Backport of multiple_assignees_feature [ci skip]

13 files changed, 474 insertions, 102 deletions

diff --git a/spec/services/issuable/bulk_update_service_spec.rb b/spec/services/issuable/bulk_update_service_spec.rb
index 7a1ac027310..5b1639ca0d6 100644
--- a/spec/services/issuable/bulk_update_service_spec.rb
+++ b/spec/services/issuable/bulk_update_service_spec.rb
@@ -4,11 +4,12 @@ describe Issuable::BulkUpdateService, services: true do
   let(:user)    { create(:user) }
   let(:project) { create(:empty_project, namespace: user.namespace) }
 
-  def bulk_update(issues, extra_params = {})
+  def bulk_update(issuables, extra_params = {})
     bulk_update_params = extra_params
-      .reverse_merge(issuable_ids: Array(issues).map(&:id).join(','))
+      .reverse_merge(issuable_ids: Array(issuables).map(&:id).join(','))
 
-    Issuable::BulkUpdateService.new(project, user, bulk_update_params).execute('issue')
+    type = Array(issuables).first.model_name.param_key
+    Issuable::BulkUpdateService.new(project, user, bulk_update_params).execute(type)
   end
 
   describe 'close issues' do
@@ -47,15 +48,15 @@ describe Issuable::BulkUpdateService, services: true do
     end
   end
 
-  describe 'updating assignee' do
-    let(:issue) { create(:issue, project: project, assignee: user) }
+  describe 'updating merge request assignee' do
+    let(:merge_request) { create(:merge_request, target_project: project, source_project: project, assignee: user) }
 
     context 'when the new assignee ID is a valid user' do
       it 'succeeds' do
         new_assignee = create(:user)
         project.team << [new_assignee, :developer]
 
-        result = bulk_update(issue, assignee_id: new_assignee.id)
+        result = bulk_update(merge_request, assignee_id: new_assignee.id)
 
         expect(result[:success]).to be_truthy
         expect(result[:count]).to eq(1)
@@ -65,22 +66,59 @@ describe Issuable::BulkUpdateService, services: true do
         assignee = create(:user)
         project.team << [assignee, :developer]
 
-        expect { bulk_update(issue, assignee_id: assignee.id) }
-          .to change { issue.reload.assignee }.from(user).to(assignee)
+        expect { bulk_update(merge_request, assignee_id: assignee.id) }
+          .to change { merge_request.reload.assignee }.from(user).to(assignee)
       end
     end
 
     context "when the new assignee ID is #{IssuableFinder::NONE}" do
       it "unassigns the issues" do
-        expect { bulk_update(issue, assignee_id: IssuableFinder::NONE) }
-          .to change { issue.reload.assignee }.to(nil)
+        expect { bulk_update(merge_request, assignee_id: IssuableFinder::NONE) }
+          .to change { merge_request.reload.assignee }.to(nil)
       end
     end
 
     context 'when the new assignee ID is not present' do
       it 'does not unassign' do
-        expect { bulk_update(issue, assignee_id: nil) }
-          .not_to change { issue.reload.assignee }
+        expect { bulk_update(merge_request, assignee_id: nil) }
+          .not_to change { merge_request.reload.assignee }
+      end
+    end
+  end
+
+  describe 'updating issue assignee' do
+    let(:issue) { create(:issue, project: project, assignees: [user]) }
+
+    context 'when the new assignee ID is a valid user' do
+      it 'succeeds' do
+        new_assignee = create(:user)
+        project.team << [new_assignee, :developer]
+
+        result = bulk_update(issue, assignee_ids: [new_assignee.id])
+
+        expect(result[:success]).to be_truthy
+        expect(result[:count]).to eq(1)
+      end
+
+      it 'updates the assignee to the use ID passed' do
+        assignee = create(:user)
+        project.team << [assignee, :developer]
+        expect { bulk_update(issue, assignee_ids: [assignee.id]) }
+          .to change { issue.reload.assignees.first }.from(user).to(assignee)
+      end
+    end
+
+    context "when the new assignee ID is #{IssuableFinder::NONE}" do
+      it "unassigns the issues" do
+        expect { bulk_update(issue, assignee_ids: [IssuableFinder::NONE.to_s]) }
+          .to change { issue.reload.assignees.count }.from(1).to(0)
+      end
+    end
+
+    context 'when the new assignee ID is not present' do
+      it 'does not unassign' do
+        expect { bulk_update(issue, assignee_ids: []) }
+          .not_to change{ issue.reload.assignees }
       end
     end
   end
diff --git a/spec/services/issues/close_service_spec.rb b/spec/services/issues/close_service_spec.rb
index 7a54373963e..51840531711 100644
--- a/spec/services/issues/close_service_spec.rb
+++ b/spec/services/issues/close_service_spec.rb
@@ -4,7 +4,7 @@ describe Issues::CloseService, services: true do
   let(:user) { create(:user) }
   let(:user2) { create(:user) }
   let(:guest) { create(:user) }
-  let(:issue) { create(:issue, assignee: user2) }
+  let(:issue) { create(:issue, assignees: [user2]) }
   let(:project) { issue.project }
   let!(:todo) { create(:todo, :assigned, user: user, project: project, target: issue, author: user2) }
 
diff --git a/spec/services/issues/create_service_spec.rb b/spec/services/issues/create_service_spec.rb
index 80bfb731550..01edc46496d 100644
--- a/spec/services/issues/create_service_spec.rb
+++ b/spec/services/issues/create_service_spec.rb
@@ -6,10 +6,10 @@ describe Issues::CreateService, services: true do
 
   describe '#execute' do
     let(:issue) { described_class.new(project, user, opts).execute }
+    let(:assignee) { create(:user) }
+    let(:milestone) { create(:milestone, project: project) }
 
     context 'when params are valid' do
-      let(:assignee) { create(:user) }
-      let(:milestone) { create(:milestone, project: project) }
       let(:labels) { create_pair(:label, project: project) }
 
