @@ module API
       end
     end
 
-    trigger_services.each do |service_slug, settings|
+    TRIGGER_SERVICES.each do |service_slug, settings|
       helpers do
         def slash_command_service(project, service_slug, params)
           project.services.active.where(template: false).find do |service|
diff --git a/lib/api/settings.rb b/lib/api/settings.rb
index cee4d309816..152df23a327 100644
--- a/lib/api/settings.rb
+++ b/lib/api/settings.rb
@@ -147,7 +147,7 @@ module API
         attrs[:password_authentication_enabled_for_web] = attrs.delete(:password_authentication_enabled)
       end
 
-      if current_settings.update_attributes(attrs)
+      if ApplicationSettings::UpdateService.new(current_settings, current_user, attrs).execute
         present current_settings, with: Entities::ApplicationSetting
       else
         render_validation_error!(current_settings)
diff --git a/lib/api/todos.rb b/lib/api/todos.rb
index ffccfebe752..c6dbcf84e3a 100644
--- a/lib/api/todos.rb
+++ b/lib/api/todos.rb
@@ -60,7 +60,7 @@ module API
       end
       post ':id/mark_as_done' do
         TodoService.new.mark_todos_as_done_by_ids(params[:id], current_user)
-        todo = Todo.find(params[:id])
+        todo = current_user.todos.find(params[:id])
 
         present todo, with: Entities::Todo, current_user: current_user
       end
diff --git a/lib/api/users.rb b/lib/api/users.rb
index 3cc12724b8a..3920171205f 100644
--- a/lib/api/users.rb
+++ b/lib/api/users.rb
@@ -2,6 +2,7 @@ module API
   class Users < Grape::API
     include PaginationParams
     include APIGuard
+    include Helpers::CustomAttributes
 
     allow_access_with_scope :read_user, if: -> (request) { request.get? }
 
@@ -70,6 +71,7 @@ module API
 
         use :sort_params
         use :pagination
+        use :with_custom_attributes
       end
       get do
         authenticated_as_admin! if params[:external].present? || (params[:extern_uid].present? && params[:provider].present?)
@@ -94,8 +96,9 @@ module API
 
         entity = current_user&.admin? ? Entities::UserWithAdmin : Entities::UserBasic
         users = users.preload(:identities, :u2f_registrations) if entity == Entities::UserWithAdmin
+        users, options = with_custom_attributes(users, with: entity)
 
-        present paginate(users), with: entity
+        present paginate(users), options
       end
 
       desc 'Get a single user' do
@@ -103,12 +106,16 @@ module API
       end
       params do
         requires :id, type: Integer, desc: 'The ID of the user'
+
+        use :with_custom_attributes
       end
       get ":id" do
         user = User.find_by(id: params[:id])
         not_found!('User') unless user && can?(current_user, :read_user, user)
 
         opts = current_user&.admin? ? { with: Entities::UserWithAdmin } : { with: Entities::User }
+        user, opts = with_custom_attributes(user, opts)
+
         present user, opts
       end
 
diff --git a/lib/api/v3/entities.rb b/lib/api/v3/entities.rb
index 2ccbb9da1c5..68b4d7c3982 100644
--- a/lib/api/v3/entities.rb
+++ b/lib/api/v3/entities.rb
@@ -252,8 +252,9 @@ module API
 
       class ProjectService < Grape::Entity
         expose :id, :title, :created_at, :updated_at, :active
-        expose :push_events, :issues_events, :merge_requests_events
-        expose :tag_push_events, :note_events, :pipeline_events
+        expose :push_events, :issues_events, :confidential_issues_events
+        expose :merge_requests_events, :tag_push_events, :note_events
+        expose :pipeline_events
         expose :job_events, as: :build_events
         # Expose serialized properties
         expose :properties do |service, options|
@@ -262,8 +263,9 @@ module API
       end
 
       class ProjectHook < ::API::Entities::Hook
-        expose :project_id, :issues_events, :merge_requests_events
-        expose :note_events, :pipeline_events, :wiki_page_events
+        expose :project_id, :issues_events, :confidential_issues_events
+        expose :merge_requests_events, :note_events, :pipeline_events
+        expose :wiki_page_events
         expose :job_events, as: :build_events
       end
 
diff --git a/lib/api/v3/members.rb b/lib/api/v3/members.rb
index d7bde8ceb89..88dd598f1e9 100644
--- a/lib/api/v3/members.rb
+++ b/lib/api/v3/members.rb
@@ -124,7 +124,7 @@ module API
               status(200  )
               { message: "Access revoked", id: params[:user_id].to_i }
             else
-              ::Members::DestroyService.new(source, current_user, declared_params).execute
+              ::Members::DestroyService.new(current_user).execute(member)
 
               present member, with: ::API::Entities::Member
             end
diff --git a/lib/api/v3/project_hooks.rb b/lib/api/v3/project_hooks.rb
index 51014591a93..631944150c7 100644
--- a/lib/api/v3/project_hooks.rb
+++ b/lib/api/v3/project_hooks.rb
@@ -11,6 +11,7 @@ module API
           requires :url, type: String, desc: "The URL to send the request to"
           optional :push_events, type: Boolean, desc: "Trigger hook on push events"
           optional :issues_events, type: Boolean, desc: "Trigger hook on issues events"
+          optional :confidential_issues_events, type: Boolean, desc: "Trigger hook on confidential issues events"
           optional :merge_requests_events, type: Boolean, desc: "Trigger hook on merge request events"
           optional :tag_push_events, type: Boolean, desc: "Trigger hook on tag push events"
           optional :note_events, type: Boolean, desc: "Trigger hook on note(comment) events"
diff --git a/lib/api/v3/todos.rb b/lib/api/v3/todos.rb
index 2f2cf259987..3e2c61f6dbd 100644
--- a/lib/api/v3/todos.rb
+++ b/lib/api/v3/todos.rb
@@ -12,7 +12,7 @@ module API
         end
         delete ':id' do
           TodoService.new.mark_todos_as_done_by_ids(params[:id], current_user)
-          todo = Todo.find(params[:id])
+          todo = current_user.todos.find(params[:id])
 
           present todo, with: ::API::Entities::Todo, current_user: current_user
         end