diff options
46 files changed, 170 insertions, 52 deletions
diff --git a/app/controllers/projects/tags_controller.rb b/app/controllers/projects/tags_controller.rb index a17c050b696..7d9387b1d94 100644 --- a/app/controllers/projects/tags_controller.rb +++ b/app/controllers/projects/tags_controller.rb @@ -8,8 +8,7 @@ class Projects::TagsController < Projects::ApplicationController # Authorize before_action :require_non_empty_project before_action :authorize_download_code! - before_action :authorize_push_code!, only: [:new, :create] - before_action :authorize_admin_project!, only: [:destroy] + before_action :authorize_admin_tag!, only: [:new, :create, :destroy] # rubocop: disable CodeReuse/ActiveRecord def index diff --git a/app/policies/project_policy.rb b/app/policies/project_policy.rb index b3e29e775fc..08bfe5d14ee 100644 --- a/app/policies/project_policy.rb +++ b/app/policies/project_policy.rb @@ -297,6 +297,7 @@ class ProjectPolicy < BasePolicy end rule { (mirror_available & can?(:admin_project)) | admin }.enable :admin_remote_mirror + rule { can?(:push_code) }.enable :admin_tag rule { archived }.policy do prevent :push_code diff --git a/app/views/projects/tags/_tag.html.haml b/app/views/projects/tags/_tag.html.haml index 8bfface3f5a..b1432917f1d 100644 --- a/app/views/projects/tags/_tag.html.haml +++ b/app/views/projects/tags/_tag.html.haml @@ -26,10 +26,8 @@ .row-fixed-content.controls.flex-row = render 'projects/buttons/download', project: @project, ref: tag.name, pipeline: @tags_pipelines[tag.name] - - if can?(current_user, :push_code, @project) + - if can?(current_user, :admin_tag, @project) = link_to edit_project_tag_release_path(@project, tag.name), class: 'btn btn-edit has-tooltip', title: s_('TagsPage|Edit release notes'), data: { container: "body" } do = icon("pencil") - - - if can?(current_user, :admin_project, @project) - = link_to project_tag_path(@project, tag.name), class: "btn btn-remove remove-row has-tooltip prepend-left-10 #{protected_tag?(@project, tag) ? 'disabled' : ''}", title: s_('TagsPage|Delete tag'), method: :delete, data: { confirm: s_('TagsPage|Deleting the %{tag_name} tag cannot be undone. Are you sure?') % { tag_name: tag.name }, container: 'body' }, remote: true do - = icon("trash-o") + = link_to project_tag_path(@project, tag.name), class: "btn btn-remove remove-row has-tooltip prepend-left-10 #{protected_tag?(@project, tag) ? 'disabled' : ''}", title: s_('TagsPage|Delete tag'), method: :delete, data: { confirm: s_('TagsPage|Deleting the %{tag_name} tag cannot be undone. Are you sure?') % { tag_name: tag.name }, container: 'body' }, remote: true do + = icon("trash-o") diff --git a/app/views/projects/tags/index.html.haml b/app/views/projects/tags/index.html.haml index 2e78b0bff3e..1f0de1e2603 100644 --- a/app/views/projects/tags/index.html.haml +++ b/app/views/projects/tags/index.html.haml @@ -24,7 +24,7 @@ - tags_sort_options_hash.each do |value, title| %li = link_to title, filter_tags_path(sort: value), class: ("is-active" if @sort == value) - - if can?(current_user, :push_code, @project) + - if can?(current_user, :admin_tag, @project) = link_to new_project_tag_path(@project), class: 'btn btn-success new-tag-btn' do = s_('TagsPage|New tag') = link_to project_tags_path(@project, rss_url_options), title: _("Tags feed"), class: 'btn d-none d-sm-inline-block has-tooltip' do diff --git a/app/views/projects/tags/show.html.haml b/app/views/projects/tags/show.html.haml index 59232372150..02f6ef02843 100644 --- a/app/views/projects/tags/show.html.haml +++ b/app/views/projects/tags/show.html.haml @@ -19,7 +19,7 @@ = s_("TagsPage|Can't find HEAD commit for this tag") .nav-controls - - if can?(current_user, :push_code, @project) + - if can?(current_user, :admin_tag, @project) = link_to edit_project_tag_release_path(@project, @tag.name), class: 'btn btn-edit controls-item has-tooltip', title: s_('TagsPage|Edit release notes') do = icon("pencil") = link_to project_tree_path(@project, @tag.name), class: 'btn controls-item has-tooltip', title: s_('TagsPage|Browse files') do @@ -28,7 +28,7 @@ = icon('history') .btn-container.controls-item = render 'projects/buttons/download', project: @project, ref: @tag.name - - if can?(current_user, :push_code, @project) && can?