       before do
@@ -20,7 +20,7 @@ describe Issues::CreateService, services: true do
       let(:opts) do
         { title: 'Awesome issue',
           description: 'please fix',
-          assignee_id: assignee.id,
+          assignee_ids: [assignee.id],
           label_ids: labels.map(&:id),
           milestone_id: milestone.id,
           due_date: Date.tomorrow }
@@ -29,7 +29,7 @@ describe Issues::CreateService, services: true do
       it 'creates the issue with the given params' do
         expect(issue).to be_persisted
         expect(issue.title).to eq('Awesome issue')
-        expect(issue.assignee).to eq assignee
+        expect(issue.assignees).to eq [assignee]
         expect(issue.labels).to match_array labels
         expect(issue.milestone).to eq milestone
         expect(issue.due_date).to eq Date.tomorrow
@@ -37,6 +37,7 @@ describe Issues::CreateService, services: true do
 
       context 'when current user cannot admin issues in the project' do
         let(:guest) { create(:user) }
+
         before do
           project.team << [guest, :guest]
         end
@@ -47,7 +48,7 @@ describe Issues::CreateService, services: true do
           expect(issue).to be_persisted
           expect(issue.title).to eq('Awesome issue')
           expect(issue.description).to eq('please fix')
-          expect(issue.assignee).to be_nil
+          expect(issue.assignees).to be_empty
           expect(issue.labels).to be_empty
           expect(issue.milestone).to be_nil
           expect(issue.due_date).to be_nil
@@ -136,10 +137,83 @@ describe Issues::CreateService, services: true do
       end
     end
 
-    it_behaves_like 'issuable create service'
+    context 'issue create service' do
+      context 'assignees' do
+        before { project.team << [user, :master] }
+
+        it 'removes assignee when user id is invalid' do
+          opts = { title: 'Title', description: 'Description', assignee_ids: [-1] }
+
+          issue = described_class.new(project, user, opts).execute
+
+          expect(issue.assignees).to be_empty
+        end
+
+        it 'removes assignee when user id is 0' do
+          opts = { title: 'Title', description: 'Description',  assignee_ids: [0] }
+
+          issue = described_class.new(project, user, opts).execute
+
+          expect(issue.assignees).to be_empty
+        end
+
+        it 'saves assignee when user id is valid' do
+          project.team << [assignee, :master]
+          opts = { title: 'Title', description: 'Description', assignee_ids: [assignee.id] }
+
+          issue = described_class.new(project, user, opts).execute
+
+          expect(issue.assignees).to eq([assignee])
+        end
+
+        context "when issuable feature is private" do
+          before do
+            project.project_feature.update(issues_access_level: ProjectFeature::PRIVATE,
+                                           merge_requests_access_level: ProjectFeature::PRIVATE)
+          end
+
+          levels = [Gitlab::VisibilityLevel::INTERNAL, Gitlab::VisibilityLevel::PUBLIC]
+
+          levels.each do |level|
+            it "removes not authorized assignee when project is #{Gitlab::VisibilityLevel.level_name(level)}" do
+              project.update(visibility_level: level)
+              opts = { title: 'Title', description: 'Description', assignee_ids: [assignee.id] }
+
+              issue = described_class.new(project, user, opts).execute
+
+              expect(issue.assignees).to be_empty
+            end
+          end
+        end
+      end
+    end
 
     it_behaves_like 'new issuable record that supports slash commands'
 
+    context 'Slash commands' do
+      context 'with assignee and milestone in params and command' do
+        let(:opts) do
+          {
+            assignee_ids: [create(:user).id],
+            milestone_id: 1,
+            title: 'Title',
+            description: %(/assign @#{assignee.username}\n/milestone %"#{milestone.name}")
+          }
+        end
+
+        before do
+          project.team << [user, :master]
+          project.team << [assignee, :master]
+        end
+
+        it 'assigns and sets milestone to issuable from command' do
+          expect(issue).to be_persisted
+          expect(issue.assignees).to eq([assignee])
+          expect(issue.milestone).to eq(milestone)
+        end
+      end
+    end
+
     context 'resolving discussions' do
       let(:discussion) { create(:diff_note_on_merge_request).to_discussion }
       let(:merge_request) { discussion.noteable }
diff --git a/spec/services/issues/update_service_spec.rb b/spec/services/issues/update_service_spec.rb
index 5b324f3c706..1797a23ee8a 100644
--- a/spec/services/issues/update_service_spec.rb
+++ b/spec/services/issues/update_service_spec.rb
@@ -14,7 +14,7 @@ describe Issues::UpdateService, services: true do
   let(:issue) do
     create(:issue, title: 'Old title',
                    description: "for #{user2.to_reference}",
-                   assignee_id: user3.id,
+                   assignee_ids: [user3.id],
                    project: project)
   end
 
@@ -40,7 +40,7 @@ describe Issues::UpdateService, services: true do
         {
           title: 'New title',
           description: 'Also please fix',
-          assignee_id: user2.id,
+          assignee_ids: [user2.id, user3.id],
           state_event: 'close',
           label_ids: [label.id],
           due_date: Date.tomorrow
@@ -53,15 +53,15 @@ describe Issues::UpdateService, services: true do
         expect(issue).to be_valid
         expect(issue.title).to eq 'New title'
         expect(issue.description).to eq 'Also please fix'
-        expect(issue.assignee).to eq user2
+        expect(issue.assignees).to match_array([user2, user3])
         expect(issue).to be_closed
         expect(issue.labels).to match_array [label]
         expect(issue.due_date).to eq Date.tomorrow
       end
 
       it 'sorts issues as specified by parameters' do
-        issue1 = create(:issue, project: project, assignee_id: user3.id)
-        issue2 = create(:issue, project: project, assignee_id: user3.id)
+        issue1 = create(:issue, project: project, assignees: [user3])
+        issue2 = create(:issue, project: project, assignees: [user3])
 
