[CE] Support multiple assignees for merge requestsosw-multi-assignees-merge-requests

Backports https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/10161
(code out of ee/ folder).

1 files changed, 103 insertions, 21 deletions

diff --git a/spec/requests/api/merge_requests_spec.rb b/spec/requests/api/merge_requests_spec.rb
index 7ffa365c651..45818edbf68 100644
--- a/spec/requests/api/merge_requests_spec.rb
+++ b/spec/requests/api/merge_requests_spec.rb
@@ -5,14 +5,15 @@ describe API::MergeRequests do
 
   let(:base_time)   { Time.now }
   set(:user)        { create(:user) }
+  set(:user2)       { create(:user) }
   set(:admin)       { create(:user, :admin) }
   let(:project)     { create(:project, :public, :repository, creator: user, namespace: user.namespace, only_allow_merge_if_pipeline_succeeds: false) }
   let(:milestone)   { create(:milestone, title: '1.0.0', project: project) }
   let(:milestone1)  { create(:milestone, title: '0.9', project: project) }
-  let!(:merge_request) { create(:merge_request, :simple, milestone: milestone1, author: user, assignee: user, source_project: project, target_project: project, title: "Test", created_at: base_time) }
-  let!(:merge_request_closed) { create(:merge_request, state: "closed", milestone: milestone1, author: user, assignee: user, source_project: project, target_project: project, title: "Closed test", created_at: base_time + 1.second) }
-  let!(:merge_request_merged) { create(:merge_request, state: "merged", author: user, assignee: user, source_project: project, target_project: project, title: "Merged test", created_at: base_time + 2.seconds, merge_commit_sha: '9999999999999999999999999999999999999999') }
-  let!(:merge_request_locked) { create(:merge_request, state: "locked", milestone: milestone1, author: user, assignee: user, source_project: project, target_project: project, title: "Locked test", created_at: base_time + 1.second) }
+  let!(:merge_request) { create(:merge_request, :simple, milestone: milestone1, author: user, assignees: [user], source_project: project, target_project: project, title: "Test", created_at: base_time) }
+  let!(:merge_request_closed) { create(:merge_request, state: "closed", milestone: milestone1, author: user, assignees: [user], source_project: project, target_project: project, title: "Closed test", created_at: base_time + 1.second) }
+  let!(:merge_request_merged) { create(:merge_request, state: "merged", author: user, assignees: [user], source_project: project, target_project: project, title: "Merged test", created_at: base_time + 2.seconds, merge_commit_sha: '9999999999999999999999999999999999999999') }
+  let!(:merge_request_locked) { create(:merge_request, state: "locked", milestone: milestone1, author: user, assignees: [user], source_project: project, target_project: project, title: "Locked test", created_at: base_time + 1.second) }
   let!(:note)       { create(:note_on_merge_request, author: user, project: project, noteable: merge_request, note: "a comment on a MR") }
   let!(:note2)      { create(:note_on_merge_request, author: user, project: project, noteable: merge_request, note: "another comment on a MR") }
   let(:label) { create(:label, title: 'label', color: '#FFAABB', project: project) }
@@ -20,6 +21,9 @@ describe API::MergeRequests do
 
   before do
     project.add_reporter(user)
+    project.add_reporter(user2)
+
+    stub_licensed_features(multiple_merge_request_assignees: false)
   end
 
   shared_context 'with labels' do
@@ -45,9 +49,9 @@ describe API::MergeRequests do
           get api(endpoint_path, user)
         end
 
-        create(:merge_request, state: 'closed', milestone: milestone1, author: user, assignee: user, source_project: project, target_project: project, title: 'Test', created_at: base_time)
+        create(:merge_request, state: 'closed', milestone: milestone1, author: user, assignees: [user], source_project: project, target_project: project, title: 'Test', created_at: base_time)
 
-        merge_request = create(:merge_request, milestone: milestone1, author: user, assignee: user, source_project: project, target_project: project, title: 'Test', created_at: base_time)
+        merge_request = create(:merge_request, milestone: milestone1, author: user, assignees: [user], source_project: project, target_project: project, title: 'Test', created_at: base_time)
 
         merge_request.metrics.update!(merged_by: user,
                                       latest_closed_by: user,
@@ -333,7 +337,7 @@ describe API::MergeRequests do
                    state: 'closed',
                    milestone: milestone1,
                    author: user,
-                   assignee: user,
+                   assignees: [user],
                    source_project: project,
                    target_project: project,
                    title: "Test",
@@ -451,7 +455,7 @@ describe API::MergeRequests do
 
     context 'when authenticated' do
       let!(:project2) { create(:project, :public, namespace: user.namespace) }
-      let!(:merge_request2) { create(:merge_request, :simple, author: user, assignee: user, source_project: project2, target_project: project2) }
+      let!(:merge_request2) { create(:merge_request, :simple, author: user, assignees: [user], source_project: project2, target_project: project2) }
       let(:user2) { create(:user) }
 
       it 'returns an array of all merge requests except unauthorized ones' do
@@ -494,7 +498,7 @@ describe API::MergeRequests do
       end
 
       it 'returns an array of merge requests created by current user if no scope is given' do
-        merge_request3 = create(:merge_request, :simple, author: user2, assignee: user, source_project: project2, target_project: project2, source_branch: 'other-branch')
+        merge_request3 = create(:merge_request, :simple, author: user2, assignees: [user], source_project: project2, target_project: project2, source_branch: 'other-branch')
 
         get api('/merge_requests', user2)
 
