Merge branch '35385-allow-git-pull-push-on-project-redirects' into 'master'

Allow git pull/push on project redirects

Closes #35385

See merge request gitlab-org/gitlab-ce!15670

(cherry picked from commit 2a181d68c810e89ff5d2e49999775d8b58adb394)

37c99562 Allow git pull/push on project redirects
64811239 Allow group/username transfers:
4344bba4 Fixes wrong condition on git access
b6bac528 Wrap ProjectMoved behavior into a class
70676e3b Fixes permanent migration
3328950e Moves allowed_path_validation up to Namespace
54900c4a Addreses ME review comments
740ed1e0 Add several improvements
6a0d9261 Add fixes based on MR suggestions
8a1a257b Ensures validations are only executed if RedirectRoute#permanent column exists
448f1c54 Fixes broken specs and suggestions on MR
da789af6 Add fixes based on MR comments
2bd96f5f Bump GITLAB_SHELL_VERSION to 5.10.2
75981dc4 Ensure RedirectRoute column information is flushed

4 files changed, 86 insertions, 14 deletions

diff --git a/lib/api/internal.rb b/lib/api/internal.rb
index 451121a4cea..ccaaeca10d4 100644
--- a/lib/api/internal.rb
+++ b/lib/api/internal.rb
@@ -4,6 +4,7 @@ module API
     before { authenticate_by_gitlab_shell_token! }
 
     helpers ::API::Helpers::InternalHelpers
+    helpers ::Gitlab::Identifier
 
     namespace 'internal' do
       # Check if git command is allowed to project
@@ -176,17 +177,25 @@ module API
 
       post '/post_receive' do
         status 200
-
         PostReceive.perform_async(params[:gl_repository], params[:identifier],
           params[:changes])
         broadcast_message = BroadcastMessage.current&.last&.message
         reference_counter_decreased = Gitlab::ReferenceCounter.new(params[:gl_repository]).decrease
 
-        {
+        output = {
           merge_request_urls: merge_request_urls,
           broadcast_message: broadcast_message,
           reference_counter_decreased: reference_counter_decreased
         }
+
+        project = Gitlab::GlRepository.parse(params[:gl_repository]).first
+        user = identify(params[:identifier])
+        redirect_message = Gitlab::Checks::ProjectMoved.fetch_redirect_message(user.id, project.id)
+        if redirect_message
+          output[:redirected_message] = redirect_message
+        end
+
+        output
       end
     end
   end
diff --git a/lib/gitlab/checks/project_moved.rb b/lib/gitlab/checks/project_moved.rb
new file mode 100644
index 00000000000..3a1c0a3455e
--- /dev/null
+++ b/lib/gitlab/checks/project_moved.rb
@@ -0,0 +1,65 @@
+module Gitlab
+  module Checks
+    class ProjectMoved
+      REDIRECT_NAMESPACE = "redirect_namespace".freeze
+
+      def initialize(project, user, redirected_path, protocol)
+        @project = project
+        @user = user
+        @redirected_path = redirected_path
+        @protocol = protocol
+      end
+
+      def self.fetch_redirect_message(user_id, project_id)
+        redirect_key = redirect_message_key(user_id, project_id)
+
+        Gitlab::Redis::SharedState.with do |redis|
+          message = redis.get(redirect_key)
+          redis.del(redirect_key)
+          message
+        end
+      end
+
+      def add_redirect_message
+        Gitlab::Redis::SharedState.with do |redis|
+          key = self.class.redirect_message_key(user.id, project.id)
+          redis.setex(key, 5.minutes, redirect_message)
+        end
+      end
+
+      def redirect_message(rejected: false)
+        <<~MESSAGE.strip_heredoc
+        Project '#{redirected_path}' was moved to '#{project.full_path}'.
+
+        Please update your Git remote:
+
+          #{remote_url_message(rejected)}
+        MESSAGE
+      end
+
+      def permanent_redirect?
+        RedirectRoute.permanent.exists?(path: redirected_path)
+      end
+
+      private
+
+      attr_reader :project, :redirected_path, :protocol, :user
+
+      def self.redirect_message_key(user_id, project_id)
+        "#{REDIRECT_NAMESPACE}:#{user_id}:#{project_id}"
+      end
+
+      def remote_url_message(rejected)
+        if rejected
+          "git remote set-url origin #{url} and try again."
+        else
+          "git remote set-url origin #{url}"
+        end
+      end
+
+      def url
+        protocol == 'ssh' ? project.ssh_url_to_repo : project.http_url_to_repo
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/git_access.rb b/lib/gitlab/git_access.rb
index 9d7d921bb9c..56f6febe86d 100644
--- a/lib/gitlab/git_access.rb
+++ b/lib/gitlab/git_access.rb
@@ -102,18 +102,15 @@ module Gitlab
     end
 
     def check_project_moved!
-      return unless redirected_path
+      return if redirected_path.nil?
 
-      url = protocol == 'ssh' ? project.ssh_url_to_repo : project.http_url_to_repo
-      message = <<-MESSAGE.strip_heredoc
-        Project '#{redirected_path}' was moved to '#{project.full_path}'.
+      project_moved = Checks::ProjectMoved.new(project, user, redirected_path, protocol)
 
-        Please update your Git remote and try again:
-
-          git remote set-url origin #{url}
-      MESSAGE
-
-      raise ProjectMovedError, message
+      if project_moved.permanent_redirect?
+        project_moved.add_redirect_message
+      else
+        raise ProjectMovedError, project_moved.redirect_message(rejected: true)
+      end
     end
 
     def check_command_disabled!(cmd)
diff --git a/lib/gitlab/identifier.rb b/lib/gitlab/identifier.rb
index 94678b6ec40..3f3f10596c5 100644
--- a/lib/gitlab/identifier.rb
+++ b/lib/gitlab/identifier.rb
@@ -2,9 +2,8 @@
 # key-13 or user-36 or last commit
 module Gitlab
   module Identifier
-    def identify(identifier, project, newrev)
+    def identify(identifier, project = nil, newrev = nil)
       if identifier.blank?
-        # Local push from gitlab
         identify_using_commit(project, newrev)
       elsif identifier =~ /\Auser-\d+\Z/
         # git push over http
@@ -17,6 +16,8 @@ module Gitlab
 
     # Tries to identify a user based on a commit SHA.
     def identify_using_commit(project, ref)
+      return if project.nil? && ref.nil?
+
       commit = project.commit(ref)
 
       return if !commit || !commit.author_email