         [issue, issue1, issue2].each do |issue|
           issue.move_to_end
@@ -87,7 +87,7 @@ describe Issues::UpdateService, services: true do
           expect(issue).to be_valid
           expect(issue.title).to eq 'New title'
           expect(issue.description).to eq 'Also please fix'
-          expect(issue.assignee).to eq user3
+          expect(issue.assignees).to match_array [user3]
           expect(issue.labels).to be_empty
           expect(issue.milestone).to be_nil
           expect(issue.due_date).to be_nil
@@ -137,7 +137,7 @@ describe Issues::UpdateService, services: true do
         {
           title: 'New title',
           description: 'Also please fix',
-          assignee_id: user2.id,
+          assignee_ids: [user2],
           state_event: 'close',
           label_ids: [label.id],
           confidential: true
@@ -163,12 +163,12 @@ describe Issues::UpdateService, services: true do
       it 'does not update assignee_id with unauthorized users' do
         project.update(visibility_level: Gitlab::VisibilityLevel::PUBLIC)
         update_issue(confidential: true)
-        non_member        = create(:user)
-        original_assignee = issue.assignee
+        non_member = create(:user)
+        original_assignees = issue.assignees
 
-        update_issue(assignee_id: non_member.id)
+        update_issue(assignee_ids: [non_member.id])
 
-        expect(issue.reload.assignee_id).to eq(original_assignee.id)
+        expect(issue.reload.assignees).to eq(original_assignees)
       end
     end
 
@@ -205,7 +205,7 @@ describe Issues::UpdateService, services: true do
 
       context 'when is reassigned' do
         before do
-          update_issue(assignee: user2)
+          update_issue(assignees: [user2])
         end
 
         it 'marks previous assignee todos as done' do
@@ -408,6 +408,41 @@ describe Issues::UpdateService, services: true do
       end
     end
 
+    context 'updating asssignee_id' do
+      it 'does not update assignee when assignee_id is invalid' do
+        update_issue(assignee_ids: [-1])
+
+        expect(issue.reload.assignees).to eq([user3])
+      end
+
+      it 'unassigns assignee when user id is 0' do
+        update_issue(assignee_ids: [0])
+
+        expect(issue.reload.assignees).to be_empty
+      end
+
+      it 'does not update assignee_id when user cannot read issue' do
+        update_issue(assignee_ids: [create(:user).id])
+
+        expect(issue.reload.assignees).to eq([user3])
+      end
+
+      context "when issuable feature is private" do
+        levels = [Gitlab::VisibilityLevel::INTERNAL, Gitlab::VisibilityLevel::PUBLIC]
+
+        levels.each do |level|
+          it "does not update with unauthorized assignee when project is #{Gitlab::VisibilityLevel.level_name(level)}" do
+            assignee = create(:user)
+            project.update(visibility_level: level)
+            feature_visibility_attr = :"#{issue.model_name.plural}_access_level"
+            project.project_feature.update_attribute(feature_visibility_attr, ProjectFeature::PRIVATE)
+
+            expect{ update_issue(assignee_ids: [assignee.id]) }.not_to change{ issue.assignees }
+          end
+        end
+      end
+    end
+
     context 'updating mentions' do
       let(:mentionable) { issue }
       include_examples 'updating mentions', Issues::UpdateService
diff --git a/spec/services/merge_requests/assign_issues_service_spec.rb b/spec/services/merge_requests/assign_issues_service_spec.rb
index fe75757dd29..d3556020d4d 100644
--- a/spec/services/merge_requests/assign_issues_service_spec.rb
+++ b/spec/services/merge_requests/assign_issues_service_spec.rb
@@ -15,14 +15,14 @@ describe MergeRequests::AssignIssuesService, services: true do
     expect(service.assignable_issues.map(&:id)).to include(issue.id)
   end
 
-  it 'ignores issues already assigned to any user' do
-    issue.update!(assignee: create(:user))
+  it 'ignores issues the user cannot update assignee on' do
+    project.team.truncate
 
     expect(service.assignable_issues).to be_empty
   end
 
-  it 'ignores issues the user cannot update assignee on' do
-    project.team.truncate
+  it 'ignores issues already assigned to any user' do
+    issue.assignees = [create(:user)]
 
     expect(service.assignable_issues).to be_empty
   end
@@ -44,7 +44,7 @@ describe MergeRequests::AssignIssuesService, services: true do
   end
 
   it 'assigns these to the merge request owner' do
-    expect { service.execute }.to change { issue.reload.assignee }.to(user)
+    expect { service.execute }.to change { issue.assignees.first }.to(user)
   end
 
   it 'ignores external issues' do
diff --git a/spec/services/merge_requests/create_service_spec.rb b/spec/services/merge_requests/create_service_spec.rb
index 0e16c7cc94b..ace82380cc9 100644
--- a/spec/services/merge_requests/create_service_spec.rb
+++ b/spec/services/merge_requests/create_service_spec.rb
@@ -84,7 +84,87 @@ describe MergeRequests::CreateService, services: true do
       end
     end
 
