Add latest changes from gitlab-org/gitlab@13-5-stable-eev13.5.0-rc42

5 files changed, 250 insertions, 164 deletions

diff --git a/spec/services/groups/create_service_spec.rb b/spec/services/groups/create_service_spec.rb
index fc877f45a39..4f5bc3a3d5a 100644
--- a/spec/services/groups/create_service_spec.rb
+++ b/spec/services/groups/create_service_spec.rb
@@ -45,6 +45,15 @@ RSpec.describe Groups::CreateService, '#execute' do
     end
   end
 
+  context 'creating a group with `allow_mfa_for_subgroups` attribute' do
+    let(:params) { group_params.merge(allow_mfa_for_subgroups: false) }
+    let(:service) { described_class.new(user, params) }
+
+    it 'creates group without error' do
+      expect(service.execute).to be_persisted
+    end
+  end
+
   describe 'creating a top level group' do
     let(:service) { described_class.new(user, group_params) }
 
@@ -138,4 +147,91 @@ RSpec.describe Groups::CreateService, '#execute' do
       expect(group.namespace_settings).to be_persisted
     end
   end
+
+  describe 'create service for the group' do
+    let(:service) { described_class.new(user, group_params) }
+    let(:created_group) { service.execute }
+
+    context 'with an active instance-level integration' do
+      let!(:instance_integration) { create(:prometheus_service, :instance, api_url: 'https://prometheus.instance.com/') }
+
+      it 'creates a service from the instance-level integration' do
+        expect(created_group.services.count).to eq(1)
+        expect(created_group.services.first.api_url).to eq(instance_integration.api_url)
+        expect(created_group.services.first.inherit_from_id).to eq(instance_integration.id)
+      end
+
+      context 'with an active group-level integration' do
+        let(:service) { described_class.new(user, group_params.merge(parent_id: group.id)) }
+        let!(:group_integration) { create(:prometheus_service, group: group, project: nil, api_url: 'https://prometheus.group.com/') }
+        let(:group) do
+          create(:group).tap do |group|
+            group.add_owner(user)
+          end
+        end
+
+        it 'creates a service from the group-level integration' do
+          expect(created_group.services.count).to eq(1)
+          expect(created_group.services.first.api_url).to eq(group_integration.api_url)
+          expect(created_group.services.first.inherit_from_id).to eq(group_integration.id)
+        end
+
+        context 'with an active subgroup' do
+          let(:service) { described_class.new(user, group_params.merge(parent_id: subgroup.id)) }
+          let!(:subgroup_integration) { create(:prometheus_service, group: subgroup, project: nil, api_url: 'https://prometheus.subgroup.com/') }
+          let(:subgroup) do
+            create(:group, parent: group).tap do |subgroup|
+              subgroup.add_owner(user)
+            end
+          end
+
+          it 'creates a service from the subgroup-level integration' do
+            expect(created_group.services.count).to eq(1)
+            expect(created_group.services.first.api_url).to eq(subgroup_integration.api_url)
+            expect(created_group.services.first.inherit_from_id).to eq(subgroup_integration.id)
+          end
+        end
+      end
+    end
+  end
+
+  context 'shared runners configuration' do
+    context 'parent group present' do
+      using RSpec::Parameterized::TableSyntax
+
+      where(:shared_runners_config, :descendants_override_disabled_shared_runners_config) do
+        true  | false
+        false | false
+        # true  | true # invalid at the group level, leaving as comment to make explicit
+        false | true
+      end
+
+      with_them do
+        let!(:group) { create(:group, shared_runners_enabled: shared_runners_config, allow_descendants_override_disabled_shared_runners: descendants_override_disabled_shared_runners_config) }
+        let!(:service) { described_class.new(user, group_params.merge(parent_id: group.id)) }
+
+        before do
+          group.add_owner(user)
+        end
+
+        it 'creates group following the parent config' do
+          new_group = service.execute
+
+          expect(new_group.shared_runners_enabled).to eq(shared_runners_config)
+          expect(new_group.allow_descendants_override_disabled_shared_runners).to eq(descendants_override_disabled_shared_runners_config)
+        end
+      end
+    end
+
+    context 'root group' do
+      let!(:service) { described_class.new(user) }
+
+      it 'follows default config' do
+        new_group = service.execute
+
+        expect(new_group.shared_runners_enabled).to eq(true)
+        expect(new_group.allow_descendants_override_disabled_shared_runners).to eq(false)
+      end
+    end
+  end
 end
diff --git a/spec/services/groups/import_export/import_service_spec.rb b/spec/services/groups/import_export/import_service_spec.rb
index 4aac602a6da..f284225e23a 100644
--- a/spec/services/groups/import_export/import_service_spec.rb
+++ b/spec/services/groups/import_export/import_service_spec.rb
@@ -10,6 +10,15 @@ RSpec.describe Groups::ImportExport::ImportService do
     context 'when the job can be successfully scheduled' do
       subject(:import_service) { described_class.new(group: group, user: user) }
 