@@ -502,7 +506,7 @@ describe API::MergeRequests do
       end
 
       it 'returns an array of merge requests authored by the given user' do
-        merge_request3 = create(:merge_request, :simple, author: user2, assignee: user, source_project: project2, target_project: project2, source_branch: 'other-branch')
+        merge_request3 = create(:merge_request, :simple, author: user2, assignees: [user], source_project: project2, target_project: project2, source_branch: 'other-branch')
 
         get api('/merge_requests', user), params: { author_id: user2.id, scope: :all }
 
@@ -510,7 +514,7 @@ describe API::MergeRequests do
       end
 
       it 'returns an array of merge requests assigned to the given user' do
-        merge_request3 = create(:merge_request, :simple, author: user, assignee: user2, source_project: project2, target_project: project2, source_branch: 'other-branch')
+        merge_request3 = create(:merge_request, :simple, author: user, assignees: [user2], source_project: project2, target_project: project2, source_branch: 'other-branch')
 
         get api('/merge_requests', user), params: { assignee_id: user2.id, scope: :all }
 
@@ -535,7 +539,7 @@ describe API::MergeRequests do
       end
 
       it 'returns an array of merge requests assigned to me' do
-        merge_request3 = create(:merge_request, :simple, author: user, assignee: user2, source_project: project2, target_project: project2, source_branch: 'other-branch')
+        merge_request3 = create(:merge_request, :simple, author: user, assignees: [user2], source_project: project2, target_project: project2, source_branch: 'other-branch')
 
         get api('/merge_requests', user2), params: { scope: 'assigned_to_me' }
 
@@ -543,7 +547,7 @@ describe API::MergeRequests do
       end
 
       it 'returns an array of merge requests assigned to me (kebab-case)' do
-        merge_request3 = create(:merge_request, :simple, author: user, assignee: user2, source_project: project2, target_project: project2, source_branch: 'other-branch')
+        merge_request3 = create(:merge_request, :simple, author: user, assignees: [user2], source_project: project2, target_project: project2, source_branch: 'other-branch')
 
         get api('/merge_requests', user2), params: { scope: 'assigned-to-me' }
 
@@ -551,7 +555,7 @@ describe API::MergeRequests do
       end
 
       it 'returns an array of merge requests created by me' do
-        merge_request3 = create(:merge_request, :simple, author: user2, assignee: user, source_project: project2, target_project: project2, source_branch: 'other-branch')
+        merge_request3 = create(:merge_request, :simple, author: user2, assignees: [user], source_project: project2, target_project: project2, source_branch: 'other-branch')
 
         get api('/merge_requests', user2), params: { scope: 'created_by_me' }
 
@@ -559,7 +563,7 @@ describe API::MergeRequests do
       end
 
       it 'returns an array of merge requests created by me (kebab-case)' do
-        merge_request3 = create(:merge_request, :simple, author: user2, assignee: user, source_project: project2, target_project: project2, source_branch: 'other-branch')
+        merge_request3 = create(:merge_request, :simple, author: user2, assignees: [user], source_project: project2, target_project: project2, source_branch: 'other-branch')
 
         get api('/merge_requests', user2), params: { scope: 'created-by-me' }
 
@@ -567,7 +571,7 @@ describe API::MergeRequests do
       end
 
       it 'returns merge requests reacted by the authenticated user by the given emoji' do
-        merge_request3 = create(:merge_request, :simple, author: user, assignee: user, source_project: project2, target_project: project2, source_branch: 'other-branch')
+        merge_request3 = create(:merge_request, :simple, author: user, assignees: [user], source_project: project2, target_project: project2, source_branch: 'other-branch')
         award_emoji = create(:award_emoji, awardable: merge_request3, user: user2, name: 'star')
 
         get api('/merge_requests', user2), params: { my_reaction_emoji: award_emoji.name, scope: 'all' }
@@ -700,7 +704,7 @@ describe API::MergeRequests do
         get api("/projects/#{project.id}/merge_requests", user)
       end.count
 