-    it_behaves_like 'issuable create service'
+    context 'Slash commands' do
+      context 'with assignee and milestone in params and command' do
+        let(:merge_request) { described_class.new(project, user, opts).execute }
+        let(:milestone) { create(:milestone, project: project) }
+
+        let(:opts) do
+          {
+            assignee_id: create(:user).id,
+            milestone_id: 1,
+            title: 'Title',
+            description: %(/assign @#{assignee.username}\n/milestone %"#{milestone.name}"),
+            source_branch: 'feature',
+            target_branch: 'master'
+          }
+        end
+
+        before do
+          project.team << [user, :master]
+          project.team << [assignee, :master]
+        end
+
+        it 'assigns and sets milestone to issuable from command' do
+          expect(merge_request).to be_persisted
+          expect(merge_request.assignee).to eq(assignee)
+          expect(merge_request.milestone).to eq(milestone)
+        end
+      end
+    end
+
+    context 'merge request create service' do
+      context 'asssignee_id' do
+        let(:assignee) { create(:user) }
+
+        before { project.team << [user, :master] }
+
+        it 'removes assignee_id when user id is invalid' do
+          opts = { title: 'Title', description: 'Description', assignee_id: -1 }
+
+          merge_request = described_class.new(project, user, opts).execute
+
+          expect(merge_request.assignee_id).to be_nil
+        end
+
+        it 'removes assignee_id when user id is 0' do
+          opts = { title: 'Title', description: 'Description',  assignee_id: 0 }
+
+          merge_request = described_class.new(project, user, opts).execute
+
+          expect(merge_request.assignee_id).to be_nil
+        end
+
+        it 'saves assignee when user id is valid' do
+          project.team << [assignee, :master]
+          opts = { title: 'Title', description: 'Description', assignee_id: assignee.id }
+
+          merge_request = described_class.new(project, user, opts).execute
+
+          expect(merge_request.assignee).to eq(assignee)
+        end
+
+        context "when issuable feature is private" do
+          before do
+            project.project_feature.update(issues_access_level: ProjectFeature::PRIVATE,
+                                           merge_requests_access_level: ProjectFeature::PRIVATE)
+          end
+
+          levels = [Gitlab::VisibilityLevel::INTERNAL, Gitlab::VisibilityLevel::PUBLIC]
+
+          levels.each do |level|
+            it "removes not authorized assignee when project is #{Gitlab::VisibilityLevel.level_name(level)}" do
+              project.update(visibility_level: level)
+              opts = { title: 'Title', description: 'Description', assignee_id: assignee.id }
+
+              merge_request = described_class.new(project, user, opts).execute
+
+              expect(merge_request.assignee_id).to be_nil
+            end
+          end
+        end
+      end
+    end
 
     context 'while saving references to issues that the created merge request closes' do
       let(:first_issue) { create(:issue, project: project) }
diff --git a/spec/services/merge_requests/update_service_spec.rb b/spec/services/merge_requests/update_service_spec.rb
index f2ca1e6fcbd..694ec3a579f 100644
--- a/spec/services/merge_requests/update_service_spec.rb
+++ b/spec/services/merge_requests/update_service_spec.rb
@@ -423,6 +423,54 @@ describe MergeRequests::UpdateService, services: true do
       end
     end
 
+    context 'updating asssignee_id' do
+      it 'does not update assignee when assignee_id is invalid' do
+        merge_request.update(assignee_id: user.id)
+
+        update_merge_request(assignee_id: -1)
+
+        expect(merge_request.reload.assignee).to eq(user)
+      end
+
+      it 'unassigns assignee when user id is 0' do
+        merge_request.update(assignee_id: user.id)
+
+        update_merge_request(assignee_id: 0)
+
+        expect(merge_request.assignee_id).to be_nil
+      end
+
+      it 'saves assignee when user id is valid' do
+        update_merge_request(assignee_id: user.id)
+
+        expect(merge_request.assignee_id).to eq(user.id)
+      end
+
+      it 'does not update assignee_id when user cannot read issue' do
+        non_member        = create(:user)
+        original_assignee = merge_request.assignee
+
+        update_merge_request(assignee_id: non_member.id)
+
+        expect(merge_request.assignee_id).to eq(original_assignee.id)
+      end
+
+      context "when issuable feature is private" do
+        levels = [Gitlab::VisibilityLevel::INTERNAL, Gitlab::VisibilityLevel::PUBLIC]
+
+        levels.each do |level|
+          it "does not update with unauthorized assignee when project is #{Gitlab::VisibilityLevel.level_name(level)}" do
+            assignee = create(:user)
+            project.update(visibility_level: level)
+            feature_visibility_attr = :"#{merge_request.model_name.plural}_access_level"
+            project.project_feature.update_attribute(feature_visibility_attr, ProjectFeature::PRIVATE)
+
+            expect{ update_merge_request(assignee_id: assignee) }.not_to change{ merge_request.assignee }
+          end
+        end
+      end
+    end
+
     include_examples 'issuable update service' do
       let(:open_issuable) { merge_request }
       let(:closed_issuable) { create(:closed_merge_request, source_project: project) }
diff --git a/spec/services/notes/slash_commands_service_spec.rb b/spec/services/notes/slash_commands_service_spec.rb
index 1a64c8bbf00..0edcc50ed7b 100644
--- a/spec/services/notes/slash_commands_service_spec.rb
+++ b/spec/services/notes/slash_commands_service_spec.rb
@@ -66,7 +66,7 @@ describe Notes::SlashCommandsService, services: true do
           expect(content).to eq ''
           expect(note.noteable).to be_closed
           expect(note.noteable.labels).to match_array(labels)
-          expect(note.noteable.assignee).to eq(assignee)
+          expect(note.noteable.assignees).to eq([assignee])
           expect(note.noteable.milestone).to eq(milestone)
         end
       end
@@ -113,7 +113,7 @@ describe Notes::SlashCommandsService, services: true do
           expect(content).to eq "HELLO\nWORLD"
           expect(note.noteable).to be_closed
           expect(note.noteable.labels).to match_array(labels)
-          expect(note.noteable.assignee).to eq(assignee)
+          expect(note.noteable.assignees).to eq([assignee])
           expect(note.noteable.milestone).to eq(milestone)
         end
       end
diff --git a/spec/services/notification_service_spec.rb b/spec/services/notification_service_spec.rb
index 989fd90cda9..74f96b97909 100644
--- a/spec/services/notification_service_spec.rb
+++ b/spec/services/notification_service_spec.rb
@@ -4,6 +4,7 @@ describe NotificationService, services: true do
   include EmailHelpers
 
   let(:notification) { NotificationService.new }
+  let(:assignee) { create(:user) }
 
   around(:each) do |example|
     perform_enqueued_jobs do
@@ -52,7 +53,11 @@ describe NotificationService, services: true do
 
   shared_examples 'participating by assignee notification' do
     it 'emails the participant' do
-      issuable.update_attribute(:assignee, participant)
+      if issuable.is_a?(Issue)
+        issuable.assignees << participant
+      else
+        issuable.update_attribute(:assignee, participant)
+      end
 