(current_user, :admin_project, @project) + - if can?(current_user, :admin_tag, @project) .btn-container.controls-item-full = link_to project_tag_path(@project, @tag.name), class: "btn btn-remove remove-row has-tooltip #{protected_tag?(@project, @tag) ? 'disabled' : ''}", title: s_('TagsPage|Delete tag'), method: :delete, data: { confirm: s_('TagsPage|Deleting the %{tag_name} tag cannot be undone. Are you sure?') % { tag_name: @tag.name } } do %i.fa.fa-trash-o diff --git a/changelogs/unreleased/11448-fix-cs-with-k8s-runners.yml b/changelogs/unreleased/11448-fix-cs-with-k8s-runners.yml new file mode 100644 index 00000000000..191e64df4f1 --- /dev/null +++ b/changelogs/unreleased/11448-fix-cs-with-k8s-runners.yml @@ -0,0 +1,5 @@ +--- +title: Fix Container Scanning job timeout when using the kubernetes executor +merge_request: 29706 +author: +type: fixed diff --git a/changelogs/unreleased/52954-allow-developers-to-delete-tags.yml b/changelogs/unreleased/52954-allow-developers-to-delete-tags.yml new file mode 100644 index 00000000000..38c65a67f2a --- /dev/null +++ b/changelogs/unreleased/52954-allow-developers-to-delete-tags.yml @@ -0,0 +1,5 @@ +--- +title: Allow developers to delete tags +merge_request: 29668 +author: +type: changed diff --git a/changelogs/unreleased/57918-encrypt-feature-flags-tokens-changelog.yml b/changelogs/unreleased/57918-encrypt-feature-flags-tokens-changelog.yml new file mode 100644 index 00000000000..9701c8bc4a5 --- /dev/null +++ b/changelogs/unreleased/57918-encrypt-feature-flags-tokens-changelog.yml @@ -0,0 +1,5 @@ +--- +title: Add token_encrypted column to operations_feature_flags_clients table +merge_request: +author: +type: other diff --git a/changelogs/unreleased/59702-fix-notification-flags-for-ms-teams.yml b/changelogs/unreleased/59702-fix-notification-flags-for-ms-teams.yml new file mode 100644 index 00000000000..14a8da95ed9 --- /dev/null +++ b/changelogs/unreleased/59702-fix-notification-flags-for-ms-teams.yml @@ -0,0 +1,5 @@ +---
+title: Fix missing API notification flags for Microsoft Teams
+merge_request: 29824
+author: Seiji Suenaga
+type: fixed
diff --git a/changelogs/unreleased/61201-pass-identities-to-external-authorization.yml b/changelogs/unreleased/61201-pass-identities-to-external-authorization.yml new file mode 100644 index 00000000000..82eea653de6 --- /dev/null +++ b/changelogs/unreleased/61201-pass-identities-to-external-authorization.yml @@ -0,0 +1,5 @@ +--- +title: Add identity information to external authorization requests +merge_request: 29461 +author: +type: changed diff --git a/doc/api/services.md b/doc/api/services.md index f38f96f64ad..042fee4a21a 100644 --- a/doc/api/services.md +++ b/doc/api/services.md @@ -1023,6 +1023,8 @@ Parameters: | Parameter | Type | Required | Description | | --------- | ---- | -------- | ----------- | | `webhook` | string | true | The Microsoft Teams webhook. For example, `https://outlook.office.com/webhook/...` | +| `notify_only_broken_pipelines` | boolean | false | Send notifications for broken pipelines | +| `notify_only_default_branch` | boolean | false | Send notifications only for the default branch | | `push_events` | boolean | false | Enable notifications for push events | | `issues_events` | boolean | false | Enable notifications for issue events | | `confidential_issues_events` | boolean | false | Enable notifications for confidential issue events | diff --git a/doc/ci/pipelines.md b/doc/ci/pipelines.md index 5d54fbe519c..4a07aa31f8a 100644 --- a/doc/ci/pipelines.md +++ b/doc/ci/pipelines.md @@ -139,7 +139,7 @@ The union of A, B, and C is (1, 4) and (6, 7). Therefore, the total running time (4 - 1) + (7 - 6) => 4 ``` -## Expanding and collapsing job log sections +### Expanding and collapsing job log sections > [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/issues/14664) in GitLab > 12.0. diff --git a/doc/development/architecture.md b/doc/development/architecture.md index 5f32cd7eba2..d817d513173 100644 --- a/doc/development/architecture.md +++ b/doc/development/architecture.md @@ -149,7 +149,7 @@ Component statuses are linked to configuration documentation for each component. | [PgBouncer Exporter](#pgbouncer-exporter) | Prometheus endpoint with PgBouncer metrics | [⚙][pgbouncer-exporter-omnibus] | [❌][pgbouncer-exporter-charts] | [❌][pgbouncer-exporter-charts] | [✅](https://about.gitlab.com/handbook/engineering/monitoring/) | ❌ | ❌ | CE & EE | | [GitLab Monitor](#gitlab-monitor) | Generates a variety of GitLab metrics | [✅][gitlab-monitor-omnibus] | [❌][gitab-monitor-charts] | [❌][gitab-monitor-charts] | [✅](https://about.gitlab.com/handbook/engineering/monitoring/) | ❌ | ❌ | CE & EE | | [Node Exporter](#node-exporter) | Prometheus endpoint with system metrics | [✅][node-exporter-omnibus] | [❌][node-exporter-charts] | [❌][node-exporter-charts] | [✅](https://about.gitlab.com/handbook/engineering/monitoring/) | ❌ | ❌ | CE & EE | -| [Mattermost](#mattermost) | Open-source Slack alternative | [⚙][mattermost-omnibus] | [⤓][mattermost-charts] | [⤓][mattermost-charts] | [⤓](../user/project/integrations/mattermost_slash_commands.md#manual-configuration), [⤓](../user/project/integrations/mattermost.html) | ❌ | ❌ | CE & EE | +| [Mattermost](#mattermost) | Open-source Slack alternative | [⚙][mattermost-omnibus] | [⤓][mattermost-charts] | [⤓][mattermost-charts] | [⤓](../user/project/integrations/mattermost.md) | ❌ | ❌ | CE & EE | | [MinIO](#minio) | Object storage service | [⤓][minio-omnibus] | [✅][minio-charts] | [✅][minio-charts] | [✅](https://about.gitlab.com/handbook/engineering/infrastructure/production-architecture/#storage-architecture) | ❌ | [⚙][minio-gdk] | CE & EE | | [Runner](#gitlab-runner) | Executes GitLab CI jobs | [⤓][runner-omnibus] | [✅][runner-charts] | [⚙][runner-charts] | [✅](../user/gitlab_com/index.md#shared-runners) | [⚙][runner-source] | [⚙][runner-gdk] | CE & EE | | [Database Migrations](#database-migrations) | Database migrations | [✅][database-migrations-omnibus] | [✅][database-migrations-charts] | [✅][database-migrations-charts] | ✅ | [⚙][database-migrations-source] | ✅ | CE & EE | diff --git a/doc/development/i18n/externalization.md b/doc/development/i18n/externalization.md index 9fb8ea542d9..ce310672dad 100644 --- a/doc/development/i18n/externalization.md +++ b/doc/development/i18n/externalization.md @@ -77,6 +77,9 @@ Or: hello = _("Hello world!") ``` +NOTE: **Note:** Messages in the API (`lib/api/` or `app/graphql`) do +not need to be externalised. + ### HAML files Given the following content in HAML: diff --git a/doc/update/upgrading_from_source.md b/doc/update/upgrading_from_source.md index bc8e5fed774..5e18769f0f1 100644 --- a/doc/update/upgrading_from_source.md +++ b/doc/update/upgrading_from_source.md @@ -4,6 +4,10 @@ comments: false # Upgrading Community Edition and Enterprise Edition from source +NOTE: **Note:** +Users wishing to upgrade to 12.0.0 will have to take some extra steps. See the +version specific upgrade instructions for 12.0.0 for more details. + Make sure you view this update guide from the branch (version) of GitLab you would like to install (e.g., `11.8`. You can select the version in the version dropdown at the top left corner of GitLab (below the menu bar). @@ -404,6 +408,23 @@ Example: Additional instructions here. --> +### 12.0.0 + +In 12.0.0 we made various database related changes. These changes require that +users first upgrade to the latest 11.11 patch release. Once upgraded to 11.11.x, +users can upgrade to 12.0.x. You **can not** upgrade from 11.11.x to 12.1.0 or a +newer version, instead you **must** first upgrade to 12.0.0. Failure to do so +may result in database migrations not being applied, which could lead to +application errors. + +Example 1: you are currently using GitLab 11.11.3, which is the latest patch +release for 11.11.x. To upgrade, first upgrade to 12.0.0, then upgrade to any +future versions. + +Example 2: you are currently using a version of GitLab 10.x. To upgrade, first +upgrade to 11.11.3. Once upgraded to 11.11.3 you can safely upgrade to 12.0.0, +then upgrade to any future versions. + ## Things went south? Revert to previous version ### 1. Revert the code to the previous version diff --git a/doc/user/admin_area/settings/continuous_integration.md b/doc/user/admin_area/settings/continuous_integration.md index d2605cbfb5e..fde7d1aeaf7 100644 --- a/doc/user/admin_area/settings/continuous_integration.md +++ b/doc/user/admin_area/settings/continuous_integration.md @@ -89,10 +89,8 @@ are enabled.  -When the pipeline minutes quota for a group is set to a value different than 0, -the **Pipelines quota** page is available to the group page settings list. -You can see there an overview of the pipeline minutes quota of all projects of -the group. +You can see an overview of the pipeline minutes quota of all projects of +a group in the **Usage Quotas** page available to the group page settings list.  diff --git a/doc/user/admin_area/settings/external_authorization.md b/doc/user/admin_area/settings/external_authorization.md index 11c0867da17..c1aa04f7bc2 100644 --- a/doc/user/admin_area/settings/external_authorization.md +++ b/doc/user/admin_area/settings/external_authorization.md @@ -76,13 +76,19 @@ service with this body: { "user_identifier": "jane@acme.org", "project_classification_label": "project-label", - "user_ldap_dn": "CN=Jane Doe,CN=admin,DC=acme" + "user_ldap_dn": "CN=Jane Doe,CN=admin,DC=acme", + "identities": [ + { "provider": "ldap", "extern_uid": "CN=Jane Doe,CN=admin,DC=acme" }, + { "provider": "bitbucket", "extern_uid": "2435223452345" } + ] } ``` The `user_ldap_dn` is optional and is only sent when the user is logged in through LDAP. +`identities` will contain the details of all the identities associated with the user. This will be an empty array if there are no identities associated with the user. + When the external authorization service responds with a status code 200, the user is granted access. When the external service responds with a status code 401 or 403, the user is denied access. In any case, the request is cached for 6 hours. diff --git a/doc/user/admin_area/settings/img/group_pipelines_quota.png b/doc/user/admin_area/settings/img/group_pipelines_quota.png Binary files differindex d94b609ad6f..318527426bd 100644 --- a/doc/user/admin_area/settings/img/group_pipelines_quota.png +++ b/doc/user/admin_area/settings/img/group_pipelines_quota.png diff --git a/doc/user/group/img/group_storage_usage_quota.png b/doc/user/group/img/group_storage_usage_quota.png Binary files differnew file mode 100644 index 00000000000..c5d81ad7a8b --- /dev/null +++ b/doc/user/group/img/group_storage_usage_quota.png diff --git a/doc/user/group/index.md b/doc/user/group/index.md index 95e10be9974..abd95eddf63 100644 --- a/doc/user/group/index.md +++ b/doc/user/group/index.md @@ -381,6 +381,14 @@ Define project templates at a group level by setting a group as the template sou for the group. **[STARTER ONLY]** - **Pipelines quota**: Keep track of the [pipeline quota](../admin_area/settings/continuous_integration.md) for the group. +#### Storage usage quota **[STARTER]** + +> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/13294) in [GitLab Starter](https://about.gitlab.com/pricing/) 12.0. + +A group owner can check the aggregated storage usage for all the project in a group, sub-groups included, in the **Storage** tab of the **Usage Quotas** page available to the group page settings list. + + + ## User contribution analysis **[STARTER]** With [GitLab Contribution Analytics](contribution_analytics/index.md), diff --git a/doc/user/permissions.md b/doc/user/permissions.md index 4b2dfdfc32e..7af3d4a0ac3 100644 --- a/doc/user/permissions.md +++ b/doc/user/permissions.md @@ -95,6 +95,7 @@ The following table depicts the various user permission levels in a project. | Dismiss vulnerability **[ULTIMATE]** | | | ✓ | ✓ | ✓ | | Apply code change suggestions | | | ✓ | ✓ | ✓ | | Create and edit wiki pages | | | ✓ | ✓ | ✓ | +| Rewrite/remove Git tags | | | ✓ | ✓ | ✓ | | Use environment terminals | | | | ✓ | ✓ | | Run Web IDE's Interactive Web Terminals **[ULTIMATE ONLY]** | | | | ✓ | ✓ | | Add new team members | | | | ✓ | ✓ | @@ -102,7 +103,6 @@ The following table depicts the various user permission levels in a project. | Push to protected branches | | | | ✓ | ✓ | | Turn on/off protected branch push for devs | | | | ✓ | ✓ | | Enable/disable tag protections | | | | ✓ | ✓ | -| Rewrite/remove Git tags | | | | ✓ | ✓ | | Edit project | | | | ✓ | ✓ | | Add deploy keys to project | | | | ✓ | ✓ | | Configure project hooks | | | | ✓ | ✓ | diff --git a/doc/user/project/integrations/mattermost.md b/doc/user/project/integrations/mattermost.md index d7fd75fd728..ea58a08e127 100644 --- a/doc/user/project/integrations/mattermost.md +++ b/doc/user/project/integrations/mattermost.md @@ -1,5 +1,9 @@ # Mattermost Notifications Service +The Mattermost Notifications Service allows your GitLab project to send events (e.g., `issue created`) to your existing Mattermost team as notifications. This requires configurations in both Mattermost and GitLab. + +You can also use Mattermost slash commands to control GitLab inside Mattermost. This is the separately configured [Mattermost slash commands](mattermost_slash_commands.md). + ## On Mattermost To enable Mattermost integration you must create an incoming webhook integration: diff --git a/doc/user/project/integrations/mattermost_slash_commands.md b/doc/user/project/integrations/mattermost_slash_commands.md index 9c69437537a..41be26c1d30 100644 --- a/doc/user/project/integrations/mattermost_slash_commands.md +++ b/doc/user/project/integrations/mattermost_slash_commands.md @@ -6,6 +6,9 @@ Mattermost commands give users an extra interface to perform common operations from the chat environment. This allows one to, for example, create an issue as soon as the idea was discussed in Mattermost. +GitLab can also send events (e.g., `issue created`) to Mattermost as notifications. +This is the separately configured [Mattermost Notifications Service](mattermost.md). + ## Prerequisites Mattermost 3.4 and up is required. diff --git a/doc/user/project/issues/img/link_zoom_call_in_issue.png b/doc/user/project/issues/img/link_zoom_call_in_issue.png Binary files differnew file mode 100644 index 00000000000..3153a0a9b07 --- /dev/null +++ b/doc/user/project/issues/img/link_zoom_call_in_issue.png diff --git a/doc/user/project/issues/issue_data_and_actions.md b/doc/user/project/issues/issue_data_and_actions.md index da585022263..ac26b672d99 100644 --- a/doc/user/project/issues/issue_data_and_actions.md +++ b/doc/user/project/issues/issue_data_and_actions.md @@ -149,6 +149,12 @@ The plain text title and description of the issue fill the top center of the iss The description fully supports [GitLab Flavored Markdown](../../markdown.md#gitlab-flavored-markdown-gfm), allowing many formatting options. +##### 16.1 Zoom Call Links + +Including a link to a Zoom call in the description of an issue will result in a "Join Zoom meeting" button at the top of the issue, just under the header. To remove the button, edit the description and remove the Zoom call link. + + + #### 17. Mentions You can mention a user or a group present in your GitLab instance with `@username` or diff --git a/lib/api/helpers.rb b/lib/api/helpers.rb index 00bcf6b055b..fd258e3edbc 100644 --- a/lib/api/helpers.rb +++ b/lib/api/helpers.rb @@ -235,6 +235,10 @@ module API authorize! :push_code, user_project end + def authorize_admin_tag + authorize! :admin_tag, user_project + end + def authorize_admin_project authorize! :admin_project, user_project end diff --git a/lib/api/helpers/services_helpers.rb b/lib/api/helpers/services_helpers.rb index 44c577204b8..cf2e9d01356 100644 --- a/lib/api/helpers/services_helpers.rb +++ b/lib/api/helpers/services_helpers.rb @@ -683,8 +683,9 @@ module API name: :webhook, type: String, desc: 'The Microsoft Teams webhook. e.g. https://outlook.office.com/webhook/…' - } - ], + }, + chat_notification_flags + ].flatten, 'mattermost' => [ chat_notification_settings, chat_notification_flags, diff --git a/lib/api/tags.rb b/lib/api/tags.rb index f5359fd316c..796b1450602 100644 --- a/lib/api/tags.rb +++ b/lib/api/tags.rb @@ -55,7 +55,7 @@ module API optional :release_description, type: String, desc: 'Specifying release notes stored in the GitLab database (deprecated in GitLab 11.7)' end post ':id/repository/tags' do - authorize_push_project + authorize_admin_tag result = ::Tags::CreateService.new(user_project, current_user) .execute(params[:tag_name], params[:ref], params[:message]) @@ -87,7 +87,7 @@ module API requires :tag_name, type: String, desc: 'The name of the tag' end delete ':id/repository/tags/:tag_name', requirements: TAG_ENDPOINT_REQUIREMENTS do - authorize_push_project + authorize_admin_tag tag = user_project.repository.find_tag(params[:tag_name]) not_found!