+      it 'creates group import state' do
+        import_service.async_execute
+
+        import_state = group.import_state
+
+        expect(import_state.user).to eq(user)
+        expect(import_state.group).to eq(group)
+      end
+
       it 'enqueues an import job' do
         expect(GroupImportWorker).to receive(:perform_async).with(user.id, group.id)
 
diff --git a/spec/services/groups/transfer_service_spec.rb b/spec/services/groups/transfer_service_spec.rb
index 89e4d091ff7..ae04eca3a9f 100644
--- a/spec/services/groups/transfer_service_spec.rb
+++ b/spec/services/groups/transfer_service_spec.rb
@@ -285,6 +285,44 @@ RSpec.describe Groups::TransferService do
         end
       end
 
+      context 'shared runners configuration' do
+        before do
+          create(:group_member, :owner, group: new_parent_group, user: user)
+        end
+
+        context 'if parent group has disabled shared runners but allows overrides' do
+          let(:new_parent_group) { create(:group, shared_runners_enabled: false, allow_descendants_override_disabled_shared_runners: true) }
+
+          it 'calls update service' do
+            expect(Groups::UpdateSharedRunnersService).to receive(:new).with(group, user, { shared_runners_setting: 'disabled_with_override' }).and_call_original
+
+            transfer_service.execute(new_parent_group)
+          end
+        end
+
+        context 'if parent group does not allow shared runners' do
+          let(:new_parent_group) { create(:group, shared_runners_enabled: false, allow_descendants_override_disabled_shared_runners: false) }
+
+          it 'calls update service' do
+            expect(Groups::UpdateSharedRunnersService).to receive(:new).with(group, user, { shared_runners_setting: 'disabled_and_unoverridable' }).and_call_original
+
+            transfer_service.execute(new_parent_group)
+          end
+        end
+
+        context 'if parent group allows shared runners' do
+          let(:group) { create(:group, :public, :nested, shared_runners_enabled: false) }
+          let(:new_parent_group) { create(:group, shared_runners_enabled: true) }
+
+          it 'does not call update service and keeps them disabled on the group' do
+            expect(Groups::UpdateSharedRunnersService).not_to receive(:new)
+
+            transfer_service.execute(new_parent_group)
+            expect(group.reload.shared_runners_enabled).to be_falsy
+          end
+        end
+      end
+
       context 'when a group is transferred to its subgroup' do
         let(:new_parent_group) { create(:group, parent: group) }
 
@@ -529,6 +567,39 @@ RSpec.describe Groups::TransferService do
         end
       end
 
+      context 'when transferring a group with two factor authentication switched on' do
+        before do
+          TestEnv.clean_test_path
+          create(:group_member, :owner, group: new_parent_group, user: user)
+          create(:group, :private, parent: group, require_two_factor_authentication: true)
+          group.update!(require_two_factor_authentication: true)
+        end
+
+        it 'does not update group two factor authentication setting' do
+          transfer_service.execute(new_parent_group)
+
+          expect(group.require_two_factor_authentication).to eq(true)
+        end
+
+        context 'when new parent disallows two factor authentication switched on for descendants' do
+          before do
+            new_parent_group.namespace_settings.update!(allow_mfa_for_subgroups: false)
+          end
+
+          it 'updates group two factor authentication setting' do
+            transfer_service.execute(new_parent_group)
+
+            expect(group.require_two_factor_authentication).to eq(false)
+          end
+
+          it 'schedules update of group two factor authentication setting for descendants' do
+            expect(DisallowTwoFactorForSubgroupsWorker).to receive(:perform_async).with(group.id)
+
+            transfer_service.execute(new_parent_group)
+          end
+        end
+      end
+
       context 'when updating the group goes wrong' do
         let!(:subgroup1) { create(:group, :public, parent: group) }
         let!(:subgroup2) { create(:group, :public, parent: group) }
diff --git a/spec/services/groups/update_service_spec.rb b/spec/services/groups/update_service_spec.rb
index 1e6a8d53354..bc7c066fa04 100644
--- a/spec/services/groups/update_service_spec.rb
+++ b/spec/services/groups/update_service_spec.rb
@@ -283,6 +283,50 @@ RSpec.describe Groups::UpdateService do
     end
   end
 