       notification_trigger
 
@@ -103,14 +108,14 @@ describe NotificationService, services: true do
   describe 'Notes' do
     context 'issue note' do
       let(:project) { create(:empty_project, :private) }
-      let(:issue) { create(:issue, project: project, assignee: create(:user)) }
-      let(:mentioned_issue) { create(:issue, assignee: issue.assignee) }
+      let(:issue) { create(:issue, project: project, assignees: [assignee]) }
+      let(:mentioned_issue) { create(:issue, assignees: issue.assignees) }
       let(:note) { create(:note_on_issue, noteable: issue, project_id: issue.project_id, note: '@mention referenced, @outsider also') }
 
       before do
         build_team(note.project)
         project.add_master(issue.author)
-        project.add_master(issue.assignee)
+        project.add_master(assignee)
         project.add_master(note.author)
         create(:note_on_issue, noteable: issue, project_id: issue.project_id, note: '@subscribed_participant cc this guy')
         update_custom_notification(:new_note, @u_guest_custom, resource: project)
@@ -130,7 +135,7 @@ describe NotificationService, services: true do
 
           should_email(@u_watcher)
           should_email(note.noteable.author)
-          should_email(note.noteable.assignee)
+          should_email(note.noteable.assignees.first)
           should_email(@u_custom_global)
           should_email(@u_mentioned)
           should_email(@subscriber)
@@ -196,7 +201,7 @@ describe NotificationService, services: true do
           notification.new_note(note)
 
           should_email(note.noteable.author)
-          should_email(note.noteable.assignee)
+          should_email(note.noteable.assignees.first)
           should_email(@u_mentioned)
           should_email(@u_custom_global)
           should_not_email(@u_guest_custom)
@@ -218,7 +223,7 @@ describe NotificationService, services: true do
       let(:member) { create(:user) }
       let(:guest) { create(:user) }
       let(:admin) { create(:admin) }
-      let(:confidential_issue) { create(:issue, :confidential, project: project, author: author, assignee: assignee) }
+      let(:confidential_issue) { create(:issue, :confidential, project: project, author: author, assignees: [assignee]) }
       let(:note) { create(:note_on_issue, noteable: confidential_issue, project: project, note: "#{author.to_reference} #{assignee.to_reference} #{non_member.to_reference} #{member.to_reference} #{admin.to_reference}") }
       let(:guest_watcher) { create_user_with_notification(:watch, "guest-watcher-confidential") }
 
@@ -244,8 +249,8 @@ describe NotificationService, services: true do
 
     context 'issue note mention' do
       let(:project) { create(:empty_project, :public) }
-      let(:issue) { create(:issue, project: project, assignee: create(:user)) }
-      let(:mentioned_issue) { create(:issue, assignee: issue.assignee) }
+      let(:issue) { create(:issue, project: project, assignees: [assignee]) }
+      let(:mentioned_issue) { create(:issue, assignees: issue.assignees) }
       let(:note) { create(:note_on_issue, noteable: issue, project_id: issue.project_id, note: '@all mentioned') }
 
       before do
@@ -269,7 +274,7 @@ describe NotificationService, services: true do
 
           should_email(@u_guest_watcher)
           should_email(note.noteable.author)
-          should_email(note.noteable.assignee)
+          should_email(note.noteable.assignees.first)
           should_not_email(note.author)
           should_email(@u_mentioned)
           should_not_email(@u_disabled)
@@ -449,7 +454,7 @@ describe NotificationService, services: true do
     let(:group) { create(:group) }
     let(:project) { create(:empty_project, :public, namespace: group) }
     let(:another_project) { create(:empty_project, :public, namespace: group) }
-    let(:issue) { create :issue, project: project, assignee: create(:user), description: 'cc @participant' }
+    let(:issue) { create :issue, project: project, assignees: [assignee], description: 'cc @participant' }
 
     before do
       build_team(issue.project)
@@ -465,7 +470,7 @@ describe NotificationService, services: true do
       it do
         notification.new_issue(issue, @u_disabled)
 
-        should_email(issue.assignee)
+        should_email(assignee)
         should_email(@u_watcher)
         should_email(@u_guest_watcher)
         should_email(@u_guest_custom)
@@ -480,10 +485,10 @@ describe NotificationService, services: true do
       end
 
       it do
-        create_global_setting_for(issue.assignee, :mention)
+        create_global_setting_for(issue.assignees.first, :mention)
         notification.new_issue(issue, @u_disabled)
 
-        should_not_email(issue.assignee)
+        should_not_email(issue.assignees.first)
       end
 
       it "emails the author if they've opted into notifications about their activity" do
@@ -528,7 +533,7 @@ describe NotificationService, services: true do
         let(:member) { create(:user) }
         let(:guest) { create(:user) }
         let(:admin) { create(:admin) }
-        let(:confidential_issue) { create(:issue, :confidential, project: project, title: 'Confidential issue', author: author, assignee: assignee) }
+        let(:confidential_issue) { create(:issue, :confidential, project: project, title: 'Confidential issue', author: author, assignees: [assignee]) }
 
         it "emails subscribers of the issue's labels that can read the issue" do
           project.add_developer(member)
@@ -572,9 +577,9 @@ describe NotificationService, services: true do
       end
 
       it 'emails new assignee' do
-        notification.reassigned_issue(issue, @u_disabled)
+        notification.reassigned_issue(issue, @u_disabled, [assignee])
 