-      create(:merge_request, author: user, assignee: user, source_project: project, target_project: project, created_at: base_time)
+      create(:merge_request, author: user, assignees: [user], source_project: project, target_project: project, created_at: base_time)
 
       expect do
         get api("/projects/#{project.id}/merge_requests", user)
@@ -730,7 +734,7 @@ describe API::MergeRequests do
 
   describe "GET /projects/:id/merge_requests/:merge_request_iid" do
     it 'matches json schema' do
-      merge_request = create(:merge_request, :with_test_reports, milestone: milestone1, author: user, assignee: user, source_project: project, target_project: project, title: "Test", created_at: base_time)
+      merge_request = create(:merge_request, :with_test_reports, milestone: milestone1, author: user, assignees: [user], source_project: project, target_project: project, title: "Test", created_at: base_time)
       get api("/projects/#{project.id}/merge_requests/#{merge_request.iid}", user)
 
       expect(response).to have_gitlab_http_status(200)
@@ -851,7 +855,7 @@ describe API::MergeRequests do
     end
 
     context 'Work in Progress' do
-      let!(:merge_request_wip) { create(:merge_request, author: user, assignee: user, source_project: project, target_project: project, title: "WIP: Test", created_at: base_time + 1.second) }
+      let!(:merge_request_wip) { create(:merge_request, author: user, assignees: [user], source_project: project, target_project: project, title: "WIP: Test", created_at: base_time + 1.second) }
 
       it "returns merge request" do
         get api("/projects/#{project.id}/merge_requests/#{merge_request_wip.iid}", user)
@@ -867,7 +871,7 @@ describe API::MergeRequests do
 
         merge_request_overflow = create(:merge_request, :simple,
                                         author: user,
-                                        assignee: user,
+                                        assignees: [user],
                                         source_project: project,
                                         source_branch: 'expand-collapse-files',
                                         target_project: project,
@@ -1005,6 +1009,71 @@ describe API::MergeRequests do
   end
 
   describe 'POST /projects/:id/merge_requests' do
+    context 'support for deprecated assignee_id' do
+      let(:params) do
+        {
+          title: 'Test merge request',
+          source_branch: 'feature_conflict',
+          target_branch: 'master',
+          author_id: user.id,
+          assignee_id: user2.id
+        }
+      end
+
+      it 'creates a new merge request' do
+        post api("/projects/#{project.id}/merge_requests", user), params: params
+
+        expect(response).to have_gitlab_http_status(201)
+        expect(json_response['title']).to eq('Test merge request')
+        expect(json_response['assignee']['name']).to eq(user2.name)
+        expect(json_response['assignees'].first['name']).to eq(user2.name)
+      end
+
+      it 'creates a new merge request when assignee_id is empty' do
+        params[:assignee_id] = ''
+
+        post api("/projects/#{project.id}/merge_requests", user), params: params
+
+        expect(response).to have_gitlab_http_status(201)
+        expect(json_response['title']).to eq('Test merge request')
+        expect(json_response['assignee']).to be_nil
+      end
+
+      it 'filters assignee_id of unauthorized user' do
+        private_project = create(:project, :private, :repository)
+        another_user = create(:user)
+        private_project.add_maintainer(user)
+        params[:assignee_id] = another_user.id
+
+        post api("/projects/#{private_project.id}/merge_requests", user), params: params
+
+        expect(response).to have_gitlab_http_status(201)
+        expect(json_response['assignee']).to be_nil
+      end
+    end
+
+    context 'single assignee restrictions' do
+      let(:params) do
+        {
+          title: 'Test merge request',
+          source_branch: 'feature_conflict',
+          target_branch: 'master',
+          author_id: user.id,
+          assignee_ids: [user.id, user2.id]
+        }
+      end
+
+      it 'creates a new project merge request with no more than one assignee' do
+        post api("/projects/#{project.id}/merge_requests", user), params: params
+
+        expect(response).to have_gitlab_http_status(201)
+        expect(json_response['title']).to eq('Test merge request')
+        expect(json_response['assignees'].count).to eq(1)
+        expect(json_response['assignees'].first['name']).to eq(user.name)
+        expect(json_response.dig('assignee', 'name')).to eq(user.name)
+      end
+    end
+
     context 'between branches projects' do
       context 'different labels' do
         let(:params) do
@@ -1574,6 +1643,19 @@ describe API::MergeRequests do
       expect(json_response['force_remove_source_branch']).to be_truthy
     end
 
+    it 'filters assignee_id of unauthorized user' do
+      private_project = create(:project, :private, :repository)
+      mr = create(:merge_request, source_project: private_project, target_project: private_project)
+      another_user = create(:user)
+      private_project.add_maintainer(user)
+      params = { assignee_id: another_user.id }
+
+      put api("/projects/#{private_project.id}/merge_requests/#{mr.iid}", user), params: params
+
+      expect(response).to have_gitlab_http_status(200)
+      expect(json_response['assignee']).to be_nil
+    end
+
     context 'when updating labels' do
       it 'allows special label names' do
         put api("/projects/#{project.id}/merge_requests/#{merge_request.iid}", user),
@@ -1728,7 +1810,7 @@ describe API::MergeRequests do
       issue = create(:issue, project: jira_project)
       description = "Closes #{ext_issue.to_reference(jira_project)}\ncloses #{issue.to_reference}"
       merge_request = create(:merge_request,
-        :simple, author: user, assignee: user, source_project: jira_project, description: description)
+        :simple, author: user, assignees: [user], source_project: jira_project, description: description)
 
       get api("/projects/#{jira_project.id}/merge_requests/#{merge_request.iid}/closes_issues", user)