+  context 'change shared Runners config' do
+    let(:group) { create(:group) }
+    let(:project) { create(:project, shared_runners_enabled: true, group: group) }
+
+    subject { described_class.new(group, user, shared_runners_setting: 'disabled_and_unoverridable').execute }
+
+    before do
+      group.add_owner(user)
+    end
+
+    it 'calls the shared runners update service' do
+      expect_any_instance_of(::Groups::UpdateSharedRunnersService).to receive(:execute).and_return({ status: :success })
+
+      expect(subject).to be_truthy
+    end
+
+    it 'handles errors in the shared runners update service' do
+      expect_any_instance_of(::Groups::UpdateSharedRunnersService).to receive(:execute).and_return({ status: :error, message: 'something happened' })
+
+      expect(subject).to be_falsy
+
+      expect(group.errors[:update_shared_runners].first).to eq('something happened')
+    end
+  end
+
+  context 'changes allowing subgroups to establish own 2FA' do
+    let(:group) { create(:group) }
+    let(:params) { { allow_mfa_for_subgroups: false } }
+
+    subject { described_class.new(group, user, params).execute }
+
+    it 'changes settings' do
+      subject
+
+      expect(group.namespace_settings.reload.allow_mfa_for_subgroups).to eq(false)
+    end
+
+    it 'enqueues update subgroups and its members' do
+      expect(DisallowTwoFactorForSubgroupsWorker).to receive(:perform_async).with(group.id)
+
+      subject
+    end
+  end
+
   def update_group(group, user, opts)
     Groups::UpdateService.new(group, user, opts).execute
   end
diff --git a/spec/services/groups/update_shared_runners_service_spec.rb b/spec/services/groups/update_shared_runners_service_spec.rb
index 9fd8477a455..e2838c4ce0b 100644
--- a/spec/services/groups/update_shared_runners_service_spec.rb
+++ b/spec/services/groups/update_shared_runners_service_spec.rb
@@ -13,17 +13,14 @@ RSpec.describe Groups::UpdateSharedRunnersService do
     context 'when current_user is not the group owner' do
       let_it_be(:group) { create(:group) }
 
-      let(:params) { { shared_runners_enabled: '0' } }
+      let(:params) { { shared_runners_setting: 'enabled' } }
 
       before do
         group.add_maintainer(user)
       end
 
       it 'results error and does not call any method' do
-        expect(group).not_to receive(:enable_shared_runners!)
-        expect(group).not_to receive(:disable_shared_runners!)
-        expect(group).not_to receive(:allow_descendants_override_disabled_shared_runners!)
-        expect(group).not_to receive(:disallow_descendants_override_disabled_shared_runners!)
+        expect(group).not_to receive(:update_shared_runners_setting!)
 
         expect(subject[:status]).to eq(:error)
         expect(subject[:message]).to eq('Operation not allowed')
@@ -37,191 +34,60 @@ RSpec.describe Groups::UpdateSharedRunnersService do
       end
 
       context 'enable shared Runners' do
-        where(:desired_params) do
-          ['1', true]
-        end
-
-        with_them do
-          let(:params) { { shared_runners_enabled: desired_params } }
-
-          context 'group that its ancestors have shared runners disabled' do
-            let_it_be(:parent) { create(:group, :shared_runners_disabled) }
-            let_it_be(:group) { create(:group, :shared_runners_disabled, parent: parent) }
-
-            it 'results error' do
-              expect(subject[:status]).to eq(:error)
-              expect(subject[:message]).to eq('Shared Runners disabled for the parent group')
-            end
-          end
+        let(:params) { { shared_runners_setting: 'enabled' } }
 
-          context 'root group with shared runners disabled' do
-            let_it_be(:group) { create(:group, :shared_runners_disabled) }
+        context 'group that its ancestors have shared runners disabled' do
+          let_it_be(:parent) { create(:group, :shared_runners_disabled) }
+          let_it_be(:group) { create(:group, :shared_runners_disabled, parent: parent) }
 
-            it 'receives correct method and succeeds' do
-              expect(group).to receive(:enable_shared_runners!)
-              expect(group).not_to receive(:disable_shared_runners!)
-              expect(group).not_to receive(:allow_descendants_override_disabled_shared_runners!)
-              expect(group).not_to receive(:disallow_descendants_override_disabled_shared_runners!)
-
-              expect(subject[:status]).to eq(:success)
-            end
+          it 'results error' do
+            expect(subject[:status]).to eq(:error)
+            expect(subject[:message]).to eq('Validation failed: Shared runners enabled cannot be enabled because parent group has shared Runners disabled')
           end
         end
-      end
-
-      context 'disable shared Runners' do
-        let_it_be(:group) { create(:group) }
-
-        where(:desired_params) do
-          ['0', false]
-        end
 