-        should_email(issue.assignee)
+        should_email(issue.assignees.first)
         should_email(@u_watcher)
         should_email(@u_guest_watcher)
         should_email(@u_guest_custom)
@@ -588,9 +593,8 @@ describe NotificationService, services: true do
       end
 
       it 'emails previous assignee even if he has the "on mention" notif level' do
-        issue.update_attribute(:assignee, @u_mentioned)
-        issue.update_attributes(assignee: @u_watcher)
-        notification.reassigned_issue(issue, @u_disabled)
+        issue.assignees = [@u_mentioned]
+        notification.reassigned_issue(issue, @u_disabled, [@u_watcher])
 
         should_email(@u_mentioned)
         should_email(@u_watcher)
@@ -606,11 +610,11 @@ describe NotificationService, services: true do
       end
 
       it 'emails new assignee even if he has the "on mention" notif level' do
-        issue.update_attributes(assignee: @u_mentioned)
-        notification.reassigned_issue(issue, @u_disabled)
+        issue.assignees = [@u_mentioned]
+        notification.reassigned_issue(issue, @u_disabled, [@u_mentioned])
 
-        expect(issue.assignee).to be @u_mentioned
-        should_email(issue.assignee)
+        expect(issue.assignees.first).to be @u_mentioned
+        should_email(issue.assignees.first)
         should_email(@u_watcher)
         should_email(@u_guest_watcher)
         should_email(@u_guest_custom)
@@ -624,11 +628,11 @@ describe NotificationService, services: true do
       end
 
       it 'emails new assignee' do
-        issue.update_attribute(:assignee, @u_mentioned)
-        notification.reassigned_issue(issue, @u_disabled)
+        issue.assignees = [@u_mentioned]
+        notification.reassigned_issue(issue, @u_disabled, [@u_mentioned])
 
-        expect(issue.assignee).to be @u_mentioned
-        should_email(issue.assignee)
+        expect(issue.assignees.first).to be @u_mentioned
+        should_email(issue.assignees.first)
         should_email(@u_watcher)
         should_email(@u_guest_watcher)
         should_email(@u_guest_custom)
@@ -642,17 +646,17 @@ describe NotificationService, services: true do
       end
 
       it 'does not email new assignee if they are the current user' do
-        issue.update_attribute(:assignee, @u_mentioned)
-        notification.reassigned_issue(issue, @u_mentioned)
+        issue.assignees = [@u_mentioned]
+        notification.reassigned_issue(issue, @u_mentioned, [@u_mentioned])
 
-        expect(issue.assignee).to be @u_mentioned
+        expect(issue.assignees.first).to be @u_mentioned
         should_email(@u_watcher)
         should_email(@u_guest_watcher)
         should_email(@u_guest_custom)
         should_email(@u_participant_mentioned)
         should_email(@subscriber)
         should_email(@u_custom_global)
-        should_not_email(issue.assignee)
+        should_not_email(issue.assignees.first)
         should_not_email(@unsubscriber)
         should_not_email(@u_participating)
         should_not_email(@u_disabled)
@@ -662,7 +666,7 @@ describe NotificationService, services: true do
       it_behaves_like 'participating notifications' do
         let(:participant) { create(:user, username: 'user-participant') }
         let(:issuable) { issue }
-        let(:notification_trigger) { notification.reassigned_issue(issue, @u_disabled) }
+        let(:notification_trigger) { notification.reassigned_issue(issue, @u_disabled, [assignee]) }
       end
     end
 
@@ -705,7 +709,7 @@ describe NotificationService, services: true do
       it "doesn't send email to anyone but subscribers of the given labels" do
         notification.relabeled_issue(issue, [group_label_2, label_2], @u_disabled)
 
-        should_not_email(issue.assignee)
+        should_not_email(issue.assignees.first)
         should_not_email(issue.author)
         should_not_email(@u_watcher)
         should_not_email(@u_guest_watcher)
@@ -729,7 +733,7 @@ describe NotificationService, services: true do
         let(:member) { create(:user) }
         let(:guest) { create(:user) }
         let(:admin) { create(:admin) }
-        let(:confidential_issue) { create(:issue, :confidential, project: project, title: 'Confidential issue', author: author, assignee: assignee) }
+        let(:confidential_issue) { create(:issue, :confidential, project: project, title: 'Confidential issue', author: author, assignees: [assignee]) }
         let!(:label_1) { create(:label, project: project, issues: [confidential_issue]) }
         let!(:label_2) { create(:label, project: project) }
 
@@ -767,7 +771,7 @@ describe NotificationService, services: true do
       it 'sends email to issue assignee and issue author' do
         notification.close_issue(issue, @u_disabled)
 
-        should_email(issue.assignee)
+        should_email(issue.assignees.first)
         should_email(issue.author)
         should_email(@u_watcher)
         should_email(@u_guest_watcher)
@@ -798,7 +802,7 @@ describe NotificationService, services: true do
       it 'sends email to issue notification recipients' do
         notification.reopen_issue(issue, @u_disabled)
 
-        should_email(issue.assignee)
+        should_email(issue.assignees.first)
         should_email(issue.author)
         should_email(@u_watcher)
         should_email(@u_guest_watcher)
@@ -826,7 +830,7 @@ describe NotificationService, services: true do
       it 'sends email to issue notification recipients' do
         notification.issue_moved(issue, new_issue, @u_disabled)
 
-        should_email(issue.assignee)
+        should_email(issue.assignees.first)
         should_email(issue.author)
         should_email(@u_watcher)
         should_email(@u_guest_watcher)
diff --git a/spec/services/projects/autocomplete_service_spec.rb b/spec/services/projects/autocomplete_service_spec.rb
index 7916c2d957c..c198c3eedfc 100644
--- a/spec/services/projects/autocomplete_service_spec.rb
+++ b/spec/services/projects/autocomplete_service_spec.rb
@@ -11,7 +11,7 @@ describe Projects::AutocompleteService, services: true do
       let(:project) { create(:empty_project, :public) }
       let!(:issue) { create(:issue, project: project, title: 'Issue 1') }
       let!(:security_issue_1) { create(:issue, :confidential, project: project, title: 'Security issue 1', author: author) }
-      let!(:security_issue_2) { create(:issue, :confidential, title: 'Security issue 2', project: project, assignee: assignee) }
+      let!(:security_issue_2) { create(:issue, :confidential, title: 'Security issue 2', project: project, assignees: [assignee]) }
 
       it 'does not list project confidential issues for guests' do
         autocomplete = described_class.new(project, nil)
diff --git a/spec/services/slash_commands/interpret_service_spec.rb b/spec/services/slash_commands/interpret_service_spec.rb
index 29e65fe7ce6..865a7c69875 100644
--- a/spec/services/slash_commands/interpret_service_spec.rb
+++ b/spec/services/slash_commands/interpret_service_spec.rb
@@ -3,6 +3,7 @@ require 'spec_helper'
 describe SlashCommands::InterpretService, services: true do
   let(:project) { create(:empty_project, :public) }
   let(:developer) { create(:user) }
+  let(:developer2) { create(:user) }
   let(:issue) { create(:issue, project: project) }
   let(:milestone) { create(:milestone, project: project, title: '9.10') }
   let(:inprogress) { create(:label, project: project, title: 'In Progress') }
@@ -42,6 +43,7 @@ describe SlashCommands::InterpretService, services: true do
       end
     end
 