('Tag') unless tag diff --git a/lib/gitlab/checks/tag_check.rb b/lib/gitlab/checks/tag_check.rb index 2a75c8059bd..ced0612a7a3 100644 --- a/lib/gitlab/checks/tag_check.rb +++ b/lib/gitlab/checks/tag_check.rb @@ -19,7 +19,7 @@ module Gitlab return unless tag_name logger.log_timed(LOG_MESSAGES[:tag_checks]) do - if tag_exists? && user_access.cannot_do_action?(:admin_project) + if tag_exists? && user_access.cannot_do_action?(:admin_tag) raise GitAccess::UnauthorizedError, ERROR_MESSAGES[:change_existing_tags] end end diff --git a/lib/gitlab/ci/templates/Security/Container-Scanning.gitlab-ci.yml b/lib/gitlab/ci/templates/Security/Container-Scanning.gitlab-ci.yml index 5372ec6cceb..d1a34c515fa 100644 --- a/lib/gitlab/ci/templates/Security/Container-Scanning.gitlab-ci.yml +++ b/lib/gitlab/ci/templates/Security/Container-Scanning.gitlab-ci.yml @@ -30,7 +30,7 @@ container_scanning: services: - docker:stable-dind script: - - if [ -z "$DOCKER_HOST" -a "$KUBERNETES_PORT" ]; then { export DOCKER_SERVICE="localhost" ; export DOCKER_HOST="tcp://${DOCKER_SERVICE}:2375" ; } fi + - if [[ -n "$KUBERNETES_PORT" ]]; then { export DOCKER_SERVICE="localhost" ; export DOCKER_HOST="tcp://${DOCKER_SERVICE}:2375" ; } fi - | if [[ -n "$CI_REGISTRY_USER" ]]; then echo "Logging to GitLab Container Registry with CI credentials..." diff --git a/lib/gitlab/external_authorization/client.rb b/lib/gitlab/external_authorization/client.rb index 60aab2e7044..7985e6dcf7b 100644 --- a/lib/gitlab/external_authorization/client.rb +++ b/lib/gitlab/external_authorization/client.rb @@ -48,7 +48,8 @@ module Gitlab @body ||= begin body = { user_identifier: @user.email, - project_classification_label: @label + project_classification_label: @label, + identities: @user.identities.map { |identity| { provider: identity.provider, extern_uid: identity.extern_uid } } } if @user.ldap_identity diff --git a/lib/gitlab/user_access.rb b/lib/gitlab/user_access.rb index 9ef23cf849f..097b502316e 100644 --- a/lib/gitlab/user_access.rb +++ b/lib/gitlab/user_access.rb @@ -45,7 +45,7 @@ module Gitlab if protected?(ProtectedTag, project, ref) protected_tag_accessible_to?(ref, action: :create) else - user.can?(:push_code, project) + user.can?(:admin_tag, project) end end diff --git a/qa/qa/specs/features/browser_ui/1_manage/login/login_via_oauth_spec.rb b/qa/qa/specs/features/browser_ui/1_manage/login/login_via_oauth_spec.rb index 15cd59f041b..a118176eb8a 100644 --- a/qa/qa/specs/features/browser_ui/1_manage/login/login_via_oauth_spec.rb +++ b/qa/qa/specs/features/browser_ui/1_manage/login/login_via_oauth_spec.rb @@ -1,8 +1,7 @@ # frozen_string_literal: true module QA - # https://gitlab.com/gitlab-org/quality/nightly/issues/100 - context 'Manage', :orchestrated, :oauth, :quarantine do + context 'Manage', :orchestrated, :oauth do describe 'OAuth login' do it 'User logs in to GitLab with GitHub OAuth' do Runtime::Browser.visit(:gitlab, Page::Main::Login) diff --git a/qa/qa/specs/features/browser_ui/3_create/merge_request/merge_merge_request_from_fork_spec.rb b/qa/qa/specs/features/browser_ui/3_create/merge_request/merge_merge_request_from_fork_spec.rb index c7db595284e..6ca7af8a3af 100644 --- a/qa/qa/specs/features/browser_ui/3_create/merge_request/merge_merge_request_from_fork_spec.rb +++ b/qa/qa/specs/features/browser_ui/3_create/merge_request/merge_merge_request_from_fork_spec.rb @@ -1,8 +1,7 @@ # frozen_string_literal: true module QA - # Failure issue: https://gitlab.com/gitlab-org/quality/nightly/issues/94 - context 'Create', :quarantine do + context 'Create' do describe 'Merge request creation from fork' do it 'user forks a project, submits a merge request and maintainer merges it' do Runtime::Browser.visit(:gitlab, Page::Main::Login) diff --git a/qa/qa/specs/features/browser_ui/3_create/merge_request/squash_merge_request_spec.rb b/qa/qa/specs/features/browser_ui/3_create/merge_request/squash_merge_request_spec.rb index 86692623790..a93f2695ec2 100644 --- a/qa/qa/specs/features/browser_ui/3_create/merge_request/squash_merge_request_spec.rb +++ b/qa/qa/specs/features/browser_ui/3_create/merge_request/squash_merge_request_spec.rb @@ -1,8 +1,7 @@ # frozen_string_literal: true module QA - # Failure issue: https://gitlab.com/gitlab-org/quality/nightly/issues/93 - context 'Create', :quarantine do + context 'Create' do describe 'Merge request squashing' do it 'user squashes