-        with_them do
-          let(:params) { { shared_runners_enabled: desired_params } }
+        context 'root group with shared runners disabled' do
+          let_it_be(:group) { create(:group, :shared_runners_disabled) }
 
           it 'receives correct method and succeeds' do
-            expect(group).to receive(:disable_shared_runners!)
-            expect(group).not_to receive(:enable_shared_runners!)
-            expect(group).not_to receive(:allow_descendants_override_disabled_shared_runners!)
-            expect(group).not_to receive(:disallow_descendants_override_disabled_shared_runners!)
+            expect(group).to receive(:update_shared_runners_setting!).with('enabled')
 
             expect(subject[:status]).to eq(:success)
           end
         end
       end
 
-      context 'allow descendants to override' do
-        where(:desired_params) do
-          ['1', true]
-        end
-
-        with_them do
-          let(:params) { { allow_descendants_override_disabled_shared_runners: desired_params } }
-
-          context 'top level group' do
-            let_it_be(:group) { create(:group, :shared_runners_disabled) }
-
-            it 'receives correct method and succeeds' do
-              expect(group).to receive(:allow_descendants_override_disabled_shared_runners!)
-              expect(group).not_to receive(:disallow_descendants_override_disabled_shared_runners!)
-              expect(group).not_to receive(:enable_shared_runners!)
-              expect(group).not_to receive(:disable_shared_runners!)
-
-              expect(subject[:status]).to eq(:success)
-            end
-          end
+      context 'disable shared Runners' do
+        let_it_be(:group) { create(:group) }
+        let(:params) { { shared_runners_setting: 'disabled_and_unoverridable' } }
 
-          context 'when parent does not allow' do
-            let_it_be(:parent) { create(:group, :shared_runners_disabled, allow_descendants_override_disabled_shared_runners: false ) }
-            let_it_be(:group) { create(:group, :shared_runners_disabled, allow_descendants_override_disabled_shared_runners: false, parent: parent) }
+        it 'receives correct method and succeeds' do
+          expect(group).to receive(:update_shared_runners_setting!).with('disabled_and_unoverridable')
 
-            it 'results error' do
-              expect(subject[:status]).to eq(:error)
-              expect(subject[:message]).to eq('Group level shared Runners not allowed')
-            end
-          end
+          expect(subject[:status]).to eq(:success)
         end
       end
 
-      context 'disallow descendants to override' do
-        where(:desired_params) do
-          ['0', false]
-        end
-
-        with_them do
-          let(:params) { { allow_descendants_override_disabled_shared_runners: desired_params } }
-
-          context 'top level group' do
-            let_it_be(:group) { create(:group, :shared_runners_disabled, :allow_descendants_override_disabled_shared_runners ) }
-
-            it 'receives correct method and succeeds' do
-              expect(group).to receive(:disallow_descendants_override_disabled_shared_runners!)
-              expect(group).not_to receive(:allow_descendants_override_disabled_shared_runners!)
-              expect(group).not_to receive(:enable_shared_runners!)
-              expect(group).not_to receive(:disable_shared_runners!)
-
-              expect(subject[:status]).to eq(:success)
-            end
-          end
-
-          context 'top level group that has shared Runners enabled' do
-            let_it_be(:group) { create(:group, shared_runners_enabled: true) }
-
-            it 'results error' do
-              expect(subject[:status]).to eq(:error)
-              expect(subject[:message]).to eq('Shared Runners enabled')
-            end
-          end
-        end
-      end
+      context 'allow descendants to override' do
+        let(:params) { { shared_runners_setting: 'disabled_with_override' } }
 
-      context 'both params are present' do
-        context 'shared_runners_enabled: 1 and allow_descendants_override_disabled_shared_runners' do
+        context 'top level group' do
           let_it_be(:group) { create(:group, :shared_runners_disabled) }
-          let_it_be(:sub_group) { create(:group, :shared_runners_disabled, parent: group) }
-          let_it_be(:project) { create(:project, shared_runners_enabled: false, group: sub_group) }
 
-          where(:allow_descendants_override) do
-            ['1', true, '0', false]
-          end
+          it 'receives correct method and succeeds' do
+            expect(group).to receive(:update_shared_runners_setting!).with('disabled_with_override')
 