+<<<<<<< HEAD
     shared_examples 'assign command' do
       it 'fetches assignee and populates assignee_id if content contains /assign' do
         _, updates = service.execute(content, issuable)
@@ -59,6 +61,8 @@ describe SlashCommands::InterpretService, services: true do
       end
     end
 
+=======
+>>>>>>> b0a2435... Merge branch 'multiple_assignees_review_upstream' into ee_master
     shared_examples 'milestone command' do
       it 'fetches milestone and populates milestone_id if content contains /milestone' do
         milestone # populate the milestone
@@ -371,14 +375,46 @@ describe SlashCommands::InterpretService, services: true do
       let(:issuable) { issue }
     end
 
-    it_behaves_like 'assign command' do
+    context 'assign command' do
       let(:content) { "/assign @#{developer.username}" }
-      let(:issuable) { issue }
+
+      context 'Issue' do
+        it 'fetches assignee and populates assignee_id if content contains /assign' do
+          _, updates = service.execute(content, issue)
+
+          expect(updates).to eq(assignee_ids: [developer.id])
+        end
+      end
+
+      context 'Merge Request' do
+        it 'fetches assignee and populates assignee_id if content contains /assign' do
+          _, updates = service.execute(content, merge_request)
+
+          expect(updates).to eq(assignee_id: developer.id)
+        end
+      end
     end
 
-    it_behaves_like 'assign command' do
-      let(:content) { "/assign @#{developer.username}" }
-      let(:issuable) { merge_request }
+    context 'assign command with multiple assignees' do
+      let(:content) { "/assign @#{developer.username} @#{developer2.username}" }
+
+      before{ project.team << [developer2, :developer] }
+
+      context 'Issue' do
+        it 'fetches assignee and populates assignee_id if content contains /assign' do
+          _, updates = service.execute(content, issue)
+
+          expect(updates[:assignee_ids]).to match_array([developer.id, developer2.id])
+        end
+      end
+
+      context 'Merge Request' do
+        it 'fetches assignee and populates assignee_id if content contains /assign' do
+          _, updates = service.execute(content, merge_request)
+
+          expect(updates).to eq(assignee_id: developer.id)
+        end
+      end
     end
 
     it_behaves_like 'empty command' do
@@ -391,14 +427,26 @@ describe SlashCommands::InterpretService, services: true do
       let(:issuable) { issue }
     end
 
-    it_behaves_like 'unassign command' do
+    context 'unassign command' do
       let(:content) { '/unassign' }
-      let(:issuable) { issue }
-    end
 
-    it_behaves_like 'unassign command' do
-      let(:content) { '/unassign' }
-      let(:issuable) { merge_request }
+      context 'Issue' do
+        it 'populates assignee_ids: [] if content contains /unassign' do
+          issue.update(assignee_ids: [developer.id])
+          _, updates = service.execute(content, issue)
+
+          expect(updates).to eq(assignee_ids: [])
+        end
+      end
+
+      context 'Merge Request' do
+        it 'populates assignee_id: nil if content contains /unassign' do
+          merge_request.update(assignee_id: developer.id)
+          _, updates = service.execute(content, merge_request)
+
+          expect(updates).to eq(assignee_id: nil)
+        end
+      end
     end
 
     it_behaves_like 'milestone command' do
diff --git a/spec/services/system_note_service_spec.rb b/spec/services/system_note_service_spec.rb
index 75d7caf2508..5f1b82e8355 100644
--- a/spec/services/system_note_service_spec.rb
+++ b/spec/services/system_note_service_spec.rb
@@ -6,6 +6,7 @@ describe SystemNoteService, services: true do
   let(:project)  { create(:empty_project) }
   let(:author)   { create(:user) }
   let(:noteable) { create(:issue, project: project) }
+  let(:issue)    { noteable }
 
   shared_examples_for 'a system note' do
     let(:expected_noteable) { noteable }
@@ -155,6 +156,50 @@ describe SystemNoteService, services: true do
     end
   end
 
+  describe '.change_issue_assignees' do
+    subject { described_class.change_issue_assignees(noteable, project, author, [assignee]) }
+
+    let(:assignee) { create(:user) }
+    let(:assignee1) { create(:user) }
+    let(:assignee2) { create(:user) }
+    let(:assignee3) { create(:user) }
+
+    it_behaves_like 'a system note'
+
+    def build_note(old_assignees, new_assignees)
+      issue.assignees = new_assignees
+      described_class.change_issue_assignees(issue, project, author, old_assignees).note
+    end
+
+    it 'builds a correct phrase when an assignee is added to a non-assigned issue' do
+      expect(build_note([], [assignee1])).to eq "assigned to @#{assignee1.username}"
+    end
+
+    it 'builds a correct phrase when assignee removed' do
+      expect(build_note([assignee1], [])).to eq 'removed all assignees'
+    end
+
+    it 'builds a correct phrase when assignees changed' do
+      expect(build_note([assignee1], [assignee2])).to eq \
+        "assigned to @#{assignee2.username} and unassigned @#{assignee1.username}"
+    end
+
+    it 'builds a correct phrase when three assignees removed and one added' do
+      expect(build_note([assignee, assignee1, assignee2], [assignee3])).to eq \
+        "assigned to @#{assignee3.username} and unassigned @#{assignee.username}, @#{assignee1.username}, and @#{assignee2.username}"
+    end
+
+    it 'builds a correct phrase when one assignee changed from a set' do
+      expect(build_note([assignee, assignee1], [assignee, assignee2])).to eq \
+        "assigned to @#{assignee2.username} and unassigned @#{assignee1.username}"
+    end
+
+    it 'builds a correct phrase when one assignee removed from a set' do
+      expect(build_note([assignee, assignee1, assignee2], [assignee, assignee1])).to eq \
+        "unassigned @#{assignee2.username}"
+    end
+  end
+
   describe '.change_label' do
     subject { described_class.change_label(noteable, project, author, added, removed) }
 
diff --git a/spec/services/todo_service_spec.rb b/spec/services/todo_service_spec.rb
index 89b3b6aad10..175a42a32d9 100644
--- a/spec/services/todo_service_spec.rb
+++ b/spec/services/todo_service_spec.rb
@@ -25,11 +25,11 @@ describe TodoService, services: true do
   end
 
   describe 'Issues' do
-    let(:issue) { create(:issue, project: project, assignee: john_doe, author: author, description: "- [ ] Task 1\n- [ ] Task 2 #{mentions}") }
-    let(:addressed_issue) { create(:issue, project: project, assignee: john_doe, author: author, description: "#{directly_addressed}\n- [ ] Task 1\n- [ ] Task 2") }
-    let(:unassigned_issue) { create(:issue, project: project, assignee: nil) }
-    let(:confidential_issue) { create(:issue, :confidential, project: project, author: author, assignee: assignee, description: mentions) }
-    let(:addressed_confident_issue) { create(:issue, :confidential, project: project, author: author, assignee: assignee, description: directly_addressed) }
+    let(:issue) { create(:issue, project: project, assignees: [john_doe], author: author, description: "- [ ] Task 1\n- [ ] Task 2 #{mentions}") }
+    let(:addressed_issue) { create(:issue, project: project, assignees: [john_doe], author: author, description: "#{directly_addressed}\n- [ ] Task 1\n- [ ] Task 2") }
+    let(:unassigned_issue) { create(:issue, project: project, assignees: []) }
+    let(:confidential_issue) { create(:issue, :confidential, project: project, author: author, assignees: [assignee], description: mentions) }
+    let(:addressed_confident_issue) { create(:issue, :confidential, project: project, author: author, assignees: [assignee], description: directly_addressed) }
 
     describe '#new_issue' do
       it 'creates a todo if assigned' do
@@ -43,7 +43,7 @@ describe TodoService, services: true do
       end
 
       it 'creates a todo if assignee is the current user' do
-        unassigned_issue.update_attribute(:assignee, john_doe)
+        unassigned_issue.assignees = [john_doe]
         service.new_issue(unassigned_issue, john_doe)
 
         should_create_todo(user: john_doe, target: unassigned_issue, author: john_doe, action: Todo::ASSIGNED)
@@ -258,20 +258,20 @@ describe TodoService, services: true do
 
     describe '#reassigned_issue' do
       it 'creates a pending todo for new assignee' do
-        unassigned_issue.update_attribute(:assignee, john_doe)
+        unassigned_issue.assignees << john_doe
         service.reassigned_issue(unassigned_issue, author)
 
         should_create_todo(user: john_doe, target: unassigned_issue, action: Todo::ASSIGNED)
       end
 
       it 'does not create a todo if unassigned' do
-        issue.update_attribute(:assignee, nil)
+        issue.assignees.destroy_all
 
         should_not_create_any_todo { service.reassigned_issue(issue, author) }
       end
 
       it 'creates a todo if new assignee is the current user' do
-        unassigned_issue.update_attribute(:assignee, john_doe)
+        unassigned_issue.assignees << john_doe
         service.reassigned_issue(unassigned_issue, john_doe)
 
         should_create_todo(user: john_doe, target: unassigned_issue, author: john_doe, action: Todo::ASSIGNED)
@@ -361,7 +361,7 @@ describe TodoService, services: true do
     describe '#new_note' do
       let!(:first_todo) { create(:todo, :assigned, user: john_doe, project: project, target: issue, author: author) }
       let!(:second_todo) { create(:todo, :assigned, user: john_doe, project: project, target: issue, author: author) }
-      let(:confidential_issue) { create(:issue, :confidential, project: project, author: author, assignee: assignee) }
+      let(:confidential_issue) { create(:issue, :confidential, project: project, author: author, assignees: [assignee]) }
       let(:note) { create(:note, project: project, noteable: issue, author: john_doe, note: mentions) }
       let(:addressed_note) { create(:note, project: project, noteable: issue, author: john_doe, note: directly_addressed) }
       let(:note_on_commit) { create(:note_on_commit, project: project, author: john_doe, note: mentions) }
@@ -854,7 +854,7 @@ describe TodoService, services: true do
   end
 
   it 'updates cached counts when a todo is created' do
-    issue = create(:issue, project: project, assignee: john_doe, author: author, description: mentions)
+    issue = create(:issue, project: project, assignees: [john_doe], author: author, description: mentions)
 
     expect(john_doe.todos_pending_count).to eq(0)
     expect(john_doe).to receive(:update_todos_count_cache).and_call_original
@@ -866,8 +866,8 @@ describe TodoService, services: true do
   end
 
   describe '#mark_todos_as_done' do
-    let(:issue) { create(:issue, project: project, author: author, assignee: john_doe) }
-    let(:another_issue) { create(:issue, project: project, author: author, assignee: john_doe) }
+    let(:issue) { create(:issue, project: project, author: author, assignees: [john_doe]) }
+    let(:another_issue) { create(:issue, project: project, author: author, assignees: [john_doe]) }
 
     it 'marks a relation of todos as done' do
       create(:todo, :mentioned, user: john_doe, target: issue, project: project)