commits while merging' do Runtime::Browser.visit(:gitlab, Page::Main::Login) diff --git a/spec/features/tags/master_creates_tag_spec.rb b/spec/features/tags/developer_creates_tag_spec.rb index f80ddd050d7..b2ad7ed8f3f 100644 --- a/spec/features/tags/master_creates_tag_spec.rb +++ b/spec/features/tags/developer_creates_tag_spec.rb @@ -1,11 +1,12 @@ require 'spec_helper' -describe 'Maintainer creates tag' do +describe 'Developer creates tag' do let(:user) { create(:user) } - let(:project) { create(:project, :repository, namespace: user.namespace) } + let(:group) { create(:group) } + let(:project) { create(:project, :repository, namespace: group) } before do - project.add_maintainer(user) + project.add_developer(user) sign_in(user) end diff --git a/spec/features/tags/master_deletes_tag_spec.rb b/spec/features/tags/developer_deletes_tag_spec.rb index bdbbe645779..dc4c7a4fb0a 100644 --- a/spec/features/tags/master_deletes_tag_spec.rb +++ b/spec/features/tags/developer_deletes_tag_spec.rb @@ -1,11 +1,12 @@ require 'spec_helper' -describe 'Maintainer deletes tag' do +describe 'Developer deletes tag' do let(:user) { create(:user) } - let(:project) { create(:project, :repository, namespace: user.namespace) } + let(:group) { create(:group) } + let(:project) { create(:project, :repository, namespace: group) } before do - project.add_maintainer(user) + project.add_developer(user) sign_in(user) visit project_tags_path(project) end diff --git a/spec/features/tags/master_updates_tag_spec.rb b/spec/features/tags/developer_updates_tag_spec.rb index d8b5b3c4cc4..1e11fc9e5d5 100644 --- a/spec/features/tags/master_updates_tag_spec.rb +++ b/spec/features/tags/developer_updates_tag_spec.rb @@ -1,11 +1,12 @@ require 'spec_helper' -describe 'Maintainer updates tag' do +describe 'Developer updates tag' do let(:user) { create(:user) } - let(:project) { create(:project, :repository, namespace: user.namespace) } + let(:group) { create(:group) } + let(:project) { create(:project, :repository, namespace: group) } before do - project.add_maintainer(user) + project.add_developer(user) sign_in(user) visit project_tags_path(project) end diff --git a/spec/features/tags/master_views_tags_spec.rb b/spec/features/tags/developer_views_tags_spec.rb index 36cfeb5ed84..09e644c6b97 100644 --- a/spec/features/tags/master_views_tags_spec.rb +++ b/spec/features/tags/developer_views_tags_spec.rb @@ -1,7 +1,8 @@ require 'spec_helper' -describe 'Maintainer views tags' do +describe 'Developer views tags' do let(:user) { create(:user) } + let(:group) { create(:group) } before do project.add_maintainer(user) @@ -9,7 +10,7 @@ describe 'Maintainer views tags' do end context 'when project has no tags' do - let(:project) { create(:project_empty_repo) } + let(:project) { create(:project_empty_repo, namespace: group) } before do visit project_path(project) @@ -25,7 +26,7 @@ describe 'Maintainer views tags' do end context 'when project has tags' do - let(:project) { create(:project, :repository, namespace: user.namespace) } + let(:project) { create(:project, :repository, namespace: group) } let(:repository) { project.repository } before do diff --git a/spec/lib/gitlab/checks/tag_check_spec.rb b/spec/lib/gitlab/checks/tag_check_spec.rb index b1258270611..80e9eb504ad 100644 --- a/spec/lib/gitlab/checks/tag_check_spec.rb +++ b/spec/lib/gitlab/checks/tag_check_spec.rb @@ -8,9 +8,8 @@ describe Gitlab::Checks::TagCheck do describe '#validate!' do let(:ref) { 'refs/tags/v1.0.0' } - it 'raises an error' do - allow(user_access).to receive(:can_do_action?).with(:push_code).and_return(true) - expect(user_access).to receive(:can_do_action?).with(:admin_project).and_return(false) + it 'raises an error when user does not have access' do + allow(user_access).to receive(:can_do_action?).with(:admin_tag).and_return(false) expect { subject.validate! }.to raise_error(Gitlab::GitAccess::UnauthorizedError, 'You are not allowed to change existing tags on this project.') end diff --git a/spec/lib/gitlab/external_authorization/client_spec.rb b/spec/lib/gitlab/external_authorization/client_spec.rb index fa18c1e56e8..a87f50b4586 100644 --- a/spec/lib/gitlab/external_authorization/client_spec.rb +++ b/spec/lib/gitlab/external_authorization/client_spec.rb @@ -19,7 +19,8 @@ describe Gitlab::ExternalAuthorization::Client do it 'adds the correct params for the user to the body of the request' do expected_body = { user_identifier: 'dummy_user@example.com', - project_classification_label: 'dummy_label' + project_classification_label: 'dummy_label', + identities: [] }.to_json expect(Excon).to receive(:post) .with(dummy_url, hash_including(body: expected_body)) @@ -81,10 +82,11 @@ describe Gitlab::ExternalAuthorization::Client do provider: 'ldapprovider') end - it 'includes the ldap dn for ldap users' do + it 'includes the ldap dn and identities for ldap users' do expected_body = { user_identifier: 'dummy_user@example.com', project_classification_label: 'dummy_label', + identities: [{ provider: 'ldapprovider', extern_uid: 'external id' }], user_ldap_dn: 'external id' }.to_json expect(Excon).to receive(:post) @@ -93,5 +95,28 @@ describe Gitlab::ExternalAuthorization::Client do client.request_access end end + + describe 'for non-ldap users with identities' do + before do + %w(twitter facebook).each do |provider| + create(:identity, provider: provider, extern_uid: "#{provider}_external_id", user: user) + end + end + + it 'includes all the identities' do + expected_body = { + user_identifier: 'dummy_user@example.com', + project_classification_label: 'dummy_label', + identities: [ + { provider: 'twitter', extern_uid: 'twitter_external_id' }, + { provider: 'facebook', extern_uid: 'facebook_external_id' } + ] + }.to_json + expect(Excon).to receive(:post) + .with(dummy_url, hash_including(body: expected_body)) + + client.request_access + end + end end end diff --git a/spec/lib/gitlab/git_access_spec.rb b/spec/lib/gitlab/git_access_spec.rb index 634c370d211..b9c21b3a7bd 100644 --- a/spec/lib/gitlab/git_access_spec.rb +++ b/spec/lib/gitlab/git_access_spec.rb @@ -831,7 +831,7 @@ describe Gitlab::GitAccess do push_master: true, push_protected_branch: false, push_remove_protected_branch: false, - push_tag: false, + push_tag: true, push_new_tag: true, push_all: false, merge_into_protected_branch: false diff --git a/spec/models/project_services/microsoft_teams_service_spec.rb b/spec/models/project_services/microsoft_teams_service_spec.rb index c025d7c882e..3ffe633868f 100644 --- a/spec/models/project_services/microsoft_teams_service_spec.rb +++ b/spec/models/project_services/microsoft_teams_service_spec.rb @@ -289,6 +289,18 @@ describe MicrosoftTeamsService do expect(result).to be_falsy end end + + context 'when disabled' do + let(:pipeline) do + create(:ci_pipeline, :failed, project: project, ref: 'not-the-default-branch') + end + + before do + chat_service.notify_only_default_branch = false + end + + it_behaves_like 'call Microsoft Teams API' + end end end end diff --git a/spec/policies/project_policy_spec.rb b/spec/policies/project_policy_spec.rb index 4b723a52b51..fd82150c12a 100644 --- a/spec/policies/project_policy_spec.rb +++ b/spec/policies/project_policy_spec.rb @@ -36,7 +36,7 @@ describe ProjectPolicy do let(:developer_permissions) do %i[ - admin_milestone admin_merge_request update_merge_request create_commit_status + admin_tag admin_milestone admin_merge_request update_merge_request create_commit_status update_commit_status create_build update_build create_pipeline update_pipeline create_merge_request_from create_wiki push_code resolve_note create_container_image update_container_image destroy_container_image diff --git a/spec/requests/api/tags_spec.rb b/spec/requests/api/tags_spec.rb index d898319e709..c4f4a2cb889 100644 --- a/spec/requests/api/tags_spec.rb +++ b/spec/requests/api/tags_spec.rb @@ -10,7 +10,7 @@ describe API::Tags do let(:current_user) { nil } before do - project.add_maintainer(user) + project.add_developer(user) end describe 'GET /projects/:id/repository/tags' do diff --git a/spec/support/shared_examples/policies/project_policy_shared_examples.rb b/spec/support/shared_examples/policies/project_policy_shared_examples.rb index 7a71e2ee370..13b7ade658b 100644 --- a/spec/support/shared_examples/policies/project_policy_shared_examples.rb +++ b/spec/support/shared_examples/policies/project_policy_shared_examples.rb @@ -17,6 +17,7 @@ RSpec.shared_examples 'archived project policies' do upload_file resolve_note award_emoji + admin_tag ] end |