-          with_them do
-            let(:params) { { shared_runners_enabled: '1', allow_descendants_override_disabled_shared_runners: allow_descendants_override } }
-
-            it 'results in an error because shared Runners are enabled' do
-              expect { subject }
-                .to not_change { group.reload.shared_runners_enabled }
-                .and not_change { sub_group.reload.shared_runners_enabled }
-                .and not_change { project.reload.shared_runners_enabled }
-                .and not_change { group.reload.allow_descendants_override_disabled_shared_runners }
-                .and not_change { sub_group.reload.allow_descendants_override_disabled_shared_runners }
-              expect(subject[:status]).to eq(:error)
-              expect(subject[:message]).to eq('Cannot set shared_runners_enabled to true and allow_descendants_override_disabled_shared_runners')
-            end
+            expect(subject[:status]).to eq(:success)
           end
         end
 
-        context 'shared_runners_enabled: 0 and allow_descendants_override_disabled_shared_runners: 0' do
-          let_it_be(:group) { create(:group, :allow_descendants_override_disabled_shared_runners) }
-          let_it_be(:sub_group) { create(:group, :shared_runners_disabled, :allow_descendants_override_disabled_shared_runners, parent: group) }
-          let_it_be(:sub_group_2) { create(:group, parent: group) }
-          let_it_be(:project) { create(:project, group: group, shared_runners_enabled: true) }
-          let_it_be(:project_2) { create(:project, group: sub_group_2, shared_runners_enabled: true) }
-
-          let(:params) { { shared_runners_enabled: '0', allow_descendants_override_disabled_shared_runners: '0' } }
-
-          it 'disables shared Runners and disable allow_descendants_override_disabled_shared_runners' do
-            expect { subject }
-              .to change { group.reload.shared_runners_enabled }.from(true).to(false)
-              .and change { group.reload.allow_descendants_override_disabled_shared_runners }.from(true).to(false)
-              .and not_change { sub_group.reload.shared_runners_enabled }
-              .and change { sub_group.reload.allow_descendants_override_disabled_shared_runners }.from(true).to(false)
-              .and change { sub_group_2.reload.shared_runners_enabled }.from(true).to(false)
-              .and not_change { sub_group_2.reload.allow_descendants_override_disabled_shared_runners }
-              .and change { project.reload.shared_runners_enabled }.from(true).to(false)
-              .and change { project_2.reload.shared_runners_enabled }.from(true).to(false)
-          end
-        end
+        context 'when parent does not allow' do
+          let_it_be(:parent) { create(:group, :shared_runners_disabled, allow_descendants_override_disabled_shared_runners: false ) }
+          let_it_be(:group) { create(:group, :shared_runners_disabled, allow_descendants_override_disabled_shared_runners: false, parent: parent) }
 
-        context 'shared_runners_enabled: 0 and allow_descendants_override_disabled_shared_runners: 1' do
-          let_it_be(:group) { create(:group) }
-          let_it_be(:sub_group) { create(:group, :shared_runners_disabled, parent: group) }
-          let_it_be(:sub_group_2) { create(:group, parent: group) }
-          let_it_be(:project) { create(:project, group: group, shared_runners_enabled: true) }
-          let_it_be(:project_2) { create(:project, group: sub_group_2, shared_runners_enabled: true) }
-
-          let(:params) { { shared_runners_enabled: '0', allow_descendants_override_disabled_shared_runners: '1' } }
-
-          it 'disables shared Runners and enable allow_descendants_override_disabled_shared_runners only for itself' do
-            expect { subject }
-              .to change { group.reload.shared_runners_enabled }.from(true).to(false)
-              .and change { group.reload.allow_descendants_override_disabled_shared_runners }.from(false).to(true)
-              .and not_change { sub_group.reload.shared_runners_enabled }
-              .and not_change { sub_group.reload.allow_descendants_override_disabled_shared_runners }
-              .and change { sub_group_2.reload.shared_runners_enabled }.from(true).to(false)
-              .and not_change { sub_group_2.reload.allow_descendants_override_disabled_shared_runners }
-              .and change { project.reload.shared_runners_enabled }.from(true).to(false)
-              .and change { project_2.reload.shared_runners_enabled }.from(true).to(false)
+          it 'results error' do
+            expect(subject[:status]).to eq(:error)
+            expect(subject[:message]).to eq('Validation failed: Allow descendants override disabled shared runners cannot be enabled because parent group does not allow it')
           end